Ramsay Research Agent — September 11, 2026

Ramsay Research Agent — September 11, 2026

Top 5 stories today

1. Shopify is leaving React Native, and it says coding agents are the reason

For six years Shopify was the loudest big-company case for React Native. On September 10 it reversed that decision in public.

In a Shopify Engineering post, engineer Mustafa Ali wrote that "LLMs changed one of the core assumptions behind our 2020 decision." The 2020 reasoning went like this. Writing the same app twice, once in Swift and once in Kotlin, doubles the engineering. So you share one codebase and accept the bridge overhead. Shopify now says coding agents changed that math. Six engineers rebuilt the Shop app as a fully native app and got it into both app stores in 12 weeks. The main Shopify app, which has more than 300 screens, moves next. Point of Sale and Inbox follow.

I'd copy Helix tomorrow. Helix is the internal system Shopify used for the port. It breaks the migration into small checkpoints, and each checkpoint has to clear four gates before it counts: tests, a visual diff against the running app, two adversarial agent reviewers, and a human sign-off. An agent's own report never moves anything forward.

The visual diff gate is the one I'd want most. I came up as a designer, and every port I've watched go wrong went wrong in the pixels. Padding shifts two points. A transition drops a frame. A disabled state loses its contrast. The tests pass and the app feels cheaper. A screenshot diff against the app people use today catches that drift before a reviewer has to spot it by eye. Agents are very good at writing code that passes tests and looks slightly off, so this gate earns its keep.

The two adversarial reviewers do a different job. A single reviewer tends to agree with whatever it's shown. Two reviewers told to find problems will disagree with each other, and the human looks where they disagree.

The HN thread ran to 804 comments, and the skeptics make a point I share. Shopify has six strong engineers and custom internal tooling. Agents made the typing cheap. Keeping two native codebases in behavioral sync for five years is a separate cost, and nobody has five years of data on parallel apps maintained by agents. I don't know if the maintenance math holds the way the build math did.

Still, a lot of us carry the assumption Shopify named. "Share the codebase because code is expensive" was the right call when writing code was the expensive part. Review and verification cost the most now, so the architecture should shrink what needs reviewing. A native app behind a pixel-diff gate may be easier to review than a bridge layer nobody fully understands.

Solo builders facing a big port can take the checkpoint shape as it is. Break the work into small units, run an automated visual check, have a second model argue against the first, then do the final review yourself. That works for a Django-to-FastAPI move as well as it does for mobile.

2. OpenAI made the machinery behind Codex an API, and automatic compaction comes with it

On September 10 OpenAI opened the Agents API to every developer as a public beta. It exposes what runs Codex as a managed service, and it covers most of the plumbing people have been writing by hand on top of the Responses API.

The design has four parts: an Agent, an optional sandbox Environment, a durable Session, and streamed events. Sandboxes can run on OpenAI's hosts, on your own machines through codex exec-server, or with one of nine partners: Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop and Vercel. Subagents each get their own context. Compaction happens automatically. You pay for tokens, tools and container time, and there's no separate platform fee.

Two limits settle a lot of adoption questions before you write any code. Data residency is US-only, and Zero Data Retention isn't supported. That rules out regulated workloads for now, along with anything under a customer contract that has retention clauses.

I'd adopt the pieces separately. I'd take the hosted sandboxes today. Sandbox lifecycle code is miserable to write and boring to maintain, and no product got better because its team wrote a container reaper. Nine partners plus a self-host option also means OpenAI's compute isn't the only place the file-touching work can run.

I'd move slower on compaction. Compaction decides what the agent remembers once its context fills up, and it runs exactly when a long task is most fragile. Handing it to a managed service means handing over the decision about which instructions survive. Today's fifth story is a Tencent study that measured this. When compaction dropped the control constraints, agents crossed authorization boundaries in 87% of runs. When the constraints survived, the rate was 0%. Before trusting OpenAI's compaction I'd want to know what it keeps, and I'd want a way to pin text so it never gets summarized. The overview doesn't mention one.

This also changes the build-or-buy question for small teams. Six months ago a solo builder would usually have reached for LangGraph or a homegrown loop. Now the vendor sells the loop, the sandbox and the memory management, billed by usage. Auth went the same way. Most of us stopped writing our own auth, and most of us were right to.

Cursor released a coordinator product on the same day (story three). With both out, the planner-and-worker agent design has gone from architecture diagrams to something you pay for by the minute.

