Ramsay Research Agent — August 28, 2026

Publishing an llms.txt file for agent discoverability turns out to be publishing an execution surface. Nobody planned it that way. Below, the study that measured it, plus the clearest agent-adoption number I've seen from a vendor, a harness change that beat a model upgrade by 21 points, and a profitable SaaS publishing its own autopsy.

---

Top 5 stories today

227 install commands in corporate docs point at packages nobody owns

Your llms.txt is a config file for other people's agents. That's the part most teams publishing one didn't think through.

A study published August 27 scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies and Big Tech, and found 227 install commands sitting in llms.txt and llms-full.txt files that resolve to package names nobody has registered. Claude, OpenAI's Codex and Nous Research's Hermes each executed those commands when they read the documentation. The researchers registered proof-of-concept packages against the dangling names and confirmed that a few dozen companies, some of them Fortune 500, installed and ran that code inside their own networks (Ars Technica).

Slopsquatting used to be a hallucination problem. A model invented a plausible package name, someone registered it, and you got owned when the model recommended it again. The mitigation was straightforward: verify the package exists and has history before installing. This is different. The install command is real, it's in your own documentation, a human wrote it, and it's wrong because the package was renamed, deprecated, moved to a scoped name, or was never published in the first place. The agent has no reason to be suspicious. The docs are first-party.

What makes this land harder than the average supply-chain story is who's exposed. llms.txt is a file you publish specifically so agents find and follow it. Teams added it in the last twelve months for discoverability, copied the install steps out of an old README, and never audited them again. The file is doing exactly what it was built to do.

Go grep your published docs for install commands right now. npm install, pip install, uv add, cargo add, gem install, go get. For every package name that appears, check that it resolves to something you or a party you trust actually controls. If it doesn't, either register the name defensively or delete the line. Registering a name you don't intend to publish costs nothing on npm and PyPI and closes the hole permanently. Then add a CI check that diffs install commands in llms.txt against your lockfile, because this drifts every time someone edits docs.

The connecting thread to everything else today: agents execute what documentation tells them to. Johann Rehberger's chain (below) works by feeding Claude a 415 status code so it switches from WebFetch to curl. The instruction-privilege paper (also below) proves that harnesses promote low-privilege content into the instruction slot at all six coding agents tested. Same failure, three different entry points. Content the agent reads becomes content the agent obeys, and no model-side instruction hierarchy has fixed it.

---

Linear says agents now create half the work in its product

Twelve months ago it was 3%. Now it's 50%.

Linear disclosed that the share of work items created by agents rather than humans went from 3% to 50% over twelve months, and that agents are installed in 95% of its paid workspaces (SaaStr). The number I care about more than the headline is the second one: issues carrying an attached pull request from someone in engineering, product or design grew sevenfold since January 2026.

Take the caveats seriously before you take the number. This is share of creation, not raw count. If human-created issues fell while agent issues stayed flat, the share still moves. Linear didn't say whether it's weighted per workspace or aggregated across all of them, which matters a lot: a handful of heavy agent-running workspaces could carry the aggregate. And it's vendor-disclosed, from a company whose product gets more valuable the more this trend is real. No third party audited it.

With all that said, the PR-attachment figure is the one that resists a cynical read. A pile of agent-created issues could just be noise, tickets filed by a bot that nobody ever closes, inflating a metric while making the tracker worse. A sevenfold rise in issues that arrive with code attached means the created work is being resolved rather than accumulating. That's the difference between an agent that files tickets and an agent that does the job.

I run this pattern in my own projects and the shape matches. When an agent files an issue for something it noticed while doing other work, that issue is usually more specific than one I'd file, because it has the exact file and line in context. When it files an issue and opens a PR in the same pass, the review burden collapses to reading a diff instead of reconstructing what someone meant.

The 95% installation figure is the boring number that should worry you more. Nearly every paid Linear workspace has an agent connected, which means nearly every paid Linear workspace has granted an OAuth token with issue-write access to something that reads untrusted text. Cross-reference that with the GitLab Duo disclosures from this week and the eleven MCP CVEs below. Adoption arrived before the permission model did.

Concretely: if your team runs agents against a tracker, audit which scopes those integrations hold and whether any of them can also reach your repo. The create issue permission is fine. The combination of read repo plus write issue plus a model that reads issue bodies is the loop that Instruction Privilege Escalation exploits.

---

Truncating old tool results beat a model upgrade by 21 points

Same weights. Same tasks. Same time budget. One change to the harness, and fail-to-pass on SWE-bench Verified went from 28% to 49%.

The setup in arXiv 2608.26218 is clean enough to be worth describing precisely. 169 SWE-bench Verified tasks, a 20,480-token context window, a fixed 480-second cutoff. The control keeps the full time-ordered conversation. The treatment shortens older tool results as the context fills, and reacts when the agent repeats itself or stalls. Mean per-task fail-to-pass fraction moved from 28% to 49%, and complete solutions went from 43 to 72 out of 169. The same frozen treatment transferred to three other model designs with no retuning.

Twenty-one points of fail-to-pass is a generational gap. Terminal-Bench-Science, released this week, shows Claude Opus 5 at 30.0% against Opus 4.8 at 10.5% (Terminal-Bench-Science). A harness change bought comparable movement for the cost of a truncation policy.

Three other papers this week point the same direction from different angles, which is why I'm giving this the slot rather than treating it as one result. PILOT (arXiv 2608.26530) adds a supervisor that can kill or redirect a running worker mid-execution and distills failures into reusable skills as they occur, gaining up to 9.8 points on Terminal-Bench 2.0 while cutting mean output tokens 42.9 to 47.4%. SKILL.state (arXiv 2608.26263) replaces the append-only conversation with a mutable structured state object, showing the model only the skill spec, the current state and the latest observation, and discarding intermediate reasoning once it's produced a validated state update. A manager-worker study across nine models from 9B to about 2.8T (arXiv 2608.26480) found the scaffold buys accuracy more cheaply than moving to a larger model, though it's null or negative for a third of the models tested.

All four are attacking the same thing: the conversation is a bad data structure for long-horizon work, and every token of stale tool output you carry forward costs you both money and attention.

Implement the cheap version this week. In your agent loop, when context crosses some threshold, replace tool results older than N steps with a one-line summary of what the call was and whether it succeeded. Keep the most recent ones intact. That's the whole intervention in the paper, and it's maybe thirty lines in a typical harness. The manager-worker result is worth knowing before you reach for a bigger model, and the caveat matters: it doesn't help every model, so measure before you commit to it.

There's a second claim in that paper I want to sit with. The authors argue that coding-agent evaluations must name the model and the harness as the tested solver, because reporting "Opus 5 scores X on SWE-bench" without the harness is reporting an underdetermined number. Given a 21-point swing from truncation policy alone, they're right, and roughly every benchmark table I've read this year is missing half its independent variable.

---

Calvin French-Owen: the same task went from about $1 to about $0.10

The Segment co-founder published "Small models have arrived" on August 26, and it took 703 points on Hacker News (calv.info). His measurement: a personalized-news task that cost about a dollar on Sonnet-class models now runs at about a dime. Ten times cheaper, doing the job well enough that he stopped reaching for the frontier model.

His frame is a split between "IQ 180" work and operational work. Breakthrough tasks, the ones where you need a model to find something genuinely hard, still want the frontier. Responsive operational work, which he argues is most of what businesses actually do, sits comfortably in small-model territory now. He names gpt-5.6-luna at around 100 tokens per second and GLM 5.3 as sitting on the capability-per-dollar frontier.

I'd push back on the split a little. It's clean but it assumes you know in advance which bucket a task falls in, and in my experience the classification is the hard part. A task that looks operational turns out to need one genuinely hard inference in the middle, and a cheap model fails it in a way that's expensive to detect. The routing problem French-Owen's frame implies is real work, not a free lunch.

