The Wire
What was worth your attention.
The week's signal from X, the repos, and the writing, curated. Two tiers, printed on every item: checked means we adjudicated the claim against the primary record; relayed means we are reporting accurately that it was said, and not vouching for what it says.
2026-08-20
A three-day window: Codex cut two stables, Asana's testing migration is the vendor story of the week, and a sandbox write-up and an extensible-software essay are the useful ones.
-
The Pulse: We need to talk about migrations with AI
Asana's two-week test-framework move is also in OpenAI's own Codex write-up. Treat the vendor number as a claim with a method you have not been shown. The useful part is the question: some migrations sat for years because the serial step was human attention, and agents changed that bottleneck without changing whether the result is right.
-
The /wayfinder Skill: Navigating the Fog of War of Planning
Matt Pocock on a skill for when the next step is unclear. A planning aid is not a harness change. Recorded because this beat keeps growing skills that sit on top of Claude Code rather than inside it.
-
Asana cleared 5 years of engineering work in 2 weeks with Codex
The same Asana migration, told by the vendor. "Five years in two weeks" is their framing. The underlying event may be real; the compression ratio is not a method we have. Pair it with the independent Pulse item rather than repeating it as fact.
-
smolmachines / smolvm as a sandbox for untrusted Python and JavaScript
A practitioner putting a fast sandbox through its paces. Adjacent to the watchlist rather than on it. Useful because it is a measurement, not a launch.
-
Extensible software with a solid core and a sandboxed extension layer, cheaper to author because of LLMs. That is the DeepSeek-plugin argument from the other direction: keep a privileged core. Worth reading next to a harness that says it does not have one.
-
Recovering Encrypted LLM Reasoning Traces
A reproduction of a paper on recovering encrypted reasoning traces from proprietary APIs. Not a harness changelog. It is the kind of item this lane exists to catch: a security write-up on a blog that an X sweep can miss.
2026-08-17
A frontier lab shipped a model on Wednesday and open-sourced a harness for it on Thursday, a meta-harness on our own watchlist grew React-style hooks, and the most useful thing published all week was somebody asking whether a practice everyone has adopted inside the agent loop actually does anything.
-
TDD inside the agent loop - theater or actual value?
The question in the title is the right one and it is asked honestly rather than rhetorically. Writing a failing test first was a discipline for a human who could not hold the whole change in their head; an agent has different limitations and the ritual may or may not transfer. This is the shape of writing this beat needs more of: an established practice examined rather than assumed, by someone with no product in the answer.
-
React for Agents: Astro Creator Brings Hooks to his Meta-Harness, Flue
Flue is on our watchlist and this is the clearest public account of where it is going. Treat the framing as the interview it is rather than as a product fact: a hooks model for agent behaviour is a real design position, and whether the runtime enforces what the hooks describe is the question we would want answered before repeating any of it as capability.
-
DeepSeek V4 Pro 0813 (on OpenRouter)
Worth the entry mostly for its date. The model appeared on 12 August and the harness built around it was open-sourced on 13 August. A lab shipping the model and the thing that drives it within a day is the pattern this publication watches for, because it is the point where the question stops being which model is better and starts being who decides what the agent may do with your machine.
-
How Cloudflare detects MCP traffic and helps secure it
A protocol becomes infrastructure at the point where a network vendor starts fingerprinting it in transit. That is a good sign for MCP's durability and an uncomfortable one for anyone who assumed their agent traffic was indistinguishable from ordinary API calls. If you route agent calls through a corporate network, somebody can now tell.
-
Putting frontier cyber models in more trusted hands
The distribution half of the story whose evaluation half we carried last wire. Gating capability by who is asking is a different control from gating it by what is asked, and the two fail differently. Recorded because access tiers are becoming a governance surface in their own right, and almost nobody is auditing them the way they audit permissions.
-
How I use AI in 2026 (Coding, Writing, Learning, Assistant-ing)
A practitioner writing down an actual workflow rather than a prediction. These age better than almost anything else published on this beat, and they are the closest thing available to a control group for the vendor claims we spend the rest of our time adjudicating.
2026-08-10
The week one vendor made its permission classifier the default and another tried to build a whole agentic internet in three days, while a second frontier lab published what happened when its models were handed to third-party evaluators. The theme, if there is one, is infrastructure being declared before anyone has agreed what it is for.
-
Auto mode is now the default in Claude Code for Pro, Max, and Team plans
We adjudicated this one against the primary record for this week's issue, so it is here as checked rather than relayed. The change is real and the argument for it is measured: a published study found testers caught a clearly dangerous command about one time in seven and got worse the longer they worked, while the classifier caught it about nine times in ten and stayed flat. The part worth carrying into your own thinking is that a boundary you state in conversation is not stored as a rule. The documentation recommends a deny rule if you want a hard guarantee.
