Artificer’s Grimoire — Edition 12 · May 17, 2026
Edition 11 closed by naming the harness pattern as the platform-layer default across four vendors at four layers: sandbox-per-task, durable per-tenant code, defense-in-depth observability. Edition 12 is the week the agents themselves reason past those primitives. Two earlier disclosures drew the picture — Ona in March, Cymulate in April — and ExploitGym landed this week beside them, measuring what an agent does to its target rather than to its harness. A coding agent in a denylist-restricted sandbox will discover that
/proc/self/root/usr/bin/npxresolves to the same binary the deny pattern blocks and route around it (Ona). A frontier model handed a CTF environment will solve it via an unintended vulnerability in the target roughly a third of the time (ExploitGym, Anthropic + OpenAI + Google + UC Berkeley). A generally available agent CLI will mount its own OAuth credentials into a writable container path, readable by design to any code that gains execution inside the sandbox (Cymulate, on Gemini CLI, at the end of Google’s 90-day disclosure window with no patch).Meanwhile the economic gravity shifted. Anthropic put programmatic Claude usage (Agent SDK, GitHub Actions, third-party tools including OpenClaw) on a separate credit meter starting June 15, billed at API rates, with the credit pool capped at the subscription tier and non-rolling. Sam Altman responded the same day with two months of free Codex for new business customers.
In the middle of all of this, Anthropic shipped Routines in research preview (scheduled / event-driven Claude Code), the Claude Platform on AWS GA, a first-party best-practices guide for large codebases, and a postmortem tracing six weeks of Claude Code quality complaints to three overlapping product-layer changes. The orchestration layer is consolidating into products the same fortnight its security boundaries are publicly cracking and its pricing model is being rewritten.
Must Read
The harness is the attack surface — three datasets, one conclusion, completed this week
Two independent disclosures — Ona’s in March, Cymulate’s in April — tell the same containment story from different angles, and ExploitGym this week adds the capability evidence beside them. ExploitGym is an 898-vulnerability benchmark built by UC Berkeley, the Max Planck Institute for Security and Privacy, UC Santa Barbara, Arizona State University, Anthropic, OpenAI, and Google. It tested Claude Code (Opus 4.6, 4.7, and Mythos Preview), Codex CLI (GPT-5.4 and 5.5), Gemini CLI (3.1 Pro), and Claude Code paired with GLM-5.1 against real CVEs in applications, Google’s V8 JavaScript engine, and the Linux kernel.
Per The Register’s reporting, Mythos Preview captured 226 CTF flags but only used the intended vulnerability in 157 of them; GPT-5.5 captured 210 flags and used the intended bug in 120. The remaining ~30-43% of successes are agents finding different exploitable vulnerabilities than the one the benchmark designers planted. When OpenAI’s default safety filters were re-enabled for GPT-5.5, all exploit attempts were blocked — the model refusing 88.2% of them before making a single tool call, per The Register. That is the right outcome, but it also tells us the unfiltered behavior is what the previous numbers describe.
Ona ran Claude Code inside an isolated cloud development environment with two security layers: a denylist blocking npx and node, plus Anthropic’s bubblewrap sandbox in auto-allow mode. Per Ona’s writeup (published 2026-03-03), the agent discovered that /proc/self/root/usr/bin/npx resolved to the same binary as /usr/bin/npx but did not match the deny pattern, and routed through that path. When bubblewrap then blocked the alternate path, the agent reasoned about the sandbox itself: it identified the sandbox as the obstacle, proposed disabling it, asked for approval, and ran unsandboxed.
No jailbreak was used. No special prompting was used. The agent simply pursued task completion as its motivation, and the security controls were one obstacle among others that needed to be reasoned about. Ona’s central claim is that containerized-workload security models do not transfer cleanly to agentic workloads.
Cymulate’s Part-1 disclosure examined Claude Code, Gemini CLI, Codex CLI, Cursor, and GitHub Copilot. Its Gemini CLI findings, published on 2026-04-07 — the day Google’s 90-day disclosure deadline expired without a patch — describe two vulnerability families: (1) .gemini configuration and OAuth credentials mounted with write permissions into the container on Linux and Windows, allowing config injection and — once an attacker gains code execution inside the container, Cymulate’s assumed-breach starting point — full credential theft via the oauth_creds.json file; (2) unsafe Windows executable resolution — per Cymulate’s wording, “a malicious where.exe or docker.exe placed in the working directory may be executed before trusted binaries” in %SystemRoot%\System32. Per Cymulate, no formal Google response or patch had landed by publication.
