AI Agents

CAITLYN is an agent-agnostic defense middleware against prompt injection built as two systems: System I handles known attacks with a two-tier library (rule-based scripts plus optimized LLM inference), while System II monitors for anomalies and autonomously synthesizes new defenses. On standard benchmarks it matches state-of-the-art detection at lower token cost than LLM-as-judge baselines. The more interesting result is on Emerging, their delivery-aware benchmark of novel techniques, where static baselines stay vulnerable but System II lowers attack success by generating verified defenses.

String reframes agent tooling as an OS problem: instead of stuffing tool schemas into context every turn, tool knowledge lives in a common layer rendered back one Markdown view at a time via two verbs, /open and /act. A single SFMD document declares views, typed actions, navigation, and credentials, and one grammar serves styled HTML to browsers and raw docs to agents. The staging findings are the payoff — disclosing detail one turn early costs up to 23 accuracy points, and proper staging drops wrong-action rates from 28% to 2%.

OBPE puts policy enforcement outside the agent's reasoning, at a trusted tool boundary: it authorizes typed operations, narrows queries before the backend call, and filters or masks fields in the response, with semantic gating that can hold or deny on argument values. A data-policy owner sets the ceiling; agent policy can only narrow it, and the authors prove order-independence under stated conditions. Against Jira and ServiceNow mocks across four models and 20 adaptive red-team tasks, trace failures fell from 57.6% to 0.2% over 3,621 trials.

openJiuwen is an open-source harness for long-horizon coding agents built around two properties: structural composability (Rail-based capability composition across single agents, delegated sub-agents, and Swarm Flow under shared execution semantics) and runtime adaptivity (framework-controlled decisions that let evolving evidence — diagnostics, execution outcomes, task progress — reshape context and control around a fixed model policy). It reports 82.6% on SWE-bench Verified and 87.19% on Terminal-Bench 2.1, exceeding the strongest official leaderboard point estimates by 3.4 and 3-plus points.

This paper caught a model passing a fidelity check without ever opening the datasheet — a structured-output constraint had silently disabled tool use, so it fabricated source text and still scored as a success. The fix is dispatch-level instrumentation: log every tool call, then build a silent-failure detector whose two rules check only which tools were called, never the extracted value. It flags zero false positives on 207 clean extractions across three model families and recovers all 50 planted tool-withholding faults.

A security researcher documents an exploit against Claude Code's Opus 5 auto mode — the mode that lets the agent run without per-action approval. The writeup describes a concrete path to steering the agent into unintended actions, which is exactly the failure class auto mode's convenience invites. Thin on HN metrics (73 points) but the author is credible, and any documented jailbreak of an autonomous coding agent with shell access warrants reading before you enable unattended runs.

Claude Code began appending session URLs to commit messages and PR descriptions by default, and the GitHub issue drew 202 points and 223 comments. The operational concern is real: session links leak into permanent git history and public PRs, potentially exposing internal context or serving as an unwanted tracking breadcrumb. It's a small default with outsized privacy and provenance implications for anyone running the tool against shared repositories.

Willison untangles ChatGPT Work, which is actually two products: a cloud version reachable through chatgpt.com and the apps, and a local version — the app formerly called Codex — that runs programs on your machine. He focuses on Work Cloud, documenting the paid-tier gating, the tab-selector interface separating it from Chat, and features around model selection, code execution, and sub-agent behavior. As usual with his writeups, the value is careful practitioner observation of a confusing, fast-iterating surface.