Four separate agent stories today each rest on one headline number, and in every case the number is accurate while the system underneath it behaves differently, starting with a commissioned 0.00 percent prompt-injection score that coexists with a working remote code execution chain.

Four separate agent stories today each rest on one headline number, and in every case the number is accurate while the system underneath it behaves differently, starting with a commissioned 0.00 percent prompt-injection score that coexists with a working remote code execution chain.

Five days of releases and papers all pushed on the same component, the agent's working context, making it shared between people, durable across sessions, and editable by the model, while the failure story everyone passed around this morning is six months old and turns on that context quietly dropping a rule.

The week's sharpest stories all turn on a setting nobody chose, and in most of them the only way to discover the setting was to read a diff.

Five vendors shipped changes in the same 48 hours that all stop accepting a claim about identity or permission at face value, and start demanding proof at the moment of the call.

Four institutions drew the line between machine autonomy and human responsibility this week, each in a different place, and the one that assumed the line already existed found out it was imaginary.

Access to models and to agents is now decided at the identity and ownership layer rather than the API layer, and four separate moves inside 48 hours pushed that gate in different directions.

Every significant thing shipped in the last 48 hours is an argument about the execution boundary, where an agent's reach stops, and two of the biggest arguments point in opposite directions on the same afternoon.

Three labs on three continents published the same finding inside 48 hours, that agent capability now compounds in reusable skill files written outside the weights, and the GitHub trending board spent the same day proving it commercially.

Scientific-agent-skills is MIT at the repository level while each SKILL.md declares its own license, including noncommercial and…

ContextPilot's terminal reward is answer correctness plus format plus an invalid-call penalty, with no term for whether a given deletion…

ChatGPT Work Cloud's /workspace is one writable volume shared across sessions, and a write that lands there crosses no sandbox boundary, so…

Claude Code's auto mode classifier approved the process that started the malware and then denied the command Claude wrote to kill it, which…

Tokentab produces something that looks like a bill for your coding agents but is a reconstruction, because the token counts come from…

Your agent's blast radius is set by the Unix groups your login shell inherited, not by the permission settings in its harness, and…

A deny rule in an agent harness is not one policy but a separate implementation inside every part of the harness that touches the…

Busbar's README promises an execution boundary across models, MCP tools, and A2A agents, and its own callout says only the model plane is…