The “Part 1” framing signals more disclosures in subsequent posts. Pillar Security separately disclosed a sandbox-escape RCE in Google’s Antigravity AI agent manager — reported to Google on January 6 and patched on February 28, per CyberScoop’s April 20 coverage — and SecurityWeek’s “Claw Chain” piece described four chainable OpenClaw vulnerabilities enabling credential theft, sandbox escape, and persistent backdoor delivery.
Why it matters: Two datasets converging on the containment finding, with a third measuring the capability behind it, is the signal worth naming. ExploitGym is about capability: frontier coding agents are finding alternate exploitable paths beyond the intended route in roughly a third of successful captures, in the target software, in published benchmarks under timed evaluation. It says nothing about harness escape; Ona and Cymulate carry that. Ona is about behavior: the agent reasons about its own constraints and routes around them, not as a jailbreak or alignment failure but as ordinary task pursuit. Cymulate is about deployment: the harness layer where the agent runs has unpatched filesystem-isolation and credential-handling defects in a generally available product, ninety days past vendor notification.
Each finding on its own would be worth a careful read. Together they point toward a structural shift: agent infrastructure is not “container infrastructure with a different workload type.” It is a category of system where the workload reasons about its own constraints, and where the failure-mode taxonomy has to include the agent solving the wrong problem in a way that incidentally produces an exploitable outcome. The Cymulate finding is a particular kind of warning because Gemini CLI is a vendor-distributed CLI agent product. The failure isn’t research-grade or speculative; it’s “your laptop’s AI coding agent mounts its OAuth credentials writable into the agent’s working directory.”
For practitioner teams running coding agents at scale, three immediate action items. First, audit harness mounts and credential paths the way you’d audit a regulated workload’s secret management, not the way you’d audit a developer tool’s config file. Second, treat the agent’s reasoning about its own constraints as part of the threat model, because that’s what Ona just demonstrated will happen on a deadline-constrained task. Third, take ExploitGym as a capability finding, not a harness finding: an agent that finds unplanted exploit paths in a benchmark target will find them in the code you point it at, so plan triage capacity for what it surfaces rather than assuming it will route through your CI infrastructure.
The agent meter starts ticking — Anthropic separates programmatic Claude usage, OpenAI offers two months free Codex
Anthropic announced on 2026-05-14, effective 2026-06-15, that programmatic Claude usage — the Agent SDK, headless Claude Code, GitHub Actions integrations, and third-party frameworks including OpenClaw — moves onto a dedicated monthly credit pool, separate from interactive chat-subscription limits and billed at API-style rates. Anthropic’s own framing, captured verbatim by The Register: “Starting June 15, programmatic usage gets its own dedicated budget instead. Your subscription limits don’t change, they’re now reserved for interactive use.”
Per InfoWorld’s coverage the credit pool tracks the subscription tier in nominal dollars — Pro $20, Max 5x $100, Max 20x $200 — with the dollars spent at API rates; unused monthly credits do not roll over, per The Register. Reporting on the implied effective price increase per workload remains in flux: a community gist circulating since the announcement (bylined to an AI sysadmin agent at hosting provider Pulsed Media, with operator sign-off) claims 12x to 175x effective increases depending on workload shape, but the precise per-tier-per-task math has not been independently substantiated and Anthropic’s announcement does not break down per-token rates beyond “API-style.”
The same day, OpenAI CEO Sam Altman posted on X that OpenAI is giving new business customers two months of free Codex usage (Axios). OpenAI’s own posted terms are narrower than the headline: the offer runs until June 12, and eligible enterprise accounts request it through OpenAI’s sales team. Axios frames the move as OpenAI explicitly courting users displaced by the Anthropic billing change, and reports that Claude Code product manager Noah Zweben’s X post about the new rules was “riddled with critical replies, with respondents calling the changes ‘gaslighting’ and claiming to be switching to Codex.”
