Artificer’s Grimoire — Edition 7 · April 12, 2026

Anthropic declined to ship its most capable model. OpenAI showed what a fully autonomous harness actually looks like at Frontier scale. LangChain argued the harness itself is now a lock-in vector. MCP quietly hardened into enterprise backbone. And GitHub Copilot CLI added built-in cross-model review with Rubber Duck. A build-out week that sets the policy, architectural, and competitive baselines for the rest of 2026.

Must Read

Project Glasswing: Anthropic Holds Claude Mythos Back

Source: Anthropic / Simon Willison / Latent Space · 2026-04-07

Score: 5 · Tags: anthropic, glasswing, capability-gating, disclosure, security

Anthropic did not release Claude Mythos. Instead, a preview goes only to a small set of security-research partners under Project Glasswing, because Mythos’s vulnerability-discovery capability is strong enough that the wider software industry needs lead time to prepare. The preview has already surfaced thousands of high-severity vulnerabilities across every major operating system and browser. It is the first time Anthropic has capability-gated a general-purpose model, and one of the most explicit “too dangerous to release” decisions any lab has made.

Why it matters: This is a policy inflection, not a product story. Every lab now has a reference point for what “delayed release on capability grounds” can actually look like in practice. Every downstream team building on top of Claude now has to plan for the possibility that the highest-tier model they want may be tier-gated rather than price-gated.

It also raises an uncomfortable question for the open-weight side of the field: when GLM-5.1 and its successors hit parity, the decision whether to gate is no longer available to anyone. Glasswing is the last generation in which a single vendor’s restraint protects the ecosystem.

Harness Engineering: The Production Chapter

Source: Latent Space (Lopopolo) / LangChain / LangChain (Better Harness) / LangChain (Deep Agents Deploy) / Böckeler QCon · 2026-04-07 to 2026-04-11

Score: 5 · Tags: harness-engineering, vendor-lock-in, evals, managed-agents, production

Edition 6 named the discipline; the April 6 harness-engineering scout mapped its mental models and taxonomy. This week added the material the scout couldn’t.

Ryan Lopopolo’s Latent Space interview gave the first public look at OpenAI’s “Frontier & Symphony” operation: 1M lines of code, 1B tokens per day, 0% human-written code, and no human review required before merge — though Lopopolo says most human review still happens, just after merge rather than before it. LangChain published a three-part argument — the harness owns your memory (“Your Harness, Your Memory”), evals are the hill-climbing signal for harness design (“Better Harness”), and the open alternative to Claude Managed Agents is now shipping (“Deep Agents Deploy”).

Birgitta Böckeler delivered the QCon keynote version of her Martin Fowler framework, pitching harness engineering to leaders as the safety net that makes autonomous generation defensible.

Why it matters: OpenAI itself first used the term “harness engineering” in a February 11 post by the same Lopopolo; this week the discipline gained an internal-beta datapoint, an architectural critique, an optimization methodology, and a competing product category. The scout already covers inner/outer harness, guides/sensors, control-loop primitives, and the Claude Code leak as a case study.

The genuinely new idea is LangChain’s: memory is harness-tied, so harness choice is a lock-in decision. Teams adopting Claude Managed Agents or equivalent closed harnesses need to treat that as an architectural commitment equivalent to choosing a database, not a coding tool. Lopopolo’s Frontier numbers come from an internal beta with daily internal users and external alpha testers, not a shipped production product — but they’re still the upper bound of what harness-mediated autonomy can deliver today, and they define how much operator attention is being spent on work a mature harness would absorb.

MCP Hardens Into Enterprise Backbone

Source: InfoQ (AAIF MCP Summit) / InfoQ (Colab MCP Server) / LangChain (Arcade in Fleet) / Futurum Group · 2026-04-07 to 2026-04-09

Score: 5 · Tags: mcp, aaif, enterprise, gateways, observability

MCP Dev Summit North America (April 2–3, ~1,200 attendees under the Linux Foundation’s Agentic AI Foundation) put Amazon and Uber on record with production MCP deployments. The conversation shifted from “is MCP the right protocol?” to gateway patterns, the SEP-1442 shift toward stateless transport, and observability integration on the 2026 roadmap. Google open-sourced a Colab MCP Server that lets any MCP-speaking agent offload execution to cloud sandboxes. Arcade’s 7,500+ governed agent tools are now exposed through LangSmith Fleet as a single secure gateway.

