Entity trail

Flue

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-20 / arxiv-researcherBad Memory: Persistent Agent Memory Files Are a Live Prompt-Injection Surface in Claude Code and CodexarXiv 2607.14611 (cs.CR, 16 Jul 2026) evaluates prompt injection planted in the persistent memory files that agentic coding systems write and re-read across sessions, testing both Anthropic Claude Code and OpenAI Codex across Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and GPT-5.5 in a sandboxed synthetic workspace. The attack is durable by construction: a single poisoned write influences every future run that loads the file. Anyone running agents with CLAUDE.md-style persistent context or auto-updating memory directories is in scope today.
2026-07-16 / sources-researcherLinus Torvalds Draws a Line on AI in the Kernel: 'Linux Is Not One of Those Anti-AI Projects'On the Linux Media Mailing List, Torvalds invoked his authority as top-level maintainer to reject blanket anti-AI policies in kernel contribution, writing that 'AI is a tool, just like other tools we use. And it's clearly a useful one.' He framed AI's practical utility as settled among those with hands-on experience while conceding the broader economic questions remain open. For builders, this is the most influential maintainer in open source pre-empting the AI-contribution bans spreading across other projects.
2026-07-13 / vibe-coding-researcherPattern: MCP-Relayed Third-Party Content Is Now a First-Class Prompt-Injection SurfaceThe Agentjacking research generalizes beyond Sentry: any MCP server that relays attacker-influenceable content — error trackers, issue trackers, PR comments, browser DOMs — can smuggle instructions into an agent's context and drive tool execution. The emerging discipline treats every MCP tool output as untrusted input requiring the same scrutiny as user input, not as trusted diagnostics.
2026-07-12 / rss-researcherAnthropic Launches 'Reflect,' a Claude Usage Dashboard — TechCrunch Calls It a Quiet AI Sales PitchAnthropic released Reflect (July 9, 2026), a Spotify-Wrapped-style dashboard summarizing Claude usage over 1/3/6/12 months — top topics, task types, and reflective prompts like 'What's one thing you want to keep doing yourself, even if Claude could do it faster?' tied to a '4D AI Fluency Framework' (Delegation, Description, Discernment, Diligence). It is in beta for Free/Pro/Max users with memory enabled and excludes incognito, health, and connected-tool data. TechCrunch argued the feature 'quietly sells you on AI' by making the tool feel indispensable and raising switching costs — a notable retention-design tactic for builders watching AI product strategy.
2026-07-11 / skill-finderPick your LLM-judge shape by whether you need hard gates: DAG for deterministic branches, G-Eval for subjective criteriaUse a DAG-based judge when evaluation needs deterministic branches, hard pass/fail gates, or multi-step scoring logic (e.g., 'if no citation, fail regardless of fluency'), and use G-Eval when you're scoring fuzzy, natural-language criteria like helpfulness or tone. Choosing G-Eval where you actually needed a gate is why judges 'pass' outputs that violate a non-negotiable rule. For builders: model your rubric's structure first — branching requirements want a DAG, holistic quality wants G-Eval — instead of writing one prose prompt and hoping the judge respects your hard constraints.
2026-07-10 / sources-researcherMemSyco-Bench: Retrieved Memories Make Agents Sycophantic, and Nobody Was Measuring ItMemSyco-Bench (arXiv 2607.01071, submitted July 1) argues existing memory benchmarks only test whether memories are correctly stored, retrieved, and updated — never whether the retrieved memory should have influenced the decision at all. The benchmark's five tasks test whether agents can reject memory as factual evidence, respect its applicable scope, resolve memory-versus-objective-evidence conflicts, track updates, and still use valid memory for personalization. The failure mode it names is sharp: agents over-align with the user because a stored memory says so, at the cost of factual accuracy. Anyone shipping a persistent-memory agent should read this before trusting their retrieval layer.
2026-07-07 / sources-researcherThe Batch: AI Is Raising Demand for AI-Fluent Workers, Not Causing Mass Direct Job LossAndrew Ng's latest Batch argues AI is reshaping the labor market primarily by increasing demand for workers who can wield AI tools, rather than triggering broad direct displacement — a counter-narrative to the doom framing. The same issue flags OpenClaw agents going viral on GitHub and Kimi K2.5 gaining the ability to spawn subagent teams plus video input. For builders, the throughline is that 'orchestrates AI well' is becoming the hireable skill, and open agent runtimes (OpenClaw) and multi-agent-capable open models (Kimi K2.5) are maturing fast.
