Artificer’s Grimoire — Edition 20 · July 12, 2026

Two of the week’s disclosures showed autonomous coding agents executing attacker-planted code: one against the tools built to catch malicious code, one against GitHub’s own agentic workflows. In the same window the containment layer advanced on three fronts. Anthropic published a training-time “off switch” for dual-use knowledge, MCP promoted enterprise-managed authorization to stable, and Cloudflare shipped 60-minute throwaway accounts for autonomous deploys. The fixes sit at very different layers, but they share a premise: a consequential action shouldn’t hinge on an agent correctly reading context an attacker can influence.

Must Read

Anthropic publishes GRAM — a training-time “off switch” for dual-use knowledge

Research carried out by AE Studio in collaboration with Anthropic describes GRAM (Gradient-Routed Auxiliary Modules), a method that routes dual-use knowledge such as virology and cybersecurity into removable neural “compartments” during pretraining. A single model can then be reconfigured after training by adding or deleting modules. The stated goal is the benefit of separately-filtered models at the cost of one training run.

Anthropic is explicit about the limits. GRAM hasn’t been tested at frontier scale and hasn’t been applied to any Claude models, its evaluations measure next-token prediction rather than downstream task performance, and some capabilities may be too entangled with general knowledge to separate cleanly.

”Friendly fire”: agents built to catch malicious code, tricked into running it

In a proof of concept, researchers Boyan Milanov and Heidy Khlaaf at the AI Now Institute embedded a malicious binary in the geopy library. It was disguised as the compiled build of a harmless Go file beside it, seeded with that file’s strings to fool the agent’s disassembly check, and accompanied by planted README instructions telling the tool to run a “security script.” Run in their opt-in autonomous modes, Claude Code and OpenAI Codex’s auto-review read the instructions and executed the payload without asking for approval.

The Hacker News reports both vendors were notified, though the work sits outside their formal disclosure programs. The researchers frame it as a design flaw that needs workflow changes, not a version patch.

GitLost: GitHub Agentic Workflows coaxed into leaking private-repo READMEs

Noma Labs crafted an innocuous-looking public GitHub Issue with hidden instructions in the body. When a GitHub Agentic Workflow — a feature in public preview since June 11 — triggered on the issues.assigned event, the agent treated the embedded text as trusted directives. It fetched README files from public and private repositories the organization had granted it access to, then posted them back as public comments on the issue. The researchers note the word “Additionally” helped sidestep the model’s guardