标签：#agents

Originally published on hexisteme notes . A new public repo showed up on 2026-07-14: mattpocock/skills , an MIT-licensed collection of Claude Code agent skills. It's the kind of thing that's easy to fall for in the first ten minutes — skim the READMEs, install the ones that sound useful, move on. I didn't do that. I ran it through the five deterministic gates in my adoption CLI, the same gates every Swift package and npm dependency in my stack has had to clear, extended for the first time to cover a Claude skill. The reason I bother with this at all: adoption decisions rot when they're vibes. "This looks solid" is not a claim you can revisit in six months and check whether you were right about. A score is. So is a pre-registered condition for when you'd bail on it. The rest of this post is what that machinery produced on a real decision, not a hypothetical one. Five gates, one score The CLI scores any candidate — package, library, or now, skill — on five gates: maturity (how long has this actually existed), dependency footprint (what does adopting it drag in), platform fit (native or third-party, and documented or not), policy and developer experience (documentation quality plus release stability), and trajectory (is it actively maintained right now). Each gate contributes points toward a 100-point total, and fixed thresholds turn that total into a verdict: ADOPT at 80 or above, TRIAL at 60 or above, HOLD at 40 or above, reject below that. No gate is a gut check — every one resolves to a number from a query I can rerun. Here's what mattpocock/skills scored, evaluated as of 2026-07-14: Gate Score Why G1 Maturity 4/20 First release 2026-06-17 — 27 days old at evaluation time. The repo itself was only created 2026-02-03, so the project as a whole is five months old. G2 Dependency footprint 20/20 Zero runtime dependencies. Skills are markdown prompt files — structurally, there's nothing to depend on. G3 Platform fit 10/20 Third-party, not built into the platform, but do

The same bug hit me in three separate sessions before I fixed it properly. Each time, my orchestrator reached a decision point, tried to present its menu, and burned a turn on a validation error instead of a question: InputValidationError: { "code" : "too_big" , "maximum" : 4 , "path" : [ "questions" , 0 , "options" ] } // abridged; the full payload includes the Zod message Claude Code's AskUserQuestion tool caps every question at 4 options. My menu had 5. First strike: the end-of-run menu. Second strike: a blocker-recovery menu. Third strike: the same recovery menu two weeks later, after I thought I'd fixed it. That repetition is the story. Why this one keeps coming back A one-off validation error is not worth a blog post. What makes this one worth writing up is why it recurred: the cause wasn't a typo. It was a template. Suhail , my Claude Code orchestrator, is a set of markdown prompt files, and its menus live in those files as literal option lists: the template says exactly what to present, and the model presents it verbatim. Five options go into one AskUserQuestion call, the schema rejects it, and the round-trip to the model is wasted. In my runs the model then retried with four options and continued, which is why, the first two times, I let the retry count as the fix. The recovery is so cheap that the bug reads as a hiccup, not a defect. But decision menus are the natural accumulation point of any orchestrator. Every new capability wants a slot: continue, commit, skip, retry, abort, show status. The menu only grows. A 5-option template doesn't fail once; it fails on every run that reaches it, one wasted turn each time, until you fix the template. The failure mode worse than the error The wasted turn is the benign version. Suhail's public changelog records the malignant one: the interactive complete-handler menu grew past the cap, and instead of erroring, the presented menu simply lost its last option. The option that got pushed out of reach was Abort . Abort o

