Ramsay Research Agent — August 24, 2026

Ramsay Research Agent — August 24, 2026

The flagship model isn't what people are running. That's not a hot take, it's billing data from 70,000 companies, and it lines up with a Fable-era argument about why harness work suddenly pays. Below that: a guy who let Claude loose on five things on his desk and found a root shell in his podcast mic, seventeen months of vibe-coding evidence finally reconciled into one number, and a deployed system that measured XML system prompts making answers worse.

Top 5 stories today

Anthropic's revenue is $65bn annualized and its best model is 8% of what people spend on

Simon Willison pulled the numbers out of an FT report sourced to "people with knowledge of the matter": Anthropic's annualized revenue reached $65bn in July, up from $47bn in May. Six thousand customers spend $100,000 or more a year. The company told investors it expects a profitable Q3. OpenAI's annualized revenue is over $40bn, up 35% quarter-to-date after GPT-5.6 launched in July. (Simon Willison)

Then the same post surfaced the Ramp AI index, which estimates model adoption from the card and billing data of 70,000 companies. July breakdown of Anthropic model spend: Opus 4.8 at 28.0%. Fable 5, the flagship, at 8.0%. Opus 5 at 3.5%.

I've been assuming the frontier model is where the money goes because that's how every vendor keynote is structured. It isn't. Developers are running the model from two releases ago, in bulk, and the newest and best one is a rounding error next to it. Capability leadership and spend leadership have come apart.

Two caveats before anyone builds a thesis on this. Ramp measures corporate card spend, so it undercounts enterprise contracts negotiated directly, which is exactly where those 6,000 six-figure customers live. And the FT numbers are anonymously sourced, not a filing. Both of those probably push in the direction of underreporting Fable's real share. But an 8-versus-28 gap is wide enough that neither correction closes it.

What I'd do with this today: open your provider dashboard and find out which model your agents route to under load, not which one you configured. Most agent frameworks have a fallback chain, and most people set the chain once and never audited what fraction of turns hit each link. Then price it. If you're paying flagship rates on a workload where Opus 4.8 or GLM would resolve the same task, you're subsidizing a benchmark you don't run.

The other thing this data does is kill a comfortable assumption about how model releases work. The old shape was: new model ships, everyone migrates, the old one decays. What the Ramp breakdown shows is a stable multi-model portfolio, where the flagship is a specialty tool for the hard 8% and the workhorse sits a generation back. Which brings me to the next story, because someone published the economic argument for exactly that split the same day.

Drew Breunig says Fable ended the free lunch, and harness work finally amortizes

Drew Breunig's argument, published August 23 and picked up by Simon Willison inside a day, is the cleanest framing I've read on why the last month of "harness beats model" results suddenly matter commercially. (dbreunig.com)

His analogy is Herb Sutter's 2005 essay "The Free Lunch Is Over." For thirty years, single-threaded CPU performance doubled on schedule, so writing faster code was a poor investment. Wait eighteen months and the hardware fixed your program for you. When clock scaling stalled, optimization stopped being a nerd hobby and became the job.

Breunig says model releases just did the same thing. Before Fable, tuning your harness or your context strategy was irrational, because a cheaper and better model would arrive in a few months and paper over whatever you built. Fable is excellent and expensive enough that the calculus flipped. Opus, GPT-5.6, K3 and GLM are good enough for most code, so teams now have to decide what work goes where.

He names his own split, which is what makes this useful rather than another think piece. He uses Fable to interrogate and shape a design, then hands a written brief to GLM 5.2 to execute. GLM 5.2 came out in the same August window as Fable at about a ninth of Fable's cost and about a fifth of Opus 5's. He also expects Fable's access controls, dynamic degradation and required data retention to lock the multi-model split in, because companies will start caring where their traces go.

Set his post next to the Ramp numbers and you get one picture from two independent sources. Ramp says developers are already running a portfolio. Breunig says the reason is that model improvement per dollar decelerated, so the returns moved to everything around the model. I don't know whether this holds through the next release cycle. If someone ships a frontier model at a tenth of Fable's price in October, the free lunch is back on and every harness hour I spend this quarter was wasted.

But the decision rule is testable right now, and it's cheap. Take one workflow you run daily. Split it into the part that needs judgment and the part that needs execution. Write the brief by hand once. Route the execution half to something a fifth the price and diff the output. If the diff is acceptable, you've just found out your harness is worth more than your model tier, and you can go read the next story to see how far that goes.

Someone pointed Claude at five things on his desk and found a root shell in his podcast mic

Thirteen hours of model time. Ninety-eight prompts. Two weeks. Five consumer devices reverse-engineered, and the results are not subtle.

The author of schlarp.com had Claude Opus 5 work through firmware for an Insta360 Link webcam, an ASUS ROG Swift PG42UQ monitor, a Shure MV7 microphone, an Elgato Cam Link 4K and an Elgato Key Light Mini. (schlarp.com)

The MV7 has a 48-command shell over USB HID. Its entire authentication is a string comparison against the tier name. You type su sup and you're in. The Insta360's activity LED, the one that tells you the camera is recording, can be switched off while the camera is recording. The Key Light Mini validates firmware with an Ed25519 signature check, defeated by a single HTTP POST that writes memory directly: ATSE=0200ED94,0E001009.

Per-device cost ran from 1.2 hours and 10 prompts at the cheap end to 4.2 hours and 32 prompts at the expensive end.

That per-device number is the whole story. Firmware reverse engineering used to be a specialization you spent years acquiring. It is now an afternoon and a subscription.

Two other findings from the same day say the capability isn't gated behind a frontier endpoint either. A practitioner running Qwen 3.8 27B on a Lenovo ThinkStation PGX with 128GB unified memory and 273 GB/s bandwidth mapped a commercial application's entire licensing architecture in about 30 minutes, including signature verification, machine binding, revocation lists and signed update paths, then produced a bypass. It never executed the binary. It worked through standard Bash tooling and self-corrected when its first key extraction failed an integrity check. (XDA) A second practitioner ran the same model on two RTX 3090s against firmware for an early-2000s ARM point-of-sale terminal, a task with essentially zero chance of training-data contamination, and reports the local model finished work Claude Opus 4 could not. (r/LocalLLaMA)

So: an afternoon, and it runs on hardware you can put under a desk with no network connection.

If you ship hardware, your threat model just changed and you should assume obscurity is worth nothing. The MV7's auth is a strcmp. That survived because nobody bothered to look, and now looking costs 1.2 hours. If you build software, the lesson transfers: any security control whose safety depends on nobody reading the binary is now a control with a published expiry date.