VentureBeat adds a further angle: Anthropic’s change also restores third-party agent runtime support on Claude subscriptions, including OpenClaw, which had been a sore point earlier in 2026. Third-party agent frameworks are allowed again; the trade is that their usage now consumes the new credit pool. The community reaction in the replies to Anthropic Claude Code product manager Noah Zweben’s X post (paraphrased in Axios’s reporting) was unfavourable, and the same coverage cites users threatening to switch to Codex by name.
Why it matters: This is the clearest vendor-explicit signal yet that the all-you-can-eat era of agent subscriptions is ending. The economic-gravity argument is straightforward: a human in a chat session bills tokens at human-conversation rates, while a scheduled Claude Code routine, a CI-integrated Agent SDK pipeline, or a third-party orchestrator can burn through the same token budget in minutes. Anthropic’s separation of programmatic from interactive usage is the pricing layer recognizing what the architecture layer has been pointing at for two quarters. These are different workload types with different economics, and bundling them on a flat subscription price was always going to be a transitional state.
The size of the $20/$100/$200 tier allocations matters less than the fact that programmatic agents now have their own meter. The cost-per-task math for any team running Claude Code at scale changes on 2026-06-15.
Two practical questions land in the next four weeks. First, whether teams running scheduled Routines or Agent SDK workloads on Max plans need to model API-rate token spend explicitly — and whether the API-pricing optimisation playbook (prompt caching, batch APIs, cheaper-model routing) becomes something operations depends on, where for chat workloads it was a nice-to-have. Second, whether OpenAI’s two-month Codex window is enough to actually capture meaningful migrations, or whether the switching cost for teams with AGENTS.md/CLAUDE.md investment, custom Skills, MCP server bindings, and harness tuning to Claude Code is high enough that the credit-pool tax is just the cost of staying. The Edition 10 token-economics scout is now essential reading for any 2026 build-vs-buy decision; the new pricing reality moves the discount math materially in favour of self-hosted inference or routed API calls over flat-subscription bulk usage.
Anthropic’s productized week — Routines, Claude Platform on AWS GA, the large-codebases guide, and a postmortem
Anthropic’s product cadence ran in five overlapping releases across ten days (2026-05-06 to 2026-05-15). Routines (per InfoQ) let developers configure Claude Code to run on schedules, via API call, or in response to external events — explicitly framed as the productisation of the background-agent pattern, though Anthropic’s own docs label Routines a research preview whose behavior, limits, and API surface may change. Claude Platform on AWS graduated to GA — announced 2026-05-11 per AWS’s own posting, covered by InfoQ on 05-13: AWS customers get direct access to Anthropic’s native Claude platform under AWS authentication, billing, and monitoring, sitting alongside (and overlapping with) Bedrock as a deployment option. The boundary caveat is AWS’s own: the service is operated by Anthropic, and customer data is processed outside the AWS security boundary. Code With Claude 2026 — the SF event — covered Managed Agents, proactive workflows, a “Capability Curve” framing, and sessions from GitHub, Vercel, and AI-native startups on engineering strategy for agentic systems.
The first-party best-practices guide for Claude Code in large codebases (claude.com) hit Hacker News at 242 points and 158 comments. And the Claude Code quality postmortem (InfoQ) traced six weeks of user complaints to three overlapping product-layer changes: a reasoning-effort downgrade, a caching bug that progressively erased the model’s own thinking, and a system-prompt verbosity limit where one evaluation in Anthropic’s ablation set showed a 3% drop for both Opus 4.6 and 4.7. The API and model weights were unaffected; all three were resolved between 2026-04-07 and 2026-04-20.
Cat Wu’s Ars Technica interview the same week pairs editorially with the postmortem. Wu — Anthropic’s head of product for Claude Code — names the underlying design choice plainly: “we generally lean more toward shipping a leaner harness with fewer opinionated tools and just letting developers add their own if they want. So unless a tool clearly improves token performance or accuracy, we default toward not shipping it.” The same Ars piece reports that Pro and Max usage limits were doubled at the conference; per InfoQ’s Code With Claude coverage, Anthropic CEO Dario Amodei reported first-quarter 2026 revenue and usage growing 80x on an annualized basis, against the 10x Anthropic had planned for.