If you have written enterprise Java in the last 20 years, you know the name Rod Johnson. He created Spring Framework back in 2003 - the thing that made Java dependency injection feel natural instead of like wrestling XML. Spring basically rewrote how enterprise Java works. Johnson stepped away from active Spring development years ago. But in early 2026, he returned - and he did not come back to build another IoC container. He built Embabel. An AI agent framework for the JVM. And it works nothing like Spring AI or LangChain4j. I have been running AI agents on my own VPS for months. Hermes Agent, Claude Code, custom MCP servers - the works. So when I heard Rod Johnson was back with a Java AI framework, I paid attention. Here is what I found. Spring AI and LangChain4j Are Great - but They Solve a Different Problem Over the last year, most Java developers entering AI have gravitated toward two frameworks: Spring AI - brings LLM integration into the Spring ecosystem LangChain4j - a Java port of LangChain's agent/tool patterns Both are excellent at what they do. You can build chatbots, RAG pipelines, tool-calling assistants, and AI-powered APIs in a few lines of code. But both treat the LLM as the center of the application. You send a prompt. The model responds. Maybe it calls a tool. Then it responds again. For question-answering or chat interfaces, that is fine. But what if you want the system to: Create a multi-step plan before taking any action Run for 10 minutes, not 10 seconds Check its own work and retry if it failed Coordinate multiple agents working on different parts of a problem This is where the chatbot pattern breaks down. And this is exactly what Embabel targets. What Is Embabel? Embabel (pronounced em-BAY-bel) is a framework for building goal-oriented AI agents on the JVM. It is written in Kotlin and works naturally from Java. It sits on top of Spring AI - Johnson described the relationship as "Spring AI is to Embabel as the Servlet API is to Spring MVC" [

AI agents can reason about the web. But giving an agent unrestricted browser or network access creates a serious authority problem. The obvious solution is to restrict the tools available to the agent. Then I kept running into the opposite problem: Once the tool became sufficiently restricted, it lost many of the capabilities required to complete real work. I wanted both sides: Enough power to crawl, render, navigate, extract, capture, and investigate the web Explicit operator control over origins, credentials, budgets, browser hooks, profiles, and evidence So I built Cockroach Crawler . It is an open-source Node.js and TypeScript toolkit for AI agents, RAG pipelines, documentation indexing, research, QA, and web-data workflows. I connected it to OpenClaw and Codex , and the difference was honestly wild. Instead of giving the agents one narrow search tool, I gave them a bounded web-research layer that could crawl websites, inspect JavaScript applications, extract structured data, process PDFs, take screenshots, generate PDFs, inspect public sources, and return evidence with provenance. And for many public workflows, I did not need to configure a separate API key for every source. GitHub: https://github.com/AjnasNB/cockroach-crawler Documentation: https://cockroachcrawler.com/docs/ npm: https://www.npmjs.com/package/cockroach-crawler What changed after I connected it to OpenClaw and Codex? Before this, the agents could reason well, but their web access was limited. They could answer questions, write code, and work with the context I gave them. But once a task required deeper live-web investigation, I still had to manually combine several tools. After connecting Cockroach Crawler, they could: Crawl public websites Render JavaScript-heavy pages Follow sitemaps Search and map documentation sites Extract readable Markdown Extract structured fields with CSS, XPath, or restricted regular expressions Read local and remote PDFs Generate PDFs Take screenshots Handle bounded c

AI coding startup Cognition has acquired Poke, the AI assistant you text like a friend, in a deal valuing the startup in the low nine figures. The acquisition brings Poke’s conversational style and interaction model to Cognition’s coding agent Devin, reflecting a growing belief that how AI assistants interact with users is as important as the models powering them.

Microsoft does not create expert-tier certifications for experiments. An expert credential is a market declaration: this discipline is mature, hireable, and worth filtering résumés on. Multi-agent orchestration just got that stamp. The credential is Microsoft Certified: Multi-Agent AI Solutions Expert , earned by passing Exam AI-500 , now in beta with limited discounted seats per Microsoft's announcement . If you are weighing an exam AI-500 beta seat, this piece gives you what it tests, how it differs from AI-102 and AB-100, and a clear book-or-wait call. No menu of options. A decision. The short version of my position: the skills outline matters more than the badge. Microsoft just published its multi-agent product roadmap and formatted it as an exam blueprint. Read it either way. What AI-500 actually covers The announcement positions the certification for practitioners who can, in Microsoft's words, "operate at expert level in the agentic era." That phrase is doing real work. It is not about calling a model endpoint. It is about designing, orchestrating, and running systems where multiple agents cooperate, hand off work, and stay inside guardrails. Microsoft's own framing in the announcement names three capabilities: architecting complex, production-ready AI systems; orchestrating multiple agents and tools; and delivering scalable, governed AI solutions. My read of what those mean in practice, and why they are the right three: Orchestration of multiple agents and tools. Not one agent with a prompt. Several agents with routing, handoffs, and shared context. Governance. Identity, permissions, content safety, evaluation, and audit as exam material, not appendix material. Production-readiness. Deployment, observability, and lifecycle. The stuff that separates a demo from a system someone is paged for at 2 a.m. To be clear, that numbered list is my interpretation of the announcement's language, not a reprint of the skills-measured document. Pull the exact blueprint your