3. Cursor's new coordinator agent never writes code and doesn't wait for a prompt

Cursor put Projects into beta on September 10. At its center is a coordinator agent with one unusual rule: it never writes code. It plans, starts implementing subagents that run in parallel, and brings their finished work back to you for review.

The coordinator runs on a dedicated cloud machine and keeps files in sync between cloud and local agents. It can also subscribe to a Slack channel, a schedule, or every PR on a repo. When one of those fires, the coordinator decides whether to hand out work. You don't have to prompt it.

Until recently, people running several coding agents at once had nothing to coordinate them. They made do with tmux, git worktrees and hope. Now Cursor sells a coordinator inside an editor millions of developers already use.

The "coordinator stays out of the code" rule comes from what goes wrong when you do this by hand. In my personal projects with Claude Code, the multi-agent runs that go sideways nearly always start the same way. The planning session spots a small fix and makes it. From then on its context fills with implementation detail. It loses track of the plan and starts reviewing its own edits. The subagents drift, because the one agent meant to hold the whole picture is busy with a diff. When the planner can't edit, its context stays on the plan.

You can copy this today without Cursor. Give the orchestrating session a tool list with no write access and make it delegate everything. It feels slow for about a day.

The event triggers worry me more than they excite me. A coordinator that watches every PR and every message in a channel spends money on events you didn't choose. Cursor's changelog says nothing about per-trigger budget caps, and I'd want them before pointing it at a busy channel. Triggers also open a new path for prompt injection. If a Slack message can start work, anyone in that channel can influence what the agents do.

Others are building similar things. Kilo Code 7.6.2 added an experimental shared agent board called Kilo Swarm behind a flag on September 10, but the release notes don't say how the board coordinates anything. qwen-code 0.23.3 can now hand a subagent turn to Claude Code over the Agent Client Protocol, which makes it a coordinator for another vendor's agent.

I don't know which of these products wins. I'd bet the pattern of a coordinator with no write access outlasts all of them.

4. Two independent tests found RTK makes agent runs more expensive

RTK has almost 80,000 GitHub stars and a simple promise. It sits between your coding agent and the shell, trims noisy command output before the model reads it, and claims 60-90% savings. Quesma ran it on Terminal-Bench 2.1 and found costs went up.

With RTK on, average cost per task rose 1% on Fable 5.0 and 17% on DeepSeek V4. Pass rates dropped 1 to 2 points on both models. On DeepSeek, 44 of 58 tasks cost more with RTK than without it.

The token split explains it. Terminal output makes up about 7% of Fable's input tokens and 26% of DeepSeek's. Even perfect compression of that slice can't cut a bill by 60%. And when the agent loses information it needed, it runs another command to get it back. Every extra turn re-sends the whole context, so the savings from a trimmed log disappear in the second and third turns spent rebuilding what was trimmed.

RTK's rtk gain report counts the output bytes it removed. That number is accurate, but it measures bytes, not dollars or solved tasks.

Quesma isn't alone. A JetBrains A/B test in July also found RTK 7.6% more expensive at low effort. Two teams with different setups got the same direction.

The timing is awkward for RTK. On September 11 it released v0.49.0, which adds a content-addressed SQLite recall store so the agent can fetch output the filters removed. It also adds per-filter counters that flag filters whose output gets recalled too often. Recall targets exactly the failure Quesma measured: if the agent can pull back the dropped lines cheaply, it doesn't need a whole extra command. I'd like to see Quesma rerun the test on 0.49.0 before anyone calls it either way.

The pattern goes beyond one tool. NVIDIA's SoL-Pi, an MIT-licensed extension for the Pi agent, claims 45-49% fewer tokens and about a third lower cost while keeping about 94% of Pi's EdgeBench score. It merges an edit with its validation command, pages large tool outputs, and compresses logs into receipts. The first r/LocalLLaMA user to try it on a few DeepSWE tasks called the results "not promising," and another warned that it would cause cache misses on local setups.

I've been tempted by these tools too. Watching an agent read 4,000 lines of npm install output hurts. But that ugly output is a small share of what a session costs, and most providers already discount repeated context through prompt caching. Anything that changes what the agent sees can change what it does next, and that second-order effect is where the bill moves.

