Trending AI Briefing: Thursday, September 24, 2026 (afternoon ET)
LangChain published five launches today and every one of them treats the same object as the unit of value: the recorded agent session. You can now read it, score it, red-team against it, and train a model on it. Cloudflare published on the same day that the storage layer underneath its Containers product, and therefore underneath Cloudflare Sandboxes, had been handing new tenants disk blocks that still held other customers' data. Those two stories are one story. The session record is worth more than it was yesterday, and the place it runs is less trustworthy than it looked.
What's hottest in AI news right now
Cloudflare disclosed on September 24 that a Workers Paid customer could recover residual disk blocks left behind by other customers' Containers on the same host. Oren Yomtov of Accomplish reported it through HackerOne on September 4 at 15:26 UTC, and Cloudflare had merged the runtime fix by 21:27 UTC the same day. The mechanism is one configuration option. Containers use Linux device mapper thin provisioning with a 64 KiB block size, and the affected pools ran with skip_block_zeroing, so a reassigned block was not cleared before a new container saw it. Write 4 KiB into a 64 KiB region and the other 60 KiB could still hold the previous owner's bytes. The researchers reported residual material on 18 of 24 placements and 20 of 22 underlying nodes across four continents, including directory structures, database pages, and structurally complete SQLite databases. Of 5,614 testable directory blocks across six production placements, zero belonged to the researchers' own filesystem and 2,700 distinct foreign directory inodes were identified by checksum. Cloudflare found no evidence of malicious exploitation in its retained disk-I/O telemetry, says an attacker could not pick a victim, and completed cleanup of pre-mitigation cached snapshots on September 19. Cloudflare Sandboxes are built on Containers, which is the part builders should sit with. (Cloudflare)
LangChain shipped Trajectories in LangSmith on September 24, and the interesting move is that a trajectory is a projection rather than a new recording. It flattens the nested run tree inside a thread, drops the execution structure, and keeps each message once in the order it first appeared, across the main agent and every subagent. That makes a nine-turn, sixty-message support session readable in one pass instead of a tree walk. Trajectories work for traces from LangChain, LangGraph and Deep Agents, from the OpenAI and Claude agent SDKs, and from Codex, Claude Code and Cursor. They can be scored by online evaluators, routed to annotation queues for subject-matter experts who should not be reading retry metadata, and exported to datasets. Available now on all plans in the US. (LangChain)
LangSmith Fine-Tuning and the smithtune CLI landed the same morning, and the reason the trajectory format matters shows up here. For supervised fine-tuning the student needs the exact context the teacher had, and LangChain's post names the specific failure a naive export hits: with deferred tool loading, tool availability changes as the agent works, so exporting the final message list loses what the model actually saw per turn. smithtune pulls trajectories, runs a council of agents against a human-written rubric to filter candidates, uploads the surviving set as a persistent LangSmith dataset, then trains on Fireworks managed SFT or Baseten Loops with LoRA and evaluates by replay against the recorded examples. LangChain ran it on two of its own agents. A stripped-down Engine agent on Kimi K3 scored 90.0 on a subset of its internal IssueBench, GPT-5.6 Sol scored 87.0, and Kimi K3 plus SFT scored 96.0. On code review, Qwen-3.8-27B went from 48.9% to 53.7% F1 while making 29.8% fewer model calls and 29.4% fewer tool requests, with precision moving 62.9% to 81.5% and recall flat at 40.0%. Every one of those numbers is LangChain measuring LangChain on internal sets. The honest detail they kept in: an earlier, less selective training set made F1 worse, and fixing it meant adding another review stage to the curation pipeline. Public Beta. (LangChain)
LangSmith Engine v2 added red teaming on September 24, and the framing is worth reading twice. Red Teaming reads your production traces and your repos to work out what the agent is for, then attacks it for hallucinations and system-prompt violations that have not surfaced in production yet. Engine also now flags inefficient trajectories and trends in error rate, latency and cost, and it validates its own proposed fixes before a human sees them: reproduce the failure against your deployment, propose a change, test it on the same inputs, adjust, then hand over a one-click PR. LangChain says Engine has analyzed more than 70M traces and diagnosed tens of thousands of issues since launching in May, and cites its August post for 2x better issue detection on IssueBench and fixes 25% more effective on Terminal-Bench. Red Teaming and the validated fixes are Private Beta for existing LangSmith Deployment users. Self-hosted teams wait for the next release, which is also when bring-your-own-key arrives so inference does not leave the VPC. (LangChain)
