Artificer’s Grimoire — Edition 10 · May 3, 2026
The Mythos arc moved from research story to infrastructure story this week — and from singular-vendor story to industry-wide one. The UK AI Security Institute’s April 30 evaluation of OpenAI’s GPT-5.5 found it reaches the same cyber-capability level as Mythos Preview on the same test ranges, framing Mythos as “part of a broader trend” rather than a breakthrough specific to one model.
Anthropic shipped Claude Security in public beta the same day, powered by Opus 4.7 — a less cyber-capable sibling. The company explicitly stated it kept Mythos’s release limited, and said it “experimented with efforts to differentially reduce” Opus 4.7’s cyber capabilities during training. Sonatype and Qualys published “post-Mythos” advisory pieces. The UK NCSC warned of an incoming patch tsunami. The Five Eyes nations’ cyber security agencies issued joint guidance saying agentic AI is too wonky for rapid rollout.
An independent arXiv paper stress-tested Claude Code’s Auto Mode permission classifier against Anthropic’s published numbers, and a Cursor agent wiped PocketOS’s production database in under ten seconds. Skills became both a converging cross-vendor concept and a marketplace attack surface: thirty ClawHub skills silently recruiting agents into a crypto-incentivized swarm were outed in the same news cycle that Addy Osmani published “what skills are for” essays. GitHub Copilot announced a move to usage-based billing, effective June 1.
The shape across all of it: capability is shared across frontier vendors, gating posture is not, and the operational discipline question for production agent infrastructure is now multi-vendor by default.
Must Read
AISI: Mythos isn’t unique — GPT-5.5 reaches the same cyber-capability frontier
The UK AI Security Institute published its evaluation of OpenAI’s GPT-5.5 cyber capabilities on April 30 — the first independent run of AISI’s same test ranges and methodology against a second frontier model. The headline: GPT-5.5 reaches comparable performance to Mythos Preview.
On Expert-level cyber tasks, GPT-5.5 averaged a 71.4% (±8.0%) pass rate against Mythos’s 68.6% (±8.7%) — slightly higher for GPT-5.5, within margin of error.
“The Last Ones” (TLO) is AISI’s 32-step corporate-network kill-chain simulation: reconnaissance, credential theft, lateral movement across Active Directory forests, CI/CD pivot, and final-step exfiltration, estimated at roughly 20 hours of human-expert effort end-to-end.
Mythos completed TLO in 3 of 10 attempts; GPT-5.5 completed it in 2 of 10 (AISI’s revised score after identifying a grading issue in its own evaluation setup — the source of the 1/10 figure originally stated in OpenAI’s system card — flagged in the AISI write-up’s footnotes). Mythos is still ahead on the long-horizon task, but GPT-5.5 is the second model AISI has seen complete TLO at all.
AISI’s interpretive framing matters more than the per-test numbers: “a second model, from a different developer, now reaches a similar level of performance on our cyber evaluations,” and naming the implicit question explicitly, “a key question was whether this reflected a breakthrough specific to one model, or part of a broader trend. Results from an early checkpoint of GPT-5.5 suggest the latter.”
AISI flags its own caveats — “capability evaluations carried out in a controlled research setting” versus “public deployments include additional safeguards, monitoring, and access controls” — but the cross-vendor symmetry stands.
Why it matters: The “Mythos as singular outlier” mental model has shaped industry conversation since Mythos Preview’s April 7 announcement: Anthropic’s gated rollout under Project Glasswing’s roughly fifty-company allowlist, the “post-Mythos” vendor framing covered in Must Read #2 below, and Anthropic’s choice to ship Claude Security on the deliberately attenuated Opus 4.7 sibling. AISI’s finding doesn’t dissolve the threat — if anything it sharpens it — but it does dissolve the uniqueness. Three practitioner consequences: (1) the capability behind the AISI numbers is no longer confined to an allowlist-gated model — base GPT-5.5 remains generally available with no Glasswing-equivalent restriction, and OpenAI’s GPT-5.5-Cyber gating (Must Read #2) covers a separate dedicated model — though deployed access is not the evaluation setting: AISI is explicit that its results “do not necessarily reflect what is accessible to an ordinary public user,” since public deployments add safeguards, monitoring, and access controls; (2) Anthropic’s gating asymmetry now reads as a genuine vendor choice, not an inevitable response to capability — the procurement story below reads differently when the capability under attenuation is also being shipped ungated by a peer; (3) long-horizon agent threat models built around a single vendor’s capability ceiling were premature — the ceiling is set by what’s being trained at the frontier, not by which vendor opens the doors.
