Artificer Digital The Artificer's Grimoire
· Updated

Artificer's Grimoire — Edition 5 · March 29, 2026

ai-governance supply-chain-security harness-engineering context-engineering coding-agents

Artificer’s Grimoire — Edition 5 · March 29, 2026

Anthropic ships autonomous agent infrastructure this week, and InfoQ spotlights OpenAI’s earlier Responses API agent platform push — while a supply chain attack on LiteLLM makes the case that guardrails aren’t optional. Meanwhile, hard data arrives: over-privileged agents report 4.5x more security incidents, and a skill closes a 68.4-point performance gap.

Must Read

Anthropic’s Big Week: Auto Mode, Computer Use, and the Permission Problem

Source: TechCrunch / Simon Willison / CNBC · 2026-03-23 to 2026-03-24 Score: 5 · Tags: claude-code, auto-mode, computer-use, agent-permissions, governance

Anthropic shipped two major features in consecutive days. Auto mode, which launched as a Team-plan research preview with Enterprise and API rollout to follow, uses a Sonnet 4.6 classifier to make permission decisions on behalf of the developer, blocking actions that escalate beyond task scope or appear driven by prompt injection.

Computer use, which launched as an early research preview for Pro and Max subscribers on macOS, gives Claude the ability to see, navigate, and control a user’s desktop. Together with Dispatch (persistent mobile-to-desktop agent threads), this represents a shift from per-action approval to autonomous-with-guardrails.

Why it matters: This is Anthropic’s answer to the agent permission problem. Every coding agent user knows the friction — approving every file write, every shell command. Auto mode replaces the binary allow/deny with a classifier that understands task scope. The architecture is worth studying: a cheaper, faster model making permission decisions for a more capable model.

If it works, it’s the template for how autonomous agents earn trust incrementally. If it doesn’t, Anthropic just handed agents the keys to the desktop. Latent Space called it “the biggest Claude launch of all time” — the ambition matches the risk.

LiteLLM Supply Chain Attack: CI/CD Poisoning, Credential Theft at Scale

Source: Simon Willison / Sonatype / Datadog Security Labs · 2026-03-24 Score: 5 · Tags: supply-chain, security, pypi, credential-theft, agent-infrastructure

LiteLLM versions 1.82.7 and 1.82.8 were compromised via a poisoned Trivy security scanner in the project’s CI/CD pipeline, in an attack researchers have linked to — but not confirmed as — the threat group TeamPCP. The malware exfiltrated SSH keys, cloud credentials, Kubernetes secrets, and Docker configs.

In 1.82.8, the payload triggered on install alone, without importing the library; 1.82.7 required the package to actually be used afterward. The compromised versions were live for approximately two hours on a package averaging three million daily downloads, and the same campaign also compromised Checkmarx’s GitHub Actions.

Why it matters: Two compromised versions, live for roughly two hours on a package averaging three million daily downloads — that’s the exposure window on a significant supply chain attack targeting AI infrastructure tooling, and the attack vector is particularly concerning: CI/CD pipeline poisoning. LiteLLM is the de facto LLM proxy layer; if it’s in your stack, you were potentially exposed. Because the attack triggered on install, not import, CI/CD pipelines that pull fresh dependencies were compromised silently.

Simon Willison’s coverage of package manager cooldowns is the practical defensive response: pnpm, Yarn, Bun, Deno, and uv all now support minimum release age settings. If you’re running agent infrastructure in production, audit your dependency pinning this week.

OpenAI Extends Responses API into an Agent Platform

Source: OpenAI · 2026-03-11 / InfoQ recap · 2026-03-27 Score: 5 · Tags: openai, agents, shell-tool, skills, context-compaction

OpenAI extended the Responses API with a shell tool, built-in agent execution loop, a hosted container workspace, server-side context compaction for long-running sessions, and reusable SKILL.md manifests — shipped March 11, and revisited by InfoQ in a March 27 recap. Both OpenAI and Anthropic have now converged on the same skills standard: YAML-frontmatter markdown files that encode agent capabilities.

