Three separate disclosures this week describe attacks in which the model never gets a turn at all, and the defenses that shipped in the same 48 hours moved enforcement off the prompt and into the request path.

Three separate disclosures this week describe attacks in which the model never gets a turn at all, and the defenses that shipped in the same 48 hours moved enforcement off the prompt and into the request path.

The scaffolding around the model is now the product, and yesterday it started editing itself, which arrived in the same 24 hours as a zero-click exfiltration proving nobody has a containment story for a harness that rewrites its own prompts and skills.

In four days the industry issued agents the full kit of a human employee (a computer, a wallet, an identity, an operating system) and every control shipped alongside sits in the identity and scope layer, not in the model, which is a quiet concession the week's Hugging Face forensics make explicit.

Four separate disclosures in 48 hours all land on the same control surface, a human reading a diff, and the same week's biggest launch is an orchestrator built to run agents while that human is asleep.

Three separate stories today all break at the same joint, systems that verify which identity signed an action but never verify what caused that identity to sign, which is the exact gap Cloudflare is now selling a product into.

Every significant agent launch on today's board answers the same two questions, where the agent is allowed to work and how a human checks what it did, which means the industry has quietly stopped competing on agent capability and started competing on containment and review.

Three projects on today's board run frontier-scale models on machines that cannot hold them by streaming weights off NVMe, which moves the binding constraint on local inference from RAM to storage bandwidth and makes every headline memory number misleading on its own.

The harness, not the model and not the prompt, became the unit of engineering this week, and it is now carrying the permission model, the review gate, and the security posture that used to live somewhere else.

Agent harnesses can now create, update, and delete their own prompts, skills, memory, and sub-agents from inside a running task, and not…

Celld runs Cloudflare Workers and Durable Objects on machines you own by removing the control plane entirely and letting nodes coordinate…

Shieldstral moves safety policy from training time to inference time, so a guardrail becomes a plain-language question your product team…

Kiro Crew is genuinely open source and genuinely self-hosted, but agent.provider is fixed to acp and every install path drives kiro-cli, so…

Coding-agent data loss is mostly a substrate mismatch, not a model failure, because the approval layer inspects command text while the…

The reason people run agents with permissions disabled is that approval is synchronous and blocks the whole run, and Cloudflare OS fixes…

TencentDB Agent Memory's real contribution is an access-control model that treats each memory as an owned, versioned asset that stays…

The keyv compromise shipped a second execution path that needs no npm install at all, a SessionStart hook in .claude/settings.json and a…