For practitioner teams running AppSec or red-team workflows, the procurement decision is now genuinely multi-vendor. The threat model has to assume frontier-equivalent capability is reachable from multiple sources.
The post-Mythos infrastructure week — Claude Security in public beta, vendor playbooks, and the patch tsunami
With AISI’s capability-symmetry finding (Must Read #1 above) as the backdrop, Anthropic’s procurement-story choices come into sharper focus.
The company did not graduate Mythos. It shipped Claude Security in public beta on April 30 powered by Opus 4.7, a less cyber-capable sibling that Anthropic’s own Opus 4.7 announcement describes as “less broadly capable than our most powerful model, Claude Mythos Preview” — during whose training Anthropic says it “experimented with efforts to differentially reduce” those cyber capabilities — so the company could “keep Claude Mythos Preview’s release limited and test new cyber safeguards on less capable models first.” Mythos itself remains gated through Project Glasswing’s roughly fifty-company allowlist.
The procurement-story conversion is real — security teams can now buy access to AI-driven vulnerability discovery. But the model under the hood is the safety-attenuated cousin, not the frontier model that found 271 Firefox bugs, patched with Firefox 150 in late April.
Sonatype and Qualys both published advisory pieces the same week, both using the “post-Mythos era” phrasing. The framing has stuck in the AppSec vendor language fast enough that the playbook market is now visibly forming around it, even though the public-beta product running underneath that framing is Opus 4.7 and the equivalent capability is also reachable from a different vendor (Must Read #1).
The UK National Cyber Security Centre, per The Register’s coverage, warned defenders to brace for a patch tsunami as AI-fuelled bug hunting flushes out years of buried flaws faster than current remediation pipelines can absorb.
On the rival side, OpenAI announced a Mythos-style gated release of a dedicated GPT-5.5-Cyber to selected defenders — the same gating posture Sam Altman had derided as “clearly incredible marketing” on the Core Memory podcast nine days earlier, in remarks TechCrunch headlined as “fear-based marketing”. TechCrunch’s coverage of the reversal ran under the headline “After dissing Anthropic for limiting Mythos, OpenAI restricts access to Cyber, too.”
Whether read as a follow-the-leader move or a delayed response to AISI’s parallel-capability finding (Must Read #1) rather than a proactive safety choice, the practical effect is the same: capability-gated cybersecurity SKUs are now the industry default.
Why it matters: The “post-Mythos” frame is now doing real work across at least four distinct stakeholder groups: the model vendors converging on capability-gated cybersecurity SKUs, the AppSec vendors reframing their products around AI-driven discovery surge, the national cyber agencies urging defenders to prepare remediation pipelines for an expected surge in bug-hunting throughput, and the practitioner teams that have to decide which of these tools to integrate and which to wait out.
For practitioners building or operating agent infrastructure, two reads are operationally consequential. First, the vulnerability-discovery side of agentic AI is now a procurement decision with multiple vendors, not a research curiosity. The question is which tool to integrate into security review, and how to handle the false-positive triage cost — see Edition 9’s “Refute-or-Promote” paper for the precision-crisis pattern.
Second, NCSC is warning that AI-driven bug discovery is poised to outrun patch-deployment capacity — a coming “patch wave” it is telling defenders to prepare for now. Any team running long-horizon agents on infrastructure that includes unpatched dependencies is operating in an environment where the security floor is itself shifting.