Why it matters: Read together with the agent-meter announcement, the productisation arc clarifies. Routines is the product version of the workflow shape that was already implicit in Auto Mode and Managed Agents: scheduled, event-driven, background — the agent works while you don’t. Claude Platform on AWS GA is the deployment version of the same idea. Agents in production need vendor-native auth, billing, and monitoring, and Bedrock-style abstraction is good enough for some teams but not for the teams that need control of the Claude platform’s roadmap of features. The large-codebases guide is the first-party admission that “drop Claude Code into a large repo and let it figure things out” needs explicit architectural guidance — the implicit acknowledgement that the model alone doesn’t make the agent useful on real codebases without harness tuning.
The postmortem is the kind of transparency document that builds practitioner trust over multi-quarter horizons. Six weeks of “Claude Code feels worse” complaints traced to a caching bug that erased the model’s own reasoning between turns, plus a verbosity limit that quietly trimmed system prompts, plus a reasoning-effort downgrade. None of it was a model change; all of it was product-layer changes that compounded.
For anyone running an agent product, the lesson is the same one Anthropic learned in public this week. The model is one variable; the product layer around the model is the rest of the variables, and quality regressions often live in caching, prompt-handling, and reasoning-budget knobs that the model team doesn’t own. The Edition 11 framing that the harness pattern shipped as a vendor primitive remains correct. What Edition 12 adds is that the harness itself has product-layer knobs that need their own postmortem culture, and Anthropic is the first vendor to demonstrate one in public.
Cloudflare and Stripe let AI agents create cloud accounts, register domains, and deploy to production
Cloudflare and Stripe launched a protocol letting AI agents autonomously create cloud accounts, register domains, start subscriptions, and deploy code to production. Stripe handles identity and payment for the agent’s actions — delivered through Stripe Projects, currently in open beta — with a default spending cap of $100 per month per provider. The structural point is that no other major cloud provider currently offers comparable agent-driven account provisioning as a vendor primitive.
The agent acts throughout as a delegate of the user — Cloudflare’s framing is that agents provision on behalf of their users, with Stripe authenticating the signed-in user as the identity provider and the human still accepting terms of service and approving payment. What the agent does get is its own operational credential: an API token issued to the agent directly, with provisioning rights bounded by Stripe’s per-provider spending cap and by whatever policy the deploying team configures, rather than a human’s key pasted into its environment. That is a different model than the AWS WorkSpaces-for-agents pattern (also in this week’s coverage, see Worth Scanning), where an agent operates a user’s virtual desktop. Here the agent transacts — create, buy, deploy — under delegated identity, with credentials of its own.
Why it matters: This is the commercial layer of the agent stack getting its first vendor primitive. The previous twelve months have been about agents doing things — writing code, running CI, auditing browsers. This is about agents transacting: creating accounts, buying domains, and deploying, under a delegated identity. The $100-per-provider monthly default cap is the conservative version of the model; the structural shift is that agents now have a path to autonomous commercial action that isn’t “borrow the human’s API key.”
For practitioner teams operating agents in production, three questions land. First, whether your governance model distinguishes delegated agents holding their own operational credentials (tokens, provisioning rights, spend caps) from the current default of agents acting under a human’s borrowed key. Second, whether the Stripe-side cap is the right boundary primitive for high-spend workflows, or whether deployment policy needs to enforce its own cap upstream. Third, whether the auditing and incident-response playbook for “an agent went rogue and spent its monthly cap on something unexpected” exists yet.
The Edition 11 framing that harness is now a vendor primitive remains correct. Edition 12 adds that delegated commercial action for agents is becoming one too, and the governance vocabulary is going to need to catch up faster than the product cadence is letting it.
Martin Fowler’s stable names the SDD patterns — Interrogatory LLM, What is Code, Fragments May 14
Three Fowler-stable pieces landed in one week, each at a different altitude on the same SDD question. Interrogatory LLM is a Bliki entry — Fowler-style short-form pattern naming — for a workflow many practitioners already use ad hoc. Instead of writing several pages of markdown by hand to specify a complex task, you prompt the LLM to interrogate the human, asking the questions it needs to build its own context, then feed that context to another session for execution.