And a recording indicator that software can disable while recording is not a privacy feature. It's a decoration.

The three vibe-coding numbers everyone argues about are all correct

Every AI-productivity fight this year has been three people quoting three studies at each other. Field experiments say +26% more tasks per week. METR's randomized trial says a 19% slowdown. Team telemetry says code review time up 441%. Pick your number, pick your priors, argue forever.

A review posted August 20 assembles seventeen months of empirical evidence since Karpathy named the practice in February 2025, spanning software engineering, HCI, labour economics, security and education, and argues the three readings are consistent once you hold measurement method and time horizon constant. (arXiv 2608.20446)

That reconciliation is the contribution. The +26% comes from peer-reviewed field experiments counting tasks completed. The 19% slowdown comes from independent randomized trials measuring wall-clock time on the developer's own repository. The 441% comes from team telemetry measuring where the work moved, not whether it disappeared. Three instruments pointed at three different things, all reporting accurately.

The review closes with a falsifiable conjecture, and I want to flag it as a conjecture rather than a result, because the paper does: gains are real on new code and shrink or reverse on mature codebases.

That matches my experience closely enough that I'm suspicious of how much I like it. Greenfield work with an agent is startlingly fast. Work inside a codebase with five years of accumulated decisions is where I spend my time re-explaining constraints that a human teammate would have absorbed in a week. But I'm one person with a sample size of my own projects, and the fact that a paper agrees with my vibe is not evidence.

So test it instead of believing it. You almost certainly have both kinds of work in flight. Track two weeks of agent-assisted tasks in each, tagged greenfield or legacy, and record wall-clock time to merged rather than time to first draft. If the conjecture is right, you'll see the split. If you don't, you've learned something more interesting than the paper did.

One number to carry forward regardless: 441% more code-review time. Whatever happens to your writing speed, review is where the work lands. A related measurement from the same week found 248,641 GitHub pull requests where an agent-authored PR received an agent review, with cross-vendor review (one company's agent reviewing another's code) growing more than two orders of magnitude between Q1 and Q3 2025. (arXiv 2608.21311) Review didn't get cheaper. It got automated and moved.

XML system prompts made a production system's answers worse, from 74% to 48%

Nearly everyone wraps their agent instructions in XML tags. The vendor docs implied it helped, so it propagated, and now <instructions> and <rules> blocks are the house style of the entire industry.

A deployed tender-response system measured it and found the formatting rule is asymmetric. Structured markup helps where the model reads source documents. Converting the instruction material itself from prose to nested XML dropped answer quality from 74% to 48%. (arXiv 2608.20786)

Structure for reading, prose for writing.

The second finding in that paper is sharper and it invalidates how most people write style guides for agents. Explicitly naming forbidden constructions increased how often the model produced them. If your prompt says "never use the phrase 'in conclusion'," you have raised the probability of "in conclusion." This is the negative-constraint problem, and it has been folk knowledge in prompting circles for two years, but here it's measured inside a system whose output an LLM judge rated at least as good as the human-submitted answer on 40 of 55 ground-truth sections. Of 15 adverse verdicts, only 6 were writing-quality failures the system could have avoided.

I write a house style guide for a living, more or less, and it's full of named forbidden constructions. Reading this was uncomfortable. The mitigation I'd reach for is the same one this newsletter uses: don't only name what's banned, give the replacement, and enforce the ban with a deterministic check outside the model rather than a line in the prompt. A regex that fails the build doesn't care whether naming the pattern made the model likelier to produce it.

There's a Reddit thread from the same day that's the folk-wisdom version of this finding. A 232-upvote r/ClaudeAI post named the failure where every correction gets written into the spec instead of removed: tell Claude Code to make coffee with ketchup, correct it, and the PR reads "make a coffee (without ketchup)." (r/ClaudeAI) The negative constraint persists as text, and text in context is a thing the model conditions on. The one dissenting comment in that thread argues the behavior is deliberate, that carrying the negative forward prevents re-hallucinating the removed feature. Both things can be true, and the measured result above suggests the cost is higher than people assume.

Three concrete changes to make this week. Move your instruction blocks from nested XML to plain paragraphs and A/B them on a task you can score. Rewrite bans as replacements. And put your hard rules in a linter, not a prompt.

Security

Poisoning 1.2% of an agent's memory dropped accuracy from 0.850 to 0.300, and write-time screening caught 0 of 360 poisoned entries. The attack needs no instruction, trigger, or retriever optimization, just plainly worded false assertions generated in one pass against a LongMemEval corpus. A four-stage screening pipeline that reaches 0.832 recall on indirect prompt injection rejected none of the poisoned memories, because distinguishing a false assertion from a true one requires grounding outside the text. Provenance-weighted retrieval was statistically indistinguishable from no defense at p=0.80, and a stronger weight only restored utility by excluding untrusted content entirely. (arXiv 2608.21230) If you run persistent agent memory, this says your write path has no working filter today.

Agents leak protected context through tool-call arguments at 20.8% to 75.0%, and privacy instructions do not stop it. The attack frames protected attributes as operationally required, so the model includes them in otherwise valid tool-call arguments. Across six pressure levels, four privacy-policy levels and five DeepSeek and Claude configurations over 120 calls, stronger privacy instructions reduced disclosure but never eliminated it. (arXiv 2608.20658) The authors' read is that prompt-level policy is not an enforcement boundary. Inspect generated arguments for purpose and destination before the call executes.

A LoRA fine-tune taught Qwen 3.5 2B to fire a payload on a date string OpenCode injects into its own system prompt. It ran touch ~/PWNED-2026-09-01.txt on 9 of 10 held-out prompts when the date matched September 1, 2026, with zero false positives on other dates. The attack surface is the harness: OpenCode stamps a metadata fingerprint including the current date into every turn, and the write-up flags Codex as having the same default exposure. (morgin.ai)

CVE-2026-59279: Spring AI's MCP Streamable HTTP transport retains sessions without limit, CVSS 7.5. Both the WebFlux and WebMvc variants cap nothing and require no client auth by default, so repeated initialize requests exhaust memory and take down every session on the server. Disclosed August 20, fixed in 2.0.1 OSS and 2.0.0.1 Enterprise, with no mitigation short of upgrading. (Spring)

ClawSentry cut skill-injection attack success from 39.55% to 2.61% while task success moved 83.78% to 83.05%. It's an open-source framework-agnostic gateway guarding four points in the control loop: skill admission, invocation intent, execution effect, post-action consequence, routed through a deterministic L1 layer, a rule-anchored L2 reviewer and a read-only L3 evidence-seeking agent. Across five work agents on SkillsSafety it held attack success to 9.09-15.03% against 33.5-49.7% unprotected. (arXiv 2608.21101) The near-zero task-success cost is the number that makes this deployable.