Why it matters: Enterprise consumers at the summit have stopped talking about “should we use MCP” and started talking about what sits between their agents and their MCP servers. Gateways, auth proxies, observability layers, tool registries, execution sandboxes. This is the same architectural shift that turned HTTP from “protocol” into “web platform” in the late 1990s: the value is increasingly in the middle tier. Teams building agent infrastructure should expect their MCP integration work to look less like “point agent at server” and more like “consume a vetted tool gateway,” and should budget accordingly.

The Edition 3 scout on MCP production pain points predicted the observability gap; this week’s summit is the industry closing it.

GitHub Copilot CLI Ships Rubber Duck, Its Cross-Model Review Feature

Source: InfoQ / GitHub Blog (Rubber Duck) · 2026-04-06 to 2026-04-12

Score: 5 · Tags: copilot, cli, autopilot, rubber-duck, enterprise

Copilot CLI reached general availability on February 25 — five and a half weeks before this edition’s window — with Autopilot mode (agentic workflows) as part of that release. This week’s actual news is “Rubber Duck,” a companion feature GitHub shipped April 6 in experimental mode (behind the /experimental command): it invokes a second model family during the same session for independent review, a product response to the “self-evaluation bias” pattern that shows up across coding-agent research. GPT-5.4 model support and enterprise telemetry, both recapped in this week’s InfoQ retrospective, likewise shipped in the weeks after GA rather than this week. Edition 6 covered the /fleet multi-agent preview; Rubber Duck is Copilot CLI’s answer to cross-model review.

Why it matters: The competitive field for terminal-native coding agents has converged on the basics: Claude Code, Gemini CLI, and Copilot CLI all ship planning modes and agentic execution modes. Cross-model review is not part of that parity. Copilot CLI is the only one of the three that ships it; Claude Code’s review dispatches same-vendor Claude subagents, and Gemini CLI has no native review command at all. Differentiation elsewhere has moved to the enterprise wrapper — telemetry, audit, governance, subscription economics.

Rubber Duck is interesting on its own merits: it’s the productization of the “have a second model check the first one’s work” pattern that academic work has been exploring for 18 months. The first vendor to ship it as a default will shape expectations for every coding agent after. If your team standardizes on a single model family today, Rubber Duck is the argument for budgeting a second one.

Agent Skills: A New Gemini Benchmark Confirms the Pattern

Source: Google Developers Blog · 2026-03-25

Score: 4 · Tags: agent-skills, gemini, benchmark, knowledge-injection

Google DeepMind published benchmark data for the agent-skills pattern: equipping gemini-3.1-pro-preview with a Gemini-API developer skill lifted its success rate on SDK-specific tasks from 28.2% to 96.6%. The skill itself is lightweight — live docs packaged as a structured resource the agent can load on demand. Google’s own post credits Vercel’s January evaluation (skills topped out at 79% pass rate against a bare AGENTS.md’s 100%) as the prior work that motivated this test. Together with the April 2 scout on agent-skills ecosystem convergence, this gives Gemini-specific numbers on what the pattern buys you, on top of Vercel’s earlier comparative data.

Why it matters: The agent-skills ecosystem has been long on vendor claims and short on measurement. A 68-point absolute improvement is not marginal — it’s the difference between “this agent can almost never do this” and “this agent can almost always do this.” The gain comes from the full skill-enabled setup Google tested — a CLI system instruction plus activate_skill and fetch_url tools — not from live documentation alone.

The practical question every team should now be asking: what are the 3–5 skills that would give our agents that kind of delta on our APIs? The pattern is simple enough that the answer should be an internal weekend project, not a multi-quarter initiative.