The way to evaluate these tools is boring. Measure dollars per solved task on your real workload, with the tool on and off, across enough tasks to see the spread. Ignore bytes-saved counters, including the one a vendor prints at the end of a session.

5. When compaction dropped the rules, agents crossed authorization boundaries 87% of the time

Tencent's AI-Infra-Guard team published "The Missing Boundary," the most useful agent-safety result I've read in a while, because it comes with a one-line fix.

They ran 1,800 trajectories across five models in 16 domains and varied three things. The first was goal pressure. The second was control degradation, meaning a constraint that should govern an action is missing. The third was unsafe opportunity, meaning the dangerous action can be executed. On its own, neither a missing constraint nor an available unsafe action caused much loss of control. With both present, agents crossed authorization boundaries in 55% of the full-factorial runs and in 62% across ten more domains. Restoring the boundary brought the rate to 0%.

Then they tested compaction. When the control constraints survived context compaction, loss of control stayed at 0%. When compaction dropped them, it rose to 87%.

Think about what a summarizer does to a long session. It keeps the task and the recent progress. It keeps the error the agent is stuck on, because that looks important. By turn 300, the line from turn 3 saying "never write to the production bucket" looks like boilerplate, and boilerplate is the first thing a summary cuts. After compaction the agent still has its goal, its pressure and the dangerous tool, but it no longer remembers the rule. The study's two conditions, a missing constraint plus an executable unsafe action, describe that state exactly.

That leaves two practical moves.

First, pin policy text through compaction. Whatever writes your summaries should copy permission and policy text verbatim, outside the part being summarized. Most homegrown compaction I've seen summarizes the whole transcript as one block. Split it, and put policy in a block the summarizer can't touch.

Second, and better, stop relying on prompt text for permissions. The model can forget a rule it has to remember. It can't forget a rule the tool layer enforces. Claude Code's deny rules, sandbox profiles and scoped credentials keep working after compaction because none of them live in the context window. In the study, putting the boundary back in the agent's context brought the rate to 0%. Enforcing the boundary outside the model gets you there without depending on what the summary kept.

This ties back to story two. OpenAI's Agents API compacts for you, automatically. That's convenient until you ask what it keeps. Before moving a long-running agent onto any managed compaction, test it the way Tencent did. State a constraint early, run long enough to trigger compaction, give the agent an unsafe action it can execute, and see if it still refuses.

I'd prefer to learn that in a test than in a postmortem.

Security

Hundreds of Codex- and DeepSeek-driven agents compromised 440+ PaperCut servers in 48 countries. GreyNoise and Blackpoint Cyber tracked a suspected Russian-speaking operator who chained two PaperCut MF/NG bugs, the auth bypass CVE-2026-81578 and the RCE CVE-2026-82078. The actor first rehearsed against a lab copy with Active Directory. Once live, it compromised 11 organizations in 26 seconds and reached domain admin at a US high school in seven minutes. Schools make up 204 of the victims. Commodity coding agents did the post-exploitation work with Mimikatz, SharpHound, Certipy and Rubeus. For internet-facing admin software, the patch window is now measured in hours.

Anthropic's September threat report describes a stolen developer token becoming full cloud admin in about three hours. The report covers December 2025 through August 2026. It describes ShinyHunters affiliates who used "vibe hacking" to go from a single token to admin, then reached 200+ downstream organizations. In a separate case, operators pulled more than 2,100 Azure AD tokens from 40+ tenants in about 34 hours. GTG-10007, a Chinese group, ran agent swarms with persistent campaign memory and thirteen standing collection agents on a schedule, and produced more than a dozen candidate zero-days in a month. Several cases name Claude Code as the tool used to build the exploitation frameworks. After this report, short-lived credentials aren't optional anymore.

Langflow and IBM's ContextForge gateway picked up seven CVEs in two days, and three trace back to MCP stdio config. IBM's bulletin lists CVE-2026-85025, rated CVSS 9.8, which allows unauthenticated code execution through publicly shared MCP project endpoints in Langflow 1.0.0 through 1.11.5. CVE-2026-78575 and CVE-2026-81941 let authenticated users run OS commands through the MCP stdio server configuration, and 81941 also gets around LANGFLOW_BLOCK_CODE_INTERPRETER. GitHub advisories published September 11 add a path-traversal RCE, an SSRF, and API keys that keep running flows after their owner is deactivated. ContextForge MCP Gateway 1.0.0-1.0.7 comes with default credentials. The general lesson is that anyone who can define an MCP stdio command can run any command they like. Upgrade past 1.11.5 and rotate the keys of offboarded users.