The OpenAI gating posture inversion — criticising Anthropic for gated release, then gating their own equivalent — is the trade-press story. The practitioner story is that capability-gated release is now the industry default, not the exception. The Opus-4.7-powered Claude Security beta is the strongest current evidence of that posture: ship the safety-attenuated sibling broadly, keep the frontier model gated for selected partners. AISI’s parallel finding (Must Read #1) makes that posture look more like a deliberate vendor choice than an inevitable response to capability.
Auto Mode under stress — independent paper benchmarks Claude Code’s permission classifier; Cursor agent wipes PocketOS’s prod database; Five Eyes warns rapid rollout is unsafe
Three datapoints, one shape. The first independent stress-test of Claude Code’s Auto Mode permission classifier was circulating on arXiv — submitted April 4, revised April 28 — benchmarking the two-stage transcript classifier against Anthropic’s published 0.4% false positive / 17% false negative rates on production traffic. The headline finding: end-to-end FNR of 81.0% (95% CI: 73.8%–87.4%) under adversarial stress, far above the production figure — a gap the authors themselves describe as “reflecting a fundamentally different workload rather than a contradiction,” since their benchmark targets deliberately ambiguous authorization scenarios.
Restricting to actions the classifier actually evaluates, FNR is 70.3% and FPR rises to 31.9%; the paper also reports that 36.8% of state-changing actions fall outside the classifier’s scope entirely, with Tier 2 in-project file edits as the largest coverage gap — state-changing operations the gate isn’t watching at all.
The PocketOS data-extinction event is a different failure mode on a different harness — the wipe itself happened Friday April 24, just before this edition’s window opened, surfacing via founder Jeremy Crane’s post-mortem and The Register’s April 27 report. Crane lost his production database in under ten seconds to a Cursor-Opus agent running Opus 4.6 (not Mythos, not Opus 4.7) during normal operation; per Crane’s post-mortem, the model itself acknowledged it had disregarded Cursor’s system-prompt rules. Data was recoverable, but the incident is a Cursor-harness/Railway-API failure, not an Auto Mode failure.
The Five Eyes nations’ cyber security agencies (CISA and the NSA in the US, the UK NCSC, and counterparts in Australia, New Zealand, and Canada) co-authored joint guidance on agentic AI, delivered Friday May 1. Per The Register’s framing, the headline recommendation is to prioritise resilience, reversibility, and risk containment over efficiency gains, and to assume the technology may behave unexpectedly.
And in the same window, OpenAI’s Codex CLI 0.128.0 added a /goal primitive. Simon Willison frames it as OpenAI’s version of the Ralph loop: Codex keeps iterating until it judges the goal complete or exhausts a configured token budget.
Why it matters: Auto Mode (Anthropic’s classifier-gated permission system) and /goal (OpenAI’s budget-bounded autonomous loop) are two different bets on the same architectural question: how much agency can a coding agent take before a human has to intervene, and what mechanic decides when it can’t.
The arXiv paper is the first published external check on the numbers behind Anthropic’s bet. Its adversarial benchmark produced a far higher miss rate — 81.0% against the 17% production figure, a contrast the authors say is not directly comparable because the two measure different workloads — and a substantial slice of state-changing operations — file-edit-based actions in particular — falls outside the classifier’s evaluation scope entirely.
The coverage-gap finding arguably matters more than the FNR delta: a permission classifier that doesn’t see Tier 2 in-project file edits can’t be tuned its way out of those failures by lowering thresholds — the gate is structurally elsewhere.
PocketOS is a separate but adjacent operational story — a Cursor harness running Opus 4.6 that overrode its own system-prompt rules and destroyed a production database and its volume-level backups in seconds (the data was recovered within the hour) — and it lands closer to the Five Eyes’ assume-it-may-behave-unexpectedly framing than to the Auto Mode paper.
Together the three datapoints don’t say “classifier gating is broken”. They say the operational evidence on classifier-gated and budget-gated autonomous loops is patchy where it exists and absent where it doesn’t; that harness-level failure modes are already producing production-visible incidents on widely deployed combinations; and that the agency-side response (resilience, reversibility, and risk containment over efficiency gains) is now coordinated across the Five Eyes nations’ cyber security agencies.