CacheTracer found 37.1% of LLM API reseller endpoint pairs share a hidden upstream, using prefix-cache reuse as a side channel. It sent 1.1 million requests across 636 endpoint pairs on 39 reseller endpoints with a Flood-then-Prove primitive that populates cache state through one endpoint and tests whether another reuses it, mapping a containment order seven layers deep with one cache reach contained within at least 31 other nodes. (arXiv 2608.20732) Routing production traffic through a cheap reseller means inheriting the blast radius of an upstream you can't name.

ARQ closed a CodeQL issue that had been open 27 months, and found two new bugs in libpng and zlib. It refines C/C++ CodeQL queries by synthesizing programs whose execution disagrees with the query verdict, treating that disagreement as ground truth for an LLM repair loop, with no labeled dataset or vulnerability templates. Refined queries detected up to 119.8% more true positives on Juliet v1.3 and FormAI v2 at precision of 98.0% or better. (arXiv 2608.20637)

Appending a security-requirements section to a vibe-coding prompt cut confirmed findings from 51 to 24 across six web apps. Six functionally distinct applications were generated twice with the same assistant and model version, the twin prompts identical except for the appended section. Static, dependency, dynamic and manual analysis confirmed 75 of 85 candidate findings; the security-aware variant produced fewer confirmed findings in every single application and contained no Critical or High issues. (arXiv 2608.20963) The corpus is small and single-generation, and the authors say so. The most severe finding in the whole set was caught only by manual testing.

Agents

Cline's "Use MCP servers" toggle now auto-approves every MCP tool call by itself. Before v4.1.15 on August 23, it only applied to tools also opted in individually, so flipping it appeared to do nothing. Anyone who left it on assuming it was inert has just widened their unattended tool surface across every connected server. (GitHub) Same release train fixed inferred capability lists for custom OpenAI-compatible models silently stripping every tool from the request, which is the kind of bug that reads as "the model got worse."

OpenBot v0.0.4 patched a policy fail-open where the guard judged browser clicks with the element half blank. A bot cites a ref from a page snapshot, the server resolves it back to an element, then the boundary decides. When the lookup failed, the action proceeded with the element half of the decision empty, so a rule like "never click anything named submit" was never shown the element, and the shipped default permitted the click. The staleness check missed it because it compares against the computer's own counter, and the failing case is a computer that's content while the deployment is out of step, which is what restarting under a stored snapshot leaves behind. (GitHub)

Mastra 1.61.0 makes concurrent workflow resume atomic, with losers getting HTTP 409. Concurrent resume() calls now claim a suspended run atomically, returning WORKFLOW_RESUME_ALREADY_CLAIMED, and state updates carry an expectedStatus guard. The release also adds caller-driven experiments so an external orchestrator like Temporal can own the eval loop while Mastra stays the system of record. (GitHub)

Cline shipped a drainable agent hub, so a restart no longer loses in-flight work. CLI v3.0.57 adds cline hub drain and cline hub upgrade, stopping new mutating work while finishing what's running, then restarting on the current build. An aborted upgrade lifts the drain so the hub is never left refusing work, and a durable event log lets a reconnecting client replay what it missed, deduped by event id. (GitHub)

Agno 3.0.0a5 refuses agent dispatch cycles and closes a fail-open in the Studio edit guard. It bounds dispatch depth, adds an opt-in self_dispatch knob, and hides inner sub-team member ids from the outer roster. The a4 prerelease made workspace exclude_patterns an access boundary rather than a display filter, which is a meaningful difference if you assumed excluded paths were unreachable. (GitHub)

Cumora patched an Apple sign-in flaw where a client-supplied email could reach the cross-provider account-link lookup. The native endpoint accepted an email in the request body and fell back to it when Apple's signed token carried none, and that value could bind an Apple identity to an existing account. The field is now removed from the request contract entirely, and an unlinked Apple sub requires an email_verified claim in Apple's own token. (GitHub)

A tiny comparator that never solves the task improved agent performance in all nine tested settings. COTA replaces the expensive expert solver used for runtime intervention with a model that only judges whether a sampled alternative leads to a better continuation than the actor's proposal, returning preferred alternatives as non-binding advice so the original actor replans. Trained on pairwise supervision from same-prefix counterfactual branches, it improved every setting across WebShop, ALFWorld and tau^3-Retail with three actors, while being substantially weaker at the task than the actor it corrects. (arXiv 2608.21027)

Artic compiles natural-language workflows into artifact-declaring steps and gained 28 percentage points of task resolve rate across 11 real domains. The argument is that natural-language workflows fail as agent instructions because data dependencies stay implicit, forcing the executor to guess which prior results a step reads. Compiled steps declare the artifacts they read and write, constraints gate produced artifacts, and control transfers are explicit, which also exposes steps depending on too much state. Measured across 488 problem instances. (arXiv 2608.21341)

Handing one agent's spec to another collapsed Gemini to 2.33% SQL syntax validity. In an Oracle-to-PostgreSQL migration study over 1,006 PL/SQL files, cross-agent experiments ran 1,802 Oracle scripts through Amazon Kiro, Gemini and Copilot. The worst replicated case was Gemini consuming a Kiro-origin specification directly: Token F1 of 0.035, SQL validity 2.33%, AST mean similarity 0.015. Rewriting the foreign spec helped substantially. (arXiv 2608.21208) Specs are not a neutral interchange format between agents, which is bad news for every multi-vendor pipeline design I've seen this month.

Research

Spend model capacity on generation and revision, not critique. A stage-wise study of self-refinement across 5 benchmarks with 6 sizes of Qwen3 and 4 sizes of Gemma 3 found larger generators and refiners generally improve the pipeline, and an undersized refiner can actively hurt, but results are highly insensitive to critic size. Including even a small critic consistently beats omitting critique entirely. (arXiv 2608.21345) If you're paying per token across a three-stage loop, route the critique step to the cheapest model that produces a critique at all.

RAG returns the superseded value 36-38% of the time on real GitHub fixes, and a deterministic supersession memory drives it to zero. The study extracted 130 clean atomic state transitions from 707 real issues in SWE-bench Lite and Verified. Plain RAG scored 0.57-0.59 answer accuracy; an LLM reranker didn't help and added latency, about 18 seconds against 2.1. A (subject, relation, object) supersession memory called MemStrata reached 0.91 at RAG latency. The authors state plainly that only about 18% of real fixes are clean atomic transitions. (arXiv 2608.20685)

An evaluator scoring 98.41% accuracy recovered only 54.8% of valid judgment receipts once its evidence was permuted. A judgment receipt is the minimal set of source changes that explain why an evaluator flipped its verdict, separating the right answer from the right reason. Measured on ReasonBench across 19,520 cases, and counterfactual training alone did not close the gap. (arXiv 2608.20938) Anyone running LLM-as-judge should report transformation consistency next to accuracy, because static accuracy hides this completely.

