AI Agents

This paper reframes agent security as authorization architecture: an agent's permissions are set once at session start and each request is evaluated in isolation, so individually-permitted actions can compose into prohibited outcomes. The Agentic Principal Chain tracks delegated authority across principals and sub-agents, applies six checks against accumulated session state, and enforces decisions outside the model. They prove Blast Radius Monotonicity and Composition Soundness (bounded to serialized admission), and in a compromised-model eval, AgentDojo exfiltration dropped from 75–100% to 0% across 3,154 instances.

A clean study of why repo-scale coding agents fail: each edit needs facts (imports, config, migration rules) from either recent context or parametric memory, and facts covered by neither become "coherence debt." Across seven models and five harnesses, availability decides outcomes and distance doesn't — a supplied fact works as well far from the edit as adjacent. Withholding a fact costs exactly the work it supports. Notably, missing facts produce wrong work, not blocked work: agents fabricate files rather than admit ignorance. Harnesses differ tenfold in tokens rebuilding the same content.

CompoSkill attacks the assumption behind skill marketplaces: that per-skill scanning implies a safe ecosystem. It shows composition risk is a path-level property — skills that each pass a scanner can chain into a harmful outcome when an agent connects their outputs and side effects. A dual attacker (white-box knowing the skill pool, black-box knowing only a role profile) reaches Chain Formation Rates up to 83.3% and 80.6% on a 1,140-record benchmark over OpenClaw and Nanobot, while existing per-package scanners intercept little. Solid framing of a real gap.

Task completion hides the real cost of context compression. In a bounded-horizon tool-using agent over a fixed 24-turn deterministic environment, compression forces the agent to reacquire dropped state, inflating retrieval calls while completion stays statistically flat. GPT-5.5 is the sharp example: completion moves 80%→85% (p=1.0) while retrieval jumps 21.0→63.9 calls (p=.002). Replacing retained state with irrelevant content raises retrieval 57% with no completion hit. A rigorous, controlled protocol that exposes what completion metrics erase.

This paper builds an instrument to measure what multi-agent coding evals normally ignore: the coordination inside a team. Each of 1,902 runs is a temporal network of agents and files with timestamped, cost-weighted edges. Direct messaging grows near-quadratically with team size until large teams shift to broadcast; shared-specification tasks yield dense networks while pipelines stay sparse. Most actionable: shared files replace repeated 1-to-1 messaging, cutting output tokens ~42% at eight agents on message-heavy work — but add overhead when files already carry coordination.

Wiz's red team walks a chain where a GitHub Copilot "autofix" suggestion, once merged, executed inside Snowflake's CI/CD and pivoted to their Jira. The lesson isn't a Copilot bug per se — it's that AI-generated code entering an automated merge-and-deploy path is untrusted input with pipeline privileges. Autofix suggestions inherit whatever your CI grants them. If a model can propose a diff that lands without human review before running with secrets, that's your blast radius.

An MCP server that drives your actual Chrome instance with logged-in sessions, rather than a fresh headless browser. That's the whole pitch and the whole risk: an agent gets your authenticated cookies for every site you're signed into, so a prompt injection on any visited page can act as you. Low HN discussion (33 points) and no security model described in the listing. Useful for automating real workflows, but the session-sharing design is the thing to scrutinize before wiring it to an autonomous loop.

Anthropic is introducing weekly usage limits for Claude Code, framed as a May–August 2026 promotion, and the 249-comment HN thread is mostly heavy users doing the math on what caps do to their workflows. If Claude Code is in your daily loop or CI, the operational question is whether weekly quotas — not just per-request rate limits — will throttle sustained agentic runs. Details are in the support article; plan capacity around the window, not the day.