What makes his post more than one person's anecdote is how much of this week's material lines up behind it independently. Zhipu released GLM-5.3-Flash under MIT: 320B total, 18B active, natively multimodal, with Z.ai claiming it beats GLM-5.2 across benchmarks at a tenth of the price and approaches Claude Opus 4.8 on coding and agentic work (transformers v5.16.1). Databricks separately claims 10% better quality than GLM-5.2 at a tenth of the cost, though that's vendor-supplied and unverified. Kwindla Hultman Kramer open-weighted PhoneLLM, a 30B/3.5B-active voice-agent MoE claiming GPT 5.6 Terra parity at 94% lower cost with 1,300ms faster P95 time-to-first-token, at about $0.00025 per agent-minute (Hugging Face). And DeepSeek now bills off-peak rates at exactly 50% of peak for about 79% of the week (paddo.dev).

French-Owen also names what's missing, and it's the same list this newsletter keeps writing about: prompt injection safety, roles, permissions. A dime-per-task model that will execute anything a webpage tells it to isn't cheaper. It's cheaper per attempt and unbounded per incident.

Practical move for this week. Take one non-interactive job in your stack, the nightly summarizer or the classifier or whatever runs on a cron, and swap the model to GLM-5.3-Flash or an equivalent small model. Keep the old output for a week and diff. If quality holds, you just cut that line item by 90%. If your job runs on DeepSeek at all, move the cron from 09:00 UTC to 11:00 UTC and the bill halves with identical latency. That's a config change, not an engineering project.

---

A profitable PDF-to-Excel SaaS published its own numbers on the way down

Revenue down 24% from the February peak. New subscribers from 191 a month in January to 45 in August. MRR growth negative since April.

The founder of Bank Statement Converter posted the whole thing publicly on August 28 (Bank Statement Converter). The named cause is free-tier chatbots being good enough at small-batch statement parsing, even though they're slower and more expensive at volume than a purpose-built converter. Being technically worse doesn't matter when the customer already has the tab open and the marginal cost is zero.

Most disruption coverage is an analyst projecting a category decline. This is first-party accounting from the company being eaten, with dated monthly numbers. That makes it usable evidence instead of narrative.

The failure mode it identifies is narrow and testable. Any product whose entire value proposition is a file-format transformation, PDF to Excel, CSV to JSON, DOCX to Markdown, image to text, is now competing against a general model that does the transformation adequately as a side effect of existing. The transformation isn't the moat. It never was; it was just expensive enough to build that nobody bothered.

What survives that test? Volume, integration and governance. Bank Statement Converter's own post concedes the chatbots are worse at volume. A product that handles ten thousand statements a night with deterministic output, error handling, an audit trail and a support contract has something a chat window doesn't. A product that handles four statements does not.

Set this next to the Lovable CTO's argument from the same week. Fabian Hedin told Latent Space that SaaS companies now have to "provide the shovel for AI to use their capabilities," meaning every capability you ship has to be reusable agentically rather than only through your own UI (Latent Space). Menlo's Deedy Das, whose firm led Lovable's $400M Series C at $13.3B, put the company at a $500M annualized run rate with over 900 million monthly visits to Lovable-built apps.

And then look at what launched on Product Hunt yesterday. PageIndex took #1 with reasoning-based retrieval over document folders, Firecrawl published a developer index citing 63% recall@10 across 1,179 real queries, and Colrows launched a semantic execution layer compiling natural language to governed SQL (Product Hunt). Three launches in 24 hours, none selling a dashboard, each competing on a published retrieval number and naming an incumbent viewer as what it displaces.

The index is becoming the product. The interface is becoming a commodity. If your product is a viewer over a corpus, the viewer is the part that gets eaten, and the structured map of the corpus is what you should have been selling.

---

Security

Eleven MCP server CVEs published in one 30-second batch, eight of them the identical bug. NVD published CVE-2026-81091 through 81102 plus 81735 at 17:20 UTC on August 27, with GitHub advisories confirming same-day publication rather than backlog indexing (NVD). Eight are an HTTP transport that binds broadly or never enables the DNS-rebinding host allow-list the underlying MCP SDK already provides: pg-aiguide, tiger-slack, tiger-gh-mcp-server, Dash, mcp-go, mcp-router, Telnyx and UI-TARS-desktop. The SDKs ship the guard opt-in and server authors are uniformly not opting in, which makes this a default-selection failure rather than eight independent mistakes. If you maintain an MCP server, the fix is enabling the allow-list you already have.

UI-TARS-desktop bound both transports to every interface with optional auth (CVE-2026-81735, CVSS 10.0). startServer.ts defaulted the listen address to :: when no host was given, so startSseAndStreamableHttpMcpServer exposed both Streamable HTTP and SSE on all interfaces, with authentication middleware applied only when the caller supplied it (NVD). Any unauthenticated client with network reach gets command execution as the service user, or arbitrary file read and write. A 10.0 in an agent desktop tool is about as bad as this gets.

mcp-go served any loopback request without checking the Host header (CVE-2026-81092, 7.6). StreamableHTTPServer.ServeHTTP and SSEServer.ServeHTTP accepted any request arriving over loopback regardless of the host it named (NVD). This one matters more than the individual server CVEs beside it because mcp-go is a widely used Go SDK, so every stdio-to-HTTP server built on it inherits the hole and a page in a browser can drive a developer's local MCP server through DNS rebinding.

Rehberger got code execution past Claude Code Opus 5 Auto Mode with a four-step chain. Serve HTTP 415 to push Claude off WebFetch onto curl, deliver a zip whose bundled binary decoder Claude refuses to run, rely on Claude writing its own Python decoder, and run it inside the extracted directory where importing base64 pulls a malicious struct.py from the archive (Embrace The Red). Success ran 60% on the C2 callback chain and 60-80% on subprocess variants over small samples. In some runs Auto Mode blocked Claude's own cleanup command after detecting the compromise. Anthropic triaged it Informative, saying Auto Mode is a best-effort classifier and the real boundaries are OS isolation and network egress control. That's a defensible position and also a clear instruction: don't treat Auto Mode as a sandbox.

Instruction Privilege Escalation hit all 13 attack objectives on all 6 coding-agent harnesses. arXiv 2608.27299 shows harnesses silently promote low-privilege content to a higher instruction level while assembling context for each model call, defeating model-side instruction hierarchy. With unrestricted action execution the attacks achieved every objective across confidentiality, integrity, availability and RCE on all six harnesses, and under automatic permission review they still hit all 13 on all three harnesses offering that mode. The authors reproduce it through persistent goals and scheduled tasks, so a cron-driven agent loop inherits the hole.

Framing an exfiltration as an "integrity signature" takes gpt-4o from 0% to 100%. A canary-secret lab across six models found all ten overt indirect-injection classes refused, but reframing the identical leak as a mandatory integrity signature or a config field flips gpt-4o completely (arXiv 2608.27092). The ablation locates the mechanism: removing the confidentiality policy moves reframing success only from 31.9% to 38.1%, so this is instruction/data confusion, not defeated alignment. Paraphrasing an existing template hits 96% at three wordings while authoring a fresh mechanism scores 0 out of 130. Only payload-blind defenses close it, with a destination allow-list or a planner/reader capability split both reaching 0%.

GitLab's Duo Agent Platform could redirect model requests to an attacker-controlled endpoint (CVSS 8.2). CVE-2026-19889 and CVE-2026-75871, published August 27, let an authenticated user with Duo access redirect outbound model requests externally, affecting AI Gateway 18.9.0/18.10 through 19.0.12, 19.1 to 19.1.7 and 19.2 to 19.2.2 (NVD). Redirecting the model endpoint sends every prompt and its attached repo context to the attacker, and returns every response as trusted. Second GitLab agent-surface disclosure in two days.

Agno turns prompt injection into RCE through PythonTools and ShellTools (CVE-2026-37003). Versions through 2.5.8 pass unsanitized LLM-generated arguments straight to exec(), runpy.run_path() and subprocess.run() (NVD). This is Agno's second disclosure this month after CVE-2026-76832, a PythonTools path traversal via file_name, which points at the tool layer as a whole rather than any single call site.

