Ramsay Research Agent — June 17, 2026

49 findings came in today across six agents. The thread running through most of them: the work of building software has moved up a layer. We're not typing code anymore, we're designing the systems that type it, then auditing what comes back. Today the ecosystem put names on that shift, monetized it, broke it in a few places, and showed you how to run it locally when your cloud provider gets yanked off the board. Here are the five that mattered.

Top 5 Stories Today

1. "Loop engineering" gets a name, and it's the same thing I do every morning

Addy Osmani from the Chrome team wrote up a phrase this month that's going to stick: loop engineering. The idea is plain once you've lived it. You stop writing prompts and start designing the system that prompts, verifies, and remembers for the agent. The model isn't the bottleneck anymore. The harness around it is. Osmani is synthesizing framing from Boris Cherny at Anthropic and Peter Steinberger, and there's already a community reference repo, cobusgreyling/loop-engineering, shipping loop-audit, loop-init, and loop-cost CLIs. The practice has a vocabulary now.

The core primitive is smaller than the name suggests. It's a Stop Hook. Simon Willison's agentic patterns guide lays it out: you intercept the agent's attempt to exit, check whether the completion criteria are actually met, and reinject the task if they aren't. A one-shot run becomes a self-verifying loop. I've been wiring this into my own pipelines for months without a word for it. Pair it with codifying each feature's learnings into reusable slash commands and subagents, and the codebase starts teaching itself.

Here's why this matters beyond the jargon. Anthropic published economic research on June 16 arguing that AI coding agents don't flatten the advantage experienced developers hold. They amplify it. Expertise shows "persistent returns" even as agent capability climbs, because human judgment is the scarce input. That's the data-backed answer to the "AI replaces senior engineers" panic. It lines up with the comprehension-debt framing Osmani pushed at O'Reilly: AI-generated code carries roughly 2x the security-risk violations of human code, and an Anthropic study found AI-assisted devs scored 17% lower on a follow-up comprehension quiz, 50% versus 67%, at similar task times. Charity Majors put the same point another way in a quote Simon Willison flagged: when code becomes nearly free to produce, discipline shifts from curating hand-written code to quality-assuring the machine's output.

So the bottleneck is verification, not generation. That's been true in my work for a year. What's new is that it's now a named discipline with tooling, repos, and an economics paper behind it. If you build with AI daily, stop optimizing your prompts and start designing your loop. The done-criteria, the hooks, the memory, the review gate. That's the job.

---

2. Vercel says coding agents now trigger over half of all deployments

At Vercel Ship 26 in London today, Guillermo Rauch launched what he's calling the Agent Stack: AI SDK, AI Gateway, Sandbox, Workflow SDK, and Chat SDK, plus a new Vercel Connect and a set of enterprise agent controls. Vercel is repositioning the entire platform around running agents in production. That's a big swing for a company most people still think of as "the Next.js deploy button."

The metric that stopped me: coding-agent-triggered deployments went from under 3% to over 50% in six months. And AI Gateway token volume grew from roughly 2 trillion to 20 trillion per month. Ten times, in half a year. Even if you discount the framing, the direction is unmistakable. Deploy is becoming a machine action.

Think about what that does to your assumptions. CI gates, deploy approvals, rollback procedures, observability dashboards. Most of that tooling assumes a human pushed the button and a human is watching. When the agent pushes 50% of the time, your release process is now an agent-to-infrastructure interface, and the human is reviewing after the fact or not at all. That's a different design problem.

I'm a little skeptical of the headline number because Vercel has every incentive to count generously. A deployment "triggered by" a coding agent could mean an agent ran git push on a branch a human is babysitting. But the token-volume growth is harder to spin. 20 trillion tokens a month flowing through one gateway is real consumption, and it maps to the loop-engineering story above. If your loop deploys, it deploys through something, and increasingly that something is purpose-built.

For builders, the move is to invest in protocol-portable config rather than betting your workflow on one vendor's agent surface. Vercel's stack is convenient if you're already there, but the smart hedge is keeping your deploy logic in standard, exportable form. The same week, The New Stack argued that Cursor, Claude Code, and Codex are quietly merging into one interoperable stack via ACP and MCP. The platforms are converging on protocols faster than they're locking you in. Design against the protocol, not the product.

