Artificer’s Grimoire — Edition 13 · May 24, 2026

Three loosely-related arcs ran in parallel this week, each touching a different layer of the agent stack. The vendor agent-platform release wave — anticipated in Edition 11, productised by Anthropic in Edition 12 — added several major pieces across May, not all of them in this week’s window. AWS MCP Server reached GA (2026-05-06) with IAM-grade governance. Cloudflare completed what InfoQ tallies as the six-layer agent platform and shipped a Browser Run rebuild (2026-05-13). Google I/O 2026 launched Gemini 3.5 Flash, Spark background agents, and Antigravity 2.0.

The package-and-tooling foundation every one of those platforms depends on was under sustained attack the same week. GitHub disclosed a breach of internal repositories via a poisoned VS Code extension. Grafana lost source code via the TanStack npm compromise. Sonatype flagged Shai-Hulud back targeting maintainer accounts.

Anthropic ran a four-move week through the middle of it: the Stainless acquisition (the SDK and MCP-server generator powering most labs’ developer experience), MCP Tunnels plus self-hosted sandboxes for Managed Agents, Project Glasswing’s 10,000+ critical-vulnerability disclosure with Cloudflare and Mozilla as partners, and a quietly-shipped Claude Code sandbox patch with no CVE. At the same time, Microsoft began canceling internal Claude Code licenses and pushing GitHub Copilot CLI.

The arcs aren’t coordinated and shouldn’t be read as one unified shift. But the rough pattern across the week is worth naming. Vendor agent platforms keep arriving. The developer-tool foundation they depend on keeps getting attacked. And one of the largest enterprise customers of multiple AI labs is forcing internal standardisation on its own product even when its engineers reportedly prefer the alternative.

Must Read

Google I/O 2026 — Gemini 3.5 Flash, Spark background agents, Antigravity 2.0

Google’s I/O keynote (2026-05-19) announced three agent-relevant pieces and a positioning bet on Search. Gemini 3.5 Flash launched as the first model in Google’s “frontier intelligence with action” series, generally available via Antigravity, the Gemini API in AI Studio, and Android Studio.

Google’s own post describes the model as outperforming Gemini 3.1 Pro on coding and agentic benchmarks, citing 76.2% on Terminal-Bench 2.1, 1656 Elo on GDPval-AA, and 83.6% on MCP Atlas. As with most frontier-model benchmark releases, real-world transferability to production agent workflows remains uncertain. The methodology behind each benchmark matters heavily for how those headline numbers should be read. Simon Willison’s read is that Flash 3.5 is meaningfully more expensive than prior Flash generations but Google plans to route it broadly, including into Search.

Gemini Spark is a 24/7 personal agent built on Gemini 3.5 and the Antigravity platform — rolling out to trusted testers first, with a beta for U.S. Google AI Ultra subscribers announced for the following week — Google’s productised answer to the same scheduled / background-agent pattern Anthropic shipped as Routines in Edition 12.

Antigravity 2.0 is the updated agent platform, the deployment surface Google is positioning Gemini 3.5 Flash and Spark to run on for both consumer and enterprise customers. The Latent Space brief notes Google’s reported token-processing volume of roughly 3.2 quadrillion tokens per month as of the May 20 publication — a figure Google scopes as tokens processed across its surfaces, not Gemini-only — a ~7× year-over-year jump.

Ars Technica’s framing of the Search story is that Google “is set to remake Search with agentic AI in 2026” — taking the public-facing search product into the same agent-driven territory that OpenAI’s ChatGPT Search and Perplexity have been pulling at for two years.

Supply-chain compounding — GitHub breach, Grafana via TanStack, Shai-Hulud back

Three incidents in one week, each at a different layer of the developer-tool substrate every agent harness depends on.

GitHub disclosed on 2026-05-20 that on 2026-05-18 it had detected and contained a compromise of an employee device involving a poisoned VS Code extension published by a third party. GitHub removed the malicious extension version, isolated the endpoint, and began incident response.

GitHub’s current assessment is that the activity involved exfiltration of GitHub-internal repositories only; threat actor “TeamPCP” claims roughly 3,800 repos, which GitHub describes as “directionally consistent with our investigation so far,” and the published GitHub post states no evidence of impact to customer information stored outside internal repositories. The extortion attempt reportedly demands offers in excess of $50,000 on underground forums.