Managed Deep Agents 0.8 shipped on September 24 with a two-layer memory model and a default table that says out loud where memory leaks. Agent memory mounts at /memories/agent/ and is shared by everyone on the deployment. User memory mounts at /memories/user/ and is keyed to the caller's authenticated identity, and the runtime never copies content between layers. The defaults are the design: a Slack one-to-one DM allows both layers, and a Slack channel, a group DM, or an HTTP call allows agent memory and denies user memory. That is a vendor writing down which surface can leak one person's stored preferences into a room. The release also adds user-owned versus agent-owned credentials across an OAuth catalog of 23 services, HTTP channels for anything that can send a JSON webhook, Slack file transfer, and web search from Parallel wired in with no separate account, free while MDA is in beta. (LangChain)
Madhukar Phatak published a working demonstration on September 24 that refusal behavior in an open-weight model can be suppressed at runtime with the base weights entirely frozen. Single-layer vector subtraction fails, and the post shows the failed output: intervene at layer 14 alone and the downstream layers rebuild the refusal. Steering layers 12, 14, 16, 18 and 20 together does not fail, and neither does the learned version, where a small Engram-style module hashes token windows across four prime-modulo tables and a sigmoid gate decides per token whether to inject anything at all. Training the steering head took roughly nine minutes on a Colab A100 over 2,000 filtered PKU-SafeRLHF samples, with the Qwen3-4B backbone frozen. The published benchmark is three prompts across credential dumping, DLL injection and ARP poisoning, base model refuses, steered model complies. Treat the scale accordingly: this is a proof of concept with a three-item eval and an author's note that the code examples were written with Gemini's help, not a measured capability study. (writeup)
Andy Brice reported on September 24 that a malware-carrying imitation of his product sat on GitHub for 23 days with no human response, then came down about ten minutes after the post hit the Hacker News front page. The repository used his product name and logo, the .dmg triggered a long list of VirusTotal warnings, and the attackers had replaced the disk image background with artwork telling downloaders to ignore the malware alerts. He reported it on August 31 and added the malware findings on September 10. He is the sole source for the timeline, and he added the takedown as an update to his own post. (Successful Software)
New tools and features worth actually trying
Trajectories for anything already tracing to LangSmith. If your Codex, Claude Code or Cursor sessions already land in LangSmith, this costs nothing to look at and changes what you can hand a non-engineer. Honest tradeoff: it is a view over data you already send, so it does nothing for a team that has not wired tracing, and it is US plans only at launch.
smithtune for a task your harness has stopped improving. The recommendation in LangChain's own post is the useful part: exhaust harness engineering first, and only reach for SFT when the agent keeps making the same mistake and you have recorded sessions showing the right answer. Honest tradeoff: you need a Fireworks or Baseten key, every published result is LangChain measuring itself, and their own writeup shows a bad training set made the model worse before curation fixed it.
Managed Deep Agents user memory for any agent more than one person talks to. Two mount points and a documented per-channel policy is a better starting position than one memory store and a prompt asking the model to be careful. Honest tradeoff: it is beta, the memory sits in LangSmith Context Hub rather than your own store, and the defaults are only defaults, so a custom access policy is still yours to get wrong.
arcbox if you have been paying for a Docker Desktop replacement. A Rust container and microVM runtime for macOS with agent sandboxes and a Docker-compatible engine, dual MIT and Apache-2.0. Honest tradeoff: the v0.7.0 notes say commercial use is free during the public beta, which is a licensing question the code license does not answer, and the default branch is master, so tooling that assumes main will miss.
Trending AI repos on GitHub today
Read from the Trendshift daily board at 15:12 ET. Its numbers are momentum scores, not star counts. Stars below come from cache-busted shields reads this run; two of them are implausible enough that they are reported as readings rather than facts.