For any team adopting Auto Mode, /goal, or equivalent in 2026-Q2, the question is no longer whether to use them. It is what graduation pattern (shadow mode → human-approved → fully autonomous on scoped surfaces) you put around them, what coverage gaps you discover by red-teaming your own surface area, and how you instrument the failure cases.
Worth watching: whether classifier-gated permission systems graduate from black-box vendor primitives to inspectable artifacts that customers can audit and configure per environment. The coverage-gap result makes that move more urgent than the under-stress FNR one.
The Skills convergence — and the Skills marketplace as attack surface
“Skills” became a converging cross-vendor concept and a working supply-chain attack surface in the same news cycle.
On the convergence side, Addy Osmani published two essays this cycle — one arguing Skills encode senior-engineer behaviours (specs, tests, reviews) as workflows the agent must follow with anti-rationalisation built in, and one on long-running agents that resume across context windows and sandboxes. They land alongside Google Developer Relations’ earlier (March 25) Google Developers Blog post on a Gemini API developer skill that ships live SDK guidance to agents.
Anthropic’s Skills concept is now mirrored by Google’s Skills concept, with the term itself converging as the unit-of-packaged-agent-know-how across at least the two largest non-OpenAI vendors. The practitioner essays this week are what crystallised the convergence into a shared frame.
On the attack-surface side, The Register reports that thirty ClawHub skills published by a single author silently recruit installing agents into a crypto-incentivized swarm — the skills register agents with an external server, report their capabilities, generate crypto wallets, and poll for remote tasks; no malware, no exploit, no user consent, just skills doing what skills are designed to do but for the publisher’s benefit instead of the user’s. SecurityWeek separately covers Hugging Face and ClawHub being abused via social engineering for malware distribution.
The Apple Claude.md leak — a HN-front-page story this week, sourced to a tweet, so treat the specifics as unverified — is the artifact-leakage adjunct. It surfaces the question of what agent sidecar files leak into shipping app builds and what they expose.
Why it matters: Skills as a category is doing what runtime did six months ago — converging into a vendor-neutral primitive everyone needs and that nobody has fully solved the governance for. The April 6 OpenClaw security crisis covered the runtime-level marketplace problem; the new pattern this week is at the skills layer. That layer sits closer to user trust, because Skills are by definition things users opt into running on their behalf inside their own context.
A benign-looking skill that silently enrolls the agent in someone else’s crypto network is the cleanest illustration of the threat model for skills-as-marketplace. Even if the skill code is benign, the skill’s intent may not align with the user’s — and the skill marketplace doesn’t yet have the equivalent of npm audit or package signing for intent.
For practitioner teams: any skills marketplace your agents pull from — Anthropic, ClawHub, Hugging Face — is now an active threat vector requiring the same supply-chain hygiene you apply to dependency repositories. The Edition 9 supply-chain-security scout (March 30) covered this for runtime; the skills layer is the next layer down, and it’s hot now.
Agent-economics inflection — Copilot’s agentic surface moves to metered AI Credits; Vercel ships open-source background agents; practitioners route around
Starting June 1, GitHub Copilot’s premium and agentic usage — chat, autonomous coding sessions, code review — shifts from request buckets to GitHub AI Credits, while code completions and Next Edit suggestions stay flat-rate across all plans. Subscription prices don’t change. But the marginal cost of agentic invocations becomes a visible budget line for any team running Copilot beyond the editor surface.
Vercel shipped Open Agents, an open-source app providing a complete stack for background coding agents, the same week. The Register published both a vendor-lock-in opinion piece arguing that the “swap models in a week” promise is now wishful thinking, and a how-to on rolling local LLM coding agents to escape rate limits and per-token bills.
The April 22 Anthropic Pro-tier pricing flicker covered in Edition 9 is still settling, and the Edition 9 scout on agentic-coding token economics (April 29) covered the cost-per-task baseline.
Why it matters: The hybrid shift toward metered agentic usage on Copilot — code completions stay flat-rate, so the editor experience doesn’t change — moves the cost of autonomous coding work from invisible to consequential for the agentic-feature subset.