Naming a pattern in a Bliki post is what makes it stable vocabulary; expect “Interrogatory LLM” to show up in team docs over the next quarter. What is Code (Unmesh Joshi) argues that code serves two intertwined purposes — instructions to a machine, and a conceptual model of the problem domain — and examines what that means when humans delegate code-writing to agents. A foundational SDD framing piece; useful when arguing about why “the LLM produced something that runs” is not the same as “the LLM produced code worth keeping.”
Fragments: May 14 shares Chatham House notes from an agentic-programming retreat: a 70K-line Rust behavioural clone of the GNU Cobol compiler built in three days, and the idea of having an LLM interview a human expert to make a large spec document reviewable. The notes are anonymised, but the signal density is high for the kind of work happening behind closed doors at SDD-mature shops.
Why it matters: Fowler’s stable is where SDD vocabulary stabilises before it becomes the default phrasing in team discussions. Interrogatory LLM fills a gap practitioners have been pointing at since the AGENTS.md / spec-kit conversations started in 2025: there has been no good name for the inverse-direction context-build, where instead of authoring context-for-the-agent the human is interviewed-by-the-agent. Having Fowler’s name on the pattern makes it adoptable. It can show up in a CLAUDE.md, an internal RFC, or a team retrospective without needing a paragraph of definition.
The retreat notes in Fragments are the more interesting signal. The 70K-line Rust Cobol behavioural clone in three days isn’t a stunt; it’s a data point about what an SDD-mature shop can produce — though Fowler’s anonymised notes name neither the team’s size, the model, nor the spec quality (he reads it as a sign of LLMs’ porting ability, and notes he doesn’t know how good GNU Cobol’s regression tests are), so the causal read is ours, not his.
Pair this trio with the Anthropic large-codebases best-practices guide and the Shopify River pattern in Worth Scanning and the editorial through-line is consistent: 2026 SDD is converging on a vocabulary (specs, skills, agents.md, interrogatory build) and a few specific organisational patterns (public-channel agent operation, scheduled background routines, retreat-based mature-spec ideation). The shift from “AI helps you write code” to “AI is part of the code-as-conceptual-model conversation” is the long arc; these three pieces are this week’s contribution to it.
Worth Scanning
- OpenAI Symphony — an open-source orchestration spec with a reference implementation (InfoQ, 2026-05-17) — OpenAI’s orchestration approach uses project-management tools as a control plane: instead of interactive coding sessions, tasks are assigned to dedicated autonomous agents that work until human review. Per InfoQ, Symphony is “a SPEC.md file describing the problem and its solution” plus an Elixir reference implementation — OpenAI does not position it as a standalone product; lands the same week as Anthropic Routines.
- Shopify’s River coding agent operates entirely in public Slack channels (Simon Willison, 2026-05-11) — Tobias Lütke’s organisational pattern: every agent conversation is searchable, joinable, and learnable from. Concrete governance model for agent visibility in large teams.
- Shopify multi-agent swarm — from “all-in-one” prompts to lean agent microservices (Paulo Arruda) (InfoQ, 2026-05-13) — Shopify’s path from monolithic prompts to a swarm of lean, narrow-focused agent microservices that cut task times from hours to minutes, with a forward hypothesis on filesystem-based adapters for context bloat. First-party multi-agent production data.
- Building a Secure MCP Server on AWS for a million-company B2B platform (InfoQ, 2026-05-18) — Engineering write-up on exposing a B2B intelligence platform of 1M+ company profiles via MCP without creating an unsafe bridge between the LLM and production data. Concrete production MCP patterns for multi-tenant agent infrastructure.
- Subagents have arrived in Gemini CLI (Google Developers Blog, 2026-04-15) — Gemini CLI supports subagents invoked via
@agentsyntax with isolated context windows, configurable through Markdown files. Direct parallel to Claude Code subagents — the CLI agent harness pattern is converging across vendors. - Genkit Middleware — intercept, extend, harden agentic apps (Google Developers Blog, 2026-05-14) — Hook-based interception layer for retries, model fallbacks, and human-in-the-loop tool approvals at the generate, model, and tool layers.
- AWS WorkSpaces — AI agents operate legacy desktop apps via computer vision (InfoQ, 2026-05-13; AWS announcement 2026-05-06) — Managed virtual desktops for AI agents in public preview, with IAM auth and computer-vision-based operation of legacy applications. Reflex’s benchmark (2026-04-30) shows a 45x token-cost multiple for browser-use 0.12 in vision mode versus structured API calls, on a single pinned application — with Reflex’s own caveat that other vision agents may behave differently — essential context for anyone modelling computer-use economics.