- deepopen-com/deepopen (#3): a non-autoregressive System One decision engine for typed choice, score and noul primitives. Why now: decision models keep trending and this one arrived at #3 overnight. Apache-2.0 with no copyright holder line in the LICENSE, ~994 stars, no releases. Caveat: the README is near-verbatim the README of NandhaKishorM/laya at #4, still carries untranslated marketing filler at the top, and its embedded image URLs point at a
NandhaKishorM/deepopenpath, which reads as an unedited republish. - NandhaKishorM/laya (#4): the same non-autoregressive typed-decision engine, shipped as
layaon PyPI and Hugging Face with three checkpoints and a router. Why now: it is the original of the pair above. Apache-2.0 with no copyright line, ~14.0k stars, releases not confirmed this run. Caveat: 14,042 stars against deepopen's 994 for near-identical code is a wide enough gap on a days-old library that the two figures cannot both be measuring adoption of the same thing. - arcboxlabs/arcbox (#13): a Rust container and VM runtime for macOS with a Docker-compatible engine, agent microVM sandboxes, and native Kubernetes. Why now: the day's lead story is a sandbox substrate failing, and this is the local alternative. Dual MIT ("Copyright (c) 2026 ArcBox Labs") and Apache-2.0, ~5.1k stars,
fleet-agent v0.1.5on 2026-09-11 with v0.7.0 on 2026-08-15, default branchmaster. Caveat: v0.7.0's notes say commercial use is free during the public beta, which implies terms that may change after it. - chubbyguan/chubbyskills (#12): a CLI plus fourteen agent skills that pull video, podcast, article and document content into a local Markdown knowledge base, with an optional MCP server over it. Why now: personal knowledge ingestion is where agent skills are finding real users. MIT ("Copyright (c) 2026 Chubby"), ~961 stars, v0.13.0 on 2026-09-17. Caveat: the v0.13.0 notes state the cloud transcription backends are experimental and were not tested against real paid services this release, and that scraping reliability varies by cookie, region and page changes.
- Ryze-AI-Adgent/open-seo-mcp-skills (#16): MIT-licensed Claude skills for SEO audits, keyword research, rank tracking and competitor gap analysis, running against your own Search Console, GA4 and Ads data. Why now: agent skills that read a business's real analytics rather than a scraped proxy. MIT per the README with no separate LICENSE file found, ~730 stars, releases not confirmed this run. Caveat: the skills are free but require connecting a hosted third-party service to your Google and ad accounts, which makes the repository a funnel for the commercial connector as much as a standalone tool.
- sxwangsxwang1/chatpassport (#24): a Manifest V3 Chrome extension that moves conversation context between ChatGPT, Claude, Gemini and DeepSeek locally, without auto-sending. Why now: conversation portability is the lock-in nobody has solved. ~253 stars, no releases. Caveat: no LICENSE file exists at
mainunder any of the usual names, so the reuse terms are undefined despite the repository being public. - kydlikebtc/awesome-jev (#21): a catalog of 1,207 entries indexing public Jev call sites by the decision each one makes, with CI re-reading cited sources weekly. Why now: it is the closest thing to a usage survey for a model with no published weights. Code MIT and data CC0-1.0 per the LICENSE, with per-row licenses in
catalog.jsonvarying, ~271 stars, no releases. Caveat: it catalogs a closed proprietary model that cannot be run locally, which the repository states plainly and flags per entry, so the honesty is a point in its favor rather than a trap. - farion1231/cc-switch (#2): a Tauri desktop app for switching API provider configs, MCP servers, prompts and skills across nine AI coding tools. Why now: people now run enough harnesses that config switching is its own product. MIT ("Copyright (c) 2025 Jason Young"), v3.20.4 on 2026-09-22. Caveat: the cache-busted shields read returned roughly 136k stars, which would put a desktop config switcher in the same tier as React, so the figure is reported as a reading and not relied on; separately the README carries dozens of paid API-relay affiliate links with signup bonuses and promo codes.