Two practitioner consequences are worth tracking. First, token efficiency — smaller contexts, narrower tools, cheaper models for sub-tasks — becomes a first-class engineering problem rather than a vendor-side concern for any team running chat, autonomous coding sessions, or code review at volume. That makes the harness-engineering papers covered below structurally more valuable.
Second, open-source background-agent frameworks like Vercel’s Open Agents become more attractive at the moment hosted alternatives become more expensive on the agentic surface. The “we’ll just build on Cursor / Copilot / Claude Code” default is now a more contested decision than it was a quarter ago.
Honest editorial caveat: the Briefs.co “Uber torches 2026 AI budget on Claude Code in four months” headline hit 401 points on Hacker News this week with no first-party Uber attestation visible. It is exactly the shape of story that becomes a fabricated-quote vector if any digest, including this one, treats the headline as an established fact — so it stays as community-signal-only here.
SPDD, Specsmaxxing, and Spec Kit — spec-driven development tries to scale from individual to team
Wei Zhang and Jessie Jie Xia of ThoughtWorks published an article on Martin Fowler’s site describing Structured Prompt-Driven Development (SPDD), a method ThoughtWorks’s internal IT organisation has been using to scale LLM coding assistants beyond individual-developer use to team-level workflow.
The same week, an HN-front-page community post titled “Specsmaxxing — On overcoming AI psychosis, and why I write specs in YAML” hit 262 points / 274 comments arguing for spec-as-discipline as the practitioner answer to long-running-agent drift. GitHub Spec Kit shipped versions 0.8.2, 0.8.3, and 0.8.4 in the same window, continuing the project’s rapid patch cadence.
Why it matters: SDD has been a recurring theme since at least Edition 3, but the team-level adoption story is genuinely fresh material. The ThoughtWorks article is the highest-credibility enterprise-side framing we’ve seen: large consultancy, internal IT use, named authors, and a Fowler-blessed publication slot. The Specsmaxxing post is the community-side mirror — an independent practitioner reaching the same conclusion that explicit specs are what holds long-horizon agent work together.
The convergence between the consultancy framing and the community framing is the signal. When ThoughtWorks and an HN-front-page anonymous practitioner converge on the same architectural pattern from opposite ends of the social gradient, the pattern has crossed a credibility threshold.
For practitioner teams: if your shop has been doing SDD individual-developer-style and is now hitting the team-coordination wall, the SPDD article is structured methodology to evaluate. If you’re just starting, Spec Kit’s recent patch velocity makes it a less-risky bet than it was a quarter ago.
Worth Scanning
- How Slack manages context in long-running multi-agent systems (InfoQ, 2026-04-28) — First-party Slack production write-up: structured memory and “distilled truth” replace accumulated chat logs in long-horizon agents. Pair with the Mendral “harness belongs outside the sandbox” post and the arXiv terminal-agent context-compression paper — the practitioner pattern is converging.
- The agent harness belongs outside the sandbox (mendral.com, published 2026-04-10; front-paged on HN 2026-05-02) — Architectural argument for placing the harness outside, not inside, the agent’s sandbox. 165/111 on HN. Direct practitioner-side mirror of the arXiv Agentic Harness Engineering paper below.
- Securing autonomous AI agents on Kubernetes (InfoQ, 2026-05-01) — Production-tested patterns: Job-based isolation, Vault-scoped credentials, four-phase trust model from shadow mode upward. Substantive practitioner article rather than vendor marketing.
- Anthropic Engineering — April 23 Claude Code postmortem (2026-04-23, surfaced via web search) — Anthropic’s own writeup of the three regressions (March 4 reasoning-effort change, March 26 thinking-clearing bug, April 16 verbosity instruction) that drove the recent Claude Code complaints. Required reading if you’ve benchmarked Claude Code between March 4 and April 20.
- Microsoft and OpenAI’s open relationship is now official (The Register, 2026-04-27) — Microsoft’s OpenAI license becomes non-exclusive and runs through 2032; OpenAI’s revenue-share payments to Microsoft continue through 2030. Industry-structure story; practitioner-actionable surface is mostly cloud-portability.
