Back to news
Sunday report

Sunday Signal Report: July 19, 2026

Three signal clusters from the last seven days of public research, plus a personal reflection on AI, meaning, and learning by doing.

Rob here

AI can carry the routine. School must carry the meaning.

Special shoutout to my friend Corey Shelton for this. I have been out celebrating turning 50 this year with a two-and-a-half-week trip through Ireland, Switzerland, and Italy. It was a much-needed break. I read Arthur C. Brooks's The Meaning of Your Life while I was away, which may explain why the question below kept following me around.

Travel collage from Rob Dickson’s 50th-year trip: coastal cliffs in Ireland, lakes and mountains in Switzerland, and the Colosseum in Italy.

This week I keep coming back to the same question: what is school for when an answer is no longer the point?

I watched a short clip on X of Sir Demis Hassabis and Dame Wendy Hall talking about the future of learning. The exchange got at something I have been sitting with. Hassabis made the case for a kind of inversion: let AI handle rote work, personalized practice, and factual scaffolding. Use the precious time in school for what humans do best together: contact, projects, creativity, judgment, taste, collaboration, and entrepreneurship.

Hall immediately complicated it. Personalization is not a feature you ship. It runs into home conditions, system design, and the uneven ground every student stands on. The technology is not the hard part. The commitment is.

I have been reading Arthur C. Brooks's The Meaning of Your Life. The title keeps doing its job. If meaning is not handed to you, how do you build it?

Brooks writes, “The one thing that can never be simulated: meaning.”

Quote card for The Meaning of Your Life by Arthur C. Brooks

That is the question we are actually facing. AI does not make the meaning of school go away. It makes the question more urgent. If a machine can deliver information, personalize practice, and mimic the shape of a good answer, then the purpose of school cannot be any of those things. It has to be the work that builds a person: contribution, effort, relationships, making things, responsibility, and work that matters to someone.

This is why I keep pointing people toward Creative Minds. Their students are not waiting for the perfect curriculum to arrive. They are designing, assembling, painting, collaborating, failing, revising, and shipping work that lands in the real world. Learning by doing is not a slogan there. It is the operating system.

Want to know more about Creative Minds? Visit their site.

Students and an adult collaborate at a maker table
Creative Minds treats learning by doing as the operating system.
A student uses their hands to assemble a small object
Making requires attention, judgment, and revision.
A student makes chalk art on the ground
Meaning is built in work that matters to someone.

I think the next four weeks are the most important planning window of the year for anyone running K-12 technology. Not because we need to decide which AI feature to buy. Because we need to decide which operating defaults inside the tenants we already own to turn on, and which gates to publish before agents, MFA defaults, and exploit chains reach students in August.

Restriction alone is not a design strategy. We need systems that earn their keep in learning design. We need to preserve judgment and initiative. We need adults who know what they are doing and why.

That is the through-line for this week's signals: AI governance, agents, and the quiet decisions that set the defaults for the school year.

Research update

One dashboard, three policy lenses

The Research page now brings three 50-state signals together: AI governance maturity, personal-device policy, and the operating environment for microschools. Filter by month, region, state, and policy context to see the patterns without pretending a score or directory count settles the question.

Explore the research dashboard
ShowMeRob 50-State Policy Signals dashboard showing policy metrics, filters, a state map, and the selected state detail.
Cybersecurity and privacy

Microsoft's record Patch Tuesday lands inside the back-to-school prep window, on top of last week's already-active SharePoint exploitation