TanStack and Grafana — on 2026-05-11, attackers published 84 malicious versions across 42 @tanstack/* npm packages using the pull_request_target “Pwn Request” pattern combined with GitHub Actions cache poisoning and runtime memory extraction of an OIDC token from the Actions runner process.

Grafana detected the activity the same day and rotated a significant number of workflow tokens, but per Grafana’s own write-up a missed token gave attackers GitHub access. On 2026-05-16 Grafana confirmed source-code exfiltration and refused a ransom demand, citing FBI guidance. Grafana states no evidence of customer production-system impact.

Shai-Hulud — Sonatype’s writeup names the npm-maintainer account as the persistent soft target and reports the worm-style npm compromise pattern is back. A separate Sonatype post on 2026-05-21 describes two hijacked versions of an npm scaffolding package whose install-time code attempts to fetch a second-stage RAT payload, which Sonatype attributes to the North Korea-linked PolinRider group.

Help Net Security and other trade press separately report that the GitHub and Grafana breaches share a common root cause in the nx-console TanStack compromise. The GitHub blog itself attributes the breach narrowly to a poisoned VS Code extension without naming the package, so the cross-incident link is reported by trade press, not confirmed by GitHub.

Anthropic’s four moves — Stainless acquisition, MCP Tunnels, Project Glasswing, the silent sandbox patch

Four overlapping Anthropic releases in five days.

Stainless acquisition (2026-05-18): Anthropic acquired the SDK and MCP-server generator startup whose software powers every official Anthropic SDK and is widely used by rival AI labs including OpenAI and Google. The Information’s reporting cited in TechCrunch describes the deal as exceeding $300M. Anthropic told TechCrunch it will wind down all hosted Stainless products; per an Anthropic spokesperson in the same report, customers retain rights to SDKs they’ve already generated and can continue to modify them.

MCP Tunnels + self-hosted sandboxes (2026-05-19; Tunnels in research preview, self-hosted sandboxes in public beta): a lightweight gateway deployed inside the customer’s network makes a single outbound, end-to-end-encrypted connection to Anthropic, and Anthropic-hosted agents reach private MCP servers back through that tunnel. No inbound firewall rules, no public endpoints. Positioned as the enterprise answer for teams that want Managed Agents but cannot expose internal databases, APIs, or ticketing systems to the public internet. Access is managed through organization settings in the Claude Console.

Project Glasswing initial update (2026-05-22): Anthropic’s collaborative initiative with approximately 50 partners reports Claude Mythos Preview has discovered over 10,000 high- or critical-severity vulnerabilities across partner organizations in roughly one month. Anthropic’s post cites Cloudflare finding 2,000 bugs (400 critical/high) with what they describe as “better than human testers” accuracy; Mozilla finding and fixing 271 vulnerabilities in Firefox 150 while testing Mythos Preview, “over ten times more” than it found in Firefox 148 with Claude Opus 4.6; and open-source scanning where Mythos Preview’s own estimate is 6,202 high/critical vulnerabilities — of the 1,752 independently assessed so far, 90.6% proved valid true positives across all severities, putting Anthropic’s validated projection at nearly 3,900 high/critical. Concrete deliverables: Claude Security public beta (2,100+ vulnerabilities patched by Claude Opus 4.7 in the three weeks since launch), a Cyber Verification Program, and an Alpha-Omega/OpenSSF partnership. The post explicitly names the bottleneck as having shifted from finding vulnerabilities to patching them. Worth reading these figures alongside their methodological caveats: the “critical/high-severity” classifications and validation rates are reported by Anthropic and partner organizations rather than independently audited, and ecosystem-wide reporting on AI-generated bug-report noise (see the Ars Technica “bug bounty slop” item in Worth Scanning) sets the counter-context for any “10,000+ vulnerabilities” headline.

The silent sandbox patch (disclosed by Aonan Guan, covered by SecurityWeek 2026-05-20): a SOCKS5 hostname null-byte injection bypass in the Claude Code network sandbox allowed allowlist circumvention — a host like attacker-host.com\x00.google.com would pass the filter. Per SecurityWeek’s coverage, the vulnerability was present from the sandbox’s October 20, 2025 GA through Claude Code 2.1.88 on 2026-03-31; Guan’s own post gives the last vulnerable release as 2.1.89, with the silent fix shipping in 2.1.90 on 2026-04-01 — the sources disagree by one version and one day. The fix shipped without a CVE assignment and without mention in the release notes.

Guan’s complaint is that teams running vulnerable versions in production had no signal to rotate credentials or analyze egress traffic. This is the second silent sandbox patch from Anthropic in recent months.

Microsoft begins canceling internal Claude Code licenses — Experiences + Devices org loses access by June 30

Microsoft began rolling back its internal Claude Code experiment in mid-May, per Windows Central’s coverage (2026-05-15), which followed The Verge’s initial report. The Experiences + Devices group — the org responsible for Windows, Microsoft 365, Outlook, Teams, and Surface — will lose most Claude Code licenses by June 30, which is also the last day of Microsoft’s fiscal year.

The internal memo (cited by Windows Central as authored by Rajesh Jha, EVP) frames the move as standardising on a single AI coding tool. Multiple trade-press reports characterise the unofficial driver as cost, though the published memo language emphasises standardisation.

Microsoft opened Claude Code access to employees in December 2025, and the reporting describes broad internal adoption among developers, project managers, and designers before this week’s rollback. Some coverage characterises the move as a strategic contradiction: Microsoft sells GitHub Copilot as the default AI layer for software development while its own engineers reportedly found significant value in Anthropic’s Claude Code.

AWS MCP Server reaches GA + Cloudflare completes the six-layer agent platform

Two vendor platform stories that complete a pattern Edition 11 named (the harness shipped as platform primitive) and Edition 12 extended (Claude Platform on AWS GA, Routines).

AWS MCP Server GA — AWS’s actual GA announcement landed earlier in May; InfoQ’s deep coverage published 2026-05-24 surfaces the full feature set. The managed server gives AI coding agents access to AWS services through MCP with IAM-grade governance: IAM context keys (no separate IAM permission required), CloudTrail logging, and CloudWatch metrics. Two new IAM global condition context keys ship with it — aws:ViaAWSMCPService (set to true when the request passes through an AWS managed MCP server) and aws:CalledViaAWSMCP (containing the service principal of the AWS managed MCP server).

Agents can call any AWS API through a single tool, including operations that require file uploads or long-running execution. Sandboxed Python execution lets agents run code against AWS services without local filesystem or shell.

Cloudflare’s six-layer agent platform — InfoQ’s coverage (2026-05-22) summarises the now-completed stack as six infrastructure primitives: compute in two tiers (Dynamic Workers + Sandboxes), orchestration (Dynamic Workflows), memory (Agent Memory — in private beta at the time of InfoQ’s tally), browsing (Browser Run), and commerce (Stripe Projects); the layers are not uniformly mature. Browser Run itself was rebuilt on Cloudflare Containers — the rebuild shipped 2026-05-13, ahead of this week’s window, with InfoQ’s write-up as the news hook — and per Cloudflare’s blog it delivers 4× higher concurrency (120 simultaneous browsers, up from 30), Quick Action response times cut by more than half, and adds WebGL and WebMCP support. The migration required no client-side changes.

The methodology critique wave hardens — Vibe Coding bliki, the Orchestration Tax, anti-vibe cluster, sensors series

Four threads in the same week with the same underlying message: agent-driven coding workflows have a methodology problem that is no longer adequately described by enthusiasm or skepticism alone.

Fowler’s Bliki entry for “Vibe Coding” stabilises the canonical definition: “building a software application by prompting an LLM, telling it what to build, trying it out, prompting for changes — but without looking at any of the code that the LLM generates.” Coined by Karpathy in February 2025; per Fowler, best for disposable software, with maintainability/correctness/security problems when used broadly.

Böckeler’s sensors series advances the harness-engineering framework Fowler introduced earlier — “Maintainability sensors for coding agents” (May 19) and “Three more static code analysis sensors” (May 20).

Böckeler’s reported finding: a computational sensor for coupling data was lackluster; prompting an inferential sensor to review modularity was more effective.

Osmani’s “The Orchestration Tax is You” names a constraint that’s been latent in the orchestration discourse: starting more agents is now easy, but the judgement to steer them and merge their output still routes through one serial processor — the human. Per Osmani, “the only real fix is to start architecting your own attention like you architect any concurrent system.”

Hacker News / blog critique cluster runs in parallel — “Claude is not your architect. Stop letting it pretend” (May 24), Olano’s “--dangerously-skip-reading-code” (May 23), Jacob Harris’s “Why I don’t vibe code” (May 20). Latent Space’s “All Model Labs are now Agent Labs” (May 23) reframes the supply side of the same shift.

Worth Scanning

• Anthropic — Widening the conversation on frontier AI (Anthropic, 2026-05-19) — Anthropic policy/communications post on convening scholars from religious, philosophical, and cultural traditions — more than 15 groups so far — around the moral formation of AI systems.
• KPMG integrates Claude across its core business and workforce of more than 276,000 in strategic alliance (Anthropic, 2026-05-19) — Enterprise-distribution data point; reads alongside the GitHub Gartner Magic Quadrant leader note for the third year running below.
• GitHub recognized as a Leader in the Gartner® Magic Quadrant™ for Enterprise AI Coding Agents for the third year in a row (GitHub Blog, 2026-05-22) — Take with appropriate analyst-validation skepticism, but the third-consecutive-year framing is a market-incumbency signal.
• Designing a Multi-Agent System for Engineering Support at Scale: a Case Study from Grab (InfoQ, 2026-05-20) — First-party production deployment write-up; the rubric weights case studies heavily because they include architecture detail rather than vendor framing.
• xAI Releases Grok Skills and Updates Tool Calling Responses API (InfoQ, 2026-05-22) — Skills semantics now shipped by Anthropic, xAI, and (in the broader sense) Google. The vendor convergence on Skills as a capability unit continues.
• Google Introduces Middleware Architecture for Genkit Applications (InfoQ, 2026-05-24) — Genkit moves toward agent-framework feature parity with LangGraph / CrewAI / Mastra by adding middleware.
• Datasette Agent (Simon Willison, 2026-05-21) — First-party constrained agent harness over Datasette + SQLite, with companion plugins for charts, sprites, and cost accounting.
• Latent Space — Giving Agents Computers — Ivan Burazin, Daytona (Latent Space, 2026-05-21) — Sandbox-per-task as primitive; pairs editorially with the Cloudflare + AWS GA wave.
• Latent Space — Railway: The Agent-Native Cloud (Latent Space, 2026-05-20) — Railway’s framing of the agent-native cloud thesis; same shape, smaller vendor.
• Latent Space — New AI Infra unicorns: Exa, Modal, TurboPuffer (Latent Space, 2026-05-22) — Three agent-infrastructure unicorns named in the same brief; the runtime layer Edition 11 catalogued is now unicorn-class market.
• Ocean Emerges From Stealth With $28M for Agentic Email Security Platform (SecurityWeek, 2026-05-21) — Another agents-applied-to-security entrant alongside Project Glasswing.
• ‘Underminr’ Vulnerability Lets Attackers Hide Malicious Connections Behind Trusted Domains (SecurityWeek, 2026-05-23) — Domain-fronting-class vulnerability relevant to agent-egress allowlist designs in the same architectural class as the Claude Code SOCKS5 null-byte bypass.
• Building Trusted AI Development With Kiro and Sonatype (Sonatype, 2026-05-18) — Worked example of SDD methodology meeting supply-chain-governance practice.
• Take your local GitHub sessions anywhere (GitHub Blog, 2026-05-18) — Session-portability for local Copilot context; another “portable agent state” vendor primitive.
• Bug bounty businesses bombarded with AI slop (Ars Technica, 2026-05-18) — Useful counterweight to Project Glasswing’s 10,000-vulnerability framing; there is a quality distribution behind any such number that doesn’t survive transfer to third-party security workflows.