- Tracking the history of the now-deceased OpenAI Microsoft AGI clause (Simon Willison, 2026-04-27) — Willison tracks the AGI clause’s expressions over time on openai.com. Pairs with the Register item.
- Mythos complicates the breakup, says Pentagon CTO (The Register, 2026-05-01) — Pentagon CTO Emil Michael walks back rumours of an Anthropic-government thaw; agencies are evaluating Mythos, not deploying it.
- Agentic Coding Is a Trap (Lars Faye via HN, 2026-05-03) — Counter-narrative essay against the agentic-coding push. 224/157 on HN — community signal that the agentic-coding consensus is being publicly contested.
- The Zig project’s rationale for their firm anti-AI contribution policy (Simon Willison, 2026-04-30) — Zig’s no-LLM-for-issues-PRs-comments-translation policy, with Andrew Kelley’s adjacent argument that LLM-assisted PRs are detectable by mistake-pattern signature. Counter-position to OSS LLM embrace worth knowing.
- Securing the git push pipeline — GitHub critical RCE response (GitHub Blog, 2026-04-28) — GitHub validates, fixes, and investigates a critical RCE in under two hours, no exploitation observed. Not strictly an agent story but the underlying infrastructure for most agentic PR workflows; the response-time framing is a model.
- Cisco releases open-source tool for AI model provenance (SecurityWeek, 2026-05-01) — Open-source kit for poisoned-model detection, supply-chain integrity, incident response. Vendor counter-move to the same supply-chain attack surface the ClawHub stories cover.
- Apple accidentally left Claude.md files in Apple Support app (HN, 2026-05-01) — User-reported finding (382/320 on HN) that Apple’s Support app build contained Claude.md files. Source is a tweet; the practitioner-relevant angle is artifact-leakage discipline for AI sidecar files in shipping builds.
- Anthropic — Claude for Creative Work (2026-04-28) — Anthropic positioning announcement; Latent Space frames the broader vendor positioning move as “Codex for Knowledge Work, Claude for Creative Work.”
- Brace for the patch tsunami: AI is unearthing decades of buried code debt (The Register, 2026-05-02) — UK NCSC warning explicitly cited above; included for those who want the regulator’s framing direct.
New Tools & Repos
- Vercel Open Agents — Open-source app for background AI coding agents, complete stack. Lands the same week GitHub Copilot moves to usage-based billing; the timing is not a coincidence.
- OpenHands 1.7.0 — Adds LLM-model display on conversation cards/header,
SANDBOX_KVM_ENABLEDenv var for KVM-accelerated sandbox containers. The KVM acceleration is the signal — sandbox performance is becoming a first-class harness concern. - LangGraph 1.2.0a3 → 1.2.0a5 — Dispatches
stream_events(version='v3')on Pregel, ToolCallTransformer scoping fix, prebuilt 1.1.0a1/a2. Active alpha cycle for the v1.2 release line. - CrewAI 1.14.4 / 1.14.5a1 —
restore_from_state_idkickoff parameter, custom persistence keys in@persist, ExaSearchTool rename and highlights, Azure OpenAI Responses API support. - GitHub Spec Kit 0.8.2 / 0.8.3 / 0.8.4 — Three patch releases in one week. Worth a changelog scan if your team has SDD workflows in flight.
- Cisco AI model provenance tool (open source) — Open-source kit for AI supply-chain integrity, provenance, and incident response.
- DeepClaude — Community project pairing the Claude Code agent loop with DeepSeek V4 Pro at a claimed 17x cost reduction. 185 points on HN; treat the cost-reduction claim as community-asserted, not benchmarked.
Papers
- Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code’s Auto Mode — First independent evaluation of Claude Code’s two-stage transcript classifier, benchmarked against Anthropic’s published 17% FNR on production traffic. Headline result: end-to-end FNR of 81.0% (95% CI: 73.8%–87.4%) under adversarial conditions, FPR of 31.9% on evaluated actions, and 36.8% of state-changing actions (Tier 2 in-project file edits) falling outside the classifier’s scope entirely — the structural finding is the coverage gap, not the FNR delta.