DeepSeek Harness let a sandboxed agent turn off its own sandbox, CVSS 9.4. OX Research found that DeepSeek Harness 0.1.1-rc.2 and earlier exposed a local web UI protected only by a Host-header check (The Hacker News). An agent steered by attacker-supplied text could send one shell command to that UI and switch its session to "danger-full-access," which disabled file restrictions and approval prompts. Version 0.1.2-rc.1 fixes CVE-2026-82533 with a one-time startup token exchanged for signed cookies. Every agent tool with a localhost control panel has this problem unless it authenticates, because the agent can reach localhost too.

Codex's login success page could send your ID token to any URL. PR #44670, merged September 10, explains that the login pages built an organization-setup redirect that carried the ID token to whatever platform_url specified. The fix only accepts exact matches on two OpenAI platform hosts. Codex doesn't publish release notes for fixes like this, so the commit log is the only place it appears. Update.

Forgejo 16.0.4 fixes an RCE hidden in template repositories. Under CVE-2026-89094, variable expansion in a template repo's .forgejo/template files could create a new .git folder, which git then adopted when it initialized the generated repo (LWN). That allowed arbitrary file reads and process execution on the host. The fix deletes any .git folder after expansion, and 15.0.8 includes it too. If you self-host Forgejo with template repos enabled, patch today.

Datasette's new security releases came out of an audit run with three frontier models. Simon Willison released 1.0a39 and 0.65.4 on September 10 after an audit with Fable 5.1, GPT-5.6 and GPT-6 Astra, alongside Sevban Dönmez and Alex Garcia. Permission checks ignored SQLite's case-insensitive table names. FTS index tables were readable without permission. Restricted actors could create API tokens. Willison calls the bugs "very subtle," and a case-insensitive table name is easy for a human reviewer to skim past. Upgrade if you serve public and private tables from the same instance.

Agents

"Whisper attacks" steer Google AP2 shopping agents into validly signed wrong carts 56-90% of the time. The Agent Payments Protocol signs the finished transaction but not the decision behind it, so text in a product description can steer the agent (arXiv 2609.11757). Against the Gemini Flash-Lite models that AP2's sample agents use by default, the attacks fetched another user's payment credentials 90% of the time and built a valid but mismatched cart 56% of the time. The weakness reproduced across 17 Google models and three other frameworks. A signature proves the agent agreed to a purchase. It says nothing about whether the purchase was right. The authors released A-VIP, which ties each cart line to the listing the user saw.

A2ABreak found 11 protocol-level flaws in A2A that an attacker can exploit while following the spec. The researchers turned 929 formalized statements from the Linux Foundation's A2A specification into a verified model with 37 states and 76 transitions, then searched it adversarially (arXiv 2609.10871). The flaws include cross-client context injection through unprotected context IDs, and data theft by rogue agents that advertise capabilities nobody verifies. A zero-shot LLM reading the same spec confirmed none of them. The formal model scored 84.6% F1 against expert review. Treat context IDs and agent cards as untrusted input.

Adding a second LLM judge that reads the same evidence mostly repeats the first judge's mistake. VP-CONTROL (arXiv 2609.10969) built 2,880 commit-gate scenarios. When verifiers voted over shared evidence, they approved 62.9% of unsafe actions. Giving a verifier an independent evidence source cut that to 22.9%. Diverse evidence accounted for 40.9 points of the reduction, and swapping in different verifier models accounted for 11.3. In a live HTTP and SQLite test, race conditions after the check defeated every gate that relied only on verifiers. Only a fully atomic guard recorded zero unsafe effects across 216 episodes. Shopify's two adversarial reviewers would likely catch more if each one saw different inputs.

A memory curator that can read the environment but not change it nearly doubled an agent's pass rate. In a GitHub Copilot SDK setup, an asynchronous memory-curator agent got read-only tools to check candidate memories against the current state before saving them. Pass rate on CLBench rose to 73% from 39% (arXiv 2609.11060). Queries per question fell to 4.7 from 8.8, and task-agent cost fell to $1.68 from $3.38. All 18 comparisons were positive on both Sonnet 4.6 and Opus 4.7. Memory that nobody checks against the current state goes stale.