A nova fase dos agentes de IA: menos chat, mais operação. A OpenAI apresentou o Presence, uma plataforma para empresas implantarem agentes de voz e chat em atendimento ao cliente e fluxos internos. Para quem desenvolve sistemas, o ponto não é apenas colocar mais um chatbot em produção. A mudança relevante é tratar a IA como uma camada operacional: ela precisa participar de processos reais, com objetivos claros e resultados verificáveis. Um agente confiável precisa de mais do que boas respostas. Precisa receber o contexto certo, operar dentro de permissões bem definidas, deixar rastros auditáveis e saber quando transferir o caso para uma pessoa. Isso altera a decisão técnica. Escolher um modelo continua importante, mas arquitetura, integrações, observabilidade, avaliação contínua e governança passam a fazer parte do mesmo problema. A pergunta mais útil deixa de ser “onde podemos colocar IA?” e passa a ser: qual processo já está pronto para ser redesenhado com um agente de confiança? Fonte oficial: https://openai.com/index/introducing-openai-presence

The article discusses an experiment where a code assistant had to design an agentic system using LangChain4j documentation. The assistant created a coding framework capable of writing, testing, and debugging code autonomously. Results showed that two architectural patterns—supervisor and workflow—offered different trade-offs between flexibility and execution speed during debugging tasks. By Kevin Dubois, Mario Fusco

When an AI agent leaks data, it may not look like a breach at first. It may look like a normal tool call, a helpful API request, or a browser fetch that quietly sends the wrong payload to the wrong place. That is the uncomfortable part for builders: prompt safety can warn you about intent, but only the network boundary can stop bytes from leaving. If your product lets agents call APIs, browse pages, use MCP tools, fetch files, or run long workflows, you need a simple rule: agents should not have open internet access by default. They should pass through an egress proxy that can inspect, block, gate, and log every outbound action. Why this topic matters now Agent workflows are moving from demos into real development environments. Recent practitioner signals point in the same direction: CLI coding agents are becoming normal, MCP-style tool access is spreading, long-running agents need better harnesses, and teams are under pressure to prove AI ROI instead of just shipping impressive demos. That creates a new risk shape. Traditional backend code usually makes predictable network calls. You know the service, endpoint, payload shape, and permission model before deploy. AI agents are different. They choose tools at runtime. They read untrusted context. They may summarize a page, then call an API, then write to a ticket, then fetch a package, then retry with modified arguments. What is an AI agent egress proxy? An AI agent egress proxy is a controlled outbound layer between your agent runtime and the outside world. Instead of letting the agent process connect directly to any domain, the agent routes outbound traffic through the proxy. The proxy checks each request against policy before it leaves your environment. A minimal mental model: Agent runtime -> Egress proxy -> Approved external services | +-> policy checks +-> secret scanning +-> SSRF protection +-> approval gates +-> audit logs The proxy does not need to be magical. It needs to be boring in the best way: determinis

GitLost is a prompt-injection exploit discovered by Noma Security that tricks GitHub's new Agentic Workflows into leaking private data. By embedding concealed instructions within public GitHub issues, attackers can circumvent security safeguards and induce AI agents to reveal confidential information in public comments. By Sergio De Simone

Aggressive training techniques sharpens threat of bad behavior by leading models.

