2026-05-27
AI Agents
Production agent capabilities are outpacing safety guardrails and operational support. Today's items contrast new benchmarks for long-horizon coding and desktop automation against concrete data exfiltration risks and the overwhelming burden AI-generated security reports place on maintainers.
News
3DeepSWE: A contamination-free benchmark for long-horizon coding agents
This new benchmark targets long-horizon coding agents with a contamination-free dataset, addressing the critical eval gap where models memorize training tasks. Previous benchmarks often failed to distinguish between genuine reasoning and recall. By isolating test data from training sets, this provides a clearer signal for agent performance on complex software engineering tasks that require multi-step planning rather than single-shot completion.
Claude Code as a Daily Driver: Claude.md, Skills, Subagents, Plugins, and MCPs
A practical breakdown of configuring Claude Code for daily production work using Model Context Protocol, subagents, and custom plugins. The guide moves beyond basic chat interactions to establish persistent workflows where subagents handle specific domains like testing or documentation. This configuration demonstrates how to stabilize agent behavior in repetitive tasks without relying solely on system prompts.
Launch HN: Minicor (YC P26) – Windows desktop automations at scale
This launch details an architecture for scaling desktop RPA using agents to navigate virtual machines via MCP. Instead of fragile UI scripting, the system generates Python scripts to control desktop software, improving determinism and observability. The approach addresses common failure modes like UI changes and cascading errors by treating automation as code execution within a controlled VM environment rather than direct mouse manipulation.
Blogs
2Microsoft Copilot Cowork Exfiltrates Files
A specific vulnerability in Microsoft's agent-enabled email system allows data exfiltration via rendered images. When an agent sends a message to a user's inbox, external images trigger network requests that leak data to attackers. Combined with pre-authenticated OneDrive links, successful prompt injection enables file downloads without further approval. This isn't theoretical; it's a direct consequence of granting agents email-sending permissions without strict egress filtering on generated content.
The pressure
The curl maintainers report a four-to-five-fold increase in security reports compared to 2024, driven largely by AI-assisted scanning. While most findings are low severity, the volume creates an operational bottleneck that threatens project sustainability. Maintainers are facing an avalanche of detailed, credible reports that require manual triage, shifting the burden from finding bugs to managing the influx of automated discovery.
2 more items the ranker flagged but didn't feature
News
Blogs
- Some ideas for what comes next, May 2026rss:interconnects