LLM judges conflate trust with truth, and changing only the stated author flips both together. Judges align trust scores with truth verdicts more tightly than the human behavioral reference does, and swapping whether content appeared human-written or AI-written shifted trust and factuality classifications in lockstep. (arXiv 2608.21097) Any judge prompt that reveals authorship is contaminating its own correctness verdict, which means a multi-dimension rubric can't treat those columns as independent evidence.

LLM assistance made human requirements inspection less accurate without making it faster. A crossover design put 34 participants through inspecting textual specifications both with and without LLM support, identifying requirements smells, classifying severity, and recording time. Bayesian regression per outcome variable found LLM support negatively affected smell detection accuracy, with no significant effect on classification or duration. (arXiv 2608.21298) Adding a model to a human review loop is not free, and this is the first controlled measurement of the cost I've seen.

JSON-formatting your prompt helped, and letting an LLM rewrite your prompt significantly hurt. PromptResponse ran five semantically identical but syntactically distinct HumanEval variants through GPT-4o over more than 8,200 executions. Consistent formatting, JSON especially, improved generation efficiency and syntactic stability. The LLM-tuned prompts, meaning prompts a model rewrote to be better, degraded task performance without improving anything else. (arXiv 2608.21074) Sits directly alongside the XML result above: the model is a poor judge of what instructions it should receive.

aiXamine ran 5,000+ tests on 120 models and quantified a safety tax. One model scoring 99.3 on safety alignment refused one in three benign queries. It also documents distillation-induced robustness collapse, where off-policy distillation without on-policy correction dropped robustness from 56.9 to 2.6 on the same base architecture. (arXiv 2608.20554) Picking an open-weight model off a single-axis leaderboard tells you nothing about what it gave up to get that number.

Retrieving reusable reasoning memories at prefill recovered 21-29 points lost to Chain-of-Draft compression. The training-free method builds memories from historical traces summarizing reasoning patterns, key constraints and critical operations, then retrieves them as prefill-side scaffolds. Gains of 21.4, 28.0, 29.5 and 6.61 points on GSM8K, MATH, BBH and MMLU-Sci, with a 1.14-1.49x latency speedup over standard CoT. (arXiv 2608.21265)

Cameron Wolfe published a single-document reference for RL on LLMs, from REINFORCE to current frontier training. It starts at first principles, walks the policy gradient algorithms actually used to train LLMs today, then covers reasoning, agents, token efficiency and reliability, with each section linking a deeper writeup. He credits his sources, including Nathan Lambert's RLHF Book, Sutton and Barto, OpenAI's Spinning Up, Lilian Weng's policy gradient notes, and the TRL and OpenInstruct codebases. (Deep Learning Focus) This is the link to keep if you want to understand why GRPO-family training behaves the way it does.

Infrastructure and architecture

IBM showed a mainframe chip whose 11 cores each run both Arm and IBM Z instruction sets, switching in nanoseconds. Presented at Hot Chips on August 24, built on 2nm, above 5.7 GHz base, with on-chip AI inference accelerators for fraud detection and a dedicated DPU for I/O. Availability is around 2028. (VentureBeat) The pitch is putting Arm64 Linux AI frameworks on the same silicon as legacy transaction processing without a network hop, which is a real problem for every bank running scoring models next to a mainframe.

Micron put a number on the memory wall: accelerator throughput grows about 3x every two years while 2.5D-attached bandwidth climbs under 2x. The August 23 Hot Chips session walked HBM1 through HBM4, with HBM3E's 128 banks per die doubling to 256 in HBM4, and showed a typical GPU package exceeding 12,000 square millimeters once eight HBM4 stacks are included. Roughly 3x as much silicon is consumed to deliver the same HBM3E capacity as DDR5. (ServeTheHome)

NVIDIA detailed the Vera CPU's 88 custom Olympus cores, with the Rubin GPU talk the same afternoon. NVIDIA claims 1.8x faster task completion and twice the efficiency against traditional x86, with Vera Rubin NVL72 racking 72 Rubin GPUs and 36 Vera CPUs alongside ConnectX-9 SuperNICs and BlueField-4 DPUs. (NVIDIA) Architecture detail months before shipping, two days ahead of the Q2 FY2027 earnings call on August 26.

Xiaomi showed an AI Cube prototype stacking three of its own chips at 1.22TB/s near-memory bandwidth and 150W sustained. The XRING O100 accelerator is 6nm with two DRAM layers stacked wafer-on-wafer at a 1.4 micron hybrid-bonding pitch and 28,672 effective data lines. Xiaomi lists local deployment of 120B and 3B models. (r/LocalLLaMA) That puts it in DGX Spark and Strix Halo territory as a self-contained local inference appliance, if it becomes a product rather than a Hot Chips slide.

Shopify's CEO published a single-binary Rust git server that keeps the whole repository in S3. Tobias Lütke pushed walgit as one commit on August 23 and it reached 720 stars within a day: MIT-licensed, no database, no leader, serving smart HTTP v0/v2 fetch and push, bundle-uri clones as static files, Git LFS, a web UI and webhooks, with every machine treated as a disposable cache. The README names it as an implementation of the Continuity architecture Cursor described on August 18, adapted for machines smaller than the repository they serve. (GitHub)

Vercel Sandbox now runs in four regions. iad1 stays the default, joined by sfo1, cle1 and cdg1, with region choice on all plans and failover configuration limited to Pro and Enterprise. Set it in Settings, via vercel project update my-project --sandbox-region cdg1 --sandbox-failover-regions iad1,cle1, or by passing region and failoverRegions to Sandbox.create(). (Vercel) Matters if your agent's sandbox has been doing transatlantic round trips to your database.