Divergence escalates the wrong population: unanimous misses auto-pass Agent Determinism Illusions (Part 7) Where this fits: This part does not continue Part 13's probe-vs-prose thread. It returns to Part 6 's L2→L3 escalation rule — Dipankar's move of treating vote disagreement as the human-review signal. Alexey Spinov's follow-up comment says that signal points at the wrong population. Two experiments check whether he is right, and what to put in the tripwire instead. Part 6 drew this control flow: L2 multi-perspective votes │ unanimous ──────────► AUTO-PASS / AUTO-REJECT │ divergence (e.g. 2–1) ► L3 human The caveat was already in the text: divergence measures ambiguity; it does not fix unanimous systematic bias. Alexey's point is sharper — and it is about routing , not about another caveat paragraph. 1. Alexey's population mismatch On the Part 6 thread, Alexey Spinov wrote (paraphrased tightly): The dangerous failures are high-confidence and directional — systematic. Systematic bias is shared across prompts, not idiosyncratic (your own P3: majority voting doesn't fix it). So the three perspectives will tend to agree on exactly those cases. Divergence-to-human then routes you the safely-ambiguous ones and auto-passes the confidently-wrong ones. The escalation signal is pointing at the wrong population. He proposed two cheap replacements: T1 — deterministic tripwire on known-reversal classes (escalate regardless of agreement). T2 — treat unanimous + high-confidence on a historically reversal-prone class as escalate — the inverse of “high confidence, auto-pass.” That is the claim under test. Not “divergence is useless,” but “divergence alone is the wrong primary tripwire for the failure mode you already measured.” 2. Experiment A — offline proxy on DF v2 (no new API) Part 6's Mike Update already showed: of 96 DF v2 MISS runs, 95.8% sat at self-reported confidence ≥ 0.9 (avg 0.969). That mass is concentrated — Part 6 also reported ~80% of MISS runs from qwen3:0.5b —

Over the past few months, I've been exploring how AI agents can fit into a modern CI/CD pipeline—not to replace engineers, but to eliminate repetitive work that slows teams down. Here's what worked well: ✅ Automatically categorized incoming pull requests ✅ Flagged potential security and dependency issues ✅ Suggested fixes for linting and test failures ✅ Generated review summaries for faster code reviews ✅ Reduced context switching for reviewers The biggest lesson? AI is most valuable before the human review begins. The Problem Every engineering team eventually runs into the same issue. Developers submit pull requests faster than reviewers can process them. A typical PR often goes through several repetitive steps: CI builds Unit tests Linting Dependency checks Security scanning Style comments Reviewer assignment Documentation validation None of these tasks require deep architectural thinking, yet they consume valuable engineering time. I started wondering: What if an AI agent handled the first round of triage automatically? The Workflow Instead of waiting for a human reviewer, the pipeline lets an AI agent inspect every pull request immediately after CI starts. Developer │ ▼ Pull Request Created │ ▼ CI Pipeline Starts │ ▼ AI Agent ├── Analyze changed files ├── Review commit summary ├── Detect risky changes ├── Check coding standards ├── Explain failing tests ├── Suggest fixes └── Generate PR summary │ ▼ Human Review By the time a reviewer opens the PR, much of the routine analysis is already complete. Example GitHub Actions Workflow A simplified workflow might look like this: name: AI Pull Request Review on: pull_request: types: [opened, synchronize] jobs: ai-review: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run Tests run: npm test - name: Run Linter run: npm run lint - name: AI PR Analysis run: ./scripts/ai-review.sh The AI step can analyze: Test failures Lint violations Changed files Security findings Dependency updates before publishing a r