Why it matters: The gap between “model API” and “agent platform” closed with OpenAI’s March 11 shipment, which InfoQ revisited this week. OpenAI is now offering sandboxed execution, persistent state, and a skills ecosystem — the same architectural components Anthropic ships with Claude Code.

The skills convergence is the signal to watch: SKILL.md, CLAUDE.md, AGENTS.md, and LangSmith Fleet skills are all variations on the same pattern. We’re watching a de facto standard emerge in real time. For practitioners, the implication is clear — invest in your skills layer. It’s becoming the portable unit of agent capability across platforms.

Agent Governance Gets Hard Data: 4.5x More Incidents, and a Pattern for Fixing It

Source: InfoQ (Teleport) / InfoQ (Declarative Architecture) · 2026-03-26 to 2026-03-28 Score: 5 · Tags: agent-security, governance, least-privilege, declarative-architecture

Two pieces that define the governance problem and its solution. Teleport’s “The 2026 State of AI in Enterprise Infrastructure Security” report, based on telephone interviews with 205 security leaders, finds enterprises granting excessive permissions to AI systems experience 4.5 times as many security incidents. Separately, InfoQ published “Architectural Governance at AI Speed,” proposing Declarative Architecture — transforming ADRs and event models into automated guardrails where the conformant path is the path of least resistance.

Why it matters: The Teleport data is the number this conversation needed. Not “governance is good practice” but “over-permissioned agents report 4.5x more incidents.” That’s a procurement conversation, a board-level metric. Pair it with Declarative Architecture, which offers the operational pattern, and you get the full picture: least-privilege means encoding architectural constraints so agents can’t drift, not just restricting access.

The ALARA paper from arXiv (2603.20380) arrives with the same thesis from a different angle: context exposure has real costs and should be minimized to what’s “reasonably achievable.” Three independent sources converging on the same principle in one week.

Context Engineering Validated: A Skill Closes a 68.4-Point Performance Gap

Source: Google Developers Blog · 2026-03-25 Score: 4 · Tags: context-engineering, skills, agent-capabilities, gemini

Google DeepMind developed a “Gemini API developer skill” providing agents with live documentation and SDK guidance. On a 117-prompt benchmark of Gemini-SDK coding tasks, the gemini-3.1-pro-preview model jumped from 28.2% to 96.6% success rate when equipped with the skill plus the Gemini CLI’s system instruction and two tools (activate_skill, fetch_url) — a 68.4-point improvement, no retraining.

Why it matters: This is the most compelling data point for context engineering we’ve seen. 28.2% to 96.6% on a skill-plus-tooling treatment, on a narrow, SDK-specific benchmark — not a single file, and not proof that skills alone carry general agent capability.

No fine-tuning, no model change — just giving the agent the right context and the tools to fetch more of it. If you’re still debating whether CLAUDE.md files, AGENTS.md, or skill manifests are worth maintaining, this is a data point in favor. Every team running coding agents should be measuring their equivalent of this gap.

Worth Scanning

New Tools & Repos

  • Lat.md — Markdown · 83 HN pts — Agent Lattice: a knowledge graph for your codebase, designed for AI coding agents.
  • Miasma — 304 HN pts — Tool to trap AI web scrapers in an endless poison pit. Adversarial response to AI crawlers.
  • Google Developer Knowledge API — Public preview — MCP server for accessing Google’s documentation corpus in real time.
  • Google Data Commons MCP — Hosted MCP service for public data queries on GCP.
  • FunctionGemma — 270M params — On-device function calling model for Android and iOS.

Papers

  • Learning to Commit: Online Repository Memory — Mo Li et al. — Agent PRs get rejected for lack of “organicity” — violating project conventions, not functional bugs. Supervised contrastive reflection on historical commits teaches agents the project’s change patterns.