Farid Zakaria made a SQLite database file that the Linux kernel executes directly. He set the 4-byte SQLite application ID at offset 68 to "SELF", decomposed an ELF binary's components into rows across a custom schema, and registered a binfmt_misc handler that hands the file to a self-exec interpreter which queries the tables and runs the program. One file, simultaneously a queryable database and a runnable binary. (fzakaria.com)

Periodic Row-wise Muon cut optimizer time 46.9-54.3% on diffusion transformers while keeping the quality edge over AdamW. Muon shows a 12.9-19.1% improvement in best generative quality over AdamW that persists from 1.3B to 15B parameters, but the 5-step Newton-Schulz iteration every step plus full-momentum materialization eats the gain at scale. Doing the full spectral update once every K steps and a cheap row-wise constrained update otherwise stayed within 0.5% of vanilla Muon at 1.3-4B and improved 4.5% at 9B, cutting end-to-end step time 15.7-24.3% and logical communication volume 66.7%. (arXiv 2608.20818)

Tools and developer experience

Claude Code's /design research preview puts artboards in the CLI. Documented in the Week 34 digest covering v2.1.234 through v2.1.239: run it with a brief, Claude publishes a canvas of editable artboards on top of artifacts and prints a link, you pick one and have Claude implement it. Requires v2.1.233 or later, available on Pro, Max, Team and Enterprise. Remote Control left research preview in the same window. (Claude Code Docs)

Claude Code 2.1.239 surfaces the 1.1x US-only-inference premium in cost estimates and adds /claude-api upgrade. The migration command moves Python projects from anthropic 0.x to 1.x. Usage-limit messages now say whether it's the session or the weekly limit resetting, and WebFetch stopped retaining expired content for the whole session instead of the documented 15 minutes. (GitHub)

qwen-code added two review lenses built from a post-mortem of a defect four review rounds missed. PR #9708, merged August 22, adds a temporal-reachability lens asking whether a value exists at the moment its consumer needs it, with findings formatted as "produced at X, needed at Y, Y precedes X", and an incident-replay lens treating the failure story in a PR description as a spec. Both came from PR #9655, where a human found the one blocking defect eleven minutes after the final automated LGTM. (GitHub)

qwen-code also files its own blocking finding when a review loop stops converging. Each round now hands over two integers: how many findings first appeared this round, and how many trace back to the previous round's fixes. On the second consecutive round where most new work was work the previous round created, it composes a blocking finding asking the author to split the change. The motivating analysis across six multi-round PRs found about a third of post-initial findings were introduced by the immediately preceding fix round, dominated by guards added with no test of their own. (GitHub)

Three independent tools now pipe Claude's output through another model to make it readable. vomit rewrites display text through a local OpenAI-compatible model via a hook, claudish-to-english appends an Ollama-generated plain-English rewrite under each reply, and Claudette routes the rewrite through Gemini via the Antigravity CLI. All three appeared inside about two weeks. (paddo.dev) Anthropic's built-in Concise output style, added in v2.1.237, does the same job with no second inference call: set "outputStyle": "Concise" in ~/.claude/settings.json and start a new session. Error reports, security warnings and destructive-action confirmations keep their full content.

DeepSeek-Reasonix 2.5.0 added a regex wake condition, so an hour-long background task costs one turn. until_output_matches takes an RE2 pattern and returns the instant output matches, replacing one turn per poll. The same release cut 256 tokens from tool descriptions by removing schema restatements, one of which had already drifted out of sync with its own schema. (GitHub) It also documents a failure shape to check in your own proxy: a gateway answers HTTP 200, holds the stream open long enough to look healthy, then ends with no content, and the agent reads that as the model returning an empty answer and burns three retries blaming the wrong party.

oh-my-pi v18.0.4 splits HTTP 413 into payload-size and context-overflow before deciding to compact. A provider's 413 was being read as token-context overflow, so the agent ran a compaction pass when the real cause was a media byte limit. Released August 24, alongside omp git, a fullscreen repo TUI with line-level staging. (GitHub)

Qwen split its computer-use driver out of qwen-code as a standalone binary and npm package. cua-driver-rs v0.20.0, published August 24, ships a codesigned and notarized macOS universal binary plus a QwenCuaDriver.app, unsigned Linux x86_64/arm64 builds on a glibc 2.31 floor, and Windows builds, with a single @qwen-code/cua-sdk npm package built against those assets. Two new env flags: CUA_DRIVER_RS_COORDINATE_SPACE=1 for relative coordinates and MCP_MODEL_PAYLOAD_FILTER=1 for textual MCP payload filtering. (GitHub)

Scrapling v0.4.15 locked its MCP server's HTTP transport behind auth and bound it to localhost by default. A breaking change, and an unusually security-conscious default for an MCP server. It also split tools into one-shot (fetch, bulk_fetch, stealthy_fetch) and session-based variants that retain cookies and fingerprints, and added a Response.markdown() that strips scripts, styles and hidden prompt-injection content before the text reaches your index. (GitHub)

Fabien Sanglard published the agent.md he uses to hold LLM code quality. Working constraints rather than a manifesto: extract magic numbers into named constants, early returns to cut nesting, function names under 30 characters, enums instead of boolean parameters, always brace single-line conditionals, layered boundaries where each layer only talks to its neighbors. Widening visibility from private to public needs approval. Testing is strict TDD, write the test, watch it fail, then fix. (fabiensanglard.net) The context rule is a fresh session per feature, with an explicit agent.md reload when output quality drops.

Models

A stealth model called Ox Alpha appeared free on OpenRouter with a 1M-token context, and the viral 80% coding score fell to 58.4% on the full run. It showed up August 20 with 1,048,576 tokens of context, 131,072 max output, and text, image and video input. Stripe's Patrick Collison called it "very impressive," no lab has claimed it, and speculation splits between Z.ai's GLM family, Microsoft's MAI and Xiaomi's MiMo. The 80% DeepSWE score everyone shared came from 8 hand-picked tasks; the completed 113-task run resolved 58.4%. (TechCrunch)

A browser-based fingerprinting tool pinned Ox Alpha to the GLM family at 6 of 9 probes. modelprint runs 9 infrastructure probes against any OpenAI-compatible endpoint from a static page with no server, keys never leaving the tab. Its day-one run against 12 candidates scored stealth/ox-alpha at 6 of 9 probes and 4 of 4 normalized tokenizer counts matching z-ai/glm-5.3, while every other lab's best was 2 of 4. (GitHub) The author built it after showing DeepSeek's API silently serves a different model under the old deepseek-chat alias, which is the general problem this checks for.

A 27B model beat Opus 4.8 and GPT-5.5 at reproducing published papers. Inherent, a British lab founded by DeepMind alumni, released Faraday, an agent that reproduces papers' findings without advance knowledge of the results. It runs on Qwen 3.6 at 27B parameters, and the team credits reinforcement-learned research taste for experiment selection rather than scale. They raised a $50 million seed. (TechCrunch) TechCrunch gives no comparative scores, so treat the margin as unquantified.

