Nothing this week made a model smarter. What changed is that the tools around the models grew three things they did not have on Monday: a memory that follows a person between apps, a credential that dies when that person leaves, and a browser that logs into websites on a schedule with nobody watching. Every one of those is a governance change dressed as a convenience feature, and every one of them lands on the person inside your agency who does the actual work on your Amazon account, not on the person who signed the contract.
The number behind the week, for context: Marketplace Pulse reported on August 27 that U.S. e-commerce grew 12.2% in Q2, the fastest in five years, with online at a record 17.1% of retail. Roughly a third of that is price, not units, and Amazon's own store grew 15% while Walmart's online sales rose 24% and Shopify merchants sold 28% more. Demand came back. The AI layer everyone is arguing about is landing on top of a real recovery, not instead of one. Keep that in mind while reading the rest, because it means the cost of a governance mistake in Q4 is measured against a bigger number than last year.
1. Claude's memory now follows the person across chat and Cowork, and it is on by default where your agency actually works
On August 25, Anthropic shipped memory that works across Claude chat and Cowork in the cloud. Everything Claude remembers is listed under Topics in Settings, editable and deletable, with a toggle for sensitive subjects. The plan defaults are the whole story: enabled by default on Free, Pro, and Max; disabled by default on Team and Enterprise, where admins control it.
I have written before that most agency AI work happens on a personal Pro or Max seat, not an org plan. That is not an accusation, it is an architecture fact. As of Tuesday, that seat has a memory that accumulates across everything the account manager does. The AM writes your A+ copy in the morning and a competitor's bullets after lunch, and Claude now holds context from both, in the same memory, with no client boundary because Claude has no idea what a client is.
The failure this produces is not dramatic. It is a bullet on your listing that quietly borrows the framing of a brand two doors down on the search results page, because the model "remembered" how that category talks. Nobody will notice. It will read fine. The dumb take is that memory makes the tool better at your account. The real signal is that memory makes the tool better at the AM's book, and you are one entry in it.
What I'd do this week: ask your agency one question in writing: is the Claude seat that touches my account on a personal plan with memory on, or an org plan with it off? Then open Settings > Memory on your own seat and read the Topics list out loud. Mine had a supplier's pricing in it.
2. Anthropic API keys that stop working when the employee leaves
On August 27, the Claude Console added personal keys and service account keys. They act as the person or as a service account, carry the same permissions, and stop working when the linked account is removed from the organization. Admins can track usage per account. Workspace keys remain as a legacy option.
This is the first credential in the AI stack that behaves the way your Seller Central access is supposed to and mostly doesn't. Every catalog automation I have audited this year runs on a workspace key somebody created in February, pasted into an environment variable, and forgot. The person who created it has in two cases already left. The automation keeps running because the key does not know that.
For the automation inventory I keep pushing (tool, model string, pinned or floating, rate, re-check date, retirement date, SDK version), this adds the column I should have had from the start: whose key. A job that runs on a departed employee's key is a job with no owner, and a job with no owner is the one that writes the wrong thing to your catalog in November while everyone assumes somebody else is watching it.
What I'd do this week: move anything that touches a write path (flat files, listing edits, bulk copy) onto a service account key with a named owner. It is a config change. Leave the read-only research jobs alone until January.
3. ChatGPT scheduled tasks can now be triggered by a webhook and log into websites
On August 25, ChatGPT Work on Plus and Pro gained scheduled tasks that fire on events (new Gmail message, Slack channel post, GitHub PR) and a browser that can sign into authenticated websites, with password-manager support and a confirmation step before consequential actions. Codex picked up cloud browser sign-in the same day. Tasks pause automatically when they need approval.
Put the two halves together and you have, on a consumer-tier plan, the shape of an unattended workflow with a login: something arrives in an inbox, a task wakes up, a browser signs into a site, and a thing happens. The approval pause is the good part, and I want to give OpenAI credit for making it the default. The operator problem is that "consequential" is the model's judgment, and a model's idea of consequential is a payment or a reservation. Changing a price on a listing is a form submission.
Amazon's own Business Solutions Agreement Section 19 requires automated tools accessing Amazon services to identify themselves, and that obligation sits on the seller account, not on OpenAI. A scheduled task that opens Seller Central through a cloud browser is squarely inside that sentence, and nobody at OpenAI wrote it with Amazon's terms in mind.