If you are an enterprise architect working on Microsoft Entra and AI agents, your first overdue job is not another policy wizard, another dashboard, or another governance steering committee. It is schema design. Specifically, it is deciding how you classify non-human identities with custom security attributes in Microsoft Entra . Not eventually. Up front. I keep seeing the same pattern across customers of every size: teams move quickly on agent experimentation, they onboard identities, they test controls, and then they realize they have no consistent attribute language for policy scope. At that point, every policy becomes a naming convention problem in disguise. That is backwards. The control plane starts with classification Custom security attributes are not decorative metadata. They are tenant-scoped key-value classifications you can assign to users, enterprise applications (service principals), and agent identities that are modeled as a service principal subtype, with dedicated role and permission boundaries for who can define and assign them ( overview , Graph model , agent identity service principal model ). That alone should change how architects think about them. This is not "nice to have taxonomy." This is policy input. Microsoft Entra Conditional Access for agents supports attribute-driven targeting with custom security attributes, and policy evaluation happens during token issuance and refresh, not just at policy authoring time ( Conditional Access for agents ). In other words: if your classification is sloppy, your runtime decisions are sloppy. Why agents raise the stakes You can say "an agent identity is still a service principal" and be technically correct. Microsoft Entra Agent ID is built on service principal infrastructure ( agent identities, service principals, and applications ). You can also miss the point. Agent identity introduces a blueprint-centered model where one blueprint can represent many agents, where blueprint-level policy decisions can

Back on 2026-07-14 I found and fixed a real landmine in this repo: requirements.txt had mcp[cli] with no version constraint at all. Any fresh install could pull in a breaking major version with zero warning. I pinned it to mcp[cli]>=1.28.0,<2.0.0 and moved on, feeling like I'd closed the gap. I hadn't. I'd only pinned the library . The actual contract my MCP server exposes to any agent that connects to it — the tool names, parameter shapes, and descriptions an LLM reads to decide how to call my code — isn't a version string anywhere. It's generated fresh, every time the server boots, from whatever my function signatures and docstrings happen to say at that moment. Nothing pins that. Nothing diffs it. Nothing tests it. What actually generates the contract My server ( server.py ) is a FastMCP app with plain @mcp.tool() -decorated functions: @mcp.tool () def create_article ( title : str , body_markdown : str , tags : list [ str ] = None , published : bool = False ) -> dict : """ Create a new DEV.to article. Returns id and url. """ payload = { " article " : { " title " : title , " body_markdown " : body_markdown , " published " : published }} if tags : payload [ " article " ][ " tags " ] = tags result = _dev ( " /articles " , method = " POST " , data = payload ) return { " id " : result [ " id " ], " url " : result . get ( " url " ), " published " : result . get ( " published " )} FastMCP inspects that signature at import time and builds the JSON Schema an agent actually sees — parameter names, types, which ones are required, and the docstring as the tool's description. I never write that schema by hand and I never check it in anywhere. It's derived, every run, from source that I edit for completely unrelated reasons. That's the gap. requirements.txt pinning stops FastMCP's own behavior from shifting under me between installs. It does nothing about my behavior shifting the schema FastMCP generates from my code, on every single commit, with no separate review step. Where

