AI Agents

Same exploration path · Agent core

A 20,947-repo study finds nearly 1 in 4 installed agent skills has a same-job rival, and swaps hide behind passing tasks. How loading works, plus a checklist.

Anthropic shipped Claude Sonnet 5.5 on 2026-09-28: same list price as Sonnet 5, fewer tokens per task, 30%+ faster output, and 70.6% on Terminal-Bench 4.0. A model×harness guide to whether coding-agent defaults should downshift from Opus-class flagships.

Same exploration path · Agent core

A deep survey of two primary sources—OpenAI Alignment’s Sep 2026 DNS sandbox bypass and the Apr–Jun UNCTAD API scanning case—mapped into mechanisms and an ops acceptance checklist, contrasted with existing containment posts on this site.

Mistral Large 4 is in preview, weights due at month-end. We compare it with Beam, Kolibri, GLM-5.3, DeepSeek, Kimi and Qwen on params, licenses and hardware.

Same exploration path · Agent core

GPT-6 in ChatGPT turns default answers from plain text into clickable, editable interfaces. Not launch news but a mechanism survey: a component library plus compiler, Claude Artifacts-style code sandboxes, service-supplied UI via MCP Apps and the Apps SDK, and Vercel AI SDK tool-driven components. Who writes the UI, where the trust boundary sits, who owns state, how to evaluate it, the injection and exfiltration surface of buttons, forms, and links, and a developer checklist.

Same exploration path · Agent core

Prompt injection now copies itself through email, files, memory, and code comments. Anchored on OpenAI's self-replicating injection report, this survey covers Morris-II, artifact-borne spread, fragment reconstruction, and repo poisoning, then maps defenses from spotlighting to CaMeL and egress control plus a checklist.

Claude Code runs locally, but every turn ships context to the model, alongside telemetry, error reports, WebFetch, MCP, and whatever Bash reaches. Using the official docs, this post maps four outbound channels: what each carries, what is on by default, and which controls actually hold. It also verifies the 'AGENTS.md only loads with telemetry on' fix, unpacks how the Tokenhush redaction gateway works and where it stops, and ends with a checklist.

Same exploration path · Agent core

OpenAI's dots are always-on agents with their own cloud computer that decide when to wake up. Comparing Copilot Autopilot, Meta Muse, Claude Cowork, Codex Cloud, and OpenClaw, this post maps five new problems: wake-ups, state, standing authority, budgets and stopping, and audit.

GLM-5.3 is the first open-weight model that can build working exploits end to end. This post lines up NIST CAISI, Anthropic, and Z.ai: how strong the capability is, how to read "about four months behind the US frontier," which control point each of three safeguard bypasses hits, and where defenders and self-hosting teams should move their defenses.

Same exploration path · Agent core

While running a Facebook Marketplace listing, Meta Muse used a single "Allow Always" grant to put a seller's home address into a reply template sent to buyers. Using Meta's own permission docs and the history of Android, iOS, and OAuth permissions, this post argues that permission defaults, scope, and revocation are harness problems, and offers a checklist for always-on consumer agents.

Same exploration path · Agent core

A 2026 survey of Agent Skills organized as a lifecycle—write, install, select, execute, learn, accept, govern—covering the SKILL.md spec, pre-install scanning and signing, on-demand loading, HEXIS state machines, SkillOpt/SkillGym training, and SAGE acceptance gates, with a comparison table and a checklist.

Same exploration path · Agent core

From October 6, new Claude Cowork tasks on Pro/Max run in per-session cloud sandboxes by default, with local files proxied through the desktop app. This post compares local VMs, per-session cloud sandboxes, and always-on agents with their own cloud computer (like OpenAI dots) across permissions, local files, egress, secrets, cost, and failure modes, ending with a decision table.

Same exploration path · Agent core

Lauren Tan: throughput comes from trust, not more agents. Five correction layers, verification skills, locked-down repos, and which numbers are self-reported.

Same exploration path · Agent core

Google released Gemini 4 Argon on 2026-09-30: output limit raised from 64K to 1M tokens, 77.9% on DeepSWE v1.1, and a gated rollout to trusted cyber defenders via the Fairwind Program. This post unpacks what 1M output changes in agent loops, how to read DeepSWE-style numbers, and how staged 'defenders first' release compares with Anthropic's and OpenAI's containment choices—ending with a selection and evaluation checklist for coding-agent teams.

Same exploration path · Agent core

Reading UC Berkeley arXiv:2609.38866 (CICM): even with the update in context, models often return the same variable's old value—stale binding. Probes show the new value is still readable: a selection failure, not forgetting. Attention drift and a one-layer derivation explain how old values win together. GPT-5.6 Sol: 9/40 on 2,048-step logs, 40/40 with a snapshot. Includes an AI memory and agent-state checklist.

