Agent state that used to live somewhere invisible is being dragged into the open, by the MCP spec that deleted the hidden session, by YC scoping memory and permissions per person and per room, and by two disclosures where the exploit was configuration and text the operator never saw.

Agent state that used to live somewhere invisible is being dragged into the open, by the MCP spec that deleted the hidden session, by YC scoping memory and permissions per person and per room, and by two disclosures where the exploit was configuration and text the operator never saw.

Three separate disclosures this week put the failure at the harness layer rather than the model layer, with Anthropic classifying its own real-world breaches as an operational failure, AI Now showing no model update fixes the README injection class, and a GitHub board led entirely by skill routers and connector gateways.

The model stopped being the product this week, with the biggest cost win credited to a harness rewrite rather than a new checkpoint, a hyperscaler putting its own model family on life support, and a GitHub board led by skills, connectors, and packaging.

Four separate disclosures and shipments in seventy-two hours all turned on the same question, what an agent can reach on the network and whether anyone checked that boundary before the agent went looking.

Three unrelated shipments on the same day attacked the price of a token from opposite ends, vendor price cuts, enterprise spend guardrails, and a local runtime that removes the meter entirely.

Three shipments in 48 hours moved capability out of the model and into the harness around it, and the same 48 hours priced the harness as the new attack surface.

Nothing shipped today was a new model, and almost everything shipped was about what goes into one, which is exactly the capability the industry spent the same 48 hours asking Washington to help it slow down.

Frontier models crossed from finding bugs in demos to breaking real systems and real math in the same week, and the defensive response that arrived within 72 hours had to route around the frontier models themselves.

Reverse-skill's copyable idea is not its security content but its RULES.md, which pre-declares authorization, writes itself into your…

Mandatory pre-release safety testing is the control almost everyone now agrees on, and Anthropic's own eval postmortem three days after…

Seven of the eight steps in the RufRoot attack chain die with the patch and a key rotation, but the poisoned AgentDB pattern store survives…

OpenConnector's value is the credential boundary rather than the provider count, and that boundary ships unlocked because encryption, the…

When an agent writes the code your system runs on, the reviewable artifact stops being the diff and becomes the checker, which is why…

Anthropic's eval prompt asserted a false fact about the world (you have no internet access) instead of a checkable rule about scope, so the…

TurboFieldfare's 2 GB headline is a RAM figure paid for with 14.3 GB of SSD and roughly a tenth of MLX's throughput, which makes it a real…

Your agent's context policy is a capability setting, not plumbing, and the two defaults most harnesses ship (discard reasoning between…