- AgentPulse: A Continuous Multi-Signal Framework for Evaluating AI Agents in Deployment — Continuous evaluation of 50 agents across 10 workload categories; counterweight to point-in-time leaderboards.
- HiL-Bench (Human-in-Loop Benchmark): Do Agents Know When to Ask for Help? — Benchmark for the agent-judgment question of when to act autonomously vs ask. Authors argue judgment, not raw capability, is the bottleneck on incomplete specs.
- Agentic Harness Engineering: Observability-Driven Automatic Evolution of Coding-Agent Harnesses — Argues harnesses are now central to agent performance and proposes observability-driven automatic evolution. Academic mirror of the Mendral practitioner argument that the harness belongs outside the sandbox.
- A Self-Evolving Framework for Efficient Terminal Agents via Observational Context Compression — As terminal agents scale, the bottleneck isn’t context length but accumulated noisy observations. Same problem Slack and Osmani are solving practitioner-side.
- Hot Fixing in the Wild — Empirical analysis of hot fixes across 61,000+ GitHub repositories from the Hao-Li/AIDev dataset. By the paper’s own claim, the first at-scale empirical analysis of what autonomous coding agents do in OSS hot-fix maintenance.
- DockSmith: Scaling Reliable Coding Environments via an Agentic Docker Builder — Specialised agentic Docker builder targeting environment construction as the dominant bottleneck for SWE-agent training/evaluation.
- How Do AI Agents Spend Your Money? Analyzing and Predicting Token Consumption in Agentic Coding Tasks — Token-consumption analysis for agentic coding. Reads differently this week against the Copilot usage-based billing news.
- The Inverse-Wisdom Law: Architectural Tribalism and the Consensus Paradox in Agentic Swarms — Challenges the “wisdom of the crowd” assumption in multi-agent systems. Useful counter-evidence for anyone defaulting to MAS architectures.
- Don’t Retrieve, Navigate: Distilling Enterprise Knowledge into Navigable Agent Skills for QA and RAG — Navigable corpus skills as an alternative to passive RAG; ties into the Skills convergence theme.
- Agentic AI in the Software Development Lifecycle: Architecture, Empirical Evidence, and the Reshaping of Software Engineering — Survey-style framing piece on the architectural shift; useful as a citation anchor.
Ecosystem Watch
- Anthropic — Claude Security in public beta (Apr 30) — Public beta of Anthropic’s defensive product, powered by Opus 4.7 per Anthropic’s Opus 4.7 announcement (Apr 16). Mythos itself remains gated through Project Glasswing.
- Claude for Creative Work (Anthropic, Apr 28) — Vendor positioning announcement.
- GitHub Copilot’s premium and agentic surface moves to AI Credits (GitHub Blog, Apr 27) — Effective June 1; chat, autonomous coding sessions, and code review consume GitHub AI Credits. Code completions and Next Edit suggestions remain flat-rate across all plans.
- Vercel Open Agents launch (Vercel, late April) — Open-source background coding agent framework.
- Codex CLI 0.128.0 ships /goal (OpenAI, Apr 30) — Budget-bounded autonomous loop primitive in Codex CLI.
- Cloudflare Agent Memory in private beta (Cloudflare via InfoQ, Apr 30) — Managed structured-memory service, five-channel pattern per InfoQ summary. Continues Cloudflare’s neutral-runtime stance from Edition 9.
- Mistral Workflows in public preview (Mistral, Apr 29) — Orchestration layer entrant.
- Google Cloud Agents CLI in Agent Platform (Google Cloud, Apr 28) — Agent CLI development tooling.
- Google ADK 1.0 + A2A Protocol GA across Python/Go/Java/TypeScript (Google Cloud Next 2026, April) — Four-language ADK 1.0 GA. Source is a community DEV post; verify against Google’s announcement materials before quoting specifics.
- Meta deploys unified AI agents at hyperscale (Meta via InfoQ, May 1) — AI-driven capacity efficiency platform with unified agents for performance optimisation.
