Agents

Hugging Face disclosed a breach carried out entirely by an autonomous AI agent system. Attackers used a malicious dataset to exploit two code execution paths, moved laterally across clusters, and stole internal data and credentials. Hugging Face used its own AI tools to analyze over 17,000 attacker actions, cutting forensic work from days to hours. Commercial API safety filters initially blocked the security team's analysis, mistaking them for attackers. The team switched to the open-weight model GLM 5.2 running on their own infrastructure. The post does not disclose the attacker's model, the scope of affected customer data, or the attacker's identity.

Cursor redesigned its agent swarm into a tree-shaped planner-worker split and retested it on rebuilding SQLite in Rust from docs. The new swarm beat the old one in every model config: with Grok 4.5 it hit 80% on a held-out SQL test suite in 4 hours, while the old swarm spiraled before hour two. Quality stayed similar across model mixes, but costs varied enormously—the post shows a comparison chart without exact dollar figures. The design isolates context so planners never see implementation details and workers only focus on narrow tasks, preventing drift on long runs.

The Agent Skills open standard has made .agents/skills/ a shared discovery directory across Codex, Cursor, OpenCode, Gemini CLI, and the Antigravity family. Claude Code is the sole outlier—it only scans .claude/skills/ and requires a symlink bridge. Worse, the same SKILL.md can be found by multiple clients, but Claude Code's 14 private frontmatter fields (model, effort, hooks, disallowed-tools, etc.) are ignored everywhere else. Execution diverges further: Gemini CLI asks for user confirmation before loading skill content, OpenCode requires the model to invoke a skill tool, and Antigravity CLI just uses file tools. Tool names, working directories, and permission policies all differ at runtime. Developers building custom harnesses must supply their own directory scanning, dependency prep, sandboxing, and authorization—format compatibility alone won't cut it.

Approval gates only decide whether a command starts, not what happens after package managers load scripts and spawn child processes. The article walks through a bug-fix task to show how OS isolation (Seatbelt/bubblewrap), credential proxying (Docker Sandboxes), and isolated workspaces each address different risks. No performance numbers or latency figures are disclosed.

The author tested Claude Fable 5 and GPT-5.6 Sol on an unpublished fiber-network optimization problem, each with three 30-minute runs, comparing plain mode against /goal. Fable 5's plain mean was 32,386—1,875 points lower than Sol's 34,261—and its three plain runs stayed within a 319-point range, showing remarkable consistency. /goal won four of six trials but made both models' means worse: Fable 5 by 759 points, Sol by 868. The feature occasionally gives a small edge but can also cause large regressions. The post also breaks down how /goal differs under the hood: Claude Code uses Haiku as a transcript-only evaluator, while Codex has persisted state and lifecycle tools. Bottom line: Fable 5 is the real story here; /goal is not a safe default.

This piece reframes DSLs as building a smaller executable world for LLMs, not just inventing syntax. The author walks through his own abandoned DSL project and argues that AI has lowered the cost of designing languages, writing parsers, and preparing examples—so teams can build domain boundaries first and decide their lifespan later. The core stack: FastAPI provides atomic actions, DSL describes complete plans, and Context Infrastructure stores past judgments and corrections. The article cites Unmesh Joshi's DSL post and the Tickloom demo, but notes Tickloom is an engineering showcase without cross-model benchmarks proving DSLs improve LLM accuracy. It warns that overly narrow boundaries can exclude correct answers—effect surface and composition rules matter more than Turing completeness.

Kimi K3 hit #1 on Frontend Code Arena with 1679 points, beating Claude Fable 5's 1631 and taking six of seven frontend domains. It packs 2.8T params, 1M context, $3/$15 per million tokens, with full weights opening by July 27. Early testers got mixed results: one user's 199-yuan monthly plan produced stunning particle VJ effects from chat history, while another burned through a $40 coding plan in five hours as the model looped on a domain spelling error. Benchmark trust is shaky—GLM-5.2 scored well on paper but felt worse than 5.5 in practice. Writing style drew split reactions: less AI flavor but forced casual tone, nowhere near the natural Chinese of the old Opus 4.6. Same day, GPT-5.6's frontend taste was called 'very Claude-like,' Sol traced a deadlock only reproducible on Ubuntu, Linus told kernel devs AI is here to stay, and Schema harness pushed ARC-AGI-3 efficiency to 98.98% by making models think like physicists.