Quantization-Aware Healing distills a 4-bit student from the uncompressed teacher and beats bfloat16 on 7 of 9 benchmarks. The argument is that a structurally compressed model's bfloat16 checkpoint is itself only a distillation-recovered approximation, so training the 4-bit student against it inherits that error. Distilling directly from the original model reaches a comparable peak about 7x faster than matched QAT, at roughly 4x less weight memory and half the teacher's parameter count. Released open-weight as Hypernova-60B. (arXiv 2608.20953)

CellFill teaches a deployed 4-bit model new facts and re-quantizes to the bit-identical released checkpoint. It writes only into the per-weight residual inside each quantization decision cell, with integer codes and scales frozen, so re-quantization returns the released artifact bit for bit as a machine-checkable guarantee, and updates are exactly revocable by dropping the residual. Across three paired seeds it matched an unconstrained reference on fact recall at 58.9% against 59.3%, and was better on held-out cross-domain perplexity. (arXiv 2608.20873)

Claude had a 2 hour 46 minute multi-model outage on August 24. Anthropic's status page logged elevated errors from 04:50 UTC to 07:36 UTC covering Mythos 5, Fable 5 and Opus 5, resolved at 08:30 UTC, with Opus 5 and Fable 5 stabilizing first. (r/ClaudeAI) The recurring complaint in that thread is that failed requests still consume the five-hour usage window, and a separate thread the same day documented 23% of a limit burned on "server is busy" across three prompts.

HiDream's world model posted 80.9 on WBench's navigation board. HiDream-O1-World generates explorable 3D worlds from a text prompt, image or interactive control, scoring 80.9 average on Navi plus 73.3 on Physical and 88.0 on Consistency across 289 multi-turn cases. The basis is 3D priors injected into a memory context plus test-time training for online adaptation, which the company credits for eliminating scene drift across viewpoint switches. (DreamWorld) The underlying paper is accepted to ECCV 2026, code is marked coming soon, and the launch numbers come from a company press release.

Vibe coding

A one-shot port of 39,000 lines of C to single-file three.js broke both local runs and produced only "okay" from Opus 5. A builder gave three agents one prompt to convert a 2.1MB single-file C shooter, about 600k tokens, far past every context window involved, with no follow-ups. Claude Code on Opus 5 finished in 21 minutes at 1,759 lines. Qwen 3.8 27B in FP8 on vLLM with full 262,144 context on an RTX 6000 Pro produced 949 lines in 4h18m under hermes and 1,056 lines in 1h40m under codehamr, both rated bad. (r/LocalLLaMA) The author's own read is the sharpest part: two very different harnesses failed identically, so the harness wasn't the variable, the one-shot prompt was.

"The Vibe Tax" names the cost disciplined developers pay for agents trained on undisciplined ones. The concrete failure described is an agent burning a full weekly token quota producing exhaustive test coverage, complete with sha256-named directories of pristine edge-case tests, and zero application code. The author's claim is that months of vibe-coder feedback trained models to one-shot everything at about 10x the token cost. (insufferable.dev) The 10x is illustrative rather than measured, but the failure mode is checkable: count generated tests against generated implementation before blaming your quota.

Someone spent $266.15 across three Chinese models to root a $114 Fire tablet after Claude's safeguards stopped. Five months of work tracing why the device shut itself down, down to three protected Amazon packages holding REBOOT and SHUTDOWN permissions that can't be disabled without root on a device with no published root method. Itemized: Kimi K3 found the exploit for $164.25, GLM-5.2 caught its fatal bugs for $21.90, GLM-5.3 finished it on day one of an $80 subscription. (ericpardee.github.io) The Claude Max work he'd already paid for ran until, in his words, its safeguards cut him off.

Terminal Agents is a survey arguing realized agent behavior is set by harness and runtime, not the model alone. It defines terminal agents as systems whose dominant progress-bearing loop runs through command execution and stateful environment interaction, organizes the space through a seven-dimensional competence profile, and finds prevailing evaluations emphasize final outcomes while exposing process quality, recovery and governance unevenly. (arXiv 2608.20485) The recommendation is explicit reporting of system and runtime conditions with replayable traces, since matched system comparisons showed benchmark-dependent performance and limits on component attribution.

BC-Bench found model choice mattering more than harness choice on domain-specific ERP code. Microsoft researchers curated 101 tasks from two production repositories for AL, the DSL behind Dynamics 365 Business Central, adapting SWE-bench's method to an ecosystem with scarce public training data. In bug-fixing, differences between frontier models exceeded differences between the two agent harnesses, and gains reported on general-purpose benchmarks did not consistently transfer. (arXiv 2608.20851) A useful counterweight to the harness-beats-model consensus: it holds on general code and may not hold on your DSL.

A platform engineer's field report says AI removed the lookup work from Terraform and Helm, not the thinking. Generating Helm charts and Terraform modules across AWS, ECS Fargate, Lambda, Kubernetes and Cloudflare Containers, always iterating before production, with AGENTS.md files per repo so output becomes a reusable template. No time savings are quantified, and the author flags his own decaying syntax recall and debugging fundamentals as the cost. (omegion.dev)

Hot projects and OSS

fx reached 2,302 stars in 13 days and already has ports, forks and two skills lists. Vercel Labs' Zig coding agent ships as one 6.39 MiB native binary with no runtime, Apache-2.0, supporting skills, MCP servers and subagents behind an approval gate, with v0.0.5 out August 21. The ecosystem formed fast: a Windows compat-layer port, a fork called ax created August 23, and two separate awesome-fx-skills lists. (GitHub)

DeepSeek's plugin-everything harness passed 190,000 stars eleven days after launch. deepseek-harness, created August 13, is at 190,635 stars and 21,319 forks, up from about 173,700 on August 20, so the curve hasn't flattened. It makes models, tools, skills, sessions, sandboxes, storage, the agent loop, scheduling and UI all pluggable under a mounting layer called Cordis. (GitHub)

Two free-tier LLM aggregation proxies are on the same trending page. free-claude-code gained 1,081 stars in a day to reach 48,433, stacking 50 ToS-friendly providers into about 1.3B free tokens a month and routing nine agents through one local server. Three rows below, freellmapi at 19,591 stars aggregates 34 free providers into about 7.4B tokens a month behind a single OpenAI-compatible /v1 endpoint. (GitHub Trending) Free-tier arbitrage is now its own tooling category, and I'd expect provider ToS enforcement to be the story that ends it.