What actually matters from today's signal
The trend to track is that the agent trace stopped being a debugging artifact and became training data, evaluation input, review material and an attack surface, all in one morning. Four of today's five LangChain launches are the same bet expressed four ways, and the smithtune writeup names the technical reason the bet needs a purpose-built format: with deferred tool loading, the model's available tools change mid-run, so a flat message-list export is not a record of what the model saw. If you are building agents, the highest-signal areas this week are trajectory capture that preserves per-turn tool context, memory that is scoped by authenticated caller rather than by thread, evaluation that scores the path rather than the final answer, and knowing what your sandbox provider's storage isolation actually does.
The counter-signal is the Cloudflare post, and not for the reason the headline suggests. Cloudflare handled this about as well as a vendor can: disclosed on the day, fixed within six hours of the report, named the researcher, published the timeline down to the minute, and said plainly which blocks the fix did not sanitize and how they were cleared. The uncomfortable part is what the bug was. Not a permission model error, not a prompt injection, not an agent escaping a boundary. A storage allocator option, three layers below anything an agent framework can see, on the product that sells itself as the safe place to run agent-generated code. Every permission dialog, every allowlist and every sandbox seam shipped this month sits on top of something like it. The week's launches all assume the session record is an asset worth keeping. Today says the medium it is kept on is a security question in its own right.
So the concrete move this week is boring and worth doing: find out where your agent sessions physically live, who else's workload shares that hardware, and what the provider's answer is to the question Cloudflare just answered in public. Nobody is going to ask that question because a vendor blog told them to. Ask it before the next disclosure makes it retroactive.
Source access notes: Primary sources fetched directly this run: blog.cloudflare.com index and the 2026-09-24 containers-cross-tenant-vulnerability post, langchain.com/blog index plus the Trajectories, Fine-Tuning, Engine v2 and Managed Deep Agents 0.8 posts, openai.com/news, anthropic.com/news, github.blog/changelog index, raw.githubusercontent.com Claude Code CHANGELOG (cache-busted; at compile time the top entry was still 2.1.281 from September 23, and the adversarial pass an hour later read 2.1.282 at the top, so a release landed mid-run and is deliberately left for the next briefing rather than written up from an unread entry), blog.madhukaraphatak.in, successfulsoftware.net, and trendshift.io read at 15:12 ET. Hacker News was gathered through the Algolia API; the first query used a malformed timestamp filter that returned a year-wide relevance-ranked set and was discarded, and the run was repeated with search_by_date over a 36-hour window. api.github.com remains proxy-blocked; all repo facts came from cache-busted shields, raw README and LICENSE files, and releases.atom feeds via a verification subagent, which could not complete two fetches (laya releases, open-seo-mcp-skills releases) and those are marked unconfirmed above rather than guessed. developers.openai.com/codex/changelog was not fetched this run. Adversarial pass: a hostile fact-check ran against this file before publication and caught four wrong star counts, all of them from cache-busted shields reads that the checker disproved against live ungh.cc queries: laya ~23k corrected to 14,042, arcbox ~7.3k corrected to 5,051, open-seo-mcp-skills ~1.4k corrected to 730, and chubbyskills ~903 corrected to 961. All four corrections are applied above, and the laya caveat was rewritten because the corrected figure no longer supports the original framing. The checker also removed an unverifiable "before noon" timing claim from the opening, since LangChain's posts carry a date and no time. Everything else held on independent re-verification: the full Cloudflare timeline to the minute, all placement and block counts, every LangSmith benchmark figure and the memory access-default table, the Engram post's layer indices and training run, and the Brice timeline. The cc-switch reading of ~136k was challenged and left standing as a reading, since the checker found roughly 132.7k as of September 13 and could not rule out growth. Article-research correction fed back: one, about the repo ranks. Gap research for the deepopen article re-read the Trendshift daily board roughly an hour after the 15:12 ET read used above and found both entries moved, laya from #4 to #5 and deepopen from #3 to #9. The ranks in the repo section are therefore the 15:12 reading and not a standing for the day, which the section's own intro line already labels as momentum scores. No star count or repo fact changed; the article says the reshuffle out loud rather than reporting a rank as fixed. Items dropped as already covered in the last two briefings: the Transluce agent-activity dataset, the Albanese and Medicare story, GitHub Copilot local sandboxing, Claude Code 2.1.281, AWS Strands harness, and the Anthropic enzyme item.