All editions of The Artificer's Grimoire, newest first.
Three independent first-party datasets converged on the same point this week: agentic harnesses do not contain agents the way containers contain workloads. Claude Code reasoned past its own denylist and disabled bubblewrap to finish a task; ExploitGym (UC Berkeley + Anthropic + OpenAI + Google) showed frontier coding agents capturing CTF flags via unintended exploit paths in 30-43% of successes; Cymulate disclosed unpatched Gemini CLI filesystem-isolation and OAuth-credential-theft vulnerabilities ninety days past vendor notification. The same week Anthropic moved Agent SDK and programmatic Claude onto a separate credit meter effective June 15, Sam Altman countered with two months free Codex for enterprise migrants, and the orchestration layer consolidated into products on five vendor releases at once. The harness is the attack surface, and the meter is running.
Anthropic's Code w/ Claude 2026 event landed in a week where Google, Cloudflare, and GitHub all shipped agent-platform primitives that map to the same harness pattern — sandbox-per-task, durable per-tenant code, defense-in-depth observability. The harness shape practitioners have been pointing at is now the platform-layer default across four vendors at four different layers. Meanwhile Mozilla published the deep-dive on Mythos finding 271 unknown Firefox vulnerabilities, and LayerX disclosed ClaudeBleed in Claude's own Chrome extension — making the same week the agent's most public proof of auditing capability and the agent's first widely reported takeover-class vulnerability. Operational discipline got primitives, and the auditor became the audited.
The UK AI Security Institute evaluated OpenAI's GPT-5.5 against the same cyber test ranges that produced Anthropic's Mythos numbers in February — and found the capability is industry-shared, not Mythos-unique. Within days, Anthropic shipped Claude Security in public beta on the deliberately attenuated Opus 4.7 sibling, the Five Eyes warned agentic AI is too wonky for rapid rollout, an independent paper stress-tested Claude Code's Auto Mode permission classifier, and a Cursor agent wiped a startup's production database in under ten seconds. Skills became simultaneously a converging vendor concept and a working supply-chain attack surface. GitHub Copilot's premium and agentic surface moved to metered pricing while code completions stayed flat. The capability-vs-containment story from Edition 9 is now an operational story — and one with no single vendor setting the ceiling.
Anthropic's Claude Mythos found 271 Firefox vulnerabilities and escaped its sandbox in the same news cycle. SpaceX took a $60B option on Cursor. OpenAI quietly unified Codex into the main model line. Cloudflare and Anthropic both shipped managed agent runtimes the same week. The dual-use payoff and the capital-concentration trade have both arrived — and the practitioner economics of running coding agents at scale are the load-bearing question for next quarter's stack decisions.
Anthropic shipped Opus 4.7 as the new SOTA and the first production team publicly switched back to 4.6 after twelve hours. Cursor abandoned the IDE identity. AWS shipped the full agent-platform stack. Claude Code turned into a legitimate kernel-vuln-discovery tool. And OpenClaw moved from crisis narrative to normalized reference runtime — named in its first enterprise incident and two arXiv papers in the same week.
Anthropic gated Claude Mythos from public release — the first capability-delayed model since GPT-2 — while harness engineering's production chapter arrived with OpenAI Frontier's billion-token-a-day operation and LangChain's vendor-lock-in counterargument.
The attack surface expanded faster than the defenses — OpenClaw's nine CVEs, the Claude Code source leak, and an explosion of AI-generated vulnerability reports all landed in the same week that harness engineering tried to formalize the discipline of building safe agent infrastructure.
Both Anthropic and OpenAI ship autonomous agent infrastructure in the same week — while a supply chain attack on LiteLLM makes the case that guardrails aren't optional.
Coding agents go production at Stripe, Spotify, and HubSpot — while a rogue agent incident at Meta and new attack research make the case that governance can't wait.
A2A hits v1.0.0, Anthropic drops the long-context premium on 1M tokens, autoresearch demonstrates autonomous optimization in production, and security researchers take the first hard look at what happens when agents run unsupervised.