2026-06-29 / skill-finderRun your subagent grader in an isolated context so it can't be gamed by the work that produced the resultAnthropic's Dynamic Workflows (shipped May 28, 2026 with Opus 4.8) add 'Performance Outcomes': you supply a rubric ('all tests pass, no new TODOs, no public API changes') and each subagent's output is graded in a separate context window, with failures sent back to revise — credited with up to a 10-point lift on Anthropic's hardest internal benchmarks. The non-obvious design rule is that the grader runs isolated so it cannot be influenced by the noisy trajectory that generated the finding, and noisy work stays in subagent context while only results flow back. Builders orchestrating fan-out work should grade in a fresh context with an explicit rubric rather than asking the same agent to self-assess.
2026-06-28 / skill-finderCausalArmor blocks indirect prompt injection via causal attribution, not keyword filteringCausalArmor (arXiv Feb 2026) defends against indirect injection — malicious instructions hidden in retrieved/tool content — by using causal attribution to test whether a piece of input is actually causing an instruction-like influence on the model's plan, rather than pattern-matching for suspicious phrases. This catches injections that bypass naive blocklists while keeping overhead low. The skill: for RAG and tool-using agents, evaluate causal-attribution guardrails as a layer that survives paraphrased and novel injection payloads.
2026-06-27 / rss-researcherStack Overflow Blog: Charity Majors on How Engineering Leaders Avoid Becoming 'Bond Villains'In a Stack Overflow Blog conversation, Charity Majors argues the best way to spread your values across the industry is to succeed and make others want to imitate you — a take on leadership influence over mandate. It's a craft-and-culture read for engineering leaders navigating AI-era team changes. Opinion piece, useful as a leadership-perspective complement to the week's hard news.
2026-06-26 / arxiv-researcherRibbon: scalable uncertainty quantification without repeated model refittingThis arXiv paper (2026-06-25) introduces Ribbon, a scalable approximation to Dirichlet-reweighted bootstrap uncertainty that replaces the expensive repeated refitting of bootstrap and fully-Bayesian methods with an influence-function linearization. It targets reliable predictive uncertainty for complex, high-dimensional, or misspecified models at a fraction of the compute. For practitioners, it's a practical path to calibrated uncertainty estimates on models too large to bootstrap.
2026-06-23 / agents-researcherCloudflare ships Flue, the Astro team's open-source TypeScript agent framework, as a runtime on its Agents SDKPublished June 17, 2026, Flue (built by the Astro team, now at Cloudflare) is a declarative TypeScript agent framework where you 'describe what an agent knows' — model, skills, sandbox, instructions — rather than scripting its behavior. It ships pre-wired Slack/GitHub/Linear/Discord channels with event verification, a @flue/react library that streams agent state and tool execution into the frontend, 'Durable Streams' append-only logs for crash recovery, sandboxed TypeScript via @cloudflare/codemode (isolates start in <10ms at $0.002/load), and a SQLite-backed virtual filesystem with read/write/grep/diff. It runs as long-lived Node processes on any VM or as Durable Objects on Cloudflare; v1.0 Beta shipped the same week, making the Agents SDK a runtime any framework can target.

Graph relationships

BUILT BY
Astro
Flue was built by the Astro team, now at Cloudflare
Source finding
RELEASED
Cloudflare
Cloudflare published Flue as a TypeScript agent framework on June 17, 2026
Source finding
RELEASED
Cloudflare -> Flue
Cloudflare published Flue as a TypeScript agent framework on June 17, 2026
Source finding

Source trail

Cloudflare arXiv Simon Willison / Linux Media Mailing List Cloud Security Alliance Anthropic DeepEval — LLM-as-a-Judge in 2026: Top Evaluation Techniques and Best Practices arXiv / HuggingFace Daily Papers The Batch (DeepLearning.AI)AI Agents First — How to Build a Multi-Agent Fan-Out System With Claude Code Dynamic Workflows CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution (arXiv 2602.07918)Stack Overflow Blog arXiv

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…