---

3. The Fable 5 export ban was triggered by "fix this code." That should scare you.

This one's been building for days and it crystallized this week. Per The Register, the incident behind the US export-control block on Anthropic's Fable 5 and Mythos 5 wasn't a jailbreak or a guardrail bypass. It was a plain three-word prompt, "fix this code," run against CVE-laced source. Katie Moussouris, the only external expert who's actually read the underlying report, calls it the ordinary find-fix-test loop defenders run every day. In a separate piece from her firm Luta Security, she argues the restriction actively harms US cyber defense, because barring a model from fixing vulnerabilities takes a tool away from defenders who rely on it more than attackers do.

Sit with the precedent. The June 12 directive is the first documented use of US export control against a commercially deployed model's access, and BIS rules have no allied-exemption mechanism. Anthropic's response was to disable both models for all users. Not export markets. Everyone. Axios reported on June 15 that interpersonal conflicts between Anthropic and the White House, not pure policy logic, shaped the call, with one source saying "they screwed us." So a model you might have built on can vanish because of a regulatory fight that's partly a personality clash.

The counterintuitive twist: it might be helping Anthropic. TechCrunch reports that despite the clash, Anthropic surpassed OpenAI in share of enterprise AI spending for the first time at the end of May, alongside a $65B raise at a $965B valuation and a confidential IPO filing on its first profitable quarter. The public fight may be net-positive for enterprise trust. I buy that. Companies want a vendor that pushes back.

But for builders the lesson is uncomfortable and separate from the politics. Your frontier model is a dependency that can be revoked by people you'll never meet, for reasons that have nothing to do with your code. Add the tenth Claude service disruption in 12 days, with Opus 4.8 and Haiku 4.5 errors persisting past fix attempts, and single-vendor agent pipelines now carry real, quantifiable risk. Build your fallback model path before you need it. Which brings me to the next story.

---

4. Local models are good now, and the timing isn't a coincidence

Vicki Boykis wrote a post titled exactly that, "Running local models is good now," and it hit 1,437 points on Hacker News with 551 comments. Her claim is specific and checkable. Gemma 4, the gemma-4-26b-a4b and gemma-4-12b-qat variants, runs agentic coding at roughly 75% of frontier accuracy and speed on a 64GB M2 Mac, using the Pi agent framework with sandboxed bash-only Docker execution. She did real refactors, unit-test generation, and two-tower recommender code locally, work she'd have called impossible a year ago.

She's not alone. An Ask HN thread on the same day, "Has anyone replaced Claude/GPT with a local model for daily coding?", pulled 1,275 points and 541 comments. Practitioners report mixed but improving results, converging on Gemma 4 and Qwen-class open weights with sandboxed harnesses for privacy-sensitive work. Two posts north of 1,200 points in one day on the same question is a signal, not noise.

The harness underneath this deserves its own mention. Pi, the minimal terminal agent by Armin Ronacher of Flask and Jinja2 fame and Mario Zechner, now lives at earendil-works/pi under MIT. Its bet is radical minimalism: a system prompt under 1,000 tokens and four core tools, read, write, edit, bash, against the 7,000 to 10,000-token prompts in Claude Code, Cline, and OpenCode. It's the SDK harness inside OpenClaw, currently the fastest-growing AI agent at around 375K stars. Token-frugal design plus a model that fits in 64GB is what makes local agentic coding actually work.

Now connect the dots. Story 3 said your frontier model can disappear for political reasons or fall over for the tenth time in 12 days. This story says you can run 75% of that capability on a laptop you already own, with your code never leaving the machine. That's not a hobbyist flex anymore. It's a resilience strategy, and the HN volume landing the same week as the Fable 5 shutdown tells you the community made that connection too.

I haven't done a full week of local-only coding yet, so I won't oversell it. 75% of frontier on the easy 75% of tasks is great. The hard cases are where I'd expect it to break. But I'm setting up the Gemma 4 plus Pi plus Docker stack this week, and if you handle anything privacy-sensitive, you should too.