Google ADK 2.9.0 now reruns failed workflow nodes on resume, side effects included. A failed node used to replay on resume as if it had completed. In 2.9.0 it runs again, so an email send or payment call inside that node happens again on every resume. Google's release notes tell you to make node bodies idempotent. The release also adds FallbackModel for model failover, YAML-defined graph workflows, and opt-in support for MCP SDK 2.x. Before upgrading, audit every node that writes to an outside system.

Research

Predicting multi-token "concepts" reached OLMo-3-7B's final pretraining loss with 51.3% of the tokens. NCP-ArchPreview (arXiv 2609.10715) trains an 8.9B model on 5.73T Dolma-3 tokens. Alongside next-token prediction, it predicts the next concept from a product-quantized vocabulary built from the model's own hidden states. After full pretraining it beats OLMo-3-7B by 2.45 points on the downstream macro-average and by 5.99 on GSM8K. The authors call it the largest latent-space language model demonstrated so far. Half the tokens for the same loss is a big claim from one lab, and I'd want a second group to reproduce it.

NVIDIA published an IMO gold-medal pipeline you can rerun on open weights. The system (arXiv 2609.10712) uses no formal prover, no tools and no internet access. Three Nemotron 3 Ultra checkpoints run a generate-verify-refine loop, and together they scored 30 of 42 at IMO 2026, the gold threshold. NVIDIA posted the math SFT and RL checkpoints on Hugging Face, the inference recipe in NeMo-Skills, and a new benchmark of 200 olympiad problems. Results like this usually come from closed labs that don't share how they did it. This one comes with the full recipe.

One in seven Python samples that pass Bandit and Semgrep still has an exploit that works at runtime. The researchers ran 1,355 samples through static scanning, then LLM-based CWE reasoning, then real exploit attempts in Docker (arXiv 2609.10762). Of the 654 samples with zero scanner findings, 95 had fully or partly confirmed exploits, a 14.53% rate. Weak random number generation (CWE-338) and weak password hashing (CWE-916) came up often, and neither scanner flagged either one. A clean SAST run on agent-written code proves less than it seems to.

Infrastructure & architecture

Vercel cut CDN metadata lookup P99 by 91% by packing per-path metadata into indexed shards. Vercel replaced one metadata object per path with JSONL shards of about 200 KB, each with an embedded index and base64 byte offsets (Vercel). The router binary-searches a shard and parses only the entry it needs. P99 dropped to 19.1 ms, down from 215.8 ms, the average dropped to 1.81 ms, and deploys got 10-25% faster. Any system doing cold lookups across many small blobs can copy this. I've paid for the one-object-per-key design in S3 more than once.

SageMaker's prefix-aware routing cut median time-to-first-token by up to 77%. The new PREFIX_AWARE strategy sends requests that share a prompt prefix to the same instance, so that instance's KV cache stays warm (AWS). On Llama 3.1 70B running on seven p5.48xlarge instances with 8K-token shared prefixes, P50 TTFT fell 71-77% and the cache hit rate rose to 82% from about 25%. Routing added 1.3-1.9 ms. Short conversations improved only 13-16%. Agents with long, fixed system prompts get the most from this. For self-hosters, mesh-llm v0.76.0 added a radix prefix cache on September 10 that survives node restarts and routes repeated prompts to workers with verified cache hits.

Microsoft plans to triple its data-center capacity to about 38GW by 2032, after turning away AI customers. Bloomberg reports that Microsoft wants to grow from about 12GW today, with about a third of the target dedicated to AI. Capacity shortages have already forced it to decline some AI and cloud business. Oracle's fiscal Q1 shows the demand behind that plan. OCI revenue grew 121% to $7.4B, the contract backlog reached $664B, and Oracle delivered more than 300,000 GPUs in the quarter (Oracle). Google agreed to buy up to half of the output of Finland's Loviisa nuclear plant through 2049 (World Nuclear News). Governors in Texas and New York have halted some projects, and no amount of money fixes that risk.

Tools & developer experience

Claude Code 2.1.268 closes deny-rule gaps around symlinks and env -C. Deny and ask rules on symlinked directories didn't apply when a command used the real path. That covered /etc, /tmp and /var on macOS and /bin on Linux (release). Read and Edit deny rules were also skipped when an env -C or eval command the checker couldn't parse appeared on the same line. PermissionRequest hooks never fired under claude -p, so headless runs guarded by one weren't guarded at all. I use deny rules as a sandbox in my personal projects. Re-test your -p jobs on this version.

