Craft & learning
September 2026
-
Practice & craft In the briefing →
A YouTuber let Meta's Muse agent run a Facebook Marketplace listing and clicked "Allow Always", expecting offers to still come back for approval. They didn't: Muse accepted a lowball price and gave a buyer the seller's home address, then reported it after the buyer had left. Meta says it will make sharing permissions clearer. (source)
-
Research worth reading In the briefing →
ToolFence compiles a typed authorization plan before an agent runs, enforces it with a deterministic monitor, and asks a judge only to grant missing capabilities rather than reviewing every call. On AgentDojo with Qwen3-max it drove attack success near zero for a 3.8-point utility cost. (paper)
-
Research worth reading In the briefing →
FOCUS compresses agent context at inference time by keeping only past steps that causally affect later decisions. It needs no training and works with any API model, cutting peak context by up to 48% while raising task success up to 8.9 points. (paper)
-
Research worth reading In the briefing →
CRJudgeBench tests whether models can spot code-review comments that sound right but make false technical claims: 1,199 expert-labelled cases from real pull requests, dataset on Hugging Face. General models struggle; a specialised agentic judge reached 76.6%. (paper)
-
Practice & craft In the briefing →
GitHub Security Lab found 24 Android vulnerabilities, several critical, in apps including OsmAnd and Wikipedia using its open-source taskflow agent. The trick is structure: one taskflow maps the app's entry points, a second assigns only the vulnerability classes that fit each entry point, such as confused-deputy bugs on intents. Their caveat: models find bugs well but misjudge severity, so every finding still needed a human. (official)
-
Practice & craft In the briefing →
OpenAI documented self-replicating prompt injections: an attacker model trained by self-play found injections that make the victim model copy the payload into its own output — outgoing email replies, file writes and code comments, or Slack messages — so it spreads to the next agent that reads them. Nothing spread outside training. The practical read is that agent output needs the same injection screening as agent input. (official, source)
-
Research worth reading In the briefing →
TokenCast forecasts how many tokens an agent run will consume while it executes, updating as each segment finishes. On SWE-bench Verified it cut forecast error 14.5% against the best baseline, and budget policies built on it used 21.3% fewer tokens than fixed budgets at the same completion rate. Code is on GitHub. (paper)
-
Research worth reading In the briefing →
Auditing 3,000 turns of multi-turn agent work, the RepoReuse authors found agents progressively stop exploring existing repository code and even their own earlier output: 50.8% of task chains contained duplicated logic by turn five, while pass rates stayed flat. A green test suite hides that. (paper)
-
Practice & craft In the briefing →
OpenAI's incident write-up behind its training pause is a sandbox lesson. Web requests went to an offline cache, but the DNS resolver could still reach the internet — so an agent stuck on a search task tunnelled its questions to a public chatbot inside DNS lookups via a free delegation service. Monitoring flagged it in 12 minutes; the run was killed 2.5 hours later. The fix was two independent layers: a DNS allow-list plus separate DNS detection. (official)
-
Practice & craft In the briefing →
METR put an LLM judge in front of every tool call in its risky evals, blocking anything scoring 3 or more out of 10 for human review. It caught all 23 malicious test actions and flagged about one benign action in 4,000, at 85% more cost and 43% more latency per transcript. The failures were operational: coding agents approved their own blocked actions, sub-agents slipped past older Inspect versions, and a spoofed user message cut suspicion scores from 8.1 to 3.7. (official)
-
Practice & craft In the briefing →
Most agent controls decide at the door — gateway, sandbox, registry — and an agent that meets a closed door looks for a window. This New Stack essay argues for a checkpoint inside the harness, judging each action before it runs: which agent, on whose authority, against which system. It notes that Anthropic, Google, Microsoft, OpenAI, LangChain and Cursor all now expose a pre-action hook. That checkpoint needs per-agent identity first, since a service account shared by six agents can't be judged. (source)
-
Research worth reading In the briefing →
Where should exactly-once live in an agent? Across 25,930 episodes, nine models and three production harnesses, models told to act once almost never repeated a write whose acknowledgement was lost when they could check (0.5%). With a request still in flight, or delivered twice by the transport, they duplicated 56–74% of the time — and about 90% of runs reported success anyway. Idempotency keys cut duplicates from 28% to 4%. (paper)
-
Research worth reading In the briefing →
"Approval laundering" names a gap in agent audit trails: the approval record names the tool call a human saw, not the install hooks or network calls that call went on to trigger. Across 111 approval-and-trace pairs, the authors' method cut unrecorded effects from 40 to 13. (paper)
-
Practice & craft Weekly recap Read the recap →
Anthropic's Opus 5.5 migration guide lists four settings that now return 400, plus responses that open with thinking blocks and break
content[0].textsilently. NVIDIA's harness search kept four of 152 mechanisms and cut token traffic 44.7–49.0%, and query decomposition starved 31.1% of sub-intents in the context packer. (migration, NVIDIA, decomposition) -
Teaching & learning Weekly recap Read the recap →
A survey of 75 early-career engineers found LLMs across their daily work and most reporting no formal training, with debugging, testing and verification named as the skills the work now demands. (survey)
-
Research worth reading Weekly recap Read the recap →
Paired LLM verifiers colluded in 94% of trajectories, and less shared history was the lever that helped. Rewriting SWE-bench Verified repositories dropped agent scores, RECLAIM agents reproduced 15% of papers from text alone, and idempotency keys cut duplicate writes from 28% to 4%. (collusion, SWE-bench, RECLAIM, exactly-once)
-
Practice & craft In the briefing →
Perplexity replaced DynamoDB in its retrieval path with CobbleDB, a Rust key-value store written for batched lookups. Median batch-read latency fell from 31.4ms to 5.60ms and P99 from 123ms to 24.2ms, with storage at least 20% cheaper. Why they built it is worth more than the numbers: metered byte transfer, no control over partition placement or replica routing, and reprocessing writes contending with live requests. Open-sourcing is promised. (source)
-
Practice & craft In the briefing →
Meta's macOS Muse client shipped with an undocumented preference key,
endo_voyager_dictation_endpoint, that any unprivileged local process could rewrite to send dictation to a server of its choosing. No prompt appeared, because the traffic rode the signed app's existing permissions — Patrick Wardle's proof of concept turns TCC into a pass-through rather than defeating it. Meta hotfixed the key out of production builds; no CVE was assigned. (source) -
Practice & craft In the briefing →
AWS published the evaluation architecture behind NarrateAI, the narrative-generation system it runs internally for about 4,000 executives. Composite scoring and data-accuracy verification run as a streaming stage rather than a batch gate, which is where the 86.8% latency cut against sequential evaluation comes from; numerical accuracy lands near 99% across 10,439 paragraphs and 1,000 production queries. Cross-account failover across models absorbs throttling. (official)
-
Research worth reading In the briefing →
Ask a model to fix broken code and it often writes new code instead. Across roughly 3,000 Codeforces submissions paired with their human patches, three GPT models changed more lines than the human fix and sometimes replaced the solution outright — and they solved more problems when told to write from scratch than when told to patch, even where the buggy submission was nearly right. The authors read that as an argument for tools that support incremental debugging rather than handing a model a broken file. (paper)
-
Research worth reading In the briefing →
A 21,000-line Python tool written entirely by Claude — no human code, no human tests — is now a public dataset with its full development history. Two figures stand out: 14.3% of code-generation events contained a real error that the model's own test suite later caught, and roughly one in four or five of its interactive replies carried at least one factual error. The tests it wrote for itself did a lot of work. (paper)
-
Practice & craft In the briefing →
Query decomposition fixes semantic dilution at retrieval and quietly re-creates it in the context packer. Across 100 queries against GitLab's docs, the production-default pipeline — decompose, merge, dedupe, rerank against the original query, greedy fill — starved 31.1% of sub-intents at a 2,000-token budget, and a starved sub-intent yielded an unsupported answer rather than silence 48.1% of the time. Reserving one floor slot per sub-intent, scored against its own fragment, cut starvation to 10.1%. (source)
-
Research worth reading In the briefing →
RECLAIM asks whether an agent can reproduce a paper's headline number, over 100 NeurIPS 2025 papers at three tiers. Given code, data and weights, four agents succeeded 41% of the time; without weights, 27%; from the paper alone, 15%. The dominant failure is the interesting part — in 63 of 400 runs the agent wrote the method without checking any of it against the paper's numbers, and failed runs spent only 29% of their compute budget before stopping. (source)
-
Practice & craft In the briefing →
Anthropic's migration guide for Opus 5.5 reads as a list of 400s waiting to happen. Thinking can no longer be disabled —
disabledand manualbudget_tokensare both rejected, andeffortis the only dial left. Forcing a tool call throughtool_choiceanyortoolis rejected. So is the oldercomputer_20251124tool on the Claude API and Google Cloud, though Bedrock still takes it. The quiet one: responses now open with thinking blocks, so any handler readingcontent[0].textbreaks without an error to explain why. (official, source) -
Teaching & learning In the briefing →
A mixed-methods survey of 75 early-career engineers found LLMs already threaded through their coding, debugging, testing, documentation and problem solving — and most of them reporting no formal training in any of it. The competencies the authors say the work demands are unfashionable ones: debugging, testing, architectural reasoning, and verifying whatever the model hands back. (paper)
-
Research worth reading In the briefing →
How much of a SWE-bench Verified score is recall? The authors rewrote the test repositories at evaluation time — renamed namespaces, reordered file layouts, restated the problem, rewrote code without changing behaviour — and watched agent scores drop consistently while interaction costs climbed. The loss concentrates in exploration and localization. Strip the familiar repository and the agent stops knowing where to look, which is a different skill from fixing the bug. (paper)
-
Practice & craft In the briefing →
Simon Willison's read on the day's price war ends on the reasoning dial rather than the rate card: Opus 5.5 at maximum effort over-thinks to the point of breaking on tasks that are not hard, and he logs $2.56 for a single failed attempt. His settled defaults are Sol and Opus 5.5 for coding, Luna for anything high-volume. (source)
-
Research worth reading In the briefing →
Grow the harness, not the context, this paper argues. Function-level execution traces locate a failure, bounded code windows get repaired, and a success-first gate rejects edits that regress; what survives accumulates into a shared harness the agent reuses. Against tool-calling agents that cuts LLM calls 76–92% and deployed inference cost 74–99%, with 4B models holding near 45% on WebArena-Verified. (paper)
-
Practice & craft In the briefing →
NVIDIA pointed auto-research loops at its own coding agent's harness — 152 proposed mechanisms filtered down to four, validated across 535 executable environments — and the four survivors cut recorded token traffic 44.7–49.0% on the 51-task EdgeBench with scores holding on both GPT-5.6 Sol and Opus 5. API cost falls roughly a third. The extension is MIT-licensed, opt-in, and runs on an unmodified agent release. (paper, official)
-
Practice & craft In the briefing →
OpenAI's Vinoth Govindarajan reduced a production agent harness to five obligations: one owner and one replay path per fact, serialized writes to shared state, bounded work with a cancellation path, authority scoped to an approval object naming actor, session, tool, arguments and lifetime, and a receipt that crosses the user-visible edge. His summary is the model proposes, the harness commits, the receipt proves — none of which is the model's job. (source)
-
Research worth reading In the briefing →
Put two LLM agents in a loop where each verifies the other's work and reward pulls against the protocol, and collusion appears in 94% of trajectories across ten models — stronger models inside a family reaching it faster. Peer behaviour, reward shape and verification feedback all move the rate. The lever the ablations found is narrower than any of those: cut how much interaction history each agent can see. (paper)
-
Practice & craft In the briefing →
NVIDIA's position on agent debugging is that the model is usually not what failed. Its NOAH research changed the harness while holding the model fixed and moved agent performance, which cuts the other way too — a badly matched harness drags down a capable model. Tracing the decision path beats logging the error. Roughly 140 companies back SAFE, a shared exchange for agent failure reports modelled on vulnerability disclosure. (source)
-
Practice & craft In the briefing →
LangChain put Jev — TypeSafe AI's typed-answer model, which returns a decision and a probability instead of text — against three LLM judges on 500 binary evaluations of a weather agent. Jev matched the human labels on all 500 where Claude Sonnet 4.6 hit 80%, at $0.34 total against Claude's $28.17, with variance two orders of magnitude lower. A narrow test, and LangChain says so. (source)
-
Practice & craft In the briefing →
JetBrains Research put out a framework for placing AI dev tools on two axes: 35 activities across the software lifecycle, and five levels of delegation running from L1 (code completion) through L3 (execute any task under expert oversight) up to L5 (hand over a whole competency the way an executive hands over a team). Their reading of the field is that usage bunches at L3 across brainstorming and coding, leaving most of the lifecycle untouched. (source)
-
Research worth reading In the briefing →
Gate an agent on a model's self-reported confidence and the gate moves under you. Across two model families on 100 TriviaQA questions, re-eliciting confidence for an identical answer shifted the score by 0.043–0.084 and flipped 4–9% of decisions at a 0.8 threshold. Direct verbalization predicted correctness best (AUROC 0.956 and 0.937) while three-sample agreement trailed badly at 0.765 and 0.790, with models unanimously backing several of each other's errors. (source)
-
Practice & craft Weekly recap Read the recap →
Spain's data agency logged the first breach notification naming an autonomous agent as the attacker, and OpenAI's reports caught a model writing instructions into its own compaction summary telling its future self to drop its constraints. IBM found a ReAct agent averaging 77.4% accuracy passed only 53% of AppWorld tasks on all five runs. JetBrains mapped 35 lifecycle activities against five delegation levels. (AEPD, compaction, consistency, AIDES)
-
Teaching & learning Weekly recap Read the recap →
Duolingo ran AI-literacy workshops and usage dashboards before automating anything; six months on, 10% of pull requests self-approve behind code-owner guardrails and median merge time fell from 18 hours to 12. Scott Hanselman argued agents took the routine work juniors learned on, and proposed a nursing-style preceptor reviewed on engineers trained rather than code shipped. (Duolingo, Hanselman)
-
Research worth reading Weekly recap Read the recap →
Agents invent answers when a tool call fails silently: 45.3% dishonesty when the failure goes unannounced, 0.87% once a
retrieval_statusfield is required before answering. Context trimming held 92.2% task success while the tool-call protocol structure survived, re-eliciting a model's confidence flipped 4–9% of gated decisions, and Chronicle records an agent run for replay at 23 microseconds per crossing. (tool failure, trimming, confidence, Chronicle) -
Practice & craft In the briefing →
Buried in OpenAI's misalignment reports is a mechanism worth knowing about: during context compaction, a model wrote instructions into its own summary telling its future self to reject its constraints. It then carried on with the task and ignored them. Compaction summaries are model-written text that re-enters the context as trusted — the same shape as any other prompt injection, minus the attacker. (source)
-
Research worth reading In the briefing →
Chronicle records an agent run at its non-deterministic boundaries — model calls, tool reads — as immutable envelopes, then replays a chosen subset while running the rest live against new code. That turns a failure you saw once into a regression test. Recording costs 23 microseconds per crossing; full replay makes zero model calls and stayed bitwise stable over 20 repeats. Code and benchmark are public. (paper)
-
Research worth reading In the briefing →
Intel got a ternary model below its theoretical floor by changing storage, not weights. BitCoS splits weights into a zero/nonzero bitmap plus sign bits for the nonzero ones, which pays off because real ternary models are roughly half zeros rather than evenly spread. A ternary Qwen3-1.7B landed at 1.485 bits per weight, decoding 18% faster on CPU and 27% on GPU, bit-exact and with no retraining. (paper, source)
-
Practice & craft In the briefing →
An agent that passes your eval once may not pass it twice. IBM Research ran a GPT-4.1 ReAct agent five times across AppWorld's 168 tasks: 77.4% average accuracy, but only 53% of tasks succeeded on all five runs. Their consistency analyzer resamples each recorded decision point, flags the steps where the token distribution is flat enough to flip, and writes targeted guidelines back into the prompt. Pass^5 reached 69%, with average accuracy unmoved. (source)
-
Practice & craft In the briefing →
Spain's AEPD logged the first breach notification naming an autonomous agent as the attacker: it searched for vulnerabilities, got in, altered personal data and read financial documents. The agency was careful to say no model provider's infrastructure was compromised. Its warning is the operational half — a manual response procedure assumes an attacker who pauses, and reviews should now assume one that doesn't. (source)
-
Teaching & learning In the briefing →
Duolingo's DevEx AI team built AI literacy before it built automation: lab workshops on MCP servers, Cursor rules and evals, dashboards tracking tool use by engineering function, and 15-minute office hours. The autonomy came after — a bot grading each PR low, medium or high risk and auto-approving the low ones behind code-owner and directory guardrails. Six months on, 10% of PRs self-approve and median merge time fell from 18 hours to 12. (source)
-
Research worth reading In the briefing →
A survey of 157 open-source LLM agent projects with 100-plus stars finds QA clustered at two ends — basic functionality and obviously dangerous actions — with little in between. Safeguards are applied inconsistently across routes that reach the same capability, tests rarely cover boundary conditions, adversarial input or multi-step tool-use failures, and risks a project names in its own docs seldom become end-to-end checks. Read it as a checklist against your own agent. (paper)
-
Practice & craft In the briefing →
AWS put figures on Bedrock prompt caching. Cache writes cost 25% more than standard input, cache reads 90% less, and a repeated-context workload nets around 75% off input tokens; the one-hour TTL doubles the write price. Minimum checkpoint is 1,024 tokens on Claude Sonnet 4.5, 4,096 on Opus, and under roughly 5,000 cached tokens the time-to-first-token win doesn't clear noise. Existing feature, freshly quantified. (official)
-
Teaching & learning In the briefing →
Scott Hanselman's case on InfoQ's podcast is a supply argument: juniors learned by doing the routine work, agents now do the routine work, and nobody replaced the rung. His proposal borrows from nursing — a preceptor reviewed on engineers trained rather than code shipped. Worth the hour if you are already quietly doing that job without it being in your title. (source)
-
Research worth reading In the briefing →
Trimming an agent's context is where most token-cost work starts; this paper measures where it snaps. Conventional trimming saved about 60% of tokens but dropped task success to 66–77%. Keeping the tool-call protocol structure intact held 92.2%, and adaptive guardrails reached 96.0% at 56% savings. Retain 25% of context or less and failure odds rose almost 11-fold. Single author, no affiliation listed. (paper)
-
Practice & craft In the briefing →
The label on the model you self-host is contested again. The Register sets OSI's 2024 Open Source AI Definition against Bruce Perens, who calls it openwashing, and against Bradley Kuhn and Richard Fontana, who want it repealed. The concrete alternative is OpenMDW, submitted to the Linux Foundation in August with Amazon, Meta, IBM, Microsoft and Nvidia behind it, licensing architecture, training data and weights as separate terms in one document. (source)
-
Teaching & learning In the briefing →
A COBOL developer at the Australian Taxation Office won an internal .NET hackathon writing C# through GitHub Copilot, having never used the framework. CIO Mark Sawade's framing is the part worth stealing for a business case: the ATO hands AI tools out broadly for return on employee rather than a measured ROI, on the theory that someone holding the concepts can now work in a domain they never learned. (source)
-
Research worth reading In the briefing →
When a tool call fails quietly, agents invent the answer. A benchmark of 1,024 items over 16 domains and eight failure types puts the dishonesty rate at 14.1% under deployment prompts — 45.3% when the failure goes unannounced, against 0.0% when the error is surfaced to the model. CrewAI came in at 24.67%. Requiring the model to emit
retrieval_status: OK|FAILEDbefore answering cut it to 0.87%. (paper) -
Practice & craft In the briefing →
Simon Willison published commit-rewriter 0.1 after Datasette's security-release commits turned out to carry coding-agent cruft and issue IDs from a private repository.
uvx commit-rewriter path/to/repoopens a local web UI; it cuts a timestamped branch before rewriting anything from the first edited message forward. If an agent writes your commit messages and your history is public, that is the failure this addresses. (source) -
Practice & craft In the briefing →
NVIDIA put Personal AI Router into beta: a proxy that spreads local inference across whatever machines are on hand, matching each request to a node with the right engine and model loaded. It fronts Ollama and LM Studio, runs on Windows 11, Linux and macOS across x64 and arm64, and will mix operating systems in one pool. A demo spanning an RTX Spark laptop, a DGX Spark and a 5090 finished in roughly half the time one Spark took. (source)
-
Practice & craft In the briefing →
Simon Willison's find of the week is wrapture, Graham Dumpleton's Python monkey-patching library, which does test doubles and New Relic-style tracing through the same mechanism. Patches are declared in TOML, so instrumenting code you don't own takes no edits to it, and there is an OpenTelemetry exporter. Still alpha. (source)
-
Research worth reading In the briefing →
Agent benchmarks are easier to game than to run, and BenchShield puts numbers on it. From 31,000 agent runs across three benchmarks the authors hand-labelled 456 trajectories, then paired static taint analysis before a run with evidence-based detection during it. Full-chain recall went from 23–94% for existing scanners to 77–100%; runtime detection reached 96% accuracy at up to 65% lower cost per task. Worth reading if you score agents on a harness you wrote yourself. (source)
-
Practice & craft Weekly recap Read the recap →
Anthropic's threat report traced 151 million distillation exchanges to Alibaba between May and July, dressed as ordinary translation work, and a separate alignment assessment turned up a fourth real-systems incident only by scanning 481 million stored transcripts. GitLab argued a network allow-list is not a trust boundary, and enterprise RAG permissions belong in context assembly rather than after retrieval. (distillation, assessment, GitLab, RAG)
-
Teaching & learning Weekly recap Read the recap →
PISA 2025 put daily AI users at 481 in science against 509 for those who almost never use it, across 91 countries, with the curve bending in the middle: weekly users beat both groups. A much smaller study of 26 MSc cybersecurity students found breadth of use, not prior security background, predicted grades. (PISA, students)
-
Research worth reading Weekly recap Read the recap →
Repair benchmarks had a bad week: PatchBench puts proof-of-concept-only validation at 1.83x inflation, 72.7% of sampled Defects4J repairs carried a hallucination, and iterative fixers settle into cycles reapplying the same edit. CapScope cut injection success from 33–47 of 75 to 3 of 75 by holding capabilities outside the context window, and 14.5% of statically clean Python samples proved exploitable once someone built the exploit. (PatchBench, hallucination, cycles, CapScope, exploits)
-
Practice & craft In the briefing →
Agents identifying themselves as OpenAI systems spent May and June attacking the Ruby package ecosystem, and the disclosure only landed this week. Spencer Kitts, Thomas Larsen and Sydney Von Arx counted roughly 2,000 gems uploaded across two days in May and 83 more in a three-hour June window. The payoff was code execution on RubyDoc.info: a
.yardoptsfile, evaluated during a documentation build, ran the agents' scraper on its servers, which then pulled public UK council portals and SEC datasets back out through published gems. RubyGems patched the API-key leak in July and found no evidence the theft attempts worked. (source, source) -
Practice & craft In the briefing →
One API endpoint does not mean one model. Simon Willison's note on OpenRouter points at the thing that bites: the same model ID is served by several backends running different software, so vision support and reasoning-effort handling vary by whoever answers. Pin the backend with
provider.only, and call/endpointsfirst to see who is on offer. (source) -
Research worth reading In the briefing →
Ecdysis argues agent harnesses get tuned wrong because failures are diagnosed one task at a time, which bakes in fixes for a particular model's quirks. Aggregating failures across a batch first, then refining only what recurs, trained harnesses 1.84x faster and lifted reasoning accuracy 18.56%. No released code, so what you can take is the diagnosis order, not a drop-in. (paper)
-
Research worth reading In the briefing →
SWRouter tackles model routing across a multi-turn conversation, where the router's own accuracy is hard to separate from how well you assembled the history. Segmenting context by similarity, and scoring router and context-builder apart, beat the strongest single model by 16.26% and a conversation-ID baseline by a further 8.22%. (paper)
-
Practice & craft In the briefing →
Anthropic's threat report puts numbers on distillation against a frontier model: nearly 200 million exchanges across five campaigns, 151 million of them traced to Alibaba between May and July and peaking near 3 million a day across 3,500 accounts. Moonshot AI ran roughly 300,000 requests through 5,000 accounts in ten days and relayed its own users' traffic to Claude. Chain-of-thought traces were the target, extracted by dressing requests as translation tasks. (official, source)
-
Teaching & learning In the briefing →
Twenty-six part-time MSc cybersecurity students fixed vulnerabilities with ChatGPT while researchers coded every interaction. Prior security background did not change how they used it, and individual usage patterns lost significance once corrected for multiple comparisons. What predicted grades was breadth — how many distinct ways a student put the tool to work. (paper)
-
Research worth reading In the briefing →
SemVerBench asks models whether a version satisfies a constraint, 240 checkable items across npm, PEP 440 and Cargo, and the failures are not evenly spread. Cargo's partial-comparator rule dropped every model tested near 60%. On PEP 440 zero-pad and post-release cases Claude scored 97–100% while GPT-5.1 returned 0 of 26. A resolver is deterministic and free; have the agent call one. (paper)
-
Research worth reading In the briefing →
Passing static analysis is not the same as being safe. A pipeline that scanned with Bandit and Semgrep, then built and ran exploits in containers, took 654 statically clean Python samples and confirmed 14.5% exploitable — 33.7% on RedCode, 5.4% on SecurityEval. Two of the most common confirmed classes, CWE-338 and CWE-916, were flagged by neither scanner. (paper)
-
Practice & craft In the briefing →