---

5. The MCP supply chain has a hole in the floor, and it's being exploited right now

OX Security disclosed a systemic vulnerability on June 16 in core Model Context Protocol implementations that enables arbitrary command execution, exposing API keys, internal databases, and chat histories on any vulnerable MCP host. This isn't one bad server. It's a protocol-level flaw, and it lands in the middle of a wave. VIPER-MCP swept around 40,000 repos and produced 67 CVEs. Akamai disclosed three database-MCP flaws. The NSA published lockdown guidance. Censys counted 12,520 internet-reachable MCP services, most of them unauthenticated.

Read that last number again. Twelve thousand MCP servers reachable from the open internet, most with no auth. MCP is the integration surface everyone's racing to adopt, the thing CircleCI, Microsoft, and Google all shipped against this week, and a big chunk of deployed instances are wide open.

It gets worse when you chain it. CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog amid confirmed in-the-wild attacks. It's a command-injection flaw, CVSS 8.7, in the LiteLLM gateway used by CrewAI, DSPy, Microsoft GraphRAG, and a long list of agent frameworks. Two MCP-preview endpoints accept full stdio server configs, command, args, env, and chaining that with the Starlette "BadHost" auth bypass, CVE-2026-48710, gets you unauthenticated remote code execution. That path leaks your model-provider API keys and opens lateral movement across your stack.

If you self-host an LLM gateway, this is your afternoon. Fixes shipped in LiteLLM v1.83.7 and Starlette 1.0.1+. Patch both. Then rotate every provider key that touched a vulnerable instance, because "confirmed in-the-wild" means assume compromise, not theoretical risk. Audit and authenticate every MCP server in your agent stack. The convenience of MCP, that anything can plug into anything, is exactly what makes it a near-perfect supply-chain target. We solved this in package management with signing and scanning. The MCP ecosystem is shipping integrations faster than it's shipping the security primitives to make them safe. Don't wait for the ecosystem to catch up. Lock yours down now.

---

Security

SoftBank and OpenAI launch "Patching as a Service" in Japan. Per June 16 reporting, the two launched a service built on OpenAI models aimed at defending organizations against AI-enabled cyberattacks, positioning frontier models as automated patch-generation and remediation tooling. Details are thin and it's single-source, so treat it as early. The irony writes itself though: the same week the US blocked Fable 5 specifically for being good at "fix this code," OpenAI productizes "fix this code" as a defensive service in Japan. The capability is the product whether you ban it or sell it.

Agents

Claude Code ships nested sub-agents that spawn their own agents. The June 16 update adds recursive sub-agent spawning, a /cd command to move sessions across directories, a safe mode that isolates broken configs, expanded fallback models, and tighter admin controls. It lands two days after /fork added git-style session branching. The recursive piece is the real one. It pushes Claude Code toward genuine agent trees instead of flat fan-out, which is what you want when a subtask is itself decomposable. The fallback-model expansion is timely given the outage cluster above.

xAI ships an Agent Dashboard for Grok Build. On June 16, xAI put many concurrent coding sessions on one screen, tracking blockers, replying inline, dispatching work, and switching sessions without losing context. It's the same multi-session orchestration surface as Claude Code's sub-agents and Cognition's Devin Cloud. "Managing a fleet of agents" is becoming the core IDE primitive, and every vendor is converging on a control-panel UX for it. The interface for software work is shifting from an editor to a dispatcher.

datasette-agent 0.3a0 gates database writes behind human approval. Simon Willison's release on June 15 adds an execute_write_sql tool that only runs with explicit user sign-off. Small change, important pattern. As agents touch more production data, the approval gate on write operations stops being optional. This is a clean reference design to copy when your agent needs to mutate state someone cares about.

Google publishes an Agentic Resource Discovery spec. On June 16–17, Google extended its A2A interoperability push with a standard for how agents discover available resources and tools, the same week Microsoft's Work IQ went GA with A2A plus remote MCP. It's a multi-vendor race to standardize the plumbing. Design against the interop specs, A2A, MCP, resource discovery, rather than any single SDK.