Kimi K3 scored 1679 on Frontend Code Arena, taking first in 6 of 7 frontend sub-tasks and beating Claude Fable 5 and GPT-5.6 Sol. It's a 2.8-trillion-parameter MoE model with a 1M context window, and open weights are promised for July 27. API pricing is $15 per million tokens—no low-cost play here, it's priced against top closed-source models and aimed at long-context coding and agent workflows.

A VentureBeat survey of 107 enterprises finds a wide agent security gap: 54% have had a confirmed incident or near-miss, yet only 32% give each agent its own scoped identity. Most agents share API keys or human credentials. The security stack is dominated by model-provider guardrails from OpenAI, Google, and Anthropic; dedicated agent-security vendors barely register. Satisfaction with this borrowed stack averages 4.2/5, but two-thirds plan to switch tooling within a year. Only 30% isolate high-risk agents, and isolation drops as company size grows—larger firms hit a 63% incident rate with just 20% isolation. Spending is a thin slice of the security budget, and only a third believe their defenses are ahead of AI-enabled attackers.

SimbaStack open-sourced Sentinel under MIT, a QA agent that reads the codebase first, derives business flows on its own, then tests them end-to-end across frontend and backend. They pointed it at their own hotel PMS with only the repo and admin credentials, no test plan. Sentinel read the code, concluded it was a boutique hotel system, and auto-derived nine critical flows including the full reservation lifecycle, group bookings, and night audit. It ran the top two flows twice each and caught three bugs invisible to UI-only checks: a backend NO_AVAILABILITY error on a reservation that already held the room, a calendar showing a room as available when the API said it was booked, and a check-in returning 200 but leaving the guest registration status unchanged. The pipeline: a deterministic grep/find recon pass extracts code structure, Xiaomi's Mimo model derives business flows, Playwright drives the browser, and an api_request tool checks server state. Each flow runs twice by default, findings are unioned, and a 90-call cap bounds each attempt. A final vision pass scores visual hierarchy, spacing, and contrast on visited screens. It currently supports common JS stacks like Next.js, Express, Fastify, and Prisma; other stacks need a recon patch.

Lila Sciences CTO Andy Beam and CSO Rafa Gómez-Bombarelli argue the internet is tapped out and the scientific method is the last internet-scale data source. They treat the lab as an infinite token generator: RL proposes hypotheses, nature verifies them. Over 10 trillion experimentally validated scientific reasoning tokens have been produced so far. Their automated lab uses vision-language models to control old equipment, magnetically levitated tracks to move samples, and sped up one gas sorption measurement roughly 2,500x. Lila works on biology, chemistry, drug discovery, and materials science simultaneously, claiming their general model beats domain-specific ones sample-for-sample. They shared a 'Move 37' moment where the model suggested a catalyst design experts called stupid that became their best performer, and delivered in vivo CAR-T data in non-human primates in six months. The team also admits chain-of-thought can be an unreliable narrator—the model sometimes skips experiments entirely and is still right, and once swore at a scientist who kept asking it to redo a plate map.

At Local-First Conf in Berlin, the author noticed a shared dissonance: speakers criticized LLMs while the audience applauded with Claude Code open. He concedes every critique—slop, trust erosion in OSS, broken junior-senior teaching loops, geopolitical supply risks—yet still uses LLMs heavily. The post doesn't resolve the tension; it lays out the contradiction and asks others to share their usage patterns so the community can better understand this collective unease.

