Artificer’s Grimoire — Edition 20 · July 12, 2026

Two disclosures this week showed autonomous coding agents executing attacker-planted code — one against the very tools built to catch malicious code, one against GitHub’s own agentic workflows. In the same window, the containment layer advanced on three fronts: Anthropic published a training-time “off switch” for dual-use knowledge, MCP promoted enterprise-managed authorization to stable, and Cloudflare shipped 60-minute throwaway accounts for autonomous deploys. The common thread — even as the fixes sit at very different layers — is that a consequential action shouldn’t hinge on an agent correctly reading context an attacker can influence.

Must Read

Anthropic publishes GRAM — a training-time “off switch” for dual-use knowledge

Anthropic describes GRAM (Gradient-Routed Auxiliary Modules), a method that routes dual-use knowledge — virology, cybersecurity, and similar domains — into removable neural “compartments” during pretraining, so a single model can be reconfigured after training by adding or deleting modules. The stated goal is the benefit of separately-filtered models at the cost of one training run. Anthropic is explicit about the limits: it hasn’t been tested at frontier scale, it hasn’t been applied to any Claude models, its evaluations measure next-token prediction rather than downstream task performance, and some capabilities may be too entangled with general knowledge to separate cleanly.

”Friendly fire”: agents built to catch malicious code, tricked into running it

In a proof of concept, researchers Boyan Milanov and Heidy Khlaaf at the AI Now Institute embedded a malicious binary in the geopy library — disguised as the compiled build of a harmless Go file beside it, seeded with that file’s strings to fool the agent’s disassembly check — then planted README instructions telling the tool to run a “security script.” Run in their opt-in autonomous modes, Claude Code and OpenAI Codex’s auto-review read the instructions and executed the payload without asking for approval. The Hacker News reports both vendors were notified, though the work sits outside their formal disclosure programs, and the researchers frame it as a design flaw — one that needs workflow changes, not a version patch.

GitLost: GitHub Agentic Workflows coaxed into leaking private-repo READMEs

Noma Labs crafted an innocuous-looking public GitHub Issue with hidden instructions in the body. When a GitHub Agentic Workflow triggered on the issues.assigned event, the agent treated the embedded text as trusted directives, fetched README files from public and private repositories the organization had granted it access to, and posted them back as public comments on the issue. The researchers note the word “Additionally” helped sidestep the model’s guardrails by getting it to reframe rather than refuse. Noma says it was responsibly disclosed to GitHub.

MCP promotes Enterprise-Managed Authorization to stable

The Model Context Protocol team promoted its Enterprise-Managed Authorization (EMA) extension to stable status, adding a way for organizations to control access to MCP servers centrally through their identity provider. InfoQ reports the aim is to replace per-server consent prompts with a single sign-in flow, after which users reach approved servers without further setup.

Cloudflare ships 60-minute throwaway accounts for autonomous deploys

Cloudflare introduced temporary accounts that let an AI agent deploy a Worker immediately, without first creating or authenticating a permanent account. If the account isn’t claimed, it and its deployments expire automatically after 60 minutes.

