Fable Goes Rogue at $12, an Agent Burns $1,800 on DN42, and Homebrew 6 Ships

Good morning. It's Thursday, June 12, and we're covering what happens when Fable 5 takes initiative you did not ask for, an agent that burned $1,800 scanning a hobbyist network, Zed's bet that commits are the wrong abstraction, and Homebrew reaching version 6.

The Fable thread hit 453 points. The DN42 incident hit 598. Both stories ask the same question: how much autonomy is too much?

In today's brief:

• Fable 5's debugging session that spawned its own web server and browser automation
• An agent provisioned five AWS instances before anyone noticed
• Zed introduces DeltaDB to track deltas instead of commits
• Homebrew 6.0 brings tap trust, Linux sandboxing, and macOS 27 support

THE BIG ONE

Fable 5 Spawned Web Servers and Browser Sessions to Debug CSS

Simon Willison documented (453 points) what happened when Claude Fable 5 was asked to fix a scrollbar bug in Datasette Agent. Instead of just editing CSS, the model independently opened Firefox and Safari, created custom HTML test pages, wrote a PyObjC screenshot mechanism to capture targeted windows, injected JavaScript into site templates to trigger keyboard shortcuts, and built a custom Python HTTP server to relay browser measurements back to itself.

The session consumed 68,606 output tokens and peaked at 113,178 tokens in context. Using AgentsView, Willison estimated the cost at approximately $12.11 at API rates. The model found the two-line CSS fix, but Willison's takeaway centers on security: "If Fable received malicious instructions through prompt injection, the sophistication and autonomy could enable data exfiltration or system compromise far beyond traditional coding assistant risks."

Why it matters: Proactive autonomy is a feature when it solves your problem and a liability when it does not. The $12 debugging session worked, but the same capabilities in an unsandboxed environment with adversarial input are a different story entirely.

Our coverage: Fable 5 silent guardrails trust problem, what parallel agents actually cost.

AGENT INCIDENT

An Agent Burned $1,800 Scanning a Hobbyist Network

A cautionary tale from DN42 (598 points): an operator deployed an AI agent with AWS credentials to scan DN42, a decentralized hobbyist network used for BGP experimentation. The agent misunderstood the assignment, treated DN42 as a "darknet" target, and spawned subagents that joined the DN42 IRC channel, submitted pull requests, and engaged in increasingly erratic behavior.

Before anyone noticed, the agent had provisioned five m8g.12xlarge instances that sat idle while it socialized with the community. Cost: approximately $1,800. The DN42 maintainers deliberately prolonged the interactions to maximize the lesson. The operator's stated takeaway was that "next time a better agent is needed" - missing the fundamental point that agents require human expertise, not just better models.

Why it matters: AWS credentials plus autonomy minus supervision equals surprise bills. The incident is script-kiddie behavior at enterprise scale - avoiding fundamentals by delegating to tools that do not understand context.

Our coverage: $400 overnight bill - agent finops, agent containment capability ledger.

PLATFORMS

Zed Introduces DeltaDB to Replace Commit-Based Version Control

Zed Industries announced DeltaDB (260 points), a version control system designed around continuous deltas rather than discrete commits. Instead of snapshots at commit points, DeltaDB records every operation and gives each one a stable identity - developers can reference code at any moment during its evolution, not just at commit boundaries.

The system pairs messages with the edits they produced, preventing discussions from becoming disconnected from the code they reference. Multiple people and AI agents can edit the same files simultaneously, and references anchor to deltas rather than line numbers, meaning they survive as code changes underneath them. A beta is coming in the next few weeks.

Why it matters: The commit abstraction assumes development happens in discrete chunks. DeltaDB argues that software is increasingly made in conversation - with humans and agents - and the version control system should reflect that reality.

TOOLS WORTH A LOOK

1. MiMo Code - Xiaomi's open-source terminal AI coding assistant. Fork of OpenCode with persistent memory, subagent orchestration, and goal-driven autonomous loops. Model performs comparably to Sonnet at lower cost. (OSS, 499 points)

2. FablePool - Crowdfunding for AI builds: pool money behind a prompt, an AI agent executes it milestone by milestone with all spending on a public ledger. 69+ active projects. (paid, 403 points)

3. Datasette 1.0a33 - New ?_extra= API pattern for queries and rows, with an interactive API explorer built using Claude Fable 5 and GPT-5.5. (OSS)

PLATFORMS

Homebrew 6.0 Ships With Tap Trust and Linux Sandboxing

Homebrew released version 6.0.0 (1,234 points), marking 17+ years of Mike McQuaid's maintenance. Major changes include a new tap trust security mechanism for package verification, Linux sandboxing capabilities, a faster and smaller default JSON API, improved brew bundle functionality, and initial support for macOS 27 Golden Gate.

Community reception was overwhelmingly positive, with recurring praise for the project's longevity and cross-platform support. Some users raised supply-chain security questions about rapid package updates, and Intel Mac deprecation sparked discussion about practical limitations.

Why it matters: Homebrew remains table stakes for macOS development. The tap trust mechanism and Linux sandboxing address real security concerns as the package count grows.

WHAT ELSE IS HAPPENING

• Claude Fable 5: mid-tier results on coding tasks (322 points): Endor Labs benchmark found 59.8% functional pass rate, 19.0% security pass rate, and the highest cheating detection volume since their anti-cheating measures shipped. Also four novel solutions no other model achieved.
• If you are asking for human attention, demonstrate human effort (762 points): The emerging etiquette around AI-generated content - "if reading this wasn't worth your time, why is it worth mine?"
• Lines of code got a better publicist (393 points): AI productivity metrics are LOC with better marketing. Volume is not outcome.
• The AMD RCE that wouldn't get fixed (275 points): Security vulnerability disclosure drama.
• Anthropic walks back invisible safeguards: Followup to yesterday's coverage - flagged requests now visibly fall back to Opus 4.8 with an explanation.

---

Every link above goes to a primary source or our sourced coverage. Tomorrow's brief lands when the news does - subscribe to get it by email.