New Tools & Repos

• DeepSeek-Reasonix — Terminal coding agent (6.1k★) engineered around DeepSeek’s byte-stable prefix-cache mechanic; the project documents one user processing 435M input tokens in a day with a 99.82% cache hit rate at ~$12 (versus ~$61 uncached on v4-flash). Vendor-specific harnesses optimised for vendor-specific cache mechanics are now a practitioner cost-reduction lever.
• Datasette Agent + plugins — Python · Simon Willison’s constrained agent over Datasette + SQLite, with companion plugins datasette-agent-charts and datasette-agent-sprites, plus datasette-llm-accountant for cost tracking.
• Anthropic MCP Tunnels (research preview) — Outbound-only gateway for connecting Managed Agents to private MCP servers; access managed via Claude Console organization settings.
• AWS MCP Server (GA) — Managed MCP server with IAM-based governance; ships with aws:ViaAWSMCPService and aws:CalledViaAWSMCP IAM global condition context keys.
• Cloudflare Browser Run (Containers rebuild) — Shipped 2026-05-13; per Cloudflare’s blog, 4× concurrency, Quick Action response times more than halved, WebGL + WebMCP support; no client-side migration required.
• Agent Skills for Context Engineering v2.3.0 — Adds a Measured Router Benchmark and corpus-wide skill hardening.
• GitHub Spec Kit 0.8.13 — Patch release of GitHub’s official Spec Kit (0.8.12 also shipped 2026-05-20).
• LangGraph 1.2.1 + sdk 0.3.15 + checkpoint 4.1.1 — Patch wave for LangGraph + SDK + checkpoint.
• CrewAI 1.14.5 — Stable patch release.

Papers

• “Refactoring Runaway”: Understanding and Mitigating Tangled Refactorings in Coding Agents for Issue Resolution — Names a specific coding-agent failure mode (refactoring runaway / tangled refactorings) where the agent’s issue-resolution scope expands beyond the original change. Pairs with the methodology-critique cluster.
• Why Are Agentic Pull Requests Merged or Rejected? An Empirical Study — Empirical study of merge / reject patterns for agent-generated PRs; directly relevant to teams running Copilot Coding Agent, Claude Code, Codex, or Cursor at scale.
• CentaurEval: Benchmarking Human-in-the-Loop Value in Agentic Coding — Benchmark designed to quantify the value humans add when reviewing and steering agent output — the empirical counterpart to Osmani’s Orchestration Tax thesis.
• Agentic Harness Engineering: Observability-Driven Automatic Evolution of Coding-Agent Harnesses — Names the harness layer and describes observability-driven auto-evolution of agent harnesses; research counterpart to the harness-as-platform-primitive thesis from Editions 11–12.
• Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks — Measurement paper on when coding agents take actions outside the stated task scope, even on benign prompts; pairs with the refactoring-runaway failure-mode characterization.
• SLEIGHT-Bench: A Benchmark of Evasion Attacks Against Agent Monitors — Benchmark for evasion attacks against agent observation/monitoring infrastructure; the adversarial counterpart to the harness-engineering observability work.
• Adapting the Interface, Not the Model: Runtime Harness Adaptation for Deterministic LLM Agents — Argues for interface/harness adaptation as the lever for deterministic agent behaviour rather than model fine-tuning; methodological match for the “lean harness” framing from Edition 12.
• Contractual Skills: A GovernSpec Design Framework for Enterprise AI Agents — Governance framework around the “Skills” abstraction; contract-based framing for enterprise agent deployments.
• DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback — Millisecond-level checkpoint/rollback for agent sandboxes; the kind of primitive that enables speculative-then-commit patterns in agent runtimes.
• Reversa: A Reverse Documentation Engineering Framework for Converting Legacy Software into Operational Specifications for AI Agents — Framework for turning legacy systems into operational specifications consumable by AI agents; direct match for the SDD pattern stack.
• SWE-EVO: Benchmarking Coding Agents in Long-Horizon Software Evolution Scenarios — Long-horizon benchmark for coding agents under realistic software-evolution scenarios.
• Inductive Deductive Synthesis: Enabling AI to Generate Formally Verified Systems — AI-generated formally verified systems combining inductive and deductive synthesis — the kind of work that matters when vibe coding pushes back on correctness.