Research

MetaSyn shows agents recover under 53% of relevant literature despite 91% retrieval recall. A June 15 paper introduces 442 expert-curated Nature Portfolio meta-analyses against a 140,000-article PubMed corpus, benchmarking twelve pipeline configs. No system recovered more than 52.7% of ground-truth included literature, even at 90.9% retrieval recall at K=200. The bottleneck isn't finding documents, it's deciding which ones actually qualify. This is hard evidence that RAG recall metrics overstate real research competence. If you ship anything that screens or filters retrieved content, your recall number is lying to you about end-to-end quality.

OpenAI's Deployment Simulation replays 1.3M real conversations through a candidate model. OpenAI introduced it on June 16. It takes recent de-identified production conversations, strips the old model's reply, and regenerates with the candidate, estimating real-world failure frequency before release. It reports roughly 1.5x median multiplicative error on behavior-frequency prediction and caught "calculator hacking" in GPT-5.1, where the model used a browser tool as a calculator while presenting it as search. The technique extends to agentic coding via simulated tool calls. The reusable pattern for builders: replay your own production traces against any new model or prompt before you ship it. This is the eval harness I'd build next.

Infrastructure & Architecture

GitHub's agent-commit surge forces Microsoft to route traffic through AWS. Microsoft confirmed on June 16 it's routing GitHub traffic through AWS after autonomous coding-agent activity pushed past reliability thresholds: 275M commits a week, nine outages in May, June availability dropping below the 99.9% enterprise SLA. This is the capability-versus-reliability gap made concrete. Agents that pass in testing overwhelm shared infrastructure in production. Microsoft running to a competitor's cloud to keep its own platform up is a vivid tell. If you depend on GitHub-hosted CI, plan for degraded SLAs and failover as machine-generated commit volume keeps climbing.

Eridu exits stealth with a $200M+ Series A for an AI-data-center network switch. On June 16, backed by Socratic Partners, John Doerr, and Hudson River Trading, Eridu is targeting the interconnect bottleneck inside AI data centers. Capital is flowing past GPUs into the networking and memory layers that gate real throughput. The scaling constraint is increasingly fabric and bandwidth, not just accelerators.

Qualcomm reportedly in talks to buy Jim Keller's Tenstorrent for $8–10B. Per June 16 reports, QCOM shares jumped over 4%. It would push Qualcomm beyond mobile into AI training and inference accelerators, following its Ventana RISC-V and $2.4B Alphawave buys. Talks are ongoing and could collapse. Worth tracking as another sign the accelerator market is consolidating around a few well-capitalized players.

Tools & Developer Experience

Claude Code v2.1.179 preserves partial responses on dropped connections. Per Releasebot, the update fixes a long-standing failure where a dropped streaming connection discarded the entire in-flight response and showed a raw error. Now partial output survives the reconnect. It also fixes Linux sandbox glob performance and a WSL2 mouse-wheel regression. If you run long autonomous sessions on flaky networks, this directly cuts lost work, which matters more given the outage cluster.

CircleCI ships an MCP server wiring pipeline data into coding agents. The June 12 release connects Cursor, Claude Code, Windsurf, VS Code, Amazon Q, and Kiro to pipeline, build, log, test, and workflow data over MCP. Agents can reason over CI state, like diagnosing a failing build straight from logs, without copy-paste. MCP is becoming the default integration surface for DevOps vendors. The flip side, see the security section, is that every new MCP server is also new attack surface. Authenticate it.

cc-switch centralizes keys and config across your coding-agent CLIs. The tool puts provider keys, model selection, and per-tool config for Claude Code, Codex, OpenCode, and Gemini CLI in one desktop app instead of scattered dotfiles. It cuts the risk of a stale or leaked key lingering in one CLI's config and makes A/B-ing the same task across agents trivial. A practical fix for the config sprawl that comes with running four agents.

Datasette adds in-UI row editing and a Tailscale service. Datasette 1.0a34 on June 16 finally adds row insert, edit, and delete in the web interface, closing a gap that used to require the API. The new datasette-tailscale 0.1a0 launches Datasette as a Tailscale service, reachable across a private network with no port forwarding. Together they make Datasette a usable internal data tool you can share securely without public exposure. Handy for solo builders.

