In four days the industry issued agents the full kit of a human employee (a computer, a wallet, an identity, an operating system) and every control shipped alongside sits in the identity and scope layer, not in the model, which is a quiet concession the week's Hugging Face forensics make explicit.

In four days the industry issued agents the full kit of a human employee (a computer, a wallet, an identity, an operating system) and every control shipped alongside sits in the identity and scope layer, not in the model, which is a quiet concession the week's Hugging Face forensics make explicit.

Four separate disclosures in 48 hours all land on the same control surface, a human reading a diff, and the same week's biggest launch is an orchestrator built to run agents while that human is asleep.

Three separate stories today all break at the same joint, systems that verify which identity signed an action but never verify what caused that identity to sign, which is the exact gap Cloudflare is now selling a product into.

Every significant agent launch on today's board answers the same two questions, where the agent is allowed to work and how a human checks what it did, which means the industry has quietly stopped competing on agent capability and started competing on containment and review.

Three projects on today's board run frontier-scale models on machines that cannot hold them by streaming weights off NVMe, which moves the binding constraint on local inference from RAM to storage bandwidth and makes every headline memory number misleading on its own.

The harness, not the model and not the prompt, became the unit of engineering this week, and it is now carrying the permission model, the review gate, and the security posture that used to live somewhere else.

Agent skills finished their transition from a convenience feature into a package ecosystem, complete with a measured supply chain, an OWASP top ten, and enterprise signing registries, while the format itself still ships with no signatures and no capability model.

Streaming experts off disk instead of holding them in RAM went from one clever hack to the default architecture for running open frontier models locally, and the same week it landed, Unit 42 published what an attacker built out of the open-weights plus open-harness stack.

Kiro Crew is genuinely open source and genuinely self-hosted, but agent.provider is fixed to acp and every install path drives kiro-cli, so…

Coding-agent data loss is mostly a substrate mismatch, not a model failure, because the approval layer inspects command text while the…

TencentDB Agent Memory's real contribution is an access-control model that treats each memory as an owned, versioned asset that stays…

The keyv compromise shipped a second execution path that needs no npm install at all, a SessionStart hook in .claude/settings.json and a…

@cloudflare/computer moves the isolate-versus-container choice out of your architecture and into the agent's own tool call, which turns the…

Atlas lasted under ten months, and its shutdown notice is the more useful document than its launch post, because it names the state a…

WASTE's most checkable claim is not 0.6 tokens per second, it is docs/LEARNED.md, a dated append-only record of hypotheses the project…

Project Perception removes the human from the middle of the security loop while keeping them at both ends, so the only control that…