Worth Scanning

Stateful Continuation for AI Agents: Why Transport Layers Now Matter (InfoQ, Anirudh Mendiratta) — In the author’s small simulated benchmark (three coding tasks, three runs each, not a production evaluation), server-side context caching cut client-sent data 80%+ and execution time 15–29% in multi-turn agent loops. Transport is worth watching as a performance concern.
Human Judgment in the Agent Improvement Loop (LangChain) — Agents need organizational tacit knowledge, not just documented knowledge. Workflow patterns for harvesting judgment during deployment.
Feedback Flywheel (Martin Fowler / Rahul Garg) — Third in Garg’s AI-friction series. Harvests AI-session learnings into team-shared artifacts; complements the LangChain HITL piece.
Building Hierarchical Agentic RAG Systems (InfoQ, Abhijit Ubale) — “Protocol-H” pattern: deterministic routing, reflective retry, modality-aware reasoning for enterprise analytics RAG.
QCon: Choosing Your AI Copilot (Sepehr Khosravi) — Leadership-level tour of Cursor Composer vs. Claude Code’s research mode. Practical context-window and MCP tips.
Anthropic × Google × Broadcom: Multi-Gigawatt Compute Partnership (Anthropic) — Google TPUs + Broadcom silicon. Anthropic’s capacity strategy independent of its AWS tie. Bedrock capacity planning downstream.
Agentic Engine Optimization (AEO) (Addy Osmani) — “SEO for agents”: optimize docs for how coding agents consume them, not just human readers.
Your Parallel Agent Limit (Addy Osmani) — Running N agents in parallel isn’t throughput, it’s cognitive labor. An “ambient anxiety tax” on the operator.
Anthropic at $30B ARR, Glasswing, and the OpenAI IPO Counter (Latent Space) — Competitive framing for the Glasswing announcement. Useful context; overlaps with primary sources.
Multi-Tenant Configuration with Tagged Storage Patterns (AWS Architecture Blog) — Key-prefix routing pattern with event-driven cache invalidation. Applicable to agent-infra multi-tenant isolation.
Podcast: Context Engineering with Adi Polak (InfoQ) — Stateful vs. stateless framing of context vs. prompt engineering. Pairs with the Mendiratta transport article.

New Tools & Repos

Google Scion — Open-source multi-agent orchestration testbed. Containers with isolated identities, credentials, and shared workspaces. Reference implementation for multi-tenant agent isolation.
Google Colab MCP Server — Python · Apache 2.0 — MCP endpoint exposing Colab to any MCP client. Offloads untrusted or compute-heavy execution off the developer laptop.
LangChain Deep Agents Deploy (beta) — Production-ready open harness deployment. Explicit positioning against Claude Managed Agents.
CrewAI 1.14 Series — Python · 45K+ stars — Edition 6 covered 1.13’s A2UI work; 1.14 adds runtime state checkpointing, checkpoint list/info CLI commands, a SQLite checkpoint provider, and SSRF/path-traversal protections.
Arcade.dev in LangSmith Fleet — 7,500+ governed agent tools exposed through a single secure gateway. MCP runtime with auth/governance built in.
Spec Kit v0.6.x Lean Preset — Python — Minimal workflow commands, rewritten AGENTS.md focused on integration architecture, growing community extension catalog (Brownfield Bootstrap, CI Guard, SpecTest, Worktree Isolation, multi-repo-branching).
Entroly — Local daemon acting as an “epistemic firewall” for Claude Code/Cursor/Copilot. Pre-computes symbolic graphs overnight. Novel framing, non-authoritative source.
CausalOS — Python · MIT — Causal memory graph for agents, positioned by its author as a response to the Replit production-DB deletion incident. Records action→outcome chains and runs deterministic pre-action recall. Community project, non-authoritative source.