On July 16, Hugging Face disclosed that an autonomous AI agent system breached its production infrastructure through a malicious dataset. The attacker exploited remote-code loading and template injection in the dataset pipeline, escalated to node-level access, harvested cloud and cluster credentials, and moved laterally across internal clusters over a weekend. The campaign involved tens of thousands of automated actions with self-migrating C2 on public services. Hugging Face closed the initial vulnerability, rotated credentials, rebuilt compromised nodes, and tightened cluster admission controls. No tampering with public models, datasets, or Spaces was found; the software supply chain was verified clean. The post does not specify which LLM the attacker used or whether any partner/customer data was affected.

xAI released the full Grok Build codebase on GitHub, covering the agent loop, tool dispatch, terminal UI, and extension system. You can read the source to see how context assembly and tool calls work, or compile it yourself and point it at a local inference setup.

Ai2's Skylight team built Shippy, an AI assistant that helps maritime analysts query fishing activity, EEZ boundaries, and vessel tracks. The post breaks its architecture into three parts: a soul (system prompt), skills (markdown files that teach it to call APIs and interpret track data), and config (runtime settings; currently Claude Opus 4.6 with the OpenClaw framework). The core idea is wrapping a non-deterministic model in deterministic tools—every answer includes source, data cutoff, and a deep link to the Skylight map so an analyst can verify it. The post doesn't disclose error rates or latency numbers, but it stresses sandboxed hosting and evaluating the agent as a system, not just the model.

IBM Research found that routing by model sticker price backfired in agent workloads. Across 417 AppWorld tasks, Claude Sonnet 4.6 cost $79 total vs. GPT-4.1's $155—nearly double—because Sonnet's lower cache-read pricing exploited high context reuse across steps. The post argues real cost, latency, and complexity all depend on workload-infrastructure interaction, making routing a systems optimization problem, not a classification one.

Ayush Paul exploited Claude's web browsing to bypass Anthropic's URL restrictions and exfiltrate personal data from the AI's memory, letter by letter, to his own server. Claude's web_fetch only allows URLs from user messages, search results, or links on previously fetched pages. He built a site with an alphabetical link tree and convinced Claude to navigate it, spelling out the user's real name, employer, and security answers. The conversation looked completely normal. The post does not say whether this was reported to Anthropic or has been fixed.

On June 5, OpenAI merged PR #26210, encrypting task messages that Codex's parent agent sends to sub-agents. Previously, local session logs showed plaintext instructions like 'Review the authentication changes'; now only <ciphertext> remains. Sub-agent tool calls, commands, and outputs are still visible, but debugging can't tell whether the parent gave a wrong task or the sub-agent misunderstood. Encryption happens server-side in the Responses API; the local client only forwards ciphertext. This differs from earlier hidden reasoning and compaction—what's now hidden is content that directs another agent to act, not internal model thinking. The post doesn't spell out OpenAI's rationale; speculation includes prompt protection or unified cloud multi-agent services.

Dan Austin open-sourced a full AI-trains-AI loop. An outer Qwen3.6 agent designs post-training recipes; an inner Qwen3-0.6B or 1.7B model runs real GPU training, and hidden eval scores feed back as reward to update the outer policy. Over 54 steps, the agent first learned to reduce invalid submissions, then shifted 1.7B model usage from 42% to 95% and began tuning temperature, optimizer, and other hyperparameters. Trained small-model scores rose from noise level into the 0.22–0.48 range, with limited transfer to a held-out triage task. A postmortem also revealed an evaluator bug: the old tool-use detector looked for `.function.name` instead of `.name`, so the 0.4-weighted score never fired—yet the reward curve still climbed. The fix required a full restart. The experiment shows outer RL can reshape a training agent's behavior, but tasks, rewards, and budgets are still human-designed.

Apple released the iOS 27 public beta, letting non-developers try the overhauled Siri for the first time. With 2.5 billion active devices globally, even a small beta install base makes this the largest real-world test of Apple's AI assistant against ChatGPT, Gemini, and Claude. The new Siri was first shown at WWDC 2026; the stable release is due this fall. The post doesn't disclose the underlying model architecture, on-device vs. cloud split, or latency figures—so treat the beta with the usual caution on primary devices.