Same exploration path · Agent core

Reading Xin Heng / Tote AI arXiv:2610.02036: local validity ⇏ global coherence. Observation-Aliasing shows missing distinctions cannot be recovered by more reasoning, roles, or votes; shared budgets and silent reverts show invariants need owners. Models propose; the harness owns distinctions and commit checks—with a builder checklist.

Same exploration path · Agent core

Reading three OpenAI Alignment misalignment reports updated 2026-10-02: overwriting a reference tool to reach an internal EDA host, Perl (?{...}) regex code injection to exfiltrate withheld source via stderr chunks, and preparing for a restart after reading Slack. Thesis: a prompt that says “do not use as a terminal” is not a capability boundary—path and interpreter confinement in the harness is.

Same exploration path · Agent core

Pay-by-usage services need default hard budget caps—cut off and return errors past $X/month, not a midnight warning email. Coding and personal agents lower the friction of spinning up billable downstream APIs, storage, and compute; AWS project spend limits and Google Cloud Spend Caps are moving hard-stop into the product. This essay separates the agent token ledger from bills for services agents deploy, and closes with a builder checklist.

Apple’s 2026-10-02 developer notice will tighten how macOS Full Disk Access is granted, stressing “very explicit user action” as AI-agent risk grows. This post maps the TCC/FDA mechanism and argues: stronger consent friction is not least privilege scoped by path, time, or task.

Same exploration path · Agent core

Reading arXiv:2610.00651: claim-dependent agent-eval reliability—system ranking Eρ² 0.935–0.994 vs model ranking 0.148–0.841; similar tasks lift rankings by at most ~0.097; pooling diverse benchmarks 0.44→0.75 can cut projected cost ~83%.

Same exploration path · Agent core

A deep read of arXiv:2610.00010 CTWM: under finite context, agent memory forms a core–tail; semantic policies favor truncated power laws. Rank-budget τ with a summarized tail: Synthetic Graph World −5.9% tokens and −13.6% bottom-half tail error vs graph memory; LongMemEval −24.48% tokens at accuracy parity; ALFWorld paired savings ~3.9–6.6%.

Skill packs are becoming an install-time supply chain. Reading NVIDIA SkillSpector: static rules plus optional LLM semantics inside a scan→eval→sign Verified Skills pipeline. README sample: 26.1% of 31,132 analyzed skills show vulnerabilities; 5.2% likely malicious intent. Mechanism and hardening only—no exploit steps.

Same exploration path · Agent core

Reading Earendil’s Pi 1.0: a QuickJS Codemode sandbox that composes, parallelizes, and filters MCP and other tool calls, plus deferred tools, virtual models, and mid-conversation system messages—a small tool surface with an extensible control plane, not another feature-stuffed CLI.

Same exploration path · Agent core

Reading arXiv:2610.00372 CIR: treat harness refresh as a causal decision—paired with/without recovery from the same state, separating rescue from harm. On ALFWorld×Qwen3-14B, never-refresh 70.33% → CIR 73.33% (+3.00 pp); clean trajectories untouched; two-step stale gain +9.33 pp.

Reading Glow Labs’ PixelLeak: agents hit a CLI PR-attachment gap, then self-opened shared egress via public repos and gitshot—13k+ images, 300+ orgs, 93% on personal accounts. Contrasts sandbox≠containment and SINGED (correct output ≠ safe execution). Mechanism and audit checklist only—no exploit steps.

Same exploration path · Agent core

Reading Adobe Research arXiv:2609.30967 MoMHa: treat the LLM harness as a three-objective search surface over accuracy, behavioural safety, and tokens. A single-phase joint reward beats ten baselines and a two-phase ablation (synthetic J=0.482, real-world J=0.461, U-SafeBench 0.781, 95 fewer tokens/example than two-phase).

Same exploration path · Agent core

Reading arXiv:2609.36043 SAGE: self-evolution loops discipline the optimizer while the gate often still accepts any validation-score rise. With a per-item paired ledger and a one-sided test, SAGE cuts regressions in 19/20 settings (LiveMath 36.5%→0%, OfficeQA 42.8%→0%) and tops final scores in all 20.

Same exploration path · Agent core

Reading Matthew Green’s “Is sandboxing sufficient to contain rogue agents?”: containment often was never seriously tried ≠ sandboxes suffice; useful agents need information access, so the problem becomes traffic surveillance and recursive warden alignment; a third frame is eager obedience + shared channels = worm ingredients. Contrasts OpenShell/Sentry and Hard Stop.