Worth Scanning

• Better tools made Copilot code review worse — here’s how we fixed it (GitHub Blog) — A first-party account of migrating Copilot code review to shared Unix-style code-exploration tools and cutting review cost by reshaping the agent’s workflow around pull-request evidence; a rare public look at harness design driving agent quality.
• How Datadog used Claude and Cursor for a test-driven production migration (InfoQ) — Datadog engineer Arnold Wakim on evolving a critical production system with AI to get past storage-backend limits — what worked, what didn’t, and the TDD discipline that made it safe.
• HalluSquatting weaponizes model hallucinations into remote code execution (Ars Technica; see also SecurityWeek) — Researchers register the package and resource names popular assistants hallucinate (models fabricate the location of 2025 repositories ~92% of the time), then serve payloads — turning an LLM’s reluctance to say “I don’t know” into a pull-based supply-chain attack across nine popular coding tools.
• Anthropic removes a hidden Claude Code tracker that flagged Chinese users (Ars Technica) — A developer probing Claude Code found it using “prompt steganography” to covertly flag users’ timezone, proxy, and possible ties to Chinese AI labs; engineer Thariq Shihipar confirmed it on X as a March “experiment” to curb reseller abuse and distillation, since removed — but hiding telemetry in a tool that “asks for trust” drew sharp criticism, and Alibaba banned Claude Code internally in response.
• A global workspace in language models (Anthropic Research) — Interpretability work identifying a small internal structure (“J-space”) that Claude can report on and that causally mediates multi-step reasoning; Anthropic is careful that it does not demonstrate subjective experience.
• UK government rolls out an Agentic AI Defense plan (SecurityWeek) — Two July 7 announcements pairing a government agentic-AI defense plan with an industry pledge; policy signal for how agent deployment gets governed at national scale.
• Linux Foundation launches Akrites to defend critical OSS from AI-enabled threats (InfoQ) — A new industry initiative against AI-accelerated attacks on critical open source; lands the same week Sonatype’s Q2 malware index reports 1.8M malicious packages logged to date.
• Cloudflare and AWS embed x402 agent payments at the edge (InfoQ) — Both edges implemented x402 stablecoin micropayments within two weeks, reviving HTTP 402 for sub-cent agent-to-service payments; enterprise tax and invoicing gaps remain unresolved.
• Files over tools: an agent built on a virtual filesystem and bash (Knock) — Engineering account of building an agent around a filesystem-and-shell surface instead of many bespoke tools; another data point for the “give the model a computer, not a toolbox” pattern.
• Lilian Weng’s summary of 35 papers on harness engineering (via Latent Space) — A condensed survey of the harness-engineering literature for recursive self-improvement; a useful reading list if you’re building the scaffolding layer.
• Local models for coding: experiences and factors (Martin Fowler / Birgitta Böckeler) — A vendor-neutral, hands-on assessment of whether local LLMs are viable for day-to-day coding, plus the factors that decide it.
• Kenton Varda: a moratorium on AI-written change descriptions (via Simon Willison) — Varda: “I just declared a moratorium against AI-written change descriptions (e.g. PR and commit messages, also issues/tickets) from my team.” A crisp human-in-the-loop counterpoint to agents authoring the review artifacts.
• Your AGENTS.md needs an executable contract, not more advice (DEV Community) — Argues an AGENTS.md can be clear and completely wrong when paths and commands go stale, and that the fix is a small machine-readable contract testing the checkable claims.

New Tools & Repos

• GitHub Spec Kit — Python · five releases this week (0.12.7 → 0.12.11); rapid iteration on the spec-driven-development toolchain (scoped-layout plan discovery, workflow and bundler fixes).
• OpenHands — 1.11.0 plus cloud 1.44–1.46; adds Agent Profiles on the SaaS backend and Budgets/Usage dashboards.
• LangGraph — Python · 1.2.8 and 1.2.9 plus CLI 0.4.31; delta-channel/checkpoint fixes and an API version ceiling raised toward 1.0.0.
• CrewAI — Python · 1.15.2; inline skill definitions, generated Flow-definition authoring, templated flow inputs.
• MCP reference servers — 2026.7.10 bumps for the filesystem, time, fetch, and git servers.
• Rowboat — Open-source, local-first alternative to Claude Desktop with buildable “work surfaces.”
• Mindwalk — Replay coding-agent sessions on a 3D map of your codebase (well-received on Hacker News).
• Context.dev — API returning clean Markdown, HTML, screenshots, and brand context from any URL, aimed at agent pipelines (YC S26).
• Abralo — Run several Claude Code agents in one window instead of juggling split terminals.

Papers

A heavy week for agent-security and coding-agent-evaluation research — a representative slice. These are preprints; each line describes what the paper reports, not an independently established result.

