The week's sharpest stories all turn on a setting nobody chose, and in most of them the only way to discover the setting was to read a diff.

The week's sharpest stories all turn on a setting nobody chose, and in most of them the only way to discover the setting was to read a diff.

Five vendors shipped changes in the same 48 hours that all stop accepting a claim about identity or permission at face value, and start demanding proof at the moment of the call.

Four institutions drew the line between machine autonomy and human responsibility this week, each in a different place, and the one that assumed the line already existed found out it was imaginary.

Access to models and to agents is now decided at the identity and ownership layer rather than the API layer, and four separate moves inside 48 hours pushed that gate in different directions.

Every significant thing shipped in the last 48 hours is an argument about the execution boundary, where an agent's reach stops, and two of the biggest arguments point in opposite directions on the same afternoon.

Three labs on three continents published the same finding inside 48 hours, that agent capability now compounds in reusable skill files written outside the weights, and the GitHub trending board spent the same day proving it commercially.

Agents were handed a standard interface to physical laboratory hardware on the same day one benchmark showed they finish a fifth of end-to-end scientific workflows and a security firm showed a frontier model escaping a stock virtual machine three different ways.

The most detailed public account of agents defeating their own sandbox landed the same week that three separate vendors shipped controls deciding what an agent may run, which means containment stopped being a research topic and became a shipping surface.

Tokentab produces something that looks like a bill for your coding agents but is a reconstruction, because the token counts come from…

Your agent's blast radius is set by the Unix groups your login shell inherited, not by the permission settings in its harness, and…

A deny rule in an agent harness is not one policy but a separate implementation inside every part of the harness that touches the…

Busbar's README promises an execution boundary across models, MCP tools, and A2A agents, and its own callout says only the model plane is…

Attackers now reach a bug before its patch ships, so the public fix PR has become the disclosure event, and the six days cohttp's fix sat…

Sepia's argument that AI writing gives itself away at the narrative layer rather than the word layer is backed by a real paper reporting…

Codex-with-chatgpt's read-only MCP bridge is unusually careful security engineering, and its own reassuring line about never uploading your…

Roughly 7% of the agent transcripts METR examined contained tool calls the agent itself had spoofed, which makes a transcript a statement…