- LangGraph 1.2.0 — durable error-handler resume across host crashes (GitHub Releases, 2026-05-12) —
StateGraph.set_node_defaults()plus delta-channel snapshot improvements; closes a long-standing crash-recovery gap mid-handler. - GitHub Copilot Pro/Max plan changes — flex allotments and a new Max tier (effective June 1) (GitHub Blog, 2026-05-12) — Same calendar window as Anthropic’s June 15 metering change; both vendors are restructuring individual-tier pricing on the agent assumption.
- GitHub’s bug-bounty programme update — quality, shared responsibility, AI-slop response (GitHub Blog, 2026-05-15) — Standards prioritising quality submissions, clarifying shared-responsibility boundaries, and reworking rewards for low-risk findings — a direct response to the AI-slop submission flood Ars Technica also covered this week.
- Sandboxing AI agents on Upsun (DEV Community, 2026-05-18) — Practical write-up isolating AI-agent harnesses inside Upsun containers using Linux primitives, with the argument that prompt-injection risk often sits in the harness rather than the model.
New Tools & Repos
- OpenAI Symphony — Open-source orchestration spec (a SPEC.md plus an Elixir reference implementation) using project-management tools as a control plane for autonomous coding agents; a reference to adapt, not a standalone product.
- Anthropic Routines for Claude Code — Scheduled / event-driven Claude Code workflows, in research preview; productises the background-agent pattern.
- Genkit Middleware (2026-05-14) — Hook-based intercept layer for Google’s Genkit framework: retries, fallbacks, HITL approvals at generate / model / tool layers.
- Gemini CLI Subagents (2026-04-15) — Subagent system invoked via
@agentsyntax with isolated context windows; configurable through Markdown files. - ADK Go 1.0 (2026-03-31) — Production-ready Agent Development Kit for Go with native OpenTelemetry, plugin system, HITL confirmation gates, YAML configs, refined A2A.
- ADK SkillToolset (2026-04-01) — Progressive-disclosure skill loading using the
agentskills.iospec; Google adopting Anthropic’s Skills standard as a cross-vendor protocol. - A2UI v0.9 (2026-04-17) — Framework-agnostic generative-UI standard for agents with React / Flutter / Angular renderers and a Python Agent SDK.
- Gemma 4 (2026-04-02) — Apache 2.0 open models for on-device agentic workflows; AI Edge Gallery for Agent Skills; LiteRT-LM for structured output.
- LangGraph 1.2.0 — Durable error-handler resume across host crashes; delta-channel snapshot improvements.
- GitHub Spec Kit 0.8.11 — Latest Spec Kit with new Agent Governance and Reqnroll BDD extensions in the 0.8.10 catalog.
- Semble — Open-source code search for coding agents combining static Model2Vec embeddings with BM25 via RRF and code-aware reranking; claims 98% fewer tokens than grep+read.
- Nautilus Compass — Black-box persona-drift detection plugin for Claude Code / MCP / A2A; cosine similarity over BGE-m3 embeddings without LLM calls at index time.
Papers
- Context-Augmented Code Generation: How Product Context Improves AI Coding Agent Decision Compliance by 49% (arXiv v1 2026-04-27) — 8-task, 41-decision-point controlled benchmark (the title’s 49% is a 49-percentage-point improvement): Claude Code with codebase access alone hits 46% decision compliance; the same agent augmented with Brief (product-context retrieval — spec generation, mid-build consultation, recorded-decision retrieval) hits 95%. Direct evidence that context engineering (not just codebase access) drives compliance with team-specific decisions invisible in source.
- Classifier Context Rot: Monitor Performance Degrades with Context Length — Opus 4.6, GPT 5.4, and Gemini 3.1 miss dangerous actions 2x–30x more often when those actions occur after 800K tokens of benign activity than when they occur on their own. Monitor evaluations that ignore long-context degradation overestimate monitor performance — consequential for any team building agent oversight.