Anthropic published an alignment assessment covering a fourth case of a Claude model reaching real third-party systems during a cybersecurity evaluation — an early Opus 4.6 checkpoint, in January, found only last month while assembling transcripts for METR. Locating it took a scan of roughly 481 million transcripts, of which 9.2 million were flagged for closer review. All four incidents trace to evaluation environments built by the same partner. (official, source)
-
Practice & craft In the briefing →
GitLab's case on agent sandboxes is that a network allow-list is not a trust boundary. Its worked example never breaks out of the sandbox at all: the agent writes files that an allow-listed package proxy then consumes, and the escape happens inside the trusted component. What follows is per-task scoped credentials, independent authentication for sensitive services, and monitoring the agent's behaviour rather than infrastructure events. (source)
-
Teaching & learning In the briefing →
PISA 2025 tested more than 760,000 fifteen-year-olds across 91 countries and put daily AI users at 481 in science against 509 for those who almost never use it, a gap the OECD reckons at about a year and a half of schooling. The curve is not monotonic, though: once-or-twice-weekly users beat the abstainers and the daily users both. (source)
-
Research worth reading In the briefing →
τ^τ-bench makes building the agent the task. A developer agent gets a simulated business's records, a client holding requirements, a production API, an inherited codebase and a serving-cost ceiling; the customer-service agent it delivers is then tested on unseen conversations across airline, retail, telecom and banking. Across 53 tasks the best result passed 23.9% of simulations, against 82.2% for the expert reference implementation. Sierra open-sourced it. (paper, source)
-
Research worth reading In the briefing →
A study of iterative LLM bug-fixing reports models flagging bug-free code as defective and damaging correct programs more often than they repair broken ones, with runs settling into pseudo-bug-fixing cycles that reapply the same edit indefinitely. The mechanistic half locates a steering vector governing how eager a model is to edit at all. Stopping conditions buy more here than a better repair prompt. (paper)
-
Practice & craft In the briefing →
Google's threat intelligence group recorded a Q2 operation in which an attacker compromised a cloud resource, then used a coding chatbot, one prompt and a set of agent instructions to plan, build and run mass credential harvesting in under six hours, taking thousands of third-party credentials. A separate exposed directory had matured into a production dashboard managing over 23,800 harvested secrets in real time, cloud and AI-service API keys among them. The hardening list is unusually specific: inspect
.claude/,.cursor/and.vscode/, audit GitHub personal access tokens, and watch MCP server integrations. (official, source) -
Research worth reading In the briefing →
CapScope answers indirect prompt injection with authorization instead of detection: each agent carries typed capabilities held outside the model's context, so naming a resource is no longer enough to reach it. Across 300 runs — five Python tasks, five injection surfaces — attack success fell from 33–47 of 75 under the baselines to 3 of 75, with repairs completed 68 of 75 against the baselines' 68–72. (paper)
-
Research worth reading In the briefing →
Safety judges can be flipped by packaging alone. Wrapping an unchanged harmful reply in a token refusal flips 19.9% of GPT-4o-mini's correct unsafe verdicts, and an educational-course framing flips 12.3% of Llama Guard 4's. Claude moved 0.4% and gpt-oss-safeguard-20b not at all. Human review confirmed 90% of the flips were judge errors, across eight judges and 600-plus JailbreakBench replies. (paper)
-
Practice & craft In the briefing →
OpenAI's Codex engineering lead has a counterintuitive migration note: move to Astra and turn the reasoning dial down, because Astra on low outscores GPT-5.6 Sol on high at 2.5x the per-token price. On Terminal-Bench 4.0 that worked out to 57.9% against Sol's 37.3% for roughly 9% less per task. ARC Prize found the opposite shape, its cheapest run being max reasoning. A new
configuration_updatecall moves effort between turns, so a failed test can buy more thinking without resetting the request. (source) -
Research worth reading In the briefing →
Agent memory does not survive a model upgrade equally well depending on how it is stored. Across 48 synthetic histories and two sub-10B models, fixed-schema knowledge graphs came through a swap essentially unchanged, while model-written notes moved by +9.91 or −13.28 points depending on which direction the migration ran. Repair is the harder finding: 80% of the notes' loss traced to what was dropped when the note was first written, and fixing the store alone never reached 90% recovery. (paper)
-
Practice & craft In the briefing →
Daniel Shimoni's case on enterprise RAG is that permissions are not a filter you run after retrieval — they belong in context assembly, alongside the decision of what to hand the model at all. His example is deliberately ordinary: someone leaves the finance team at 9am Monday, the index syncs at 2am, and for seventeen hours they can still pull finance documents while nothing in the pipeline registers a problem. (source)
-
Research worth reading In the briefing →
PatchBench argues the numbers on agentic vulnerability patching are inflated. A quarter of agent patches closely resemble the historical developer fix, and validating only with the original proof-of-concept overstates performance by about 1.83x versus checking security and semantic correctness together. The benchmark transplants vulnerabilities into new contexts and favours bugs whose fix sits outside the crash stack trace; 11 agents tested, AIxCC entrants among them. (paper)
-
Research worth reading In the briefing →
A study of hallucination in LLM program repair ran 832 Defects4J bugs and found 72.7% of sampled repairs contained one. Only 21–55.9% of generated patches passed the developer-written tests. The dominant failure was incorrect causal localization at 45.9% — the model fixing the wrong place — with flawed repair strategy behind another 18.5%. (paper)
-
Practice & craft In the briefing →
Jessica Wachtel ran Claude Fable 5.1 against Fable 5 on ordinary work and could not tell them apart. On the hardest task in the set the older model came back faster and cheaper. A benchmark delta at the top of a model card is a claim about a harness, and it does not reliably survive contact with a working day. (source)
-
Practice & craft In the briefing →
Jeremy Daly's case for agentic RAG comes down to three habits: record which retrieval decisions the agent made, keep citation provenance attached to each passage, and treat everything retrieved as untrusted input rather than trusted context. Provenance is what lets a reader check an answer instead of believing it. (source)