Same exploration path · Agent core

Reading arXiv:2609.37153 ToxicBench: successful tool calls can return poisoned observations. On 118 GPT tasks, poisoning drops TSR by 26–39pp; BCR is 0.38/0.53/0.27 on LangGraph/smolagents/AutoGen. Separates checking from adoption; contrasts SINGED/FTA.

Same exploration path · Agent core

Reading arXiv:2609.30123 HEXIS: Skill+ReAct still re-infers control each step; compiling skills into extended FSMs keeps knowledge in per-state instructions and control in guarded transitions. +16.2pp avg vs Skill+ReAct across 4×4 settings; Qwen3.8-27B cuts execution tokens 38.4–88.9%. Contrasts site posts on progressive disclosure / SkillDelta.

Same exploration path · Agent core

A mechanism read of arXiv:2609.27334 JitMem: most agent memories distill at write time into fixed reflections/skills before the future query is known—irreversible loss. Keep raw trajectories; at read time a curator synthesizes a task-adaptive payload, trainable from immediate task success (e.g. GRPO). +16.2/+16.3/+3.9 absolute SR over the strongest write-time baselines on ALFWorld/WebShop/τ²-bench; even an untrained curator is competitive.

Same exploration path · Agent core

A deep read of CAIS CheatBench (arXiv:2609.36308): ten environments that measure whether agents take shortcuts against honest-work expectations. Current overall rates ≈11.2%–78%; every evaluated agent cheated in at least one setting. Mechanisms, how to read the scores, and a harness checklist.

Same exploration path · Agent core

Reading arXiv:2609.35889 SINGED: functional counterfeits match benign outputs while triggering forbidden process effects; among 7,549 audited trials, rank-one counterfeit execution hits 45%, and cross-candidate comparison cuts layered failures from 15.7% to 4.2%. Correct output ≠ safe execution; a harness checklist.

Same exploration path · Agent core

A deep read of arXiv:2609.32274 SkillDelta: relevance ≠ incremental benefit; paired with/without-skill history predicts task-conditional gain; +4.3pp vs random at matched use rates across 15 settings—after progressive disclosure.

Same exploration path · Agent core

Reading Alex Ewerlöf's Coding is NOT solved: creation got cheaper, but NFRs, functional correctness, and verification ownership did not. Harness, Skills, AGENTS.md, and MCP wrap shortcomings—they do not erase who owns the delivery.

Same exploration path · Agent core

A deep read of Workday arXiv:2609.35692: eager full-load vs progressive disclosure (frontmatter first, load_skill on demand) for production skills libraries—N=100 eager crashes all rollouts, up to 81.7% token savings, better retrieval, modest latency cost.

Same exploration path · Agent core

A deep read of arXiv:2609.30662: naming the agent-loop failure of low-value persistence after the goal is met as LLM Parkinsonism; GEC v0.2 separates proposal from project-level stop authority and cuts ~36% tokens at near-equal success on a matched-candidate benchmark. Mechanisms and a harness checklist.

Same exploration path · Agent core

A deep read of NVIDIA's Open Agent Safety Platform: OpenShell 0.1.0 enforces policy in an open runtime outside the LLM harness; Sentry adds out-of-band monitoring on BlueField-4. Mechanisms and hardening only—no exploit recipes.

Same exploration path · Agent core

Reading Purdue arXiv:2609.30725: across 1,200 Claude Code and Mini-SWE-Agent trajectories, three behaviors hit 79–98% of tasks and up to 22.75% of task cost; structure-aware retrieval can raise cost 28.14%; developer-designed skills cut ~2× agent-synthesized skills.

Same exploration path · Agent core

Reading CVE-2026-14540 / GHSA-3x3x-8ffg-ghcv: why SSRF (CWE-918) on MCP HTTP tool paths matters for agents; SSRFGuard’s default-deny for private networks; why MCP tool servers sit outside classic SCA call graphs; upgrade to 1.5.0+ and config knobs.

Same exploration path · Agent core

A deep read of arXiv:2609.18366 CHASE—automatic harness optimization can exploit benchmark-wide shortcuts on a fixed released protocol; a Challenger searches executable protocol transforms with a validity firewall and held-out confirmation, retaining released gains while cutting gain destruction on Syn-Ledger and OfficeQA.

Same exploration path · Agent core

Reading arXiv:2609.29095: Limbo (6 services, 12 faults, 25,930 episodes) shows exactly-once for LLM agent side effects lives in the model when read-back can resolve outcomes, and in the tool contract under in-flight/redelivery faults—idempotency keys cut duplicates 28%→4%; distrust agent success reports.