What changed: The CISA Known Exploited Vulnerabilities catalog published three addition alerts in five business days, including a Microsoft SharePoint Server deserialization RCE (CVE-2026-58644), two Fortinet FortiSandbox OS command injections (CVE-2026-25089 and CVE-2026-39808), and earlier in the week the July 14 CISA hardening alert for active SharePoint exploitation, and Microsoft's July 2026 Patch Tuesday that Tenable documented at 569 CVEs including actively exploited zero-days in SharePoint Server (CVE-2026-56164) and AD FS (CVE-2026-56155). PowerSchool also posted status incidents affecting Unified Talent imports across Perform, PL, Employee Records, and Applicant Tracking modules for a subset of US customers. Why it matters now: These five business days are also the five business days districts run their pre-August security readiness reviews. Any team that treats this set as a single triage pass instead of five separate ones will arrive at the first day of school with a known actively-exploited SharePoint CVE still open, or with a FortiSandbox (managed or self-hosted) that nobody can attest to. Rob's take: 'Patch available since May' is not a defense. Active exploitation is. The new flow is not weekly CISA review, it's twice-weekly CISA review for the next four weeks, paired with named asset owners and an exposure-attestation template that requires an explicit 'absent' answer. Concrete implication for a district leader: Before the next board meeting, publish a one-page attestation for SharePoint Server (patched or migrated off 2016/2019 by end-of-support), FortiSandbox (self-hosted or MSSP-managed), and the PowerSchool module incident status. If any item is still 'unknown' by August 15, the board sees it in writing.

AI governance

AI moved from chat to action inside the productivity tenants districts already own, and the procurement math changed with it

What changed: On July 8-9 OpenAI shipped the GPT-5.6 family and launched ChatGPT Work, an agent that can run connected apps, local files, a browser, computer use, and scheduled tasks. The same week, Google added background execution, remote Model Context Protocol servers, custom functions, and credential refresh to Managed Agents in the Gemini API, and announced a forthcoming Google Classroom MCP server. Microsoft put GPT-5.6 into Microsoft 365 Copilot while announcing 4,800 job cuts, and Meta released Muse Spark 1.1 only through a paid API preview rather than open weights. The FTC proposed treating undisclosed AI objectives that distort outputs as potentially deceptive. Why it matters now: 'Which model' is no longer the procurement question. 'Which lab's full ladder of agents fits our data, privacy, and instructional posture' is. The four weeks before August are when the fall AUPs and DPA reviews get approved, and they are now the only window to write the gate before the new agents get turned on by individual staff. Rob's take: The labs won the framing war before districts noticed it started. The useful question for any board is not 'Microsoft or Google' but 'which lab's ladder are we buying into, what privacy and audit posture travels with that ladder, and what is our exit when the next rung of the ladder changes the data terms.' Agent capability now defaults to action, which means district approval language should default to least-privilege tool scope, per-user identity, short-lived credentials, network allowlists, complete action logs, and human approval before any external message, data export, or record change. Concrete implication for a district leader: Add an agent capability standard to the next published AUP before any 365 Copilot update, Gemini Managed Agent update, or OpenAI Work pilot lands on a staff device. The standard exists to say 'no' first and 'yes' second.

K-12 leadership

Anthropic's verified K-12 free tier and Google's stronger MFA default land the same week, and the procurement choices quietly follow

What changed: On the same week as Anthropic's Claude for Teachers launch (verified US K-12 educators get premium Claude capabilities free, plus a standards-aligned Learning Commons connector and curated curricular resources, with a district offering 'coming soon'), Google shipped FIDO2 hardware-key support to GCPW so that districts using Google identity can enforce stronger MFA at the Windows login screen. The UK finalized Keeping Children Safe in Education (KCSIE) 2026 guidance treating generative AI explicitly as part of safeguarding and online safety expectations. CISA added a FortiSandbox OS command injection and Microsoft published its largest Patch Tuesday on record. Why it matters now: Two of these (Claude for Teachers, Google hardware-key MFA) are operating defaults a district can turn on before school starts, no contract change required. The third (UK KCSIE) is a governance framing district leaders can borrow now to update their own AI safeguarding language ahead of parent questions in August. None of the three is a procurement decision; all three improve safety or learning in the next 30 days. Rob's take: The durable lesson is that the strongest K-12 improvements of the moment are operating defaults that arrive inside tenants districts already pay for, not new vendor relationships. Districts that win August 2026 will not be the ones who signed the most contracts; they will be the ones who turned on the right existing toggles before teachers turned on the rest. Concrete implication for a district leader: Three things to ship before August 15: (1) turn on Anthropic's verified K-12 Claude for Teachers claim form and assign a single named owner for the rollout; (2) Google identity districts: enable FIDO2 hardware-key support through GCPW and decide which staff the higher-assurance factor applies to first; (3) update the safeguarding / acceptable-use section of your AI guidance to mirror the UK KCSIE 2026 framing so 'generative AI is part of online safety' is on the record.