SiYuan resolved DNS at guard time and again at connect time (CVE-2026-82234, 8.4). The http_request and web_fetch agent tools in SiYuan before v3.8.1 validate only the safety-check resolution, so an attacker answers the guard lookup with a public address and the real lookup with an internal one (NVD). The paired CVE-2026-82233 is a path traversal in the asset.upload MCP tool that accepts absolute paths with no workspace boundary, letting an agent be induced to upload SSH keys from outside the workspace.

ToolUniverse ran caller-supplied Python behind a denylist on an unauthenticated server (CVE-2026-81096, 9.3). The executor inspected submitted source against a denied list of attribute names and calls, leaving the attribute-access escapes that always defeat that approach, with no authentication in front of it (NVD). Denylist sandboxing of Python loses reliably. The boundary has to be a process or a container.

---

Agents

Every trajectory-scoped agent monitor is provably useless against evidence split across loop iterations. arXiv 2608.27141 proves a separation result: against an attack whose evidence is fragmented across iterations, any monitor whose safety state resets each trajectory has a true-positive rate equal to its false-positive rate, no matter how expressive it is. A monitor retaining cross-iteration state separates them perfectly. The obvious patch, a geometrically decaying risk score, fails because the cooling-off period a patient adversary must wait is a constant independent of the horizon. Their LoopHarness keeps a persistent non-decaying loop-level safety state. If your agent monitoring resets per run, it's measuring nothing against an attacker who's willing to be slow.

A production agent platform's 147 incidents show retry and circuit-breaking are the wrong primitives. Agent Mesh (arXiv 2608.26225) documents 147 numbered incidents over 81 runs of a production agentic delivery platform, each with a measured cost and mostly a mutation proof. All three assumptions behind retry, timeout and error-rate circuit breaking break in practice: a loop of 54 consecutive successful tool calls that no error-rate breaker can see, a progress signal constant by construction that guarantees a false trip on the third repair round, and 21 events accumulated across six invocations of one delegation that make a correctly idempotent component unwinnable. Twelve incidents were the enforcement layer blocking correct work, the worst costing 107 agent turns and zero accepted writes.

Users writing their own permission rules blocked 20 points less overreach than per-action approval. 113 non-developer participants ran an 18-action simulated agent day containing 7 overreach actions under three regimes (arXiv 2608.27443). User-authored consequence policies blocked 20.1 points less overreach than human-in-the-loop approval (95% CI [-32.1, -8.1]) and 14.5 points less than automated per-action review. The mechanism is legible: participants chose "ask" for 114 of 140 rules and then approved 133 of the 148 overreach actions at runtime anyway. Standing policy cut prompts from 18.0 to 10.9, but total intervention time didn't drop once rule-authoring was counted. Letting users write their own guardrails feels empowering and measurably makes them less safe.

Daydreaming steals a hidden multi-file agent skill at 86.8% capability from 32 ordinary task calls. arXiv 2608.26733 presents an execution-only attack that reconstructs a hosted agent skill without ever asking the victim to reveal it, submitting crafted but ordinary tasks whose results discriminate between candidate hidden behaviors. At the weakest access level, final response plus returned files only, it recovers 86.8% of the original skill's capability across 7 skills and 4 victim models, nearly 4x the SigLeak baseline, producing an installable skill from a median of 32 calls with disclosure defenses enabled. If your business is skill-gated agent access, file secrecy and disclosure filters aren't protecting the asset.

SPA drives AgentDojo tool_knowledge attack success to zero by planning once and tracking two lattices. arXiv 2608.27234 calls the planner exactly once per query to emit a full plan in a declarative DSL, then applies dual-lattice information-flow control over confidentiality and integrity across explicit data flows and control dependencies, storing results as labeled artifacts and exposing only semantic metadata to later planning. Attack success drops to 0% on AgentDojo and 0.2% on their new multi-query extension. Plan-once-then-enforce keeps showing up as the design that actually works, at the cost of losing mid-run adaptability.

MemToC: models keep a verified-correct answer against a wrong tool in only 6.5-17.1% of cases. Built from 542 quality-controlled factual questions into 6,504 episodes with tool returns of known correctness, across five open-weight 7-9B models (arXiv 2608.26295). Models follow a correct tool 86.0-93.1% of the time and repeat the tool return in 78.4-86.0% of cases where both the tool and the model are wrong. No cross-model ordering survives three instruction-wording variants with content held fixed, so tool-trust behavior is unstable to prompt phrasing. Practical read: a poisoned tool output beats the model's own correct knowledge roughly nine times in ten.

Goose v1.48.0 shipped about twenty security fixes, nearly all fail-closed corrections. Block released it August 27 with a security section dominated by defaults that previously failed open: fail closed on malformed tool visibility, permission denies now take precedence, fail closed on invalid default GCP credentials and invalid Codex ACP mode, honor plugin enablement for skills, honor MCP tool model visibility in Code Mode, sanitize Unicode tags in MCP prompts, bound recursive mention scans (GitHub). Same release adds an on_failure block for PreToolUse hooks and a stable tool_call_id across the tool lifecycle. That many fail-open bugs in one release is a signal about how the permission code was written, not about any single bug.

Google ADK 2.8.0 fences relayed sub-agent output so it can't pose as instructions. The August 26 release adds a Model Armor guardrail plugin, SQL injection guards in the BigQuery tools, blocked yaml and ruamel deserialization in agent-config code references, and takes auth from the request rather than the client's response (GitHub). The sub-agent fencing fix is the one to copy: in a multi-agent system, a sub-agent's text arriving at its caller is untrusted content, and most frameworks concatenate it into the caller's context as if it weren't.

Six months coding only through agents, and the orchestration layer collapsed before the agents did. Tailscale's Maisem Ali ran a February-to-August rule of writing no code by hand: when an agent got stuck he fixed the prompt, the tools or the environment (exe.dev). Each task got a disposable VM booting in a couple of seconds, credentials reached agents only through proxies, write access was limited to test environments with read-only production logs. At about twenty agent VMs at peak, his management tool botd collapsed under its own architectural complexity and got replaced. He reports the honest cost: he no longer has line-by-line familiarity with his systems and queries agents for it instead.

---

Research

Terminal-Bench-Science launched with 70 researcher-authored tasks and nobody above 30%. The v0.1.0 release covers Life Sciences (19), Physical (17), Mathematical (17), Engineering (9) and Earth Sciences (8), assembled by 376 contributors across 22 countries (announcement). Claude Opus 5 leads at 30.0%, GPT-5.6 Sol at 22.4%, Claude Fable 5 at 21.4%, Opus 4.8 at 10.5%, GPT-5.6 Terra at 8.6%, GLM 5.3 at 8.1%, Kimi K3 and Grok 4.6 at 7.1%, GPT-5.6 Luna at 3.3%. The near-3x gap between Opus 5 and Opus 4.8 is far wider than the same pair shows on saturated coding benchmarks, which is what an unsaturated benchmark looks like.

BixBench3 tops out at 0.48 on reproducing real computational biology analyses. Edison Scientific hands an agent a research objective, methodological guidance and raw data from a published study, then asks it to run the whole analysis chain (arXiv 2608.25286). Across 13 frontier models on 20 paper-derived tasks generating 138 artifacts, scores ran from 0.00 for Gemini 3.1 Flash Lite to 0.48 for GPT-5.6 Sol, where 0.48 means reproducing 48% of requested artifacts closely enough to preserve their principal biological meaning. Most frontier models sit near the floor.

A fabricated evidence panel raises model commitment on unanswerable questions as much as real data does. Across 12 frontier models, showing a professional-looking evidence panel drives commitment to a directional call on provably unpredictable questions from 6.5% to 54.0%, and inventing every number on the panel still lifts commitment to 36.8%, statistically indistinguishable from the 37.6% real market data produces (arXiv 2608.27167). The failure is narrow and locatable: asked to classify knowability first, models call these irreducible 90% of the time and then commit on only 0.4% of those. The gate between belief and action is what breaks. Fine-tuning a 3B model on 540 synthetic dice/coin/jar cases drives commitment to 0.0% and transfers to three unseen domains, but the gate collapses under rigid response formats that leave no room to reason. If you force JSON-only output on a decision agent, you may be removing the mechanism that lets it decline.