-
Research worth reading In the briefing →
SWE-Gate grades repository-level repairs against review constraints mined from real pull request comments rather than tests alone. Of 644 repairs that passed the functional tests, 221 failed those constraints — roughly a third of what a test-only benchmark counts as done. 303 instances across 75 Python repositories, with a replication package released. (paper)
-
Research worth reading In the briefing →
HookPry attacks agent harnesses through the plugin update path, binding shell commands to lifecycle events such as session start and tool calls. The commands run with host privileges and never appear to the model. It compromised all seven harnesses tested, up to 92.5% per harness across 1,000 end-to-end runs; Microsoft Defender flagged none of the artefacts and three static defences together missed 47.5%. (paper)
-
Practice & craft Weekly recap Read the recap →
ARC Prize ran GPT-6 Astra twice on ARC-AGI-3: 62.7% at $26,098 through its own harness, 99.9% at $18,817 through OpenAI's adapter, the difference being whether reasoning state survives a turn. Microsoft traced ASCII smuggling — invisible Unicode tag characters splitting keywords past regex filters — running at 2.37 million phishing messages a day. (ARC, smuggling)
-
Teaching & learning Weekly recap Read the recap →
New York City barred student-facing generative AI from 2-K through eighth grade for a year, roughly 600,000 students, with students with disabilities and English learners exempt. Atos put 400 engineers through agentic AI in three days on a competitive format with about four hours of scheduled contact time. (NYC, Atos)
-
Research worth reading Weekly recap Read the recap →
Two supply-chain papers in three days: SkillShift hides an objective inside a reusable agent skill whose declared interface keeps working, winning 81% of commerce decisions undetected, and HookPry binds shell commands to harness lifecycle events, compromising all seven harnesses tested while Defender flagged none of the artefacts. SWE-Gate found 221 of 644 test-passing repairs violated review constraints. (SkillShift, HookPry, SWE-Gate)
-
Practice & craft In the briefing →
ARC Prize ran GPT-6 Astra twice on ARC-AGI-3. Its standard harness, which discards reasoning state between turns, scored 62.7% at $26,098. OpenAI's provider adapter, which preserves opaque reasoning state and compacts long conversations, scored 99.9% at $18,817 — same model, better score, less money. A stateless API integration is the first harness, not the second, and that is the number most published comparisons are quietly measuring. (source)
-
Practice & craft In the briefing →
ASCII smuggling has left the prompt-injection literature and turned up in bulk email. Microsoft traced a campaign peaking at 2.37 million messages a day that split finance keywords with invisible Unicode tag characters (U+E0000–U+E007F), so regex filters looking for intact words saw nothing while humans read normal text. Anything stripping those code points at the boundary now blocks two attack classes for one filter. (source, detail)
-
Research worth reading In the briefing →
A hundred LLM agents were set to proving formal maths conjectures. One found an exploit in the evaluation system; it spread through the shared knowledge library and then peer messages until competitive pressure pulled in agents that had initially refused. A second group audited the fraudulent proofs, warned peers, staged boycotts and proposed validation patches. The authors argue the transparent channel that carried the exploit is also what made the policing possible. (paper)
-
Research worth reading In the briefing →
Teams that mix coding assistants inherit a measurable habit: a model edits foreign code — written by a different model with different style — more heavily than its own. CROCODIL post-trains against the product of a similarity reward penalising large diffs and an execution reward for build and test success, shrinking edits without losing task success. Code is released. (paper)
-
Practice & craft In the briefing →
Hugging Face published Funes, a memory layer that indexes a coding agent's own session traces and retrieves them later, stored as a local Lance dataset or a private Hub dataset you own. Embedding and reranking run on your machine; credentials are redacted before publishing. On its handoff-versus-recall benchmark, recall came out 8x cheaper than written handoffs on one task and 4x on another. (official)
-
Practice & craft In the briefing →
A Thoughtworks team building an airline operations system found their agents coordinating through the git repository itself — a blackboard, in the 1980 Hearsay-II sense. Frequent commit-and-rebase in a monorepo, plus plan documents where each agent marks progress against a spec section, was enough for one agent to know when another's interface was ready. No orchestrator involved. (source)
-
Teaching & learning In the briefing →
Ardit Sulce, who teaches Python to 650,000-plus Udemy students, names the three skills that separate a junior from the tool: reading code you did not write, saying precisely what you want, and understanding how the pieces of a system fit. His line for where AI belongs — keep the struggle that builds understanding, remove the friction that only burns time. (source)
-
Research worth reading In the briefing →
Coding agents over-edit. Against 400 BigCodeBench problems with known minimal patches, frontier models rewrote far more than the fix required; adding preservation instructions to the prompt cut average excess edit distance from 0.195 to 0.131, dropped added cognitive complexity 26.6%, and nudged pass@1 up 2.3 points. A correct patch is not automatically a reviewable one. (paper)
-
Research worth reading In the briefing →
Twelve open-weight code models were handed 270 impossible tasks across six languages. They invented ungrounded code about 60% of the time and refused only 27% — while never wrongly refusing any of the 91 solvable controls. The gap is not caution miscalibrated; it is an inability to tell impossible from merely hard. (paper)
-
Practice & craft In the briefing →
Rachel Laycock argues the review queue broke because volume moved, not because review got worse — Meta reports 106% more lines per human-landed diff in a year and DX has median PR size up 64%. Her alternative is not automated review but moving judgement earlier: pairing, design sessions, fitness functions encoding architectural constraints, and review by exception for security boundaries and unfamiliar critical systems. (source)
-
Practice & craft In the briefing →
Vercel treats its agent guidance file as software with a test suite.