  • Ask or Assume: Uncertainty-Aware Clarification — N. Edwards, S. Schuster — Multi-agent scaffold decouples underspecification detection from code execution. OpenHands + Claude Sonnet 4.5 achieves 69.4% vs 61.2% single-agent on underspecified SWE-bench.

  • ALARA for Agents: Least-Privilege Context Engineering — C. Agostino, N. D’Souza — Radiation safety’s ALARA principle applied to agent context: minimize exposure to what’s “reasonably achievable.” Portable, composable multi-agent teams.

  • ManagerWorker: Can AI Models Direct Each Other? — Rui Liu — Strong manager + weak worker (62%) matches strong single agent (60%) at a fraction of cost. Weak manager + weak worker (42%) performs worse than weak alone (44%).

  • RACE-bench: Reasoning-Augmented Code Agent Evaluation — S. Liu et al. — 528 real-world feature additions with structured reasoning ground truth. Measures both patch correctness and reasoning quality.

  • Context Engineering via Digital-Twin MDP — X. Yang et al. (IBM Research) — RL-guided context engineering using digital twin MDPs for enterprise AI agents.

  • OPENDEV: Terminal-Native Coding Agent — N. Bui — Dual-agent architecture (planning/execution), lazy tool discovery, adaptive context compaction, automated memory. Open-source, written in Rust.

  • Multi-Agent Orchestration Benchmarking — S. Kulkarni, Y. Kulkarni — Compares sequential pipeline, parallel fan-out, hierarchical supervisor-worker, and reflexive self-correcting architectures across five frontier LLMs on 10K SEC filings.

  • The Controllability Trap — ICLR 2026 Workshop — Framed for military AI agents, but challenges binary “human-in-the-loop or not” with a Control Quality Score (CQS) — a continuous metric for graduated governance.

Ecosystem Watch

The Long View

The Case for Slowing Down

Mario Zechner, creator of the Pi agent framework used by OpenClaw, wrote something this week that cuts against the prevailing narrative: “A human cannot shit out 20,000 lines of code in a few hours. […] With an orchestrated army of agents, there is no bottleneck, no human pain. These tiny little harmless booboos suddenly compound at a rate that’s unsustainable.”

He’s not alone. Nicole Forsgren presented DORA data at QCon showing that generating code faster with AI often makes deployment bottlenecks more expensive — the AI productivity paradox. A practitioner blog post cataloguing “uncomfortable truths” about coding agents drew 101 comments on Hacker News. And the “Learning to Commit” paper found that agents get rejected not for writing broken code, but for ignoring how the project actually works.

There’s a pattern worth naming: velocity without alignment is negative productivity. Agents that generate code faster than teams can review it, that ignore project conventions, that compound small errors across thousands of lines — these agents aren’t accelerating development, they’re creating a review debt that someone has to pay.

The Controllability Trap paper from ICLR 2026 — framed for military AI agents, but analogically relevant here — puts a finer point on governance: it is a continuous variable, not a binary “human in the loop or not” switch, and it degrades in real time as systems become harder to steer. The paper’s Control Quality Score measures that degradation, enabling graduated responses before control is lost entirely.

This isn’t an anti-agent argument. It’s an argument for what Anthropic is attempting with auto mode’s scope classifier, what Declarative Architecture encodes in machine-readable constraints, and what the ALARA paper formalizes as least-privilege context. The agents that win will be the ones that know when to pause.

Since publication

  • 2026-08-21 — Auto mode, described here as a Team-plan research preview, has since shipped broadly: Anthropic’s announcement now carries the update “Auto mode is generally available in Claude Code for all users. (July 10, 2026)” (Anthropic), and auto mode became the default permission mode for new Claude Code sessions on Pro, Max, and Team plans in August 2026. The scope classifier this edition treats as an opt-in experiment is now the default path for most paid users.

The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).