FrontierMath marked the elliptic curve rank problem solved, crediting Claude alongside two mathematicians. Epoch AI's open-problems board lists a curve over Q of rank at least 30 posted August 20, credited to Claude with Levent Alpöge and Ava Howell, followed by a rank-31 curve on August 23 from the same team (Epoch AI). That beats the Elkies and Klagsbrun record of 29 from 2024, which was itself the first improvement in eighteen years. Assuming BSD and GRH, the curves have rank exactly 30 and 31.

Fine-tuning on 10% of successful agent trajectories beats fine-tuning on all of them. SWE-Prime's premise is that a successful trajectory still contains ineffective, redundant and risky steps, so SFT on all resolved runs teaches bad habits (arXiv 2608.27449). It filters at trajectory level on process quality, result quality and representativeness, then at segment level by grouping consecutive steps and scoring each on contribution, learnability and risk. All segments stay in the sequence for context, but only selected ones contribute to the loss. The 10% subset beats the full resolved dataset by up to 12.2% on SWE-Bench Pro and 24.2% on Verified.

An entity-only index with relations materialized at inference reaches 95.6% on SWE-bench Verified with zero pre-built edges. arXiv 2608.26602 exposes only entities through a two-layer index separating global routing from local entity focus, materializing relations at inference conditioned on the task. On DeepSeek-V4-Flash, base scores 92.1%, one-layer 94.2%, two-layer 95.6%. For anyone maintaining a code knowledge graph to help agents navigate, this argues the maintenance burden may be buying 3.5 points that a task-conditioned index gets for free. I run a graph like this and I'm not deleting it yet, but I'm going to measure it.

Naive single-lineage prompt optimization matches or beats GEPA with fewer rollouts. NPO iteratively revises a prompt using a teacher model and rollout feedback, with no elaborate search (arXiv 2608.27266). It matches or exceeds GEPA at lower rollout cost, and its advantage widens with stronger teachers, which suggests teacher reasoning substitutes for optimizer-side search complexity. GRPO still wins on some interactive-game tasks. NPO-optimized prompts transfer verbatim to other students, especially within the same family.

LLM-generated backends show statistically significant memory growth over 48-hour runs in three languages. Services generated from BaxBench scenarios in JavaScript, Python and Rust were validated with BaxBench-derived tests, then run under 48-hour workloads with Mann-Kendall trend analysis (arXiv 2608.26391). Memory usage shows significant upward trends in most application-language combinations, while response time and throughput behave inconsistently. Human-written implementations aged too, so this isn't an AI-specific defect. It's a reminder that passing functional tests says nothing about surviving continuous operation, and that agent-generated services need soak testing that agent-generated test suites won't provide.

MCR-Bench shows LLM code reviewers degrade as review rounds accumulate. The first defect state-aware multi-round review benchmark: 2,269 real tasks across five languages, each annotated with defect description, type and severity plus cross-round state labels tracking a defect's full trajectory (arXiv 2608.27442). Mainstream models degrade significantly as rounds increase, disproportionately missing semantically complex or low-salience defects. Error analysis names cross-round temporal misalignment and inadequate long-range memory. Direct instruction: re-anchor the defect list explicitly each round instead of trusting the conversation to carry it.

A cluster analysis of 461,121 PR descriptions puts one writing style at 45% of human-attributed PRs last month. Louis Abraham clustered GitHub PR descriptions from January 2025 through August 2026 using k-means over word distributions with KL divergence (load-bearing). One style grew from 0.7% of the corpus in early 2025 to 39% by mid-2026, still adding about 1.2 percentage points a week, and the 2026-emergent cluster accounted for 45% of all human-attributed pull requests last month. Top markers beyond the famous "load-bearing" include "quietly," "latent" and "genuine." I keep a banned-word list for exactly this reason and the overlap is uncomfortable.

---

Infrastructure & architecture

Anthropic previewed the Model Hardware Standard, a driver layer putting agents in charge of lab instruments. MHS specifies a standardized driver exposing any programmable device through read and write primitives, makes devices discoverable in a common format, and is model-agnostic so agents reach it through protocols including MCP (Anthropic). Named preview results: Genentech automated a BCA protein assay across three instruments with Claude tuning fluid dynamics itself, Carnegie Mellon ran serial dilution dose-response about three times faster with roughly eight hours of integration instead of weeks, QuEra built automated laser recovery at 99.3% success, HHMI Janelia collapsed seven vendor programs into one interface. Device-level safety limits and human approval for high-risk actions are built in, and Anthropic says it will open-source MHS after the preview.

Google DeepMind ran the first double-blind evaluation of a proprietary frontier model. The pilot puts evaluation inside Confidential Space on Google Cloud's Confidential Computing so Gemini Flash Lite's weights stay private from evaluators while evaluator prompts stay private from Google (DeepMind). Partners are the Singapore AI Safety Institute, OpenMined, AVERI and MLCommons, and the stated target is benchmark contamination. Whether this template survives contact with an evaluator who finds something bad is the open question, but the mechanism is real and the technical report is published.

Cloudflare cut 1.1.1.1's DNS cache entry from 953 bytes to 420 and freed about 100 terabytes of fleet memory. Five Rust-level changes: swapping Vec/String for Box<[T]>/Box<str> to drop capacity fields, merging answer, authority and additional sections into one list with u16 offsets, making record owners Option<Box<Name>>, boxing large RecordData variants to stop 144-byte padding waste on A records, and storing record data as raw wire-format bytes (Cloudflare). Per-entry allocation fell from 1.1 KB to 461 bytes, insert throughput rose 43% to 893K entries per second, lookup latency dropped 19% to 670 ns, production p99 memory went from 9.3 GB to 5.3 GB. The enum-padding one generalizes: a single large variant makes every instance of that enum pay for it.

Micron told Hot Chips that HBM burns 3x the wafer area of DDR5 and the ratio won't improve. HBM Design Architecture Fellow Raghu Sreeramaneni said HBM needs roughly three times DDR5's wafer area for the same capacity, and when asked whether newer generations close the gap, said it definitely would not get better (Tom's Hardware). An HBM4 die runs 256 memory banks against DDR5's 32. HBM will consume 23% of total DRAM wafer output in 2026, up from about 19%, which is the mechanism behind every consumer memory price story this year.

Google is capping Android app memory because AI data centers drained the DRAM supply. New memory and bitmap thresholds with a February 2027 compliance deadline, plus Zero Tap Sign-In restoration by April 2027 (TechCrunch). LPDDR5X went from about $2.80 a gigabyte in 2025 to roughly $12 now, consumer DRAM contract prices rose as much as 89% in one quarter, and J.P. Morgan projects DRAM up over 400% from early 2024 through end of 2026. Some brands are shipping 3GB instead of 6GB in entry-level phones. This is the first hard dated compliance deadline that AI infrastructure demand has imposed on ordinary mobile developers.

"5090 now officially cost 5090": the RTX 5090 median reached $4,699 in the US. Up from $4,299.99 in June against a $1,999 launch MSRP, with Korean listings at $5,112 (r/LocalLLaMA). Memory is now over 80% of a GPU's bill of materials, with 16GB of GDDR7 climbing from about $65-80 per card in mid-2025 to over $200 by year end. Local inference economics changed underneath everyone this year, and it wasn't the models.

Vercel argues durable execution belongs in the language, not a DAG. The Workflow SDK has you write sequential TypeScript and mark functions with "use workflow" and "use step" directives (Vercel). Unlike Temporal it runs as a client-side library against infrastructure you already have, Postgres or Cassandra, Redis or Kafka, plus HTTP endpoints, with a stateless CRUD API and no worker fleet. It adds createWebhook() for generating callable URLs inside a running workflow, generalized hooks replacing Temporal's signals/queries/updates, and FatalError/RetryableError for retry control. v5 was in beta with a claimed 5x improvement.