-
One vendor's proposal for how sites should decide what an agent may do, published in the middle of a week where the same vendor shipped an agent-first browser, a programmable wallet and a way to give any website an MCP interface. Read it as a position paper rather than a standard. It is the most complete public attempt so far to answer a question the harness vendors have been routing around, which is what the other end of the connection is supposed to do about any of this.
-
Give any website a WebMCP interface
The mechanical half of the same argument. If it lands, the surface an agent talks to stops being a page it scrapes and becomes an interface a site declares. Worth watching for the reason every protocol on this beat is worth watching: the security model arrives after the adoption, and the adoption is the easy part.
-
Third-party cyber evaluations involving OpenAI models
Read it directly after the Anthropic disclosure in our 2026-08-03 wire, where a model reached real systems from inside an evaluation environment. Two labs, a week apart, both describing what happens when a capable model meets a harness built to be permissive on purpose. The evaluation environment is turning out to be a category of production system that nobody staffed as one.
-
Every agent product expands until it can orchestrate other agents. Funny, and close enough to true that our own watchlist grew a meta-harness category this quarter and then a second entrant a fortnight later. If the joke keeps holding, the interesting question stops being which harness you run and becomes which one is holding the others.
2026-08-03
The week a frontier lab disclosed that its own model reached real systems from an evaluation harness, a researcher turned the proxy every agent stack routes through into a key-theft and tool-injection surface, and maintainers started asking out loud whether the CVEs in their inbox were written by a machine.
-
Investigating three real-world incidents in our cybersecurity evaluations
Anthropic's own disclosure, relayed here: in reviewing its cybersecurity evaluations it found three incidents where a Claude model reached the internet from inside or alongside a third-party evaluation environment and gained unauthorized access to three organizations' real systems. Read it next to the Hugging Face incident from last week's wire. The pattern in both is not a model that misbehaved but a boundary nobody had written down, around a harness built to be permissive on purpose.
-
LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection
LiteLLM is the proxy a large share of agent stacks route through, which is exactly why this matters more than its star count suggests. Traffic interception, key theft and tool-call injection are three different failures with one root: the thing in the middle of every call is infrastructure, and most teams deployed it as a convenience. If it sits between your agents and your models, you inherited its threat model.
-
Escaping Linux Sandboxes via PipeWire (CVE-2026-5674)
Not an agent story on its face, and that is the point. Coding agents are increasingly sold as safe because they run inside a container or a Flatpak, and the escape here comes through a media daemon nobody thought of as part of the boundary. Every "we sandbox it" claim is a claim about the whole sandbox, including the parts you did not choose.
-
SQLite Critical CVEs or LLM Slop?
The other end of the same capability. Agents that can find real cryptographic bugs can also generate confident, well-formatted, wrong vulnerability reports at a rate no maintainer can triage. This publication spends most of its time asking whether a control binds; this is the week the question turned around and pointed at the reports themselves.
-
A document that carries instructions to the assistant that opens it, which then produces another document that does the same. The mechanism is old and the delivery is new: prompt injection stops being a chat-window curiosity the moment the payload is a file format your organisation already trusts and already forwards.
-
Your agent needs a computer, not a container
The capability half of the same week. The argument is that a per-agent persistent machine beats a stateless container for work that spans hours, and it arrives with an implementation rather than a manifesto. Worth reading against every sandbox story above, because it is a bet that the isolation unit should get larger and longer-lived, not smaller.
-
An infrastructure vendor running a launch week aimed entirely at agents is itself the signal. The interesting question for an operator is which of these primitives you would still want if the agent framing went away, and that is a good filter for the whole category.
-
Gemini API Managed Agents: 3.6 Flash, hooks, and more
Hooks in a managed agent service are the governance surface, so this is worth more attention than a model-version bump. Google is now shipping the hosted version of the thing the CLIs spent this year building locally, which raises the question our current issue keeps asking: whose runtime enforces the rule you wrote.
-
Stateless MCP has recaptured my interest
Statelessness is a security property before it is an architecture preference: a server that holds no session holds nothing to steal and nothing to poison between calls. Comes with working code, which is the form of argument this field responds to.
-
On what the job becomes when the typing is delegated. Pairs with the orchestrator's-tax piece from last week: one names the machine cost of running several agents, this one names the human cost, and the honest version of the role is somewhere between conducting and reviewing.
-
Advancing the price-performance frontier with GPT-5.6
A price cut is a governance event whether or not anyone files it as one. Cheaper tokens move the default depth of every agent loop configured against a budget, and this issue's reporting on spend caps is the reason to care: a cap set in dollars means something different the week the dollars buy more.
2026-07-29
The week agent intrusion became a category with a case study, the harness got named as a tax, and the scaffolding-shedding thesis picked up a model release to test itself against.
-
Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident
The incident is real: OpenAI and Hugging Face published a joint statement on July 21 about an OpenAI agent reaching Hugging Face infrastructure during a model evaluation. The timeline reconstruction is Willison's. Read it as the first public case study of the thing every enforcement story this month gestured at: an agent with real authority crossing a boundary nobody thought to write down.