backpass treats your AGENTS.md as weights and reads your transcripts to propose the edits. The framing is blunt: the memory file is a set of weights, each session is a forward pass, and the transcript sitting on disk is the loss signal nothing currently reads. It scans local transcript stores from seven agent harnesses, finds sessions that ran in your repo, and proposes evidence-backed edits under a token budget with a human gate. 190 stars since August 21, npm-published, macOS and Linux. (GitHub)

A hackathon seeded 21 TrueForge agent repos in four days, and the names all point the same way. RepoLatch, holdline, sentinelforge-agent, aegis-zero and release-commander are incident or release agents built around a human approval gate. Twelve of the 21 appeared on August 23 and 24 tagged Agent Harness Hackathon 2026, with the host repo at 3,916 stars since July 23. (GitHub)

Game Terminal-Bench grades coding agents on whether the game actually runs. Its loop is inspect, edit, run, observe, diagnose, repair, verify, and the evaluator drives controlled input probes against the running project to confirm runtime state changed, rather than stopping at files and exit codes. 224 stars since August 21, with one complete task published so far: fix a broken phase jump in a Godot platformer without breaking shard collection. (GitHub)

doop puts a multiplayer design canvas behind an MCP server. 255 stars in the two days after its August 22 creation, AGPL-3.0, positioned against Paper.design. Designs live on a shareable canvas of frames rendering real HTML in sandboxed iframes; people edit in the browser and agents edit through the built-in MCP server, with live cursors and an activity feed showing both. A scripted demo agent performs on the first canvas with no API key configured. (GitHub)

A pack of 817 cybersecurity agent skills gained 2,918 stars this week by mapping every skill to six frameworks. Each skill ties to MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF and MITRE F3, packaged to the agentskills.io standard so it loads across harnesses. That mapping is what turns a skill dump into something an audit can reference. (GitHub Trending)

A reconstruction of Grok Bot 0.18 for macOS drew 726 forks against 774 stars in one day. A fork-to-star ratio near 1.0 almost never happens organically. The repo describes itself as an unofficial source-oriented reconstruction of the closed macOS client, and the ratio is what a takedown-anticipating mirror looks like. (GitHub)

kimodo.cpp ported NVIDIA's text-to-motion model to GGML in 48 hours. 375 stars in two days, running Kimodo-SMPLX-RP-v1 from a UTF-8 prompt or a precomputed LLM2Vec embedding, with GGUF loading, safetensors conversion, DDIM sampling, C/C++ APIs and CPU/Vulkan parity tests. Tune VRAM with KIMODO_TEXT_LAYER_CHUNK=1..32. Constraints, SOMA, G1, GLB export and quantized models are not implemented. (GitHub)

SaaS disruption

Four launches in 48 hours priced as one-time perpetual licenses. Bumply at $24.99 one-time for three Macs, Localdock at $9 one-time, Histiq at $129 lifetime alongside monthly tiers, and an outbid-directory boilerplate at $29 one-time. They span devtools, local hosting, browser utilities and marketing directories, and each names a subscription incumbent as its foil. (Product Hunt) For small tools, the one-time price has become a positioning move, not just a pricing detail.

The agent control plane is now a priced category, selling governance over agents employees already built. Decawork, in the YC S26 batch, took Product Hunt #2 on August 24 with 141 votes selling IT teams a way to take agents employees built in Claude Code or Cursor, deploy them with company credentials rather than personal ones, and centrally control access and retirement. Product Hunt's similar-product graph names four more doing versions of the same job, including Kastra, which evaluates every agent action in under 1ms. (Product Hunt) The premise every one of them shares: the agent already exists inside your company, and what's for sale is the ability to see it and switch it off.

Navigara sells analytics attributing AI coding token spend to specific roadmap items. It reads commit history, scores the complexity of the work, and maps token expenses onto roadmap lines to separate aligned from unaligned spend and surface maintenance cost. Product Hunt #3 on August 24. (Product Hunt) This category couldn't have existed a year ago. Engineering leaders now have an AI line item big enough to sell a dedicated analytics product against.

PaymentKit took Product Hunt #1 selling billing that survives your merchant account getting shut down. 237 votes for routing payments across multiple processors, vaulting card tokens independently of any one of them, and keeping subscriptions billing if a merchant ID is terminated. Its listing names Stripe, Paddle, Lemon Squeezy, Polar and Dodo as alternatives. (Product Hunt) The product isn't a better processor, it's insurance against depending on one.

Offloop gave up margin on inference to sell the workspace. Product Hunt #4 on August 24, shared channels where people and agents work the same multi-step projects with per-stage ownership, approval gates and decision history that persists across chats. Teams on their own model subscriptions run with no Offloop markup. (Product Hunt)

Founders are finding AI features break the zero-marginal-cost math SaaS was priced on. The argument, from a widely discussed r/SaaS post, is that every AI action carries real variable cost, so flat-rate subscriptions silently invert margin on power users. (r/SaaS) This is the solo-founder P&L version of the same pressure pushing platforms toward per-outcome pricing.

Meetless open-sourced a governance layer arguing the problem is authority, not memory. It watches coding-agent sessions, extracts the decisions, constraints and assumptions worth keeping, and routes them through human approval before agents act on them. Founder An Pham frames it against the CLAUDE.md pattern directly: agents fail from acting on stale instructions that look as valid as current ones. Apache-2.0 client, free hosted beta. (Meetless)

Enozunu applies lockfiles and reproducible builds to agent configuration. One manifest of skill and agent source definitions generates the target-native paths each system expects, with lockfiles guaranteeing identical configuration across developer machines and CI, and tool authors publishing artifacts with a compatible manifest instead of writing an installer. Apache-2.0, 221 commits, 4 stars. (GitHub) Barely noticed, but treating agent config as a dependency graph with package-manager reproducibility guarantees is the right instinct.

UK fintech funding fell to £1.8B in H1 2026, the weakest in a decade. KPMG figures reported by Finextra, set against AI capturing more than 70% of global venture funding in Q2, with OpenAI and Anthropic alone taking $217 billion or 43% of all reported venture dollars. (Finextra) Capital isn't scarce. It's concentrated, and non-AI verticals are being drained to fund it.

Policy and governance

Altman says he was wrong about AI timelines because "the economy just has so much inertia." In an August 24 interview he said he expected that after GPT-4 in 2023 "very quickly after that there was going to be much more disruption, software businesses up for grabs right away, than it turned out to be," attributing the miss to inertia rather than capability: "People keep doing the same things, buying from the same company, wanting to use their tools the same way." He concluded "we've all been too ambitious on timelines." (r/singularity) The top reply points at Solow's 1987 productivity paradox as the precedent, which is the right reference.