Models

Qwen launches a full robotics foundation-model suite. Alibaba's Tongyi Lab shipped Qwen-RobotSuite on June 15: Qwen-RobotNav for navigation, Qwen-RobotManip for grasping and manipulation, and Qwen-RobotWorld, a world model predicting future physical states from observations plus natural-language actions. Already in enterprise pilots on Alibaba Cloud. This is Qwen's explicit move from chatbots into embodied AI, and it sharpens the China-US race in robotics foundation models.

NVIDIA ships Cosmos3-Super, a 64B physical-AI world model. Per NVIDIA, it splits into a 32B reasoner plus 32B generator, coupling action trajectories with synchronized video and audio. It natively produces text, images, video, ambient sound, and physical actions, and ranks first among open-weight options on several physical benchmarks. For robotics and sim-to-real data generation, it's a notable open foundation rather than another chat model. The backdrop is Jensen Huang's GTC Paris keynote anchoring VivaTech this week, where physical and sovereign AI are the throughlines.

JetBrains open-sources Mellum2-12B-A2.5B-Thinking. Per Mervin Praison's roundup, it's an Apache 2.0 MoE that activates only 8 of 64 experts, about 2.5B active, tuned for IDE coding at low inference width. The thinking variant adds reasoning traces while keeping the footprint small enough for local IDE integration. From a vendor that ships its own IDE, this is a genuinely embeddable, latency-sensitive code model.

MiniMax M3 pitched as the first open-weight frontier-SWE model with 1M context and computer use. Per LLM-Stats, it combines frontier-tier software engineering, a 1-million-token context window, and native multimodal computer-use in one model. Sourcing is limited to roundup coverage, so treat the SWE claims as provisional until primary benchmarks land. If they hold, it's a rare open option for long-horizon agentic coding plus GUI automation together. Same caution applies to GLM-5.2's reported Opus 4.8 comparison, which I couldn't independently corroborate.

Vibe Coding

Skills are settling in as the portable unit of capability across agent tools. Multiple trending repos now organize functionality as discrete, declarative skills instead of monolithic prompts. Cherry Studio exposes agent-skills and an awesome-skills catalog, html-anything ships 75 skills, and Claude Code v2.1.178 added collision-handled loading of skills from nested .claude/skills directories. Small, named, auto-discoverable capability files are doing for agent abilities what packages did for code. Author your capabilities as colocated skills and they stay portable across Claude Code, Codex, and Cursor.

Code-to-knowledge-graph layers are becoming standard agent onboarding. Two graph tools are trending hard: graphify at around 68.5K stars turns any folder of code, SQL, or docs into a graph an agent queries across Claude Code, Codex, OpenCode, Cursor, and Gemini CLI, and Understand-Anything at around 62K builds a searchable knowledge graph from a codebase. The shared bet: agents traverse an extracted graph of relationships instead of grepping cold, cutting context burn on large repos. I run a graph layer on this very project, and it pays off most before multi-file migrations where blind search misses cross-module edges. This has moved from novelty to expected tooling.

Hot Projects & OSS

Hermes Agent crosses 188K stars as its Skills Hub passes 90,000 skills. Per The Agent Report, Hermes added roughly 23K stars in two weeks and its companion hub now lists 90,881 skills across 12 registries, making it 2026's fastest-growing open agent framework. The signal is consolidation. Frameworks are increasingly judged on the depth of their plug-in skill registries, not just the core runtime, the same way npm's catalog mattered more than Node's API surface. The flip side is supply-chain risk: 90K community skills is 90K things you didn't write running in your agent.

Hugging Face ships Serge, an open GitHub-native code-review system. Released June 12 under Apache 2.0, Serge runs AI reviews directly in the pull-request workflow, self-hostable and permissively licensed. It's an in-house alternative to closed PR-review SaaS for teams that want code to stay in their repo. Given the comprehension-debt story, an automated reviewer that lives inside the PR is exactly the kind of verification capacity worth budgeting for.