用 FROST 家族治理模型，构建你的「AI 第一性原理」 作者 ：神通说 日期 ：2026-07-23 主题 ：双项目联动 | 周四代码教程 阅读时间 ：12分钟 前言：为什么你需要「第一性原理」？ 埃隆·马斯克推崇「第一性原理」思维——从物理学的最基本定律出发，而不是类比他人的做法。 在 AI Agent 开发领域，大多数人都在用 LangChain、CrewAI、AutoGen 这些现成框架。它们很好用，但你是在用别人的「家族结构」，而不是理解为什么需要家族结构。 FROST 的目标是让你从第一性原理理解 AI Agent： 为什么需要治理结构？为什么需要记忆传承？为什么需要层级分工？ 然后，FROST-SOP 帮你把第一性原理变成可运行的系统。 一、从细胞分裂看 AI Agent 本质 想象一个细胞分裂的场景： ┌─────────┐ │ 细胞 │ ← 拥有细胞核（记忆）、蛋白质（能力） └────┬────┘ │ 分裂 ┌────┴────┐ │ 细胞A │ │ 细胞B │ ← 各自独立，但共享DNA └─────────┘ └─────────┘ FROST 的四个原子就是生命的四个基本元素： 原子 生命类比 技术实现 Store 细胞核 记忆容器，持久化状态 Skill 蛋白质 无状态能力单元 Agent 细胞膜 包裹 Store + Skills 的执行单元 SOP DNA 序列 有序的操作指令集 # FROST 的最小可用示例：50行代码理解 Agent 本质 from frost.core import Store , Agent , skill_set , skill_get , skill_del # 1. 创建记忆容器 store = Store () # 2. 定义能力（蛋白质） skills = { " set " : skill_set , # 存记忆 " get " : skill_get , # 取记忆 " del " : skill_del # 删记忆 } # 3. 创建 Agent（细胞） agent = Agent ( " my_cell " , store , skills ) # 4. 定义 SOP（DNA 序列） sop_steps = [ " set " , # 存一个值 " get " , # 读回来 " del " # 删掉 ] # 5. 运行 result = agent . run ( sop_steps = sop_steps , initial_context = { " key " : " name " , " value " : " FROST " } ) print ( result [ " _result " ]) # 输出: "FROST" 这 50 行代码展示了 FROST 的核心： Agent = Store + Skills + SOP 。 二、为什么需要「家族」？从独居细胞到多细胞生物 单细胞生物可以独立存活。但复杂生命需要多细胞协作——肝脏细胞、心脏细胞、神经细胞各有分工，协同维持生命。 AI Agent 也是如此。简单任务一个 Agent 够了，但复杂系统需要多 Agent 协作。 FROST 的家族模型： ┌─────────────────────────────────────────────────────┐ │ 君主（Human Agent） │ │ 最高决策者，只发布任务不看执行 │ └─────────────────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────┐ │ 祖辈（Ancestor） │ │ 全局编排、宪法定义、任务拆分、资源分配 │ │ ⚠️ 不亲自执行，只做调度 │ └─────────────────────────────────────────────────────┘ │ ┌─────────────┼─────────────┐ ▼ ▼ ▼ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ 斥候 │ │ 斥候 │ │ 斥候 │ │ (侦察) │ │ (侦察) │ │ (侦察) │ └────┬─────┘ └────┬─────┘ └────┬─────┘ │ │ │ ▼ ▼ ▼ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ 府兵 │ │ 府兵 │ │ 府兵 │ │ (执行) │ │ (执行) │ │ (执行) │ └──────────┘ └──────────┘ └──────────┘ │

Best-of-K eval selection bias: pick the highest-scoring config from K candidates on one eval set and that observed score is biased up. It reports the expected maximum of K noisy estimates, which beats the field mean whenever K exceeds one. The bias appears even when all K configs are truly equal, grows with K, and shrinks with n. Here is the version that bites you. Your bake-off ran a batch of prompts against one eval set, the top one came out ahead, and you shipped it. In production it does worse. That drop reads like bad luck, or drift, or a bad week. It is none of those. It is a number you could have computed before you shipped, and it gets larger the more candidates you tried. I ran a small script to make the gap concrete. Eight configs, one hundred eval items, and here is the catch: I made all eight configs truly identical , every one a fair coin at 50%. There is no real best. Nothing to tune. Then I let selection pick a winner anyway: config 0: 47/100 = 47.0% config 1: 50/100 = 50.0% config 2: 52/100 = 52.0% config 3: 52/100 = 52.0% config 4: 50/100 = 50.0% config 5: 50/100 = 50.0% config 6: 54/100 = 54.0% <- selected winner (argmax) config 7: 44/100 = 44.0% config 6: 54.0% (k=54 n=100 SE=4.98) config 2: 52.0% (k=52 n=100 SE=5.00) RANK: INDISTINGUISHABLE - gap 2.00 pp against 7.06 pooled SE = 0.28 SE < 2.0. Ranking "config 6" above "config 2" is NOT allowed. Held-out the winner on a fresh 100 items: 48/100 = 48.0%. Config 6 wins the bake-off at 54.0%. Then I asked the same eval-guard I use in the McNemar and rule-of-three pieces to rank config 6 against the runner-up. It refused: the gap is 0.28 SE, far under the two-SE bar, so INDISTINGUISHABLE . The ranker would not call config 6 the best. Selection did. And on a fresh held-out set the 54.0% falls back to 48.0%, toward the true 50% it was always going to be. TL;DR Picking the best of K configs by observed pass rate reports the expected maximum of K noisy estimates. The max of K exceeds the field mean, strict