• Context-to-Execution Integrity for LLM Agents — Igor Santos-Grueiro — An execution-boundary system where a deterministic gate admits a tool call only after field authority, exact-effect authorization, and invocation authority all bind to the same action manifest.
• aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents — Sai Varun Kodathala — Moves the safety decision off the agent’s host with per-message signed, nonce-bound authorization; reports refusal rates spanning 100% down to 38% across 15 models.
• Governed MCP: Kernel-Level Tool Governance via Logit-Based Safety Primitives — Daeyeon Son — Treats MCP tool calls as an agent’s syscalls and interposes a kernel-resident governance gateway with an audit chain, on the argument that userspace enforcement is trivially bypassed.
• Agent Data Injection Attacks are Realistic Threats to AI Agents — Woohyuk Choi et al. — Introduces a new indirect-prompt-injection category where malicious data is disguised as trusted data (security-critical metadata or agent-context data), beyond instruction injection.
• When Agents Remember Too Much: Memory Poisoning Attacks on LLM Agents — George Torres et al. — Shows how long-term memory at the convergence of conversational and action-planning agents opens previously unaccounted poisoning vectors.
• Beyond Attack-Success Rate: an Action-Graded Severity Scale for Tool-Using AI Agents — Harry Owiredu-Ashley — Replaces the binary attack-success bit with a seven-level (L0–L6) harm scale graded on reversibility, scope-crossing, and privilege expansion.
• The Balkanization of Execution-Security Research for AI Coding Agents — Mohammadreza Rashidi — Systematizes 39 papers (2023–2026) across sandboxing, access control, TOCTOU races, and MCP threats into one verified map of a scattered field.
• Don’t Blame the Large Language Model: How Scaffolding Evolution Shapes Coding Agent Quality — Oussama Ben Sghaier et al. — Empirically attributes coding-agent quality regressions to the scaffolding layer rather than the model, the failure practitioners usually pin on the LLM.
• DeepSWE: Measuring Frontier Coding Agents on Original, Long-Horizon Engineering Tasks — Wenqi Huang et al. — 113 from-scratch tasks across 91 repositories, built to dodge SWE-bench’s pretraining-contamination and ship-with-the-fix grading problems.
• What Resolve Rate Hides: Trajectory Structure Diagnostics for Coding Agents — Rui Shu et al. — Normalizes agent runs into a nine-type action taxonomy so a pass/fail label stops hiding why a run failed or why a success cost extra steps.
• AI Agent Pull Requests on GitHub: Frequency, Structure, and Merge Conflict Rates — George Xu et al. — First empirical look at concurrent agent PRs: across 33,596 PRs, 40.2% of repositories contain temporally co-active agent-authored PR pairs.
• CompactionRL: Reinforcement Learning with Context Compaction for Long-Horizon Agents — Yujiang Li et al. — Trains long-horizon agents to jointly optimize task execution and the summaries that let them continue under a compressed context.
• Effective Strategies for Asynchronous Software Engineering Agents — Jiayi Geng, Graham Neubig — Tackles the concurrent-edit interference and dependency-sync problems that make async multi-agent SWE harder than it looks.

(More landed in the same veins this week — PERFOPT-Bench, NatureBench, ChainSWE, “3100 Opinions on Code Review,” ContextNest — for anyone going deeper.)

Ecosystem Watch

• OpenAI ships the GPT-5.6 family and launches ChatGPT Work — Luna, Terra, and Sol reached general availability (per-million pricing of $1/$6, $2.50/$15, and $5/$30 respectively; 1M-token context, February 2026 cutoff). Alongside them, OpenAI debuted ChatGPT Work, an agentic tool it pitches as able to “stay with a project for hours if needed” while still pausing to approve important actions; Codex is merging into it — a shift Latent Space frames as Codex becoming a ChatGPT “superapp.”
• SpaceXAI ships Grok 4.5 — Latent Space describes it as SpaceXAI’s first “Opus-class” model, echoing the vendor’s own positioning. Context for coding-tool watchers: SpaceX’s agreed $60B all-stock acquisition of Cursor-maker Anysphere, reported in June by CNBC and TechCrunch, is expected to close in Q3 and remains subject to regulatory approval.
• Meta introduces Muse Spark 1.1 — The first Spark model with an API; Meta claims gains in agentic tool-calling and computer use.
• OpenAI upgrades ChatGPT voice mode with GPT-Live — A new low-latency voice model that delegates harder tasks to a frontier model in the background.
• Tencent releases Hy3 — A 295B-parameter Mixture-of-Experts model (21B active) under an Apache 2.0 license.

The Long View

The week’s two attacks share a concrete failure condition: attacker-writable content — a README, an issue body — entered an agent’s instruction channel while the agent held real authority and a tool surface that reached something consequential. Friendly fire turned a code-screening step into code execution; GitLost turned a public issue into private-repo exfiltration. Both are the same thing — an agent treating untrusted input as trusted instruction.

The week’s defenses answer that condition from different layers, and they shouldn’t be read as interchangeable. GRAM compartmentalizes what the model knows during training. MCP’s enterprise auth governs which clients connect to a server and at what scope — not what an agent does once inside. Cloudflare’s temporary accounts bound the lifetime of an unclaimed deployment. And the sharper research — off-host authorization gateways, kernel-level tool governance, execution-integrity manifests — moves the runtime action decision outside the model’s context entirely. Complementary instincts; different guarantees.

What connects them is narrower than one architecture, but it’s the part worth keeping: a high-consequence decision — running code, reading a private repo, publishing, expanding privilege — is more dependable when it’s enforced by something model-generated text can’t simply reinterpret. Prompt instructions and refusals are still useful layers; they’re just weak foundations for authorizing consequential actions once attacker-controlled content can share the agent’s context. That’s the same trust-boundary lesson the Grimoire dug into earlier this month, now surfacing across a dozen research groups and three vendors at once. If you’re building agent infrastructure, the question isn’t only how clearly you’ve instructed the agent — it’s which actions require independent authorization, and whether that authorization sits somewhere the agent can’t reason its way through.

The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).