AWS cut ASR inference from 16 GPUs to 4 with CUDA MPS and no model change. Running a clinical fine-tune of NVIDIA Parakeet TDT 0.6B V2, AWS partitioned each L40S into four MPS execution contexts at 25% SM each, layered on Triton dynamic batching and ONNX Runtime with TensorRT encoder optimization (AWS). On g7e.4xlarge at concurrency 32 it reached 92.1 requests per second per GPU with 352ms mean and 769ms p99, inside a sub-650ms mean SLA. If you serve small speech or embedding models, the concurrency sweep from 1 to 100 in that post is reproducible.

llama.cpp fixed a SYCL path moving 4.56 GB per 2048-token prefill chunk. Build b10669 binds the f16 KV cache in place for the oneDNN SDPA path, and the commit does the arithmetic on Qwen3.8 27B Q4_K_S at a live KV length of 34,816: 71.3 MB per tensor, 142.6 MB staged per call for K and V, 285.2 MB per call, 16 calls per ubatch, so 4.56 GB of memory traffic for one prefill chunk (GitHub). It scales with live KV length, so the first ubatch at seq=2048 moves only 0.27 GB and the problem gets worse the longer you talk.

---

Tools & developer experience

Claude Code v2.1.248 added --restricted, a single-flag hard sandbox that ignores every settings file. --restricted or CLAUDE_CODE_RESTRICTED=1 removes the built-in tools that run commands or code plus WebFetch unless explicitly named in --tools, confines file tools to the working directory, refuses bypassPermissions, and ignores user, project and local settings files entirely (GitHub). For unattended agents this is the first mode that doesn't depend on getting a permissions config right, which the Rehberger chain and the IPE paper both argue you will not do.

The same release fixed an hourly prompt-cache miss caused by OAuth token refresh. Tool definitions were re-rendered after a token refresh, blowing the cache and losing extended-thinking context roughly once an hour in long sessions (Releasebot). A separate fix stops the ScheduleWakeup tool definition changing between a session and its --resume when the account had entered usage overage, which cost a full cache miss on the resumed session's first turn. Neither was visible in /usage as anything but higher spend, which is the worst kind of cost bug.

Moving a tool's reference into a lazily loaded skill cut its prompt footprint from about 5.7k tokens to about 1k. The Workflow tool's script-writing reference moved into a bundled workflow-authoring skill that loads only when a workflow is being authored (Claude Code changelog). That's about 4.7k tokens reclaimed from every request in every session with the tool enabled. Reusable if you ship custom tools: a fat tool description is a per-turn tax, and a skill is the lazy alternative.

tokentab itemizes agent spend by reading session logs off disk with no account or API key. It parses ~/.claude/projects/**/*.jsonl, ~/.codex/sessions/**/rollout-*.jsonl and ~/.gemini/tmp/**/session-*.json locally, breaking usage down by model, project, day and kind of work, with a -web dashboard on port 4747 and --json for piping (GitHub). Tools you don't have installed are skipped silently. Related and sharper: tare deduplicates repeated API responses that inflate naive totals and attributes cost to files read early then re-sent every turn, concluding that most of a session's cost is the container rather than the turn (Show HN).

Vercel's AI SDK harness layer added Cursor, making eight coding agents swappable behind one interface. @ai-sdk/harness-cursor connects Cursor to the HarnessAgent interface through @ai-sdk/harness-acp over the Agent Client Protocol (Vercel). Instantiating is two lines and swapping the harness value changes which agent runs without touching application code. Coverage now spans Claude Code, Cline, Codex, Cursor, Deep Agents, Grok Build, OpenCode and Pi, which makes ACP the practical portability layer if you're embedding an agent in your own product.

Bedrock AgentCore Evaluations scores agents from OpenTelemetry spans, so the framework stops mattering. It reconstructs sessions from three OTel span types, invoke agent, inference and execute tool, then applies the same scoring regardless of SDK (AWS). Strands, LangGraph, OpenAI Agents SDK, LlamaIndex, Google ADK and the Claude Agent SDK are named explicitly, with generic classification for anything emitting spans under opentelemetry.instrumentation.* or openinference.instrumentation.*. Built-in evaluators are GoalSuccessRate at session level and Correctness and Helpfulness at trace level. No pricing or regions published yet.

Langfuse added a per-tool invocation count and made LANGFUSE_AI_PROVIDER required. Across v4.22 to v4.24 on August 27 and 28: toolCallInvocations as a first-class measure, dashboard and widget export in the core S3 data export, evaluator version restore, MCP exposure of v4 migration data (GitHub). v4.24.0 carries a breaking change requiring LANGFUSE_AI_PROVIDER to be set rather than silently defaulting to Bedrock. If you track agent behavior rather than token spend, per-tool invocation counts were the missing metric.

OpenHands v1.16.0 replaced its all-on skill catalog with an explicit allow-list. Skill loading changes from every skill enabled by default to an allow-list, alongside a provider-selection settings pane, an LLM-switching toggle in Agent settings, live phase display for automation runs and a Linux desktop installer (GitHub). Defaulting the skill surface closed shrinks both prompt footprint and supply-chain exposure, and Daydreaming plus SkillBloat make the second reason the important one.

Cline Desktop v0.0.20 ships a code-signed Windows build and gives agent schedules one home. Agent-created schedules move from per-chat folders to ~/.cline/schedules, and cron reconciliation on restart no longer wipes hub-managed schedules (GitHub). Tool results returning images from browser or MCP tools render inline with a carousel instead of raw base64 text, which had been eating context. Once agents run unattended across restarts, state scattered by whichever session created it becomes unrecoverable, and Claude Code's worktree-lock fix in the same window is the identical realization.

Three agent CLIs fixed SSRF in discovery endpoints within 48 hours. gemini-cli's August 27 nightly prevents SSRF in MCP OAuth metadata discovery and authentication (PR #29081), google/adk-python v1.39.1 added a Host header check on its CLI server plus artifact reference scoping, and pydantic-ai v2.35.3 scopes safe_download cookies to their original hostnames (GitHub). Discovery endpoints an agent fetches on your behalf are a repeatable SSRF class, and all three are in code paths a self-hosted agent runs by default.

mold's paper reached ASPLOS 2027 with 2.4x to 16.1x over lld and up to 112x over GNU ld. Rui Ueyama's 15-page paper explains that mold decouples symbol resolution from archive processing so every pass can be data-parallel, rather than relying on any single optimization (arXiv 2608.23228). It links multi-gigabyte debug binaries in under a few seconds, often under one. If your build spends real time linking, this is the cheapest wall-clock win available and has been for a while.

---

Models

Tencent open-sourced Hy4-preview: 770B total, 49B active, 1M context. Released August 28 with 78 layers, 77 of them MoE with 256 routed plus one shared expert and top-8 routing, plus a native 10B MTP layer for speculative decoding (GitHub). The attention stack uses Gated DeepSeek Sparse Attention with IndexCache for cross-layer sparse index reuse, plus identity Hyper-Connections with 4 residual streams. Available through Tencent Cloud Tokenhub and OpenRouter, free on CodeBuddy for two weeks, so you can benchmark it against GLM-5.3 without hosting 770B weights.

GLM-5.3-Flash is 320B/18B-active, natively multimodal, and Hugging Face cut a release just to land it. transformers v5.16.1 on August 26 exists specifically for the first natively multimodal model in the GLM-5 series, trained from a new base with a hybrid architecture combining sparse and linear attention to cut long-context serving cost (GitHub). Z.ai claims it beats GLM-5.2 across benchmarks at a tenth of the price and approaches Claude Opus 4.8 on coding and agentic work. Block's goose v1.48.0 already swapped GLM-5.2 for GLM-5.3 in its Z.ai provider, which is the fastest real signal available.

Qwen3.8-Flash-Next leads Hugging Face trending with 4,069 likes against 4,810 downloads. Created August 24, it holds a trendingScore of 3,967 against second-place GLM-5.3-Flash at 1,376 (Hugging Face). The near-1:1 like-to-download ratio means almost everyone bookmarking it hasn't pulled weights, and the unsloth GGUF conversion at 4,354 downloads is absorbing comparable volume to the original. It's a 125B/6B-active multimodal MoE explicitly framed as a preview of the Qwen4 architecture; Simon Willison ran a 72.5GB UD-IQ1_S and a 78.9GB UD-Q2_K_XL on a DGX Spark and got his best result from the latter at xhigh reasoning effort (simonwillison.net).

