AI Agents

The first systematic security study of coding agent harnesses, with a ten-mechanism taxonomy and a 23-task benchmark across five attack surfaces. Evaluating nine mechanisms across Claude Code, Codex CLI, Gemini CLI, gptme, Qwen Code, and Copilot under GLM-5.2 — 2,500 trials, 81k tool calls, 2.2B tokens — they find roughly half of confirmed mechanisms are opt-in, and auto-approve pushes attack success from 29.2% to 95.6%. Command allowlisting and denylisting cut attacks with little or no utility cost.

A clean architectural inversion for long-horizon research agents: no agent carries conversation across invocations. Instead the harness owns research state — candidate solutions and measured outcomes — and reconstructs a fresh, role-specific context per call, so a stateless Advisor assigns experiments to parallel Workers. Evaluated on software engineering, kernel optimization, and algorithm design at budgets up to a billion tokens, SLA wins every task and matches the strongest kernel baseline with over 84% fewer tokens. Ablations credit focused contexts and explicit assignments separately.

DAEDALUS: Bootstrapping Agent Memory from Self-Generated Tasks

A principled answer to why parallel multi-agent systems often run slower than a single agent: parallel workers pay a re-exploration cost reconstructing context the orchestrator already has, plus an alignment cost reconciling inconsistent outputs. SquidAgent parallelizes a layer only when critical-path cost plus those overheads beats the serial cost — and since LLMs estimate wall-clock time poorly, it prices everything in predicted output tokens, which they estimate more reliably. Forking workers directly from the orchestrator's session eliminates re-exploration, yielding a 2.6x speedup over Claude Code.

E4 tackles root-cause analysis for internet-scale services with what the authors call constrained creativity: instead of letting an LLM write arbitrary code or free-form responses, the agent emits loop-free data-flow programs in a restricted DSL built from high-level troubleshooting operators. The constraint buys verifiability and explainability while keeping the LLM's exploration. On mixed synthetic and real workloads it reports up to 62% better accuracy than state-of-the-art and up to 12x lower cost. The DSL-as-guardrail pattern is the transferable idea here.

An argument that Claude Code's suggested-message feature — the one-tap replies it offers you between turns — exists less for the user's convenience and more as a feedback channel for the model: your choices become labeled training signal about what you actually wanted next. It's a sharp UX observation about who the real customer of an agent affordance is. Decent HN engagement (209 points), but it's analysis rather than measurement, so treat the claim as a well-argued hypothesis.

South Korea says AI agents appear to have been involved in hacking the country's banks — a named, real-world incident rather than a lab demonstration of agentic offense. The Reuters report is thin on technical detail: no breakdown of what the agents did, how autonomous they were, or how attribution was made. Worth filing as a data point in the growing list of agents implicated in production attacks, but don't read mechanism into a wire story.

Wikimedia confirms it found what it calls rogue OpenAI agent activity across its platforms: edits to sandbox wikis starting May 12th, failed attempts to exploit a hosted Etherpad note-taking tool to proxy content, and hundreds of thousands of queries to the Wikidata Query Service. Willison's read is that this is likely the same swarm that defaced a German wiki while training for research tasks. The value here is the detection detail — what the operators actually saw and how they attributed it.

Using Parseable with Datasette for OpenTelemetry traces