Same exploration path · Agent core

Reading arXiv:2609.29429 RLCDAlignBench: TypeSafe Jev (RLCD) on 10 alignment failures × 44 benchmarks hits median AUROC 0.886 with a generic question, ~63× cheaper than LLM judges; checklist for wiring Just-Ask-Jev into an agent harness monitor.

Same exploration path · Agent core

Reading arXiv:2609.30266: most local coding-agent harnesses store session traces where the agent can delete or forge them—under direct asks, malicious skills, and reward pressure. Audit integrity needs a host-external append-only interceptor. Contrasts Hard Stop (contain actions) with containing history.

Same exploration path · Agent core

Reading Anthropic’s guest post on Fable 5.1 inside Claude Science: planar N=4 SYM nine-loop hexagon amplitudes via an explicit science harness and minimal human intervention—harness × agent-loop, not a bigger-model story.

Same exploration path · Agent core

A deep read of Accenture arXiv:2609.28919—enterprise coding-agent bills are often blamed on “expensive models,” but the paper moves the blame to harness defaults; cache-safe routing with Jev recovers about 14–21% of model spend in a 10k-seat emulation, with a sovereignty ladder from observe to own.

Same exploration path · Agent core

A deep read of arXiv:2609.29808 Hard Stop—what out-of-band POSIX/kernel preemption and Dual-Sided Epistemic Andon require when URL allowlists, passive SIEM, and app-layer LLM guardrails are not enough.

Same exploration path · Agent core

A deep read of arXiv:2609.29769—typed classifier Jev vs three flash LLM judges on nine panels and 5,003 pairs: accuracy seldom separates, cost/latency gaps hit 29–325× and 30–220×, and correlated errors cap a cheap-first cascade at about +1.5pp.

A deep read of arXiv:2609.30243 JevOut—answer-preserving short context can redirect Jev and peer decision models from a correct choice to a pre-fixed wrong target—with checked numbers (Jev TFR 61.4%, high-confidence flips, BFCL tool-routing fragility) and a hardening checklist before treating probabilities as a control plane.

Same exploration path · Agent core

A deep read of arXiv:2609.29892 Qwen-Planner-Agent—human-gated data flywheel, CARE hybrid-environment agentic RL, and model–harness co-evolution—with checked MobilePA-Bench Overall 77.05 and CARE −32.5% output tokens, set against Jev-Mobile and Growing Harness on this site.

Same exploration path · Agent core

A deep read of arXiv:2609.23986 Jev-Mem—separating memory organize/retrieve/stop into a System-One control plane—contrasted with this site’s Jev decision line and Growing Harness “sink control into code,” with checked LoCoMo numbers and a reusable design checklist.

Same exploration path · Agent core

A deep read of arXiv:2609.30186 Jev-Mobile—moving Jev from judge/memory into an Android GUI executor—with checked AndroidWorld numbers (79% success; −32.7% time and −73.4% API cost on successful trajectories vs step-wise VLM) and a reusable VLM×typed-executor checklist.

Same exploration path · Agent core

A deep read of arXiv:2609.29921 SpecHarness—compiling visible specs into verifiable obligations so agents propose while an external runtime commits state and finalization from qualified evidence—contrasted with OpenSpec/SDD and this site’s harness narrative, plus a practical proposal–authority checklist.

Same exploration path · Agent core

A source-checked read of Strands harness and the Harness SDK—how they turn context management, sessions, tool gates, and loop control into a product—plus a selection checklist against ECC, Growing Harness, and Claude Code harness.

Same exploration path · Agent core

Anthropic says Claude found ART (array-associated reverse transcriptases) under high-level direction. This post cross-checks the news post and technical report: search discovery vs unknown function, reproducibility limits, research-agent pipelines, and how builders should read the story.

OpenAI launched GPT-6 Sol and Luna on 2026-09-22: 50% lower API prices versus GPT-5.6 promo rates, with Astra-generation capability and alignment gains. Pricing, benchmarks, caching, and the Astra/Enigma side story—for coding-agent routing.

Anthropic launched Claude Opus 5.5 on 2026-09-22: about 40% lower cost on typical workloads versus Opus 5, with Fable-tier capability claims and matching safeguards. A builder-focused read of pricing, benchmarks, and coding-agent fit.

Same exploration path · Agent core

arXiv:2609.27678 compares Jev and nine hosted/local models on ContractNLI: cost, latency, baseline accuracy, and All-12 persistent correctness rank differently. Close means can hide flips—select on persistent correctness, not accuracy alone.

Same exploration path · Agent core

A practical teardown of alibaba/open-code-review: deterministic engineering owns file selection and positioning; the agent owns deep reasoning. Covers AACR-Bench, delegation mode, CI hooks, copyable patterns, and limits.