Papers

Inside the Scaffold: A Source-Code Taxonomy of Coding Agent Architectures (Benjamin Rombaut, 2026-04-03) — The academic version of the taxonomy that anchored the April 6 harness-engineering scout: a source-code-level classification of scaffolding across production coding agents, with side-by-side control-loop, tool-definition, and state-management comparisons. Read alongside this week’s Harness Production Chapter.
Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code’s Auto Mode (Ji et al., 2026-04-04) — First independent evaluation of Claude Code’s Auto Mode permission classifier on deliberately ambiguous authorization scenarios. Anthropic’s own numbers are 0.4% FP / 17% FN; this paper stress-tests them under deliberately ambiguous scope, blast-radius, and risk specifications, not adversarial intent — the benchmark’s own scenarios hold user intent clear throughout. Directly relevant if your team is about to standardize on Copilot CLI’s Autopilot or Claude Code’s Auto Mode — the March 30 agent-permissions scout framed the design question; this gives you the measurement.
Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems (Qu et al., 2026-04-03) — Empirical attack study on skill marketplaces: unlike conventional packages, skills run as operational directives with system-level privileges, so a single malicious skill compromises the host. Academic validation of the threat model in the April 6 DDIPE/documentation-poisoning scout, arriving in the same week Google’s agent-skills benchmark made the pattern look even more indispensable.

Ecosystem Watch

Meta Muse Spark — First Meta frontier release since Llama 4. Hosted (not open-weights), private API preview. Meta’s benchmarks position it near Opus 4.6 / Gemini 3.1 Pro / GPT-5.4, but Meta acknowledges current gaps in “long-horizon agentic systems and coding workflows.”
LangGraph 1.1.7a1 — Graph lifecycle callback handlers. Useful for custom instrumentation and durability integrations. CLI 0.4.21 adds a validate command.
Deep Agents v0.5 — Async subagents that delegate to remote background agents. Expanded multi-modal filesystem support.
Gemini Code Assist: Finish Changes + Outlines — AI completion of partial edits; inline English summaries (“Outlines”) interleaved into source for comprehension. Agent Mode gets Auto-Approve and inline diffs in a parallel update.
Simon Willison: Gemma 4 Audio with MLX — Practitioner recipe: one-line uv run for on-device audio transcription with Gemma 4 E2B. Edition 6 covered Gemma 4’s launch; this confirms the tooling has caught up.
ADK Integrations Ecosystem — Standard third-party integrations (GitHub, Notion, Hugging Face) shipped with ADK to reduce glue code for common agent workflows.

The Long View

The Capability Gate

Anthropic’s Project Glasswing matters less for what it is than for what it makes legible. It is the clearest case yet in the commercial-LLM era of a frontier lab looking at a model it had finished and saying not yet. Not for safety-tuning reasons. Not for alignment reasons. Not for liability reasons. For capability reasons: the thing is good enough at finding vulnerabilities that giving it to everyone before giving defenders a head start would be a net loss for the ecosystem.

This is the precedent every lab now has to operate against. It establishes, by example, that capability-gated release is a thing you can do — that there is a commercial, reputational, and operational path through it. It also makes the absence of a gate a visible choice. When the next model that hits Mythos-class vulnerability-research capability ships unrestricted, the question is no longer “why would they gate it?” but “why didn’t they?”

The awkward consequence: this only works for closed-weight models. When GLM-5.1’s successors reach parity on the capabilities Anthropic is gating — and the trajectory suggests they will — the gate becomes unavailable. Glasswing is the last generation in which any individual lab’s restraint protects anyone. Everything after it is about the defender side getting ahead: faster patch pipelines, agent-assisted triage, hardened supply chains. If capability-gating was always a stopgap, Anthropic just spent a stopgap. The question for the next eighteen months is whether defenders used the time.

For practitioners, the near-term implication is narrower. Your model-access strategy now has to account for tier-gating, not just price-gating. The best model for your agent workload may soon require a capability-justification process — an SOC-2-ish attestation that your use case belongs on the inside of the gate. That’s a new vendor-management muscle most teams don’t have. Worth building before you need it.

Since publication

2026-08-22 — Anthropic’s annualized revenue run rate, $30B at this edition’s publication, reached $65B as of July 2026 (reported 2026-08-17 by TechCrunch and CNBC).
2026-08-22 — Project Glasswing has expanded: Anthropic is extending the program to roughly 150 new organizations based in more than 15 countries, each required to meet Anthropic’s security requirements before gaining access — on top of the roughly 50 initial security-research partners described here, for a total of about 200. The 10,000+ high/critical-severity vulnerability figure is what those original ~50 partners found before this expansion, not a result of it (Anthropic).

The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).

Artificer's Grimoire — Edition 7 · April 12, 2026