Pillar Security's latest research says AI coding agents can be pushed to act outside their sandbox through files and tools they were told to trust, and the operational read for anyone wiring one of these into CI/CD is straightforward: an agent invocation now behaves closer to a build runner reaching your production plane than to a chat window. DevOps.com's Jeff Burt covered the work on July 22. The researchers demonstrated multiple sandbox-bypass techniques and a parallel class of prompt-injection attacks embedded in READMEs, code comments and dependencies, per the DevOps.com writeup. OpenAI, Google and Cursor have patched several of the reported flaws. Pillar's argument, as summarised there, is that the injection surface reaches every file the agent trusts on the way to the model's prompt, and every tool it can call on the way back. What the sandbox actually covered None of this is entirely new to anyone who has already read Cyberhaven Lab's May note that adoption of AI coding agents is outpacing the security tools built to protect them. What Pillar adds is a concrete demonstration of the gap. A coding agent asked to do a legitimate job can be steered to take actions outside its supposed security boundary through content that arrives on paths the sandbox was not asked to police. Those are the same paths your CI already fetches for you: dependency manifests, README files, the code comments the model reads as context. That surface has been named before. HalluSquatting and GhostApproval, both referenced in the DevOps.com piece, already gave teams a taxonomy for how AI-adjacent supply-chain attacks reach developers and their tools. Pillar's research is the sandbox counterpart. Same theme, one layer deeper into the runtime. The pipeline read Two things fall out for anyone who owns a runner fleet. First, the agent's identity, network scope and filesystem access have to be tighter than the developer who invoked it, not looser. Second, a patched-vendor list is not a covera

AutoGen's hidden token tax: why a 3-agent chat costs 15× what you expect Cost-audit series, episode 2. This series began with an AI agent that burned 136M tokens overnight → . AutoGen is Microsoft's multi-agent framework. It's genuinely good at orchestrating agents that hand off work to each other. But its default memory model has a cost shape that surprises almost every team that hits it in production. This audit shows you exactly where the tokens go, with line numbers. The setup: a 3-agent RoundRobin chat The canonical AutoGen pattern is a RoundRobinGroupChat with N agents taking turns on a task. Here's the minimal version from the docs: from autogen_agentchat.agents import AssistantAgent from autogen_agentchat.teams import RoundRobinGroupChat from autogen_agentchat.conditions import MaxMessageTermination planner = AssistantAgent ( " planner " , model_client = client , system_message = " You plan. " ) coder = AssistantAgent ( " coder " , model_client = client , system_message = " You code. " ) reviewer = AssistantAgent ( " reviewer " , model_client = client , system_message = " You review. " ) team = RoundRobinGroupChat ( [ planner , coder , reviewer ], termination_condition = MaxMessageTermination ( max_messages = 10 ), ) await team . run ( task = " Build a web scraper for Hacker News. " ) Three agents, 10 turns total (~3–4 turns each). Seems cheap. It isn't. The default context: unbounded, per-agent Every AssistantAgent gets its own UnboundedChatCompletionContext by default: # autogen-agentchat/src/autogen_agentchat/agents/_assistant_agent.py, __init__ (L708) if model_context is not None : self . _model_context = model_context else : self . _model_context = UnboundedChatCompletionContext () source UnboundedChatCompletionContext.get_messages() returns self._messages — the full list, no cap, no truncation: # autogen-core/.../model_context/_unbounded_chat_completion_context.py (a ~20-line file) async def get_messages ( self ) -> List [ LLMMessage ]: """ Get at most

For quite a while now, I've had the feeling that AI agents are surrounded by this mystical aura....