Agent skills finished their transition from a convenience feature into a package ecosystem, complete with a measured supply chain, an OWASP top ten, and enterprise signing registries, while the format itself still ships with no signatures and no capability model.

Agent skills finished their transition from a convenience feature into a package ecosystem, complete with a measured supply chain, an OWASP top ten, and enterprise signing registries, while the format itself still ships with no signatures and no capability model.

Streaming experts off disk instead of holding them in RAM went from one clever hack to the default architecture for running open frontier models locally, and the same week it landed, Unit 42 published what an attacker built out of the open-weights plus open-harness stack.

Agent state that used to live somewhere invisible is being dragged into the open, by the MCP spec that deleted the hidden session, by YC scoping memory and permissions per person and per room, and by two disclosures where the exploit was configuration and text the operator never saw.

Three separate disclosures this week put the failure at the harness layer rather than the model layer, with Anthropic classifying its own real-world breaches as an operational failure, AI Now showing no model update fixes the README injection class, and a GitHub board led entirely by skill routers and connector gateways.

The model stopped being the product this week, with the biggest cost win credited to a harness rewrite rather than a new checkpoint, a hyperscaler putting its own model family on life support, and a GitHub board led by skills, connectors, and packaging.

Four separate disclosures and shipments in seventy-two hours all turned on the same question, what an agent can reach on the network and whether anyone checked that boundary before the agent went looking.

Three unrelated shipments on the same day attacked the price of a token from opposite ends, vendor price cuts, enterprise spend guardrails, and a local runtime that removes the meter entirely.

Three shipments in 48 hours moved capability out of the model and into the harness around it, and the same 48 hours priced the harness as the new attack surface.

WASTE proves a 2.78-trillion-parameter model no longer has to fit in RAM, but it relocated the constraint rather than removing it, from…

Every control the attacker disabled in Unit 42's autonomous-attack campaign is a documented, supported setting in harnesses developers…

The most valuable file in YC's newly open-sourced QM harness is SECURITY.md, because it enumerates in plain language the twelve places its…

Reverse-skill's copyable idea is not its security content but its RULES.md, which pre-declares authorization, writes itself into your…

Mandatory pre-release safety testing is the control almost everyone now agrees on, and Anthropic's own eval postmortem three days after…

Microsoft built the prompt-injection defense for its Azure DevOps MCP server and applied it to wiki and build-log tools but not to the one…

Seven of the eight steps in the RufRoot attack chain die with the patch and a key rotation, but the poisoned AgentDB pattern store survives…

OpenConnector's value is the credential boundary rather than the provider count, and that boundary ships unlocked because encryption, the…