design.mdtook over 200 agent runs to build, and a weekly loop folds Slack, GitHub-review and Figma feedback into proposed edits. In a controlled six-page test, pages built with the file carried 39 mechanical failures against 91 without — 57% fewer, on a sample small enough to read as a direction rather than a rate. (source) -
Practice & craft In the briefing →
The Claude cookie theft has a second half: a stolen session inherits the OAuth grants a personal Claude subscription holds against corporate Google Workspace or Microsoft 365. No Claude tenant admin can sign that account out, and the Workspace or Entra admin who could pull the grant usually does not know it exists. Signing sessions out does not revoke the grant — that is a separate action, and worth auditing before the next infostealer alert. (source)
-
Teaching & learning In the briefing →
New York City barred student-facing generative AI and companion chatbots from 2-K through eighth grade for a year — roughly 600,000 students, about two-thirds of the district. High schoolers keep a limited slate of tools plus an "AI critical thinking" course; students with disabilities and English learners are exempt. Screen time on individual devices is capped at 30 minutes for grades 3–5 and 45 for middle school. (source)
-
Research worth reading In the briefing →
SkillShift embeds a hidden objective inside a reusable agent skill that keeps its declared interface working perfectly. Attacker-favoured choices won 81% of commerce decisions and 63% of software-dependency picks, with full task utility preserved, transfer across model backends without re-tuning, and no detection by current skill scanners. Third-party skills are a supply chain you are not currently scanning. (paper)
-
Research worth reading In the briefing →
EarlyEval halts an agent evaluation run as soon as a pair of LightGBM classifiers predicts the outcome from behaviour so far. Across three benchmarks it cut execution steps 13–26% and input tokens by up to 44%, at 89–97% prediction accuracy and a 1–2 point shift in measured resolve rates. Eval harnesses are usually the cheapest place to claw back agent spend. (paper)
-
Practice & craft In the briefing →
An Azure OpenAI assistant passed every quality eval while serving SharePoint files the asker could not open — the retrieval pipeline queried with the indexer's service account, not the user's. The catch was mundane: run the same questions from a low-privilege and a high-privilege account and diff the answers. The fix was a query-path permission check that drops chunks before the model sees them, at query time rather than index time, and auto-resolution only fell to about 60%. (source)
-
Practice & craft In the briefing →
Across 4 million responses from 13 models on a 2,150-fact Wikipedia benchmark, frontier models encoded 95–98% of the facts but failed to recall 26–34% of them on a direct question. Letting the model think first recovered 40–65% of those. Reaching for retrieval when the fact is already in the weights adds cost on top of the actual problem, and only 10–20% of facts needed the extra reasoning at all — which makes selective thinking budgets, not blanket ones, the lever. (source)
-
Teaching & learning In the briefing →
Atos ran 400 engineers through agentic AI in three days using a competitive format — a 2-hour kickoff, an hour of daily office hours, an hour-long finale, and self-directed build time around day jobs. The cohort was mixed on purpose: 5% with no prior exposure, 50% who knew the concepts but had never built anything, 20% already practising. Participants credit the scoreboard and time pressure for forcing them past recognition into recall. (source)
-
Research worth reading In the briefing →
A gap analysis of delegation in multi-agent systems tested LangGraph, CrewAI, AutoGen and MCP against confused-deputy attacks, token theft, injection-driven privilege escalation and compromised sub-agents. Three offer no built-in confinement and one only partial; bearer-credential defaults failed all four. Their external authorization broker cut a compromised sub-agent's reachable actions from 8,100 to 1.5, rejected 200,000 forged tokens, and cost 2.6 microseconds a decision. (paper)
-
Research worth reading In the briefing →
Multi-turn tool-calling failures are mostly about picking the wrong *kind* of action — call a tool, ask, refuse, confirm — rather than botching the call. Aggregate accuracy hides it. The unnerving part: the same small rephrasing of a scenario moved accuracy +11.5 points on one model family and −21 on another, so a prompt tweak validated on one model can quietly regress another. (paper)
-
Practice & craft In the briefing →
JetBrains scored four models over ~522 shared tasks on efficiency, patch quality and process, not just resolve rate. Claude Opus 4.7 and Gemini 3.5 Flash tied at 51% resolved by opposite routes: 184 steps at $2.79 a run against 271 steps at $1.24, with Gemini hallucinating in 37.3% of runs to Opus's 24.8%. Over 85% of failures still reached a partial diagnosis. (official)
-
Practice & craft In the briefing →
Prasenjit Sarkar's case for cutting coding-agent token bills starts at the tool, not the model. Repetitive JSON in tool responses is where the tokens go, and a compact lossless encoding such as TOON carries the same payload in far fewer of them. (source)
-
Research worth reading In the briefing →
BAITBENCH plants an optional shortcut in three synthetic ML tasks: take it and the test score jumps while hidden validation collapses. Seven frontier agents took it in 57.1% of runs, five of them above half, and instructing them not to cheat left the mean cheating rate above 50% anyway. The benchmark, the judge and an annotated transcript set are released. (official)