What I'd do this week: write the rule down and send it to the agency: no scheduled or webhook-triggered task logs into Seller Central, the ad console, or Brand Registry. Read-only research through a browser agent is fine until January; anything that can submit a form is not. Ten weeks from peak is the wrong moment to find out what "consequential" means.
4. Site tools (WebMCP): websites can now hand agents their own tools, and you are not the website
Also August 25: ChatGPT Work and Codex can use tools that a website itself exposes, in the desktop app's built-in browser, on GPT-5.6 Sol or Terra. The site publishes a small set of actions and the agent calls them instead of scraping the page.
Read that from an Amazon seller's chair. Last week I wrote that every retailer building an agent-facing surface controls that surface and you do not. This week the mechanism arrived. Target, Walmart, and a Shopify store can publish tools an agent uses to search, compare, and buy. Amazon can too. What Amazon will not do is publish your tools, because on Amazon you are not the site, you are a row in it. Whether an agent sees your compatibility statement depends on whether Amazon chose to expose that attribute through its own tools, which is a decision you will read about after it is made.
The dumb take is "agentic commerce is here, rebuild the listing." Adoption is still a rounding error and I would rather say so. The real signal is narrower: for an Amazon seller the only agent-facing asset that exists is the structured data Amazon already holds about your product. Attributes to completion, alt text on A+ modules, Item Highlights as a readable phrase, bullets that state facts. If Amazon ever exposes site tools, those fields are what it will expose. If it never does, they are what Amazon's own AI layer reads. Two readers, one job, and it is still housekeeping, not strategy.
What I'd do this week: nothing new. Finish the attribute pass on the top twenty ASINs if it is not finished. Refuse any invoice with "agentic readiness" on it.
5. Claude Code shipped a restricted mode and a hook that can block a model switch
On August 27 Claude Code added --restricted (or CLAUDE_CODE_RESTRICTED=1): it removes the built-in tools that run commands or code and removes WebFetch, keeps file tools inside the working directory, refuses bypass-permissions mode, and ignores user, project, and local settings files. On August 28 it added PreModelSwitch and PostModelSwitch hooks that can block, confirm, or annotate a model change, plus a per-session prompt-cache line in /cost.
Two things I have been telling people to do by convention became things you can enforce in configuration. "Don't let the model run anything on this catalog export" was a sentence in a prompt; it is now a flag, and flags are not negotiable the way sentences are. "We pinned our model" was a claim that any teammate with environment access could quietly make untrue; a PreModelSwitch hook that blocks the switch turns the pin into a rule with a log line.
The honest sizing: this matters if you or your agency run Claude Code against catalog files, which more of you do than will admit. If your only AI exposure is a SaaS tool's optimize button, skip it. The uncomfortable part is that I know how many operators will turn --restricted on for the bulk copy job that handles 140 ASINs: almost none, because nothing broke last week and nothing will break next week either.
What I'd do this week: any Claude Code job that reads a flat file and writes a flat file runs under --restricted from now on. Add a PreModelSwitch hook that blocks on the write-path jobs. Both are twenty minutes.
What I'd ignore
The Model Hardware Standard. Anthropic's August 27 research preview lets Claude operate lab equipment and robotic arms. Genuinely interesting, and it has nothing to do with a listing. If your 3PL mentions it in a sales deck, ask them which microscope they were planning to run.
The GPT-5.4 retirement on August 31. I flagged it last week. If a Codex job still points at it, it fails loudly on Monday, which is the good kind of failure. Fix the string, move on.
"AI shopping is 41% of consumers" style numbers. Adobe's June figure is real and it describes people who used generative AI somewhere in a shopping journey, which includes asking ChatGPT what a French press is. It is not a share of your traffic and nobody has that number for your account.
Any vendor pitching a "memory-safe" or "client-isolated" AI workflow this week. The isolation is a plan setting and a checkbox. You can verify it in a screenshot. Ask for the screenshot.
Four features, four governance changes, none of them announced as governance. The models had a quiet week. The seats, keys, memories, and logins around them did not, and those are the parts that end up in your catalog.