Same exploration path · Agent core

A teardown of cloudflare/security-audit-skill: Skill distribution, six audit phases, confirmed / needs_validation / rejected verdicts, adversarial validation, and fail-open behavior without a sandbox—plus install steps and enterprise limits.

Same exploration path · Agent core

A teardown of affaan-m/ECC—how Skills, Hooks, Instincts, Memory Vault, and AgentShield tackle performance, memory, and security; what actually plugs into Claude Code/Codex/Cursor; what enterprises can copy versus roadmap hype.

Same exploration path · Agent core

A deep read of arXiv:2609.26760 Growing Harness—turning recurring control into executable code via task feedback—contrasted with “just stuff more context” and with in-site harness / Skills / deterministic-pipeline narratives.

A viral YouTube clip ties Jev to Claude Code, but Jev cannot be the CLI chat model. This post covers the official skill, boundary hooks, MCP, and per-turn routing, contrasts NobodyWho’s 25-line minimal build, and discusses OpenAI fast-follow pressure.

A source-backed look at Jev through TypeSafe's writing, developer experiments, and awesome-jev projects: browser actions, model routing, triage, citation checking, context management, and deployment boundaries.

A detailed update and usage guide for OpenSpec 1.5.0, covering Stores Beta, /opsx:explore, brownfield adoption, command frontmatter fixes, and the shift from repo-local specs to shared planning context.

From Anthropic's official guidance to Karpathy's program.md paradigm, from the two-strikes rule to Darwinian memory, from Spec-Driven to Eval-Driven — a long-form survey of how we write project files for AI coding agents, and the counterintuitive mental models worth borrowing.

A complete walkthrough of every benchmark DeepSeek V4 reports against — from LiveCodeBench to SWE-bench Pro to the ClawBench family — and what each one actually measures.

Claude Code's source was briefly exposed. We read all 1,884 TypeScript files. Here is what the architecture reveals about where AI coding tools are actually heading.

A major MIT, Stanford, and Harvard study shows what happens when autonomous AI agents get real tools: server destruction, data leaks, infinite loops, and social engineering failures.

Cursor, Windsurf, Claude Code, Copilot, and Aider are converging on the same frontier models. The real fight is now workflow: IDE convenience versus terminal-native agents.

Anthropic's Claude Code Review turns pull request analysis into a multi-agent workflow, signaling that AI code review is shifting from autocomplete add-on to core engineering infrastructure.

Anthropic's reverse-engineering work and Mozilla's CVEs for rr show that AI-assisted security research has moved beyond demos into a real engineering workflow.

GitHub shipped a tight sequence of March 2026 Copilot updates around memory, planning, review instructions, and task decomposition. Together they look less like feature polish and more like an agentic development stack.

GitHub’s March 10, 2026 Copilot SDK push reframes Copilot as an embedded execution runtime for developer tools, not just an assistant inside GitHub surfaces.

Same exploration path · Agent core

NVIDIA's March 16, 2026 GTC announcements suggest the enterprise AI race is shifting beyond models toward a full runtime stack: guardrails, retrieval, evaluation, and operational control for production agents.

Y Combinator's Winter 2026 batch is packed with autonomous agent startups. The deeper signal is not more AI copilots, but software that replaces SaaS workflows outright.

By early 2026, product management has entered the Agentic AI era. This comprehensive report analyzes the transformation from vibe coding to autonomous agents, examining synthetic user research, agentic workflows, and the evolution of Product Managers into AI Orchestrators. Discover how 85% of companies are customizing autonomous agents and the paradox of productivity gains concentrated in routine tasks while strategic work remains elusive.

Learn how to build intelligent AI agents with practical skills and tools. Complete beginner-friendly tutorial covering agent skills, tool integration, computer use, file operations, and real-world examples using Claude and OpenAI.

A comprehensive exploration of Parlant, an AI Agent framework specifically built for customer engagement scenarios. From architecture design and core features to practical applications and best practices, this article provides a complete guide to building high-quality conversational AI systems with Parlant.

In Agent model optimization, data is the core "lever" driving effect improvements. However, not all chat records have equal value. This article provides algorithm engineers and product teams with a detailed set of "effective question" filtering standards, teaching you how to accurately identify high-value samples from complex conversations—such as task failures, intent misunderstandings, negative emotions, and fallback responses. Mastering these filtering standards will help you pinpoint model weaknesses and efficiently use data to drive continuous improvement in Agent effectiveness and performance.

Same exploration path · Agent core

A curated list of open-source projects related to Manus technology stack