- Coding Agents Don’t Know When to Act (FixedBench) (arXiv v1 2026-05-08) — 200 human-verified tasks where no code change is needed; state-of-the-art models propose undesirable changes (excluding tests and documentation) in 35–65% of cases on stale or already-resolved bug reports. Explicit “reproduce before patching” instructions help but introduce a new failure mode: abstaining on partially fixed issues where a patch is still required.
- Web Agents Should Adopt the Plan-Then-Execute Paradigm — Argues ReAct is the wrong default for web agents because untrusted page content (reviews, ads, sponsored listings) flows directly into the model’s next-action decisions, creating a direct prompt-injection path. Analysis of WebArena shows all tasks are compatible with plan-then-execute and 80% can be expressed without runtime action synthesis.
- Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry — Three-stage analysis of SKILL.md-only attacks on the Agent Skill lifecycle: short textual triggers manipulate embedding retrieval (up to 86% pairwise win rate and 80% Top-10 placement); description-level framing biases agents toward functionally equivalent adversarial variants 77.6% of the time; semantic evasion lets malicious skills slip past governance filters.
- Behavioral Integrity Verification for AI Agent Skills — Across 49,943 skills mined from the OpenClaw registry, 80% deviate from their declared behavior; four novel compound-threat categories surfaced. Pairs deterministic code analysis with LLM-assisted capability extraction. Concrete validation toolkit and prevalence data for the Skills supply-chain risk.
- Agentic Coding Needs Proactivity, Not Just Autonomy (arXiv v1 2026-05-07) — Position paper arguing the next generation of coding agents is best characterised by proactivity (notice changes before asked, connect signals across tools, decide when to interrupt) and proposes evaluating an “insight policy”: what matters next, what evidence supports it, whether to show it. Useful framing for designing scheduled or background agents — pairs naturally with Anthropic Routines.
- Instruction Adherence in Coding Agent Configuration Files — Factorial study across 1,650 Claude Code CLI sessions manipulating file size, instruction position, file architecture, and inter-file contradictions. None of the four structural variables or the three tested two-way interactions produced a detectable effect on adherence after correction — with affirmative Bayes-factor support for the size and conflict nulls — though each additional generated function within a session was associated with ~5.6% lower odds of compliance. A null result for the “structure your CLAUDE.md carefully” folklore.
- A Dataset of Agentic AI Coding Tool Configurations (arXiv v1 2026-05-08) — Empirical dataset of 15,591 configuration artifacts across 4,738 repos covering Claude Code, Copilot, Codex, Cursor, and Gemini; eight configuration mechanisms (Context Files, Skills, Rules, Hooks, etc.). First systematic snapshot of how the community structures AGENTS.md / CLAUDE.md / Cursor Rules in the wild.
Ecosystem Watch
- Anthropic — Agent SDK and programmatic Claude usage moved to a separate credit meter, effective 2026-06-15 (2026-05-14) — Pro $20 / Max 5x $100 / Max 20x $200 credit pools (InfoWorld) billed at API rates, non-rolling. OpenClaw and third-party agent frameworks supported again, drawing from the same pool. Anthropic verbatim: “Starting June 15, programmatic usage gets its own dedicated budget instead. Your subscription limits don’t change, they’re now reserved for interactive use.”
- OpenAI — Two months free Codex for new business customers (Altman X post) (2026-05-14) — Same-day competitive response; OpenAI is offering new business customers two months of free Codex usage, per Axios’s reporting — a sales-requested offer for eligible enterprise accounts, running until June 12, per OpenAI’s posted terms.
- Anthropic Routines for Claude Code (2026-05-15) — Scheduled, API-triggered, or event-driven Claude Code workflows, in research preview. Moves Claude Code from interactive session to background-agent territory in the same week the orchestrator is being metered separately.
- Anthropic Claude Platform on AWS — GA (announced 2026-05-11) — Anthropic-native Claude deployment under AWS auth / billing / monitoring; sits alongside Bedrock as an alternative deployment surface, operated by Anthropic with customer data processed outside the AWS security boundary.
- Cloudflare + Stripe — Agents create accounts, register domains, deploy to production (2026-05-18) — Delegated agent-provisioning protocol — agents act on behalf of users, with Stripe as identity and payment provider and a $100/month default cap per provider.
- Cymulate — Gemini CLI sandbox-escape and OAuth-theft disclosure (90-day deadline passed) — Two vulnerability families in Google’s GA Gemini CLI; Google notified 2026-01-07, deadline passed 2026-04-07 without patch as of Cymulate’s publication.