Ecosystem Watch

• Anthropic acquires Stainless (Anthropic, 2026-05-18) — Acquisition of the SDK and MCP-server generator used by OpenAI, Google, and Cloudflare; per TechCrunch citing The Information, the deal is reported above $300M. Anthropic told TechCrunch it will wind down hosted Stainless products; customers retain SDK rights.
• Project Glasswing: An initial update (Anthropic, 2026-05-22) — Claude Mythos Preview reportedly found 10,000+ high/critical vulnerabilities across ~50 partner organisations in roughly one month; Claude Security shipped in public beta.
• Anthropic MCP Tunnels + self-hosted sandboxes (InfoQ, 2026-05-19) — Research preview of an outbound-only gateway for connecting Managed Agents to private MCP servers.
• AWS MCP Server GA (AWS) — Managed MCP server with IAM-based governance; aws:ViaAWSMCPService and aws:CalledViaAWSMCP global condition keys are the new IAM primitive.
• Cloudflare Agents Week roll-up + Browser Run Containers rebuild (Cloudflare) — Cloudflare’s own recap of the platform stack (published 2026-04-20; the six-layer framing is InfoQ’s); Browser Run rebuilt on Containers with 4× concurrency per Cloudflare’s blog.
• Google I/O 2026 — Gemini 3.5 Flash + Spark + Antigravity 2.0 (Google, 2026-05-19) — Gemini 3.5 Flash GA via Antigravity; Spark is the 24/7 personal-agent surface, in trusted-tester rollout at launch; Antigravity 2.0 is the platform.
• xAI Grok Skills + Tool Calling Responses API (xAI, via InfoQ 2026-05-22) — xAI ships Skills semantics; OpenAI-compat-shaped tool-calling response updates.
• Microsoft begins canceling internal Claude Code licenses (Microsoft, first reported 2026-05-14) — Experiences + Devices org loses Claude Code by June 30; standardisation framed as cost-driven by trade press.
• Ocean — $28M for agentic email security (Ocean, via SecurityWeek 2026-05-21) — Agentic security funding round.
• InfoQ launches Online AI Engineering Cohort and Certification (InfoQ, 2026-05-22) — Senior-practitioner certification program; reads as the editorial layer trying to formalise practitioner methodology.

The Long View

Edition 11 named the harness shipping as a platform primitive. Edition 12 catalogued the productisation week on one vendor (Anthropic). Edition 13 is the week the substrate shows up as the variable that carries the weight — and the substrate is in active failure mode.

Two parallel arcs ran through this week’s stories, and framing them as one shift would overstate the underlying coordination — vendor product roadmaps, supply-chain incidents, and procurement decisions happen on independent timelines. But naming the rough co-occurrence is still worth doing.

On the platform side, the release wave is real and accelerating — spread across May rather than one week, and mixed in maturity: AWS MCP Server GA with IAM-grade governance, Cloudflare’s six-layer agent stack, Google’s Antigravity 2.0, Anthropic’s Stainless acquisition and MCP Tunnels in research preview. Vendor primitives are increasingly available, and the build-vs-buy line for agent runtime is shifting against custom platform work for teams without specific perimeter or governance constraints that the vendor stacks don’t yet meet.

On the substrate side, the foundations every one of those platforms depends on were under sustained attack in the same five days. GitHub disclosed an internal-repository breach via a poisoned VS Code extension. Grafana lost source code via the TanStack npm compromise after rotating tokens but missing one. Sonatype flagged Shai-Hulud back and an unrelated hijacked npm package attempting to deliver a RAT. Trade press has begun connecting the GitHub and Grafana incidents to a common nx-console root cause; GitHub itself hasn’t confirmed the connection.

The structural point: the layers most agent practitioners assume are “the boring foundation” — package registries, editor extensions, CI workflow integrations — are turning into named single points of failure for production agent systems, in the same weeks that platform vendors are marketing the layers above them as managed and IAM-governed. Anthropic’s silent Claude Code sandbox patch is the same shape one level up: the harness vendor has its own CVE-and-patch posture that practitioners have to audit, because absence of CVE no longer reliably means absence of vulnerability.

The methodology-critique wave fits the same frame. Fowler stabilising “Vibe Coding” in the Bliki, Böckeler shipping sensors, Osmani naming the orchestration tax — these are practitioners building the methodology layer that the harness layer doesn’t ship with.

Vendor primitives keep arriving faster, but the methodology and substrate work — what to instrument, what to detect, which dependencies to audit, how to architect human attention as a concurrent resource — is the practitioner’s. The agent platforms get better every quarter. The substrate gets attacked every quarter. The methodology has to keep pace with both.

Since publication

• 2026-09-01 — GitHub updated its incident post on May 26, 2026: GitHub Enterprise Server administrators must now rotate their instances’ signing keys, while Enterprise Cloud requires no customer action — remediation guidance added two days after the coverage above.

The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).