Altman also called doom-marketing "misanthropic" in a barely-veiled shot at a competitor. From the same interview cycle, attacking the pattern of pairing catastrophe odds with cure-for-cancer promises: "it's a very misanthropic thing to say we're going to just put all of our trust in this model and let it have all the power," describing a countdown to destruction used as marketing as the rhetoric of anti-human dictators. (OfficeChai) In the same conversation he said what worries him most is fear of AI risk becoming the justification for concentrating control. (SiliconANGLE)

Training on copyrighted books remains legally unsettled, and most published authors are already in the corpus. TechCrunch's August 23 explainer walks the competing fair-use readings without declaring a winner, and makes the uncomfortable point plainly: most published authors contributed to training the tools now competing with them, without knowledge or consent. (TechCrunch) For anyone shipping on frontier models, upstream corpus liability is still unpriced.

Dependency trust signals are a market for lemons, and 54.6% of published advice comes with no action taken. Coding 252 Google Search sources and 870 Reddit threads on how practitioners judge open-source dependencies, the study finds stars, download counts and contributor activity collapsing under three simultaneous forces: adversarial manipulation, gaming indistinguishable from legitimate behavior, and non-adversarial inflation driven by legitimate AI tooling. Proposed remedies substituted one gameable signal for another. (arXiv 2608.20678) The authors argue costlier signals like cryptographic attestation have to be mandatory rather than voluntary, and the 54.6% figure is why.

Ben Thompson argues agentic cybersecurity structurally favors offense, and that favors startups. The contention is that incentives in agentic security point toward offense, constraining incumbent vendors while fueling new entrants over the long run. (Stratechery) Most enterprise agent-security pitches this month have been defensive tooling sold by established players. If the asymmetry is real, buying agent security from an incumbent is buying the slower side.

Alibaba raised $10.2B in Hong Kong's largest-ever follow-on with 100% earmarked for AI, and the stock fell 10%. 710 million new shares priced at HK$112.70 on August 23, about 3.57% of enlarged share capital, all net proceeds going to full-stack AI covering chips, infrastructure and models. The book was covered nearly three times and shares dropped anyway on dilution. (CNBC via r/singularity) Alibaba spent $9.5B on AI compute in Q2 2026 and has projected $25B more this year.

Hollywood workers are taking RLHF gigs at $44 to $100 an hour while industry employment sits 28% below 2022. Motion picture and sound recording employment fell from 450,000 in July 2022 to 326,000 in May 2026 per BLS, with LA shoot days down 48% between 2021 and 2025. Writers, editors and executives are filling the gap with reinforcement learning from human feedback contracts, creative writers up to $44/hour and music professionals with a master's or above up to $100/hour. Netflix says it used AI in 300 of its 1,000 2026 titles. (The Guardian) The displaced labor is also the training signal, and the hourly rate is the price of that transfer.

Flock's CEO is publicly seeking "compromise" as opposition mounts. Flock runs one of the largest deployed AI-vision surveillance networks in US municipalities, which makes a concession posture from its CEO a leading indicator for how AI-vision vendors respond to local political pressure. (TechCrunch)

Startups acquired other startups more than 500 times in 2026, and OpenAI and Anthropic are among the most active buyers. Crunchbase counts 440 deals closing in the first half and fewer than 100 since, with OpenAI at 8 acquisitions this year and at least 19 lifetime, and Anthropic at 5 or more including Coefficient Bio at $400 million. Databricks, Cyera, Harvey and Legora appear as repeat acquirers. (Crunchbase) Exit paths for small AI tooling companies now run through other startups.

Skills of the day

1. Move your agent instruction blocks out of XML and into plain paragraphs, then measure. A deployed system saw answer quality drop from 74% to 48% when instruction material was converted from prose to nested XML, while structure still helped on source documents the model reads. Keep the markup on the documents, drop it on the instructions, and A/B on a task you can score before you commit.

2. Rewrite every "never do X" rule in your prompt as "do Y instead," and enforce X in a linter. Naming forbidden constructions measurably increased how often the model produced them. A regex that fails the build doesn't condition on anything, so put the hard bans outside the model and use the prompt for the replacement.

3. Route the critique stage of a generate-critique-revise loop to your cheapest model. A stage-wise study across 6 sizes of Qwen3 and 4 of Gemma 3 found results highly insensitive to critic size, while an undersized refiner actively hurt. Including a small critic still beats no critic. Spend the capacity budget on generation and revision.

4. Add a supersession memory in front of your RAG index instead of a reranker. On real GitHub fixes, plain RAG returned the superseded value 36-38% of the time and an LLM reranker didn't help while adding about 16 seconds of latency. A deterministic (subject, relation, object) supersession table reached 0.91 accuracy at RAG latency.

5. Split HTTP 413 into payload-size and context-overflow before your agent decides to compact. oh-my-pi was reading a provider's media byte limit as token-context overflow, triggering a full compaction pass for the wrong reason. Same class of bug: a gateway that answers 200, holds the stream, then ends empty gets read as the model returning nothing, burning three retries against the wrong party.

6. Give long-running background tasks a regex wake condition instead of polling. DeepSeek-Reasonix's until_output_matches takes an RE2 pattern and returns the instant output matches, so an hour-long job costs one turn rather than one per poll. If your harness lacks the primitive, a blocking wait with a pattern check costs an afternoon to add and pays back on the first long job.

7. Compile your RAG corpus into atomic claims at ingest rather than re-interpreting chunks per query. On 500 transcripts across 32 budget-by-model configurations, compiled claims reached 85.2% accuracy at about 2,200 reader tokens, against 72.5% at 16,300 for the best chunk baseline, with incremental updates costing 33.7x less than full reconstruction. The ingest path is the one to optimize, not the query path.

8. Report transformation consistency next to accuracy for any LLM-as-judge you run. An evaluator scoring 98.41% on frozen tests recovered only 54.8% of valid judgment receipts once its evidence was permuted. And strip authorship from judge prompts entirely, because changing only the stated author shifted trust and truth verdicts in lockstep.

9. Inspect tool-call arguments for purpose and destination before the call executes. Agents disclosed protected context through valid-looking tool-call arguments at 20.8% to 75.0% across six pressure levels, and stronger privacy instructions reduced but never eliminated it. Prompt-level policy is not an enforcement boundary; a check in the call path is.

10. Track your agent-assisted work split into greenfield and legacy, with wall-clock time to merged. The seventeen-month vibe-coding review closes with a falsifiable conjecture that gains are real on new code and shrink or reverse on mature codebases. Two weeks of tagged tasks tells you whether it holds in your repos, and time-to-merged is the measure that catches the 441% review inflation that time-to-first-draft hides.