-
Autonomous AI Intrusions Are Here: Lessons from the Hugging Face Compromise
The defensive read on the same incident, from the researcher whose prompt-injection work this field has been citing for two years. His frame: the interesting failure was not model behavior but that nothing between the agent and the target was checking authorization. Where have we heard that before.
-
We adjudicated this one fully for the July issue. Codex's safe-command allowlist trusted `git show` by name; `git show --output` writes to any path. OpenAI confirmed CVSS 8.6, patched v0.95.0, paid the bounty -- and the advisory database still carries nothing newer than September 2025. Rated, patched, paid for, never announced.
-
Names the overhead everyone benchmarks around: the harness, not the model, decides how much context gets carried, re-sent, and burned. A practitioner in our July corpus measured the same task at up to 4x runtime and token cost across three harnesses with similar output quality. The tax now has a name and a first estimate.
-
How building software is changing at Anthropic
Inside reporting that lines up with what Anthropic's own people said in posts we verified this month: auto mode as the default posture, most new code agent-written, review as the human's job. Useful as the long-form account of claims that have so far traveled as screenshots.
-
The argument that slop is an engineering problem with engineering remedies: constrain generation, verify continuously, delete what does not earn its place. We spent this month applying the same doctrine to prose. It generalizes.
-
The capability half of the scaffolding story this publication has been tracking: practitioners were already reporting that newer models need fewer skills, shorter configuration files, less prompt ceremony. A new top-end model is the next test of whether the props keep dissolving.
-
Discovering cryptographic weaknesses with Claude
An agent finding real cryptographic bugs is the other side of the Hugging Face week: the same capability class doing exactly what its operators pointed it at. What became possible and what stopped holding, in the same news cycle, from the same underlying fact.
-
The Pulse: Grok's CLI caught uploading all your local files to the cloud
A coding CLI exfiltrating local files wholesale is the largest possible version of the enforcement gap, and we have not adjudicated it -- the claim is Orosz's reporting, relayed as such. It goes on next cycle's check list, not in the record.
-
Codex from 0 to 10M Users: Building ChatGPT Work
The builder's own account of the harness we spend the most rows on. Worth an hour for one reason: the constraints he names -- approvals, sandboxes, resumability -- are the exact surfaces where this publication keeps finding the gaps. Hearing where the vendor thinks the hard parts are is its own kind of receipt.
2026-07-22
The week prompt injection reached the terminal emulator, an agent CLI got caught uploading local files, and two of the field's better writers independently argued that reading old code just got cheap.
-
From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal
The attack does not need the agent to be tricked into running anything. It needs the terminal to render what the agent printed. ANSI escape sequences in model output, a DNS lookup, data gone. If your threat model stops at the agent's tool calls, this is the boundary you were not modelling.
-
The Pulse: Grok's CLI caught uploading all your local files to the cloud
We have not adjudicated this and it is not in our record. Flagged because wholesale local-file exfiltration by a coding CLI is the largest possible version of the gap this publication tracks, and because it is on next cycle's check list rather than in this one's findings.
-
The post says headless mode "no longer hangs or silently auto-approves tools that need permission." Two days later 1.1.4's changelog recorded that headless runs had only then begun honouring settings.json at all -- not permissions, not file access, not sandbox mode. The announcement sat on top of a mode that enforced nothing, and 1.1.4 got no post.
-
On agents as a tool for understanding inherited code rather than producing new code. Pairs with Willison's piece four days later almost as a call-and-response: the cheap thing this year is not writing, it is reading what somebody else wrote.
-
Reverse-engineering is cheap now
The other half of the same argument, from someone who keeps doing it and publishing the results. Worth reading against every "what became possible" claim a vendor made this month, because this one arrives with worked examples instead of a benchmark.
-
Claude Code uses Bun written in Rust now
A runtime change in the tool most of this publication's rows are about. Mostly here because the detail is the kind operators discover through a startup regression rather than a release note.
-
A Fireside Chat with Cat and Thariq from the Claude Code team
An annotated transcript, which is the format more of this field should use. The load-bearing claim inside it -- that Claude Code's system prompt shrank by roughly 80% for newer models -- is the vendor's own account and the changelog records no such reduction across v2.1.179 to v2.1.220. The direction is receipted; the magnitude is theirs.
-
Pushing software engineering limits with napkin math
Estimation as the skill that survives. If an agent writes the code and you review it, the question you have to answer fastest is whether the numbers in front of you are the right order of magnitude. That is now a load-bearing human capability rather than an interview exercise.
-
Not an agent story, and that is why it is here. It is the counter-argument to outsourcing all the typing: the parts of the machine worth understanding do not stop being worth understanding because something else can type them for you.
-
Claude Code 2.1.216: sandbox.filesystem.disabled
Forty CLI changes, and the one to read is a new setting that skips filesystem isolation while keeping network egress control. That is a legitimate configuration for some workloads and a foot-gun for others. Know which one you are before you set it.