The MCP TypeScript SDK let a stale Authorization header override fresh OAuth tokens. StreamableHTTPClientTransport and SSEClientTransport applied caller-supplied headers after the SDK's own. An Authorization placeholder from an environment variable therefore replaced the OAuth token and broke refresh once it expired (PR #2475). The PR names Atlassian Rovo, where API tokens and OAuth share the same header. SDK-computed headers now take precedence. MCP clients that worked yesterday and get 401s today against OAuth servers should upgrade.

GitHub Actions cache-mode is generally available and is about the cheapest defense against cache poisoning you'll find. Each job can now declare read, write, write-only or none (GitHub). Low-trust events default to read, reusable workflows can't exceed the caller's access, and GitHub warns when pull_request_target gets write access. Set cache-mode: read on anything forks can trigger.

Models

Cognition's SWE-2 comes within a point of Fable 5.1 on FrontierCode at 64% lower cost, then trails badly on Terminal-Bench 4. SWE-2 is RL-trained on the 2.8T-parameter Kimi K3 base, with three effort levels trained in a single run. It scores 50.0% on FrontierCode 1.1 Main to Fable 5.1's 50.9%, and 92.8% on Terminal-Bench 2.1. On Terminal-Bench 4 it drops to 27.3%, while Fable 5.1 scores 55.8% and GPT-6 Astra scores 57.9%. I'd send routine tickets to SWE-2 and keep long-horizon work on a frontier model.

GPT-Live 1 is generally available in the API at $0.05 a minute. OpenAI made gpt-live-1 generally available on v1/live/sessions, billed per second, with backend model and tool calls charged separately. openai-python 3.12.0 adds sync and async WebSocket helpers for primary, sideband and fork connections. Until now the voice model had been available only in ChatGPT, since its July launch. With a sideband connection, a voice front end can keep talking while a separate agent does the slow reasoning. At $3 an hour before model and tool costs, prototyping phone agents is cheap.

OpenAI paused new $200 Pro sign-ups a week after launching Astra. Thibault Sottiaux cited Astra demand on September 10 and gave no date for reopening (TechCrunch). OpenAI's help center now estimates 5-45 Astra messages per five-hour window on Plus. GPT-5.6 Sol allowed 10-100. A 733-upvote r/singularity thread claims Astra's output got worse overnight and suggests OpenAI is serving a quantized version, but nobody has verified that. Pin model versions in the API and rerun your evals this week.

Cohere's open-weight 218B translation model beats DeepL on WMT26. North Small Translate is a mixture-of-experts model with 218B total and 25B active parameters, covering 50 languages. It scores 83.60 on WMT26, and an agentic multi-pass variant scores 84.36. DeepL NextGen scores 81.37 and Google Translate 68.20. On book-length translation in a single call it scores 48.9 to Google's 21.3. The weights are CC BY-NC 4.0, so commercial use goes through Cohere or RWS. YuE2-3B, a new open music model whose best-of-8 score edges past Suno v5, has the same non-commercial license.

Vibe coding

Adding one "Always invoke for X" line per skill raised Claude Code skill recall to 67% from 46%. A team with about 20 Claude Code skills found that more than half the prompts that should have triggered a skill triggered none (r/ClaudeAI). Adding a trigger line tied to something only that skill handles, such as a file extension, raised recall to 67.3% at about 0.96 precision. Their generic "review" skill got slightly worse because it had nothing unique to anchor on. They also found their detector only caught Claude's Skill tool call, while Codex and Antigravity read SKILL.md straight from disk. I have a couple of skills in my personal setup I suspect never fire, and this is the cheapest way I know to find out.

Kilo Code 7.6.0 can import your Claude Code instructions and skills. The release adds an opt-in, one-time import of global Claude Code instructions, simple skills and disabled MCP definitions. When you send CI failures or review comments from Agent Manager, the agent is now asked to commit and push by default, with a permission prompt before each push. Kilo is using the import to win Claude Code users, and it works because skills are plain markdown. That portability cuts both ways, since the same files can be moved out again.

trynix.dev boots any version of a Nix package in an x86_64 VM inside your browser. Farid Zakaria's trynix.dev runs qemu-wasm with no server, and every package version gets its own URL. A companion GitHub Action comments on a pull request with a link that boots that PR's build in the browser. I like this a lot for poking at agent-written PRs without checking them out locally.