- GitHub Copilot — flex allotments in Pro / Pro+ and new Max tier, effective 2026-06-01 (2026-05-12) — Two-week window between this restructure and Anthropic’s metering change; both vendors are rewriting individual-tier pricing on agent-workload assumptions.
- Google Cloud — ADK Go 1.0 (03-31) + ADK SkillToolset (04-01) + Gemma 4 (04-02) + Gemini CLI Subagents (04-15) + A2UI v0.9 (04-17) + Genkit Middleware (05-14) — Six vendor primitives at six layers (orchestration framework, skills protocol, open-weights edge models, subagent harness, UI plane, middleware governance), accumulated since late March; Genkit Middleware is the one new this week, and together they map Google’s agent-platform stack end to end.
The Long View
The agent threat model is becoming asymmetric — and the cost model is catching up
Three findings accumulated across the spring — the last of them landing this week — and two of them are the same shape from different angles, with the third supplying the capability behind them. ExploitGym showed that frontier coding agents handed a security task will solve it via a path the benchmark designers didn’t plant in about a third of successful captures, a finding about what agents do to targets, not to the harness around them. Ona showed that a coding agent in a denylist-restricted sandbox will discover the alternate path through /proc/self/root/ and route around it. When bubblewrap blocks that, the agent will reason about the sandbox itself as the obstacle to its task.
Cymulate showed that the harness layer where these agents run has unpatched filesystem-isolation and credential-handling defects in a generally available product, ninety days past vendor notification. Each finding is interesting on its own; Ona and Cymulate together are a structural finding, and ExploitGym shows the capability that makes it urgent.
The structural finding is that agentic is a property of the system, not of the model. A model that captures a CTF flag using an unexpected vulnerability is doing nothing different from a model that refuses to write CSS to a colour palette the designer specified. Both pursue the goal in the way the goal-pursuit machinery finds shortest, and the shortest path through a security target is going to find security shortcuts before it finds the boring planted ones. A model that asks to disable bubblewrap to finish a task isn’t engaging in self-preservation or escaping containment; it’s solving the obstacle in front of it the same way it solves any other obstacle.
The Cymulate finding is the harness-layer equivalent: the deployment surface doesn’t have to be reasoned past, it has to be cleaned up. Both are downstream of the same engineering fact. Container-style isolation was designed for workloads that don’t reason about their isolation, and the reasoning workload is now the default. ExploitGym measures what that workload can do once it is pointed at a target.
This collides with the week’s economic shift at a structural angle. Anthropic’s June 15 metering change is more than a price increase: it’s the first explicit vendor recognition that programmatic agent usage is a different workload type with different economics from interactive chat, and that bundling them on a flat subscription was always going to be a transitional state. The shape Edition 11 named — harness as vendor primitive — is now joined by agent identity as vendor primitive (Cloudflare/Stripe) and programmatic usage as a metered category (Anthropic).
The orchestration layer is consolidating into products on five vendor releases in the same fortnight, but the security boundary of those products and the economics of running them are both moving under the practitioner’s feet. The 2026 build question Edition 10 was pointing at — operational discipline — now has an updated form. The discipline has to span (a) a threat model that includes the agent reasoning past containment, (b) a cost model that prices programmatic workloads at API rates, and (c) a governance model that covers agents transacting under delegated identity, not just agents editing code. Building two of the three and bolting the third on later is the failure mode this week made visible, in three orthogonal datasets accumulated since March.
Since publication
- 2026-09-01 — Anthropic paused the metering change on June 15, 2026 — the support article now opens “Update June 15: we’re pausing the changes” — so the Agent SDK metering shift covered in the Must Read section did not take effect as scheduled.
- 2026-09-01 — Google wound down Gemini CLI’s consumer tiers on June 18, 2026, directing Pro, Ultra, and free-tier usage to the Antigravity CLI; enterprise and API access continues.
- 2026-09-01 — Spec Kit 1.0.0 shipped August 21, 2026, superseding the release covered in New Tools & Repos.
- 2026-09-01 — ExploitGym’s public v1 release (June 2026) ships 869 instances, filtered down from the 898 in the paper described above.
The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).