NEWS

A new arXiv paper shows the encrypted reasoning blocks that Anthropic, OpenAI, and Google return to API clients can be replayed into weaker models from the same provider and transcribed verbatim. The authors decoded 315,320 blocks from public repositories and recovered 367 PII artifacts and 182 credentials.

A new arXiv paper probes six widely used open-source agent frameworks and finds the barrier semantics of approval gates, cancellation, and timeouts hold on none of them. A sibling branch can execute while the user is rejecting another one, and replay can double-execute. The fix is a verified external gate called SoundGate.

Vercel Sandbox now polices all outbound traffic on the host, outside the microVM, with SNI-based domain policies, CIDR rules, host-level credential injection, and a deny-all default. Here is why a network boundary is the half of agent isolation that VM escapes missed.

A new ASE 2026 framework injects server errors, truncated responses, and corrupted tool calls into live agent systems at the HTTP layer. Every system degrades, pass@1 drops up to 50 points, and the ranking stays the same no matter which LLM is behind it.

Multiverse Computing open-sources two changes that make knowledge distillation cheap enough to run at scale: caching the teacher's top-100 logits once so it never sits in memory during training, and a fused chunked KL loss that never materializes the vocab-by-sequence matrix. A GPT-OSS 20B distillation at 32K context drops from four GPU nodes to one, with step time down 5x.

A new arXiv paper builds a deterministic monitor on top of SWE-agent that watches long agent trajectories and only calls an advisor LLM when the run actually drifts. Resolution rates go up by up to 15.2 points at an extra $0.08 per instance, and the paper argues the expensive approach is re-planning from inside the loop.

Meta open-sourced Muse Glimmer, a 30B Apache 2.0 multimodal agent model that runs in a 24GB envelope at up to 233 tok/s. MCP Atlas 75.5, SWE-Bench Verified 76.0, 131K context. Here is what the numbers actually say.

GPT-5.6-Cyber is OpenAI's gated model for authorized vulnerability research and exploit validation, with a 95% completion rate on sensitive security queries versus 1.5% for the base model. It already produced a fixed Chrome CVE. Here is what actually shipped and who gets it.

Claude Code v2.1.224 lets one running session message another over a first-party channel - plain text, permission-aware, with approval dialogs when bypass-mode sessions talk to each other. Here is what ships, how delivery and inbound controls work, and where the feature stops.

A developer's Claude-built night-sky site reproduced an open source project's name, feature set, and even a bug the author had already fixed. The saga that followed says a lot about memorization, accountability, and the verification duties of AI-assisted shipping.

Copilot code review's Lite and Balanced effort levels are generally available. Here is what each level does, what it costs in AI credits and Actions minutes, and how to set org-level defaults so review depth matches PR risk.

GitHub's impact dashboard now models Copilot ROI directly: cost per developer per month from real AI credit consumption, PR output per phase, and a salary selector. What the numbers actually tell you about agent-first vs passive adoption.

GitHub now lets enterprise owners install third-party GitHub Apps on their enterprise account, and lets any user or organization create apps with enterprise permissions. This opens the enterprise management layer to the broader ecosystem - with a hard security boundary around the most powerful permission set.

xAI released Grok Imagine Image 2.0 on August 7 as the new Quality Mode on grok.com and mobile, ranked second worldwide on both text-to-image and image-editing leaderboards. A 2.0 preview build is already callable through Vercel's AI Gateway with the AI SDK, before xAI's own API access goes live.

Vercel added Hermes Agent to AI Gateway and made Vercel Sandbox a terminal backend for the open-source agent. Hermes is now fully BYO: your own model routing through 200+ models at no markup, and your own cloud microVM for every agent command. Here is what that unlocks and why the agent control plane is consolidating.

skills.sh now lets you bundle multiple agent skills into a shareable, unlisted pack and install it with one command. Packs mix public directory skills, private local files, and GitHub repos, then sync with a single update command. Here is how they work, what they mean for team standardization, and where the trust questions are.

WeatherNext Cyclones adds a full day of lead time to tropical cyclone forecasts - roughly a decade of meteorological progress - and now the weights, code, and data feeds are public. What the paper actually shows and how to run it.

Cloudflare's Web Integrity team published the framework behind its agent traffic posture: continuous behavioral trust instead of point-in-time bot scoring, Precursor telemetry from 206 million evaluation events a day across 73,438 zones, and a verified-bot taxonomy where agents earn access by declaring themselves honestly.

Cloudflare's Agents Week finale frames agents as a new kind of web visitor with four primitives: readable, discoverable, callable, payable. Here is what that architecture means for developers building and monetizing agent-facing services.

Cloudflare shipped Radar Researcher, a natural-language agent that answers questions about global internet traffic with real interactive charts. The architecture - MCP code mode, chart specs that never let the model touch raw numbers, and a three-model fallback chain - is the interesting part for developers.