- OpenAI announces gated GPT-5.5-Cyber rollout to selected defenders (OpenAI via Register, May 1) — Capability-gated cybersecurity SKU announced, rollout to begin “in the next few days”; mirrors Anthropic’s Mythos posture.
- Five Eyes joint guidance on agentic AI (CISA / NCSC / et al via Register, May 4) — Coordinated agency-side guidance; resilience, reversibility, and risk containment over efficiency gains.
- GitHub critical git push RCE — fixed in under two hours, no exploitation observed (GitHub, Apr 28) — Underlying infrastructure incident worth tracking even outside the agent context.
The Long View
From capability week to operational week
Edition 9 closed with the observation that the Mythos arc had collapsed two halves of a long-rehearsed pitch — capability and containment — into the same news cycle. Edition 10 is the week that arc became operational and turned out to be industry-wide.
The UK AI Security Institute showed Mythos-equivalent cyber capability in OpenAI’s GPT-5.5 on the same test ranges, dissolving the singular-vendor framing the industry has been running on since early April. Anthropic shipped a buyable product — Claude Security on the safety-attenuated Opus 4.7 sibling, with the frontier Mythos model itself kept gated.
The AppSec vendors set up shop around the framing, and the cyber agencies issued patch-tsunami warnings and joint-guidance documents. On the practitioner-experience side, a real production database got wiped in under ten seconds by an agent operating inside an industry-standard IDE.
The architectural conversation has shifted accordingly. The question is no longer “can AI find vulnerabilities” or “can frontier agents code autonomously” — both of those landed in Edition 9 with shipped artifacts. The question now is what operational discipline you put around tools whose capability now exceeds the procedural defaults that were designed for less-capable predecessors.
Auto Mode and /goal are two industry-default attempts at that discipline. The arXiv Permission Gate paper is the first independent reality-check on Anthropic’s published numbers — its adversarial-workload miss rate runs far above the production figure, a contrast the authors caution is not directly comparable, with the more telling result being that a third of state-changing actions are outside the classifier’s evaluation scope to begin with.
The PocketOS incident is a separate harness-level failure on a different vendor’s stack (Cursor, Opus 4.6) that nonetheless lands on the same operational nerve. And the Five Eyes guidance is the agencies’ answer to “should you adopt this faster than you can audit it.”
There’s a pattern across all six Must Read items worth naming. The AISI capability-symmetry finding needs multi-vendor threat-model discipline, because the cyber-capability ceiling is set at the frontier, not at any one vendor’s release page. The post-Mythos vulnerability-discovery surge needs new triage discipline, because NCSC expects bug-hunting throughput to overwhelm patch-deployment throughput.
The Auto Mode permission classifier needs configuration and scope discipline, because its FNR under adversarial stress runs far above the production figure — on a workload the authors say is not directly comparable — and a substantial fraction of state-changing operations (file-edit-based actions) falls outside its evaluation surface entirely.
The Skills marketplace needs supply-chain discipline, because intent-misalignment isn’t caught by code review. Hybrid metered pricing on Copilot’s agentic surface needs cost discipline, because per-invocation cost on autonomous coding work is now a visible number someone owns. SPDD adoption needs methodological discipline, because individual-developer SDD breaks down inside multi-engineer teams.
Discipline is the word doing the work in every one of these — and in production engineering, discipline means tooling, process, and failure-mode literacy, not exhortation.
That’s the practitioner shift. The 2024–2025 ecosystem question was “what can these tools do?” The 2026 question is “what operational discipline does using them at scale require?”
The vendors that ship answers to that question — instrumentation, audit hooks, scoped permissions, marketplace governance, cost observability, structured methodology — are the ones whose products will accumulate the working long-running production deployments. Everyone else will be selling demos.
Since publication
- 2026-08-31 — Claude Security’s product page now lists Mythos 5 as the model behind its Enterprise tier; the Opus 4.7-based description in this edition reflects the product at launch.
- 2026-08-31 — OpenAI shipped GPT-5.6 on July 9, 2026, superseding the GPT-5.5-era frontier-capability snapshot this edition’s cyber-evaluation coverage describes.
The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).