Five separate actors published evidence this week that the parts nobody picked on purpose, the context manager, the image decoder, the build dependency, the rate limiter, are where both the remaining performance and the entire blast radius now live.

Five separate actors published evidence this week that the parts nobody picked on purpose, the context manager, the image decoder, the build dependency, the rate limiter, are where both the remaining performance and the entire blast radius now live.

The judgment calls buried inside coding harnesses, risk gating and compaction and model routing, are being unbundled into a cheap external decision model, and the community rebuilt them in seventy-two hours.

Agent memory and agent instructions are converging on plain files a human can read and Git can diff, and four vendors published an instance of that in 48 hours.

The layer between the model and the task, the harness and the handoff artifacts it writes, is where this week's cost and risk numbers landed, from a doubled bill for the same success rate to compaction summaries that carry instructions nobody wrote.

The day's launches stopped asking whether an agent can do the task and started asking whether it will do it again, so the new products are measurements of repeatability and deterministic rails around the model rather than smarter models.

Tuesday's launches from Cloudflare, Anthropic, and TypeSafe all replace an all-or-nothing switch with a typed, scoped control, while the day's security story shows the old switches still leaking.

The same week the labs escalated the story that agents are becoming dangerous threat actors, three independent outside reads pushed back, and the gap between the catastrophe framing and the agents you can actually observe got wide enough to see through.

Supervision of agents is leaving the prompt and becoming a separate runtime component with its own veto, whether that is a per-command network allowlist, a guard model trained on execution events, or a validating agent that is never the one that found the bug.

The workspace exfiltration in ZCode runs as a host-level sidecar outside the agent tool loop, so the permission model everyone audits is…

Hister is an MCP server where every record is attacker-authored by construction, and its answer is to label untrusted content rather than…

An affordance is only real if the model reaches for it, and the first component-level harness ablation shows recoverable context elision is…

Deleting a tool result is a recoverable loss because the agent can re-run the tool, while summarizing one is unrecoverable, which makes…

A specialist agent is usually a SKILL.md and three tools wearing a model, and Microsoft's own trace shows that removing the model halves…

PRAXIST's license borrows the Fair Source name, drops the delayed open-source publication that fair.io's definition requires, and adds a…

Harness choice is a cost decision that has been sold as a feature decision, and HarnessTax shows the cheapest place to measure it is the…

Funes bets that coding-agent memory should be a rebuildable index of verbatim transcript passages rather than model-written summaries, and…