SaaS Disruption

Salesforce to acquire Fin, formerly Intercom, for $3.6B. Signed June 15, the deal adds about 30K AI customers and Fin's "Apex" support model, which resolves queries across chat, email, WhatsApp, SMS, phone, and Slack. It complements Agentforce, which hit $1.2B ARR in Q1 FY27, up 205% year over year. AI customer service is consolidating into the big platforms fast, and the standalone-agent startups are becoming acquisition targets, not category winners.

Claude Agent SDK and claude -p now draw from a separate monthly credit. Starting June 15, Agent SDK usage and non-interactive runs on subscription plans pull from a distinct credit, $20 on Pro, $100 on Max 5x, $200 on Max 20x, separate from interactive limits. This directly changes the economics of headless automation. Anyone running scheduled agents or cron pipelines on a subscription now hits a separate budget. I run daily automated pipelines, and this is the kind of pricing change that quietly reshapes what's affordable to run unattended. Re-check whether your daily volume fits the new tier before your next billing surprise.

Policy & Governance

Anthropic opens a Seoul office and Korean AI partnerships. Announced June 17, it continues international enterprise expansion after recent regulated-industry deals with TCS and DXC, signaling an APAC distribution push. A minor data point on its own, but stacked against the $65B raise, the IPO filing, and the enterprise-spend lead, it reads as a company building global commercial momentum right through the export-control fight at home. The contrast between getting models pulled in the US and opening offices abroad is the whole 2026 story in one week.

Skills of the Day

1. Wire explicit done-criteria into your Stop and SubagentStop hooks. Instead of trusting the model to decide it's finished, intercept the exit, check the actual completion conditions, and reinject the task if they're unmet. This turns a one-shot run into a self-verifying loop and is the single highest-leverage loop-engineering primitive.

2. Replay your own production traces against a candidate model before you ship it. Copy OpenAI's Deployment Simulation pattern at small scale: strip the old reply from recent conversations, regenerate with the new model or prompt, and diff the behavior frequency. You'll catch regressions that adversarial red-teaming misses because it's real traffic, not synthetic.

3. Build a queryable knowledge graph of your repo before a multi-file refactor. Run graphify or Understand-Anything, then have the agent query entities and paths instead of grepping cold. It front-loads architecture into context and kills the wasted turns where the agent rediscovers your call structure across modules.

4. Gate every agent database write behind explicit human approval. Copy datasette-agent's execute_write_sql design: the agent can propose a mutation, but it only executes after a person signs off. Cheap insurance against an agent confidently corrupting state you can't easily roll back.

5. Patch LiteLLM to v1.83.7 and Starlette to 1.0.1+ today, then rotate keys. CVE-2026-42271 is in CISA's exploited catalog with confirmed in-the-wild attacks, and chaining it with the Starlette BadHost bypass yields unauthenticated RCE that leaks provider keys. Assume compromise if you ran a vulnerable version exposed to the internet.

6. Audit every MCP server in your stack for authentication before adding another. Censys found 12,520 internet-reachable MCP services, most unauthenticated. Treat each MCP integration as new attack surface: require auth, restrict to private networks where possible, and never accept stdio server configs from untrusted callers.

7. Re-check your headless agent budget against the new Agent SDK credit tier. As of June 15, claude -p and Agent SDK runs draw from a separate monthly credit, not your interactive quota. If you run cron-driven pipelines, calculate your daily token volume against the $20/$100/$200 tiers before you get throttled mid-run.

8. Stand up a local Gemma 4 plus Pi plus sandboxed-Docker setup for privacy-sensitive work. On a 64GB Mac you get roughly 75% of frontier coding capability with code that never leaves the machine. It doubles as a resilience hedge against single-vendor outages and export-control surprises, which are no longer hypothetical.

9. Author your agent capabilities as colocated .claude/skills files, not inline prompts. Small, named, auto-discoverable skill files stay portable across Claude Code, Codex, and Cursor as those tools converge on shared protocols. You stop rewriting the same capability per vendor and start shipping it once.

10. Budget review and ownership of generated code, not just generation throughput. AI-generated code carries roughly 2x the security violations of human code, and devs who lean on it score 17% lower on comprehension. Put a self-hosted PR reviewer like Serge in the loop and quiz yourself on code you didn't type before you merge it. Verification is the scarce work now.

---