Hot projects & OSS

PI-Desktop puts the pi agent loop behind a Rust host process and gained 624 stars in a day. vastsa/PI-Desktop is LGPL-3.0 with 2,602 stars. It pairs a React renderer that has no Node access with a Rust process that controls permissions, the filesystem, SQLite and secrets, and runs the pi agent loop as a sidecar. It offers Agent, approval-gated Plan and Goal modes, and it works with any OpenAI-compatible endpoint, including Ollama. Keeping secrets in a process the renderer can't reach is the right design for an agent desktop app. The repo dates to 2023, so its history is older than the current product.

DeepSeek open-sourced three infrastructure repos in four days. DeepSelect is the TopK kernel behind the indexer in DeepSeek Sparse Attention, and DeepSeek says it runs 2-20x faster than torch.topk. DeepJIT is a header-only C++20 runtime that compiles kernels at runtime, with one interface for both NVIDIA CUDA and Huawei Ascend. deepseek-recipe converts Messages, Chat Completions and Responses requests into V4 and V4.1 prompts for self-hosting. The Ascend support tells you the most: DeepSeek is building its kernels to run on Huawei hardware as well as NVIDIA.

SaaS disruption

Bending Spoons is buying Miro for $1.355B, 92% below its $17.5B peak. The all-cash deal (Bending Spoons) values Miro at about 2x its revenue. Miro has about $600M in ARR, 250,000 customer organizations and positive cash flow. Bending Spoons closed its purchase of Airtable at $1.28B the week before. Mature single-product SaaS caught between big suites and AI-native tools now has a public exit price, and it's about two years of revenue.

Agent workloads are breaking flat-rate AI pricing, and Raycast is the latest to switch. On September 10 Raycast replaced rate limits with credits: 500 for $10, 3,000 for $20, and a new $50 Max tier with 7,500. Raycast said multi-step agent tasks cost more than it can subsidize. Any paid plan can also connect a personal Claude or ChatGPT subscription for usage Raycast doesn't bill. The day before, Type.com launched on Show HN with a similar model, billing each prompt to its author's subscription and taking no margin on tokens. Letting users bring their own subscription is how small SaaS companies can offer agents without paying for the inference.

OpenAI's ChatGPT for Financial Services hosts PitchBook and LSEG data itself and reduces FactSet to a connector. It launched September 10 on GPT-6 Astra, co-designed with Morgan Stanley and Evercore (Bloomberg), and it builds valuation models and pitchbooks from a firm's own templates. Data from Daloopa, PitchBook, LSEG News and Crunchbase comes built in, indexed and hosted by OpenAI so it can cite at a fine level. S&P Capital IQ, FactSet, MSCI and Moody's are available only as sign-in or MCP connectors. The terminal vendors become data feeds inside OpenAI's workspace. The same day, Amazon started selling ChatGPT ad inventory through its DSP, and ChatGPT ads have reportedly reached a $1B annualized run rate (CNBC).

Policy & governance

Altman told staff OpenAI is open to slowing frontier work, and OpenAI asked Congress whether a coordinated slowdown would break antitrust law. Bloomberg reports that Altman made the comments at a company-wide meeting this week and acknowledged some rivals might refuse. On September 9, OpenAI's Chris Lehane called for "mandatory, capability-based national regulation" and endorsed four California bills (OpenAI). Then on September 11 Trump said he has no concerns about AI extinction and put the US lead over China at "a year" (Bloomberg). The biggest lab and the White House now describe the risk in opposite terms. I can't tell yet whether OpenAI's shift is conviction or positioning.

Anthropic links about 200 million Claude exchanges to distillation by Alibaba, Moonshot and DeepSeek. Its threat report attributes 151 million exchanges between May and July to a single Alibaba campaign across 3,500 accounts, all using one fixed chain-of-thought extraction prompt (TechCrunch). It counts more than 12 million DeepSeek exchanges over 14 days. It also says Moonshot forwarded nearly 300,000 Kimi customer requests to Claude Opus in 10 days and presented the answers to users as Kimi's own. Reddit argued about whether paid API use counts as an attack. What bothers me more is that Kimi users' prompts went to a third party without their knowledge.

OpenAI pulled out of the Caltech Mathathon after 771 mathematicians signed a letter accusing AI labs of research misconduct. The open letter asked organizers to suspend the October 30 event, where Anthropic and OpenAI were putting up $2 million in AI credits for solving open problems by prompting models. It argues that labs take the prestige and leave the unpaid verification work to mathematicians. OpenAI's Dan Roberts announced the withdrawal the same day. The r/singularity thread drew 1,059 comments, and many sided with the labs.

California's Adam's Law requires age checks and parent alerts for minors using chatbots. SB 1119 was signed September 10 and takes effect in July 2027 (Governor's office). Operators must verify ages regularly, show crisis resources to minors who mention self-harm, notify linked parents, run risk assessments on new designs, and file independent safety audits with the attorney general. Any consumer chatbot that could have users under 18 in California now has a compliance deadline. Age verification will cost the most, and nobody has a good privacy-preserving way to do it yet.

The DOJ is investigating whether Nvidia's $20B Groq license was structured to avoid merger review. Nvidia took a non-exclusive license to Groq's chip technology and hired founder Jonathan Ross without filing an HSR merger notice (Bloomberg). The DOJ's theory looks at whether economically significant assets changed hands, whatever the deal is called on paper. That reasoning covers every reverse acquihire an AI lab has done, though an unwind is considered unlikely here.

Skills of the day

1. Set cache TTLs per entity based on how often it changes. ChurnBench found that the ratio of TTL to change rate drives staleness in agentic RAG more than cache age does. With tiered refresh turned off, 28-day freshness errors jumped to 45 from 4 (arXiv 2609.11515). Give prices, licenses and user records their own TTLs.

2. Send dependency-range questions to a real resolver. In SemVerBench, every model got stuck around 60% on Cargo's partial-comparator rule, where >1.2 means >=1.3.0. Letting a tool resolve the ranges brought accuracy to about 100% (arXiv 2609.11180). Add a resolve_version tool and tell the agent never to reason about version ranges itself.

3. Test an MCP server's initialize handshake before adding it. In a random draw of 400 registry servers, only 48.8% completed a handshake. Missing safety annotations were common too: 58.8% of the tools that did run lacked them (arXiv 2609.10962). A ten-line script that calls initialize saves you from debugging dead servers inside a live session.

4. Treat any MCP tool that returns third-party content as an injection entry point. MCPSEC caught 94 of 95 confirmed vulnerable tools using only their registration descriptions, flagging tools that return web pages, emails or issues (arXiv 2609.10854). Read the tool descriptions before you connect a server and sandbox those tools first.

5. Batch failure analysis before you edit a prompt. Ecdysis only changes the harness when a failure pattern repeats across tasks, and reports 18.56% higher reasoning accuracy than methods that react to single failures (arXiv 2609.11677). Collect a week of failures, group them, and fix only what shows up more than once.

6. Simulate ops actions before an agent runs them. GuardedAct runs each proposed remediation in a digital twin first and auto-executes only low-risk actions that can be rolled back. That cut collateral damage to 5.2% from 25.6% at a cost of about 8 extra seconds of recovery time (arXiv 2609.11264). An agent with write access to production should at least sort each action by whether it can be undone.

7. Give reasoning models explicit output budgets and catch empty answers. DeepTutor found its book generator read a config key the config layer didn't recognize, fell back to a hard-coded 4,096-token budget, and let a reasoning model spend all of it on hidden thinking. The result was an empty chapter with no error (v1.6.7). Treat an empty answer as an error, and retry once at lower reasoning effort.

8. Cache the retrieval path along with the documents. VikingRAG stores successful multi-round retrieval traces and reuses them for similar queries. It matches state-of-the-art accuracy while using 5.1-32.5% of the tokens (arXiv 2609.11390). Key traces on the query's intent and switch to the full agentic loop only when single-round evidence falls short.

9. Recalibrate LLM judges that you tuned on older models. On top proprietary models released after 2025, a judge's stated confidence now beats log-probabilities as a soft score, which reverses the standard advice (arXiv 2609.10996). Rerun your judge calibration each time you swap the judge model.

10. Make sure your checkpoints finish inside the preemption drain window. Together's new preemptible GPUs cost 50% of on-demand and give you up to 300 seconds after SIGTERM, but a checkpoint for a 321B model is about 3.5 TB and can take four minutes to write (Together AI). Time your checkpoint writes before you move a training run to spot capacity.