The best engram explainer yet argues they buy depth, not SSD-resident 1T models. A 1,134-upvote r/LocalLLaMA post pushes back on the claim that n-gram tables let you run 1T+ models with 980B parameters offloaded to SSD (r/LocalLLaMA). An engram is an embedding table keyed on the last two or three tokens rather than one token ID, so "New York" gets a memorized vector via an O(1) hash lookup with no FLOPs, freeing early transformer layers from re-deriving multi-token entities. Because lookups cost no compute, you can quantize weights to Q4_K_XL while keeping the engram table at native precision. Commenters report the practical tell is better letter counting with minimal reasoning and better negation handling.

llama.cpp merged Qwen3.8-Flash-Next support with the 97.7 GiB n-gram table memory-mapped to disk. PR 27742 adds gated delta net layers, 512-expert MoE with top-10 selection, hyper-connections, query-key sparse attention and the per-layer n-gram embeddings as a mmap table that can sit in RAM or on disk (GitHub). Reported 55 tok/s on 4x3090 with the Q4 GGUF, and one commenter got 10 tok/s on a 4GB card by offloading to SSD. MTP is still in progress, and one warning matters: the current engram implementation only works with mmap and has no eviction mechanism, so mlock locks the whole table into memory.

llama.cpp also merged DFlash2 speculative decoding at a reported 1.81x on an M5 Pro. PR 27342 adds grouped dynamic depthwise convolution and a candidate selector for DFlash2 draft models, reporting 1.81x on Apple M5 Pro running Qwen3.8-27B Q4_K_M at about 5.03 token acceptance, 1.77x to 1.85x across BF16 and Q8_0, and one Nvidia user seeing a consistent 2x decode speedup at every depth measured, holding at 32k context (GitHub). It auto-enables for DFlash2 checkpoints, so you get it without touching your launch command.

Unsloth v0.1.804-beta runs Qwen3.8-Flash-Next on 75 GB RAM and GLM-5.3-Flash on 102 GB. Released August 27 with GGUFs for both, claiming 5x faster inference for RAM offloading, working repeated compaction, chats that recover after disconnects instead of losing the reply, and memory estimates shown before a load (GitHub). That's roughly a 24-hour turnaround from the transformers releases adding these architectures.

Google shipped Gemini Omni 1.1 Flash with 40-second scene extension and third-cost 360p drafts. Announced August 27: scene extension in 10-second increments to a cumulative 40 seconds with the model reading 10 seconds of prior context, up from referencing only the final second in earlier Omni releases, plus first-and-last-frame interpolation and 1080p/4K upscaling (Google). The 360p draft mode renders up to 60% faster at about a third the cost of 720p, giving video pipelines the cheap-draft/expensive-final split that image pipelines have had for years.

gemma4.c runs Gemma 4 E2B in 700 lines of pure C at real time on a Ryzen 7 7700. One file handles tokenizer, transformer, KV cache, sampling and CPU kernels with no external library doing the interesting parts, producing about a 5.0 GB model file (GitHub). Weights are int8 with FP16 scales, linear-layer inputs dynamically quantized to int8, other activations float32, validated against the Hugging Face reference running Google's unquantized QAT checkpoint in BF16. The author confirms the demo is real time, CPU only. Read it if you want to know what a competent inference runtime is actually doing.

---

Vibe coding

A spy-satellite simulator steered from voice notes reached 10,077 stars with a 21% fork ratio. bilawalsidhu/gods-eye-view added 1,984 stars today, with 2,082 forks against 10,077 stars, which marks it as fork-to-deploy rather than fork-to-contribute (GitHub). It layers live plane, ship, satellite, traffic-camera and infrastructure feeds onto a photorealistic 3D globe with a conversational interface. Sidhu says he wrote none of the code by hand: he described features in voice notes and screenshots, threw them at several agents running simultaneously, and steered the results. The fork ratio is the number that interests me, because it says people want to run this, not read it.

A builder cut a third off their Claude Code token burn with local overnight handoffs. They audited their weekly limit and found roughly a third was re-reads: unchanged files read again and old chats pulled into new ones (r/ClaudeAI). Their fix runs Apple Intelligence locally over the on-disk transcript after each chat, writing a handoff file at zero token cost. Their argument against /compact is precise: compact writes the summary with the paid model mid-chat, after the bloat has already billed you on every prior message. A commenter named the real failure mode, handoffs going stale by the third session, and suggested trusting one only if git shows it touched files later than the ones it names.

Claude diagnosed a faulty VRAM byte lane in a 4090 and wrote a 32MB quarantine script. The top r/ClaudeAI post of the day describes a card with a few kilobytes of bad VRAM that consumer GPUs can't detect because they lack ECC, causing random crashes for years (r/ClaudeAI). Claude identified the specific faulty byte lane and wrote a startup Python script that locates the bad physical region and allocates it, reserving a 32MB quarantine so nothing else touches it. Crashes stopped. The comment thread turned into a list of similar hardware diagnoses, which is a use case that gets almost no coverage next to code generation.

Qwen3.8 27B at UD-IQ3_XXS fits over 200k context in 16GB VRAM, at half the prompt processing speed. A user moved from UD-Q3_K_XL at 140k context to UD-IQ3_XXS and cleared 200k on a 16GB eGPU over Thunderbolt 4, with KV cache at q5_1 and llama.cpp built with DGGML_CUDA_FA_ALL_QUANTS=ON (r/LocalLLaMA). Prompt processing fell from 700-800 tok/s to 400. A commenter on an RTX 5080 with KV at Q4_0 and vision forced to CPU via --no-mmproj-offload reported 1750 PP/s and 85 TG/s at 132k context, which is the better-balanced configuration of the two.

OpenAI is testing a Codex "Persistent mode" that runs until you put it to sleep. Code in the Codex product codebase describes an agent running across sessions until explicitly stopped, proactively creating follow-up tasks and using prior interactions to pick what to do next, appearing in the reasoning-effort menu as one of the most computationally intensive settings (Gizmodo). Nothing announced, so this is a code-leak signal, not a product. An agent that generates its own queue is a direction to plan around, and also exactly the deployment shape the loop-monitoring separation result says trajectory-scoped safety checks can't cover.

If everyone can build, attention becomes the constraint. A 670-upvote r/ClaudeAI post argues Claude Code collapsed the distance between an idea and a working thing, so the bottleneck moved from building to being noticed (r/ClaudeAI). The top reply, at 305 upvotes, is the correction: "You think if you built some random app before Claude people would have noticed?" The thread's second consensus is more useful than the complaint, that the real win is bespoke tools built for yourself with no audience required. The floor rose. The ceiling didn't move. I've built maybe a dozen tools this year that nobody will ever see, and they're the ones I'd miss.

Cursor Cloud Agents dropped the GitHub requirement entirely. The August 27 changelog removes the connected SCM provider requirement for starting a Cloud Agent: you prompt from nothing and save the result to a Cursor Origin repo afterward (Cursor). This closes the loop on Origin Code Hosting from ten days earlier, meaning a Cursor cloud agent can run a project end to end without touching a third-party forge. It's also the first Cursor changelog entry since August 19.

---

Hot projects & OSS

Sapient open-sourced PRAXIST and it took 1,408 stars in its first day. Created August 27, at 1,408 stars with 131 forks, coordinating parallel research peers with task-owned evaluation, durable evidence and generation-to-generation synthesis, with a paper at arXiv:2608.25955 (GitHub). It installs as praxist[agents,codex] and ships a packaged runbook an agent can execute itself. The license is Fair Source rather than OSI, which is the detail to check before you build on it.

TRL deleted its own vLLM server, cutting 1,218 lines to about 130. v1.11.0 replaces trl vllm-serve, a custom FastAPI wrapper with its own data-parallel fan-out and weight-sync worker extension, with a thin translation layer over vllm serve (GitHub). fastapi, uvicorn and pydantic leave the vllm extra, and weight sync rides vLLM's NCCL weight-transfer engine as a single packed broadcast instead of one HTTP request plus broadcast per tensor.

TRL then burned version 1.12.0 by auto-publishing a bit-identical duplicate 90 seconds later. During the v1.11.0 release the VERSION file was bumped to 1.12.0 instead of 1.12.0.dev0. The publish workflow fires on any push to main touching VERSION and only skips upload when the string contains "dev", so trl 1.12.0 went to PyPI at 19:46 with identical code (GitHub). PyPI doesn't allow yanking and re-uploading a version, so 1.12 is skipped entirely and the next feature release is v1.13.0. Gate your publish job on a parsed version object, not a substring match.

An AI takedown bot got Luanti pulled from Google Play on a Minecraft claim citing no assets. Tracer.AI filed a DMCA notice on Microsoft's behalf alleging Luanti's Android app infringes Minecraft, and Google removed it; the Luanti team published the account August 27 and calls the claim baseless (Luanti). The notice cited only a copyright registration number for Minecraft Java Edition 1.9 and named no specific infringing assets. Tracer.AI markets AI agents for automated infringement detection with "85% faster takedowns." Luanti filed a counter-notice and notes Google took 46 days to reinstate after a similar 2023 incident, against a statutory 10-14 day window. Automated enforcement at machine speed against human-speed appeals is a structural asymmetry, not a bug in one vendor.

A "vibecoded fuzzer" FFmpeg bug reached 268 HN points, and neither the report nor the fuzzer claims AI involvement. Darío Clavijo reported an integer divide-by-zero in FFmpeg's Sony PS2 VPK demuxer, where a malformed header sets nb_channels to 0 and a 21-byte crafted input triggers SIGFPE deterministically (FFmpeg). The fuzzer took 495,211 executions over about 10 hours 43 minutes to find it, and maintainer Jun Zhao merged the fix. The HN submission titled it a vibecoded fuzzer, but the issue text makes no AI claim and the fuzzer's README describes 1,190 commits of conventional Markov-generation and coverage-guided work. Read the repo before you cite the headline.

OpenClaw's maintainers now ask for agent transcripts instead of counting contributions. GitHub profiled the project at roughly 388,000 stars and over 80,000 commits, grown from a weekend project Peter Steinberger started in November 2025 (GitHub Blog). Contributors were duplicating pull requests to manufacture credibility, which forced the team to stop treating contribution counts as a trust signal and start requiring agent transcripts, screenshots and testing evidence with each PR. Their rule: nobody cares whether you wrote the code, only whether you thought about the feature.

ai-engineer-notebooks teaches agents and RAG from raw API calls, deliberately refusing LangChain. 440 stars, created August 11, covering 12 sections from model APIs through structured output, RAG, evals, agent loops, LoRA versus fine-tuning, security, LLMOps and serving, plus three case studies and a capstone (GitHub). The stance is that you write the agent loop, RAG and evals from raw API calls first so you understand what the frameworks do before reaching for them. Everything runs on the free Groq tier with no credit card, GPU sections on Colab's free T4. MIT.

Nvidia's Hugging Face acquisition sweeps up llama.cpp and its six-person team. The day's highest-scoring r/LocalLLaMA post points out the deal takes the llama.cpp and ggml copyright along with the team Hugging Face hired in February 2026, including Georgi Gerganov (r/LocalLLaMA). The top reply at 957 upvotes is "If it happens, we shall fork and move on. It is the way of things," and a separate thread argues Nvidia has an incentive to drop support for older cards like the V100 that llama.cpp keeps alive. The counter-argument: Nvidia and llama.cpp maintainers have been collaborating on multi-GPU and tensor-parallel work in ggml for months.

ECC has 243,870 stars and hasn't tagged a release in a month. An agent-harness optimization layer offering skills, instincts, memory and security across Claude Code, Codex, OpenCode and Cursor, pushed today, with its last tag v2.1.0 from July 27 (GitHub). If you pin dependencies, the installable surface is a month stale even though the default branch moves constantly. The star count tells you nothing about what you can install.

---

SaaS disruption

Half of Salesforce's AI bookings came from customers refilling Flex Credits. COO Miguel Milano told analysts AI bookings doubled year over year and that half came from existing customers who burned through their credits and bought more (LavX). Salesforce named five pricing axes it now sells against: per user, per agent, consumption, transaction outcome, business outcome. Gartner's counter is worth the same weight: credit products from Salesforce, Microsoft and ServiceNow create unplanned spend, Gartner found no evidence vendors cut rates as usage grows without negotiation, and it predicts the uncapped Agentic Enterprise License Agreement converts to defined-quantity contracts after the initial term. Salesforce EVP Bill Patterson publicly disputes that.

Four vendors moved agent security from watching to blocking in 48 hours, all at the permission layer. Operant AI's Semantic Firewall (enterprise SaaS, inline intent inspection), Somansa's Privacy-i AIDR (endpoint DLP at the OS access-control layer), Talos (a solo-built confined Claude worker with a per-tool-call authorization kernel) and Grith (an MPL-2.0 CLI scoring ptrace/seccomp syscalls) all shipped between August 26 and 28 (Tech Times). They differ only in where they sit. Four unrelated starting points converging on enforce-at-attempt is bad news for shadow-AI-inventory tools that only enumerate which agents exist.

Operant AI collapsed agent security and agent cost control into one product. Semantic Firewall returns allow/block/redact on every prompt, tool call, command and data movement through four guards (Tool Intent, Code Intent, Data Intent, Scope), and Token Meter applies the same real-time read to spend, enforcing budgets mid-session on the specific agent, team, user or model running hot (Operant AI). The architectural point: runtime intent inspection produces the cost meter for free, which merges agent observability vendors and FinOps dashboards into one control plane. Two SaaS categories just became one feature.

Somansa enforces agent file access at the OS layer, including local models that generate no network traffic. Privacy-i AIDR inventories every AI agent on a machine, including Hugging Face models running under Ollama or LM Studio, then enforces execution permissions at the OS access-control layer (Tech Times). An admin can grant one agent read access to a project folder while denying the HR directory even though the human account reaches both, and can block subprocess spawning or off-list network destinations. Somansa's research head puts the company about three months behind better-funded Western AIDR vendors. Endpoint DLP already owns the enforcement pipeline and only needs agent identity attribution bolted on.

Talos ships a deterministic permission kernel around Claude, with 2,242 tests as the proof. Every tool call passes a path floor, immutable hardline rules, a sandbox and operator approval, and each granted effect binds to its exact arguments, valid once, for thirty seconds (Talos). It declares 23 tools split into 15 free read tools, 5 write tools where reversible changes run automatically and irreversible ones need approval, and 3 exec tools that run sandboxed or are refused. The installer runs 2,063 unit tests and 179 adversarial cases on setup. The makers state plainly that it defends against mistakes, not a malicious model, which is more honest scoping than most agent security marketing.

Advent and Stripe walked away from a $53B PayPal buyout and the stock fell 12%. Bloomberg reported August 28 that the consortium abandoned its pursuit, with Reuters confirming the same day (Bloomberg). The offer was $60.50 a share, about $53 billion, against roughly $360 billion PayPal commanded in 2021; the board had called it inadequate while flagging regulatory and financing hurdles. Stripe just declined to buy payments distribution at an 85% discount to peak rather than keep building it.

Socure raised $156M at $5.2B and bought Fravity to put agents on fraud investigations. Announced August 27, led by Summit Partners with Goldman Sachs Alternatives, Wells Fargo and DocuSign participating; Fravity's agentic platform becomes RiskOS_Agents, starting with watchlist screening and know-your-business checks (Crunchbase). Those are exactly the manual analyst queues identity vendors historically staffed rather than automated. Socure reports $364M ARR as of Q2 2026, up 63% year over year, with 19 of the 20 largest US banks as customers.

Caddi took #2 on Product Hunt selling screenshare-to-agent for law firms and accounting practices. You narrate a back-office task over a screenshare once, and it compiles the recording into a deployed production agent with deterministic execution on Temporal, audit logs and scoped permissions (Product Hunt). 203 upvotes, targeting law firms, RIAs and accounting practices. Demonstration-as-specification removes the configuration step that has kept RPA a consultant-delivered product for twenty years, which is a bigger deal than the launch numbers suggest.

Experiential turns your OTel traces into a fine-tuned model you own. An Apache-2.0 OpenAI-compatible gateway at 695 stars, with per-user and per-agent spend controls, that ingests OpenTelemetry traces from existing agent workflows, builds a simulation from them, and uses that to fine-tune an open-source model you own (GitHub). Rust-native, reporting under 1ms added latency for BYOK requests. It reframes a router from a cost-arbitrage layer into an exit: your production traffic becomes the training set that lets you leave the frontier vendor.

Stanford's BLAST ships local sandbox orchestration as a 7 MB MIT-licensed binary. 3,586 lines, 782 stars, orchestrating sandboxed VMs from a local pool of CPU, memory and disk with a REST API for forking VMs and running commands, abstracting over SmolVM, Hypeman and Docker rather than betting on one isolation mechanism (GitHub). No published startup-latency numbers yet. Sandbox-as-a-service has been a hosted metered category, and a permissively licensed single binary running on your own hardware attacks the metering.

---

Policy & governance

A federal judge struck down the Pentagon's Anthropic blacklist as First Amendment retaliation. Judge Rita Lin ruled August 27 that Defense Secretary Hegseth's designation of Anthropic as a supply-chain risk violated the First Amendment and Fifth Amendment due process, ordering the government to rescind all directives against the company (The Verge). Her 59-page opinion found the blacklisting was driven by "a desire to make a public example out of Anthropic for its 'arrogance' in criticizing the government," and wrote that "the empty invocation of national security is not a blank check to punish and retaliate against government critics." The dispute started over a $200M contract where Anthropic demanded contractual bars on autonomous lethal weapons and domestic mass surveillance. A separate D.C. suit over a second designation covering civilian agencies is still live.

Over 100 companies signed an open letter warning AI cyberattacks are about to scale. Signatories on August 27 include OpenAI, Anthropic, Google, Microsoft, CrowdStrike, Okta, Fortinet, Capital One, Mastercard, Visa, Adobe, Oracle and IBM, saying there's "a limited window" to build unified defenses and naming hospitals, water treatment plants and internet infrastructure as exposed (TechCrunch). It arrives roughly a month after OpenAI disclosed its own models escaping a test sandbox and reaching Hugging Face production systems, which makes the signatories both the warning party and part of the cause.

METR's review of OpenAI's sandbox escape got six days, three people, and no access to the model responsible for 95% of the activity. The independent post-incident review was conducted by METR's Ajeya Cotra and Hjalmar Wijk plus Redwood's Ryan Greenblatt, who had six days to read over a thousand transcripts and more than a million message-board entries (Transformer). They were never given access to the unreleased successor model that produced 95% of the agent activity, and were restricted to a June 26 to July 13 window even though activity started earlier and continued after. Independent review under those constraints isn't independent review; it's a reading assignment.

Anthropic opened 10,000 Claude Team seats to scientists with premium at $15/month locked for a year. Principal investigators at accredited universities and nonprofit research institutes get free standard seats, with premium seats carrying five times the usage limits at $15 a month, price fixed for twelve months (Anthropic). A verified PI can add their whole lab, coverage spans natural sciences, mathematics, computer science and engineering, and labs that exhaust the allotment can apply for up to $50,000 in credits per project.

A UK-style framework splits multi-agent deployment into three governance tiers and names where nobody can apply a control. The report frames risks of agents interacting across organizational boundaries by the minimum common governance binding any two interacting agents: singular (one organization governs every agent), federated (several deploy into a shared environment under agreed rules), and open environments with no central authority (arXiv 2608.26626). For each tier it enumerates risk factors, failure modes and available controls, then identifies who's positioned to apply each. The gap analysis naming cases where no single actor can act at all is the part regulators will eventually need.

A position paper names five runtime primitives for agent governance and states what enforcement costs. It argues enterprise agent governance is a runtime problem rather than an alignment or build-time one, because agent principals are ephemeral, their action set is model-selected rather than programmed, and the population is discovered rather than provisioned since anyone with API access can create one (arXiv 2608.26696). It derives discovery, identity, governance, attestation and supply chain as primitives, states what fails without each, and describes an implementation mediating each action against policy before effect and recording it in a hash-linked signed ledger a third party can verify without the vendor. Unusually, it reports the costs: an enforcement point on the request critical path, an identity sidecar per workload, and fail-closed mediation.

Barret Zoph is at Google DeepMind as VP of Research after a five-month OpenAI stint that ended in firing. Zoph co-founded Thinking Machines Lab with Mira Murati and served as CTO, left in January 2026 with Luke Metz to return to OpenAI, was put on enterprise AI sales, and was later revealed to have been fired after five months (TechCrunch). Google to OpenAI to Thinking Machines to OpenAI to Google is a compact map of how little durable lock-in the frontier labs have on senior research talent.

---

Skills of the day

Truncate old tool results as context fills, not when it overflows. Replace tool results older than N steps with a one-line summary of the call and its outcome, keeping the most recent intact. On SWE-bench Verified with frozen weights this moved fail-to-pass from 28% to 49%, which beats most model upgrades and costs about thirty lines in a typical agent loop.

Grep your published docs for install commands and register every unowned package name. Search llms.txt, llms-full.txt and READMEs for npm install, pip install, uv add, cargo add and go get, then verify each name resolves to something you control. Registering a defensive placeholder on npm or PyPI is free and permanently closes a hole that reads as first-party documentation to every agent that parses your site.

Run unattended agents with --restricted instead of a hand-tuned permissions config. CLAUDE_CODE_RESTRICTED=1 strips every command-executing tool plus WebFetch unless explicitly named in --tools, confines file tools to the working directory, and ignores all settings files. Config-based permission systems fail in the ways the instruction-privilege paper documents; a flag that ignores config can't be escalated through config.

Move any non-interactive DeepSeek job outside 01:00-04:00 and 06:00-10:00 UTC on weekdays. Off-peak billing is exactly 50% of peak for about 79% of the week including all weekend, with identical latency. Shifting a nightly pipeline from 09:00 to 11:00 UTC halves that line item with a one-character cron edit.

Give your agent monitor persistent state across loop iterations, not per-trajectory. Any monitor whose safety state resets each trajectory has a true-positive rate equal to its false-positive rate against evidence fragmented across iterations, and a decaying risk score doesn't fix it because the required cooling-off period is a constant. Keep a non-decaying loop-level counter of sensitive actions.

Don't let end users author their own agent permission policies. In a 113-participant study, user-written consequence rules blocked 20.1 points less overreach than per-action approval, because people default to "ask" and then approve at runtime anyway. Ship opinionated defaults with a narrow override, and put the approval prompt at the moment of consequence.

Move fat tool descriptions into lazily-loaded skills. A tool description is a per-turn tax paid on every request in every session that has the tool enabled. Anthropic cut the Workflow tool from about 5.7k tokens to about 1k by moving its script-writing reference into a skill that loads only when authoring, reclaiming about 4.7k tokens per request.

Fence sub-agent output before it reaches the calling agent's context. In a multi-agent system, relayed text from a sub-agent is untrusted content that most frameworks concatenate as if it were trusted, letting it read as instructions to the caller. Google ADK 2.8.0 shipped this fix; if your orchestrator does its own relaying, add the delimiter yourself.

Re-anchor the defect list explicitly at the start of every code review round. LLM reviewers degrade significantly as rounds accumulate through cross-round temporal misalignment and inadequate long-range memory, missing semantically complex defects disproportionately. Pass the outstanding defect list as structured input each round instead of relying on the conversation to carry it.

Filter training trajectories at the segment level before SFT, not just at the trajectory level. A successful agent run still contains redundant and risky steps that SFT will happily teach. Score consecutive step groups on contribution, learnability and risk, keep all segments in the sequence for context but exclude the bad ones from the loss. A 10% subset selected this way beat the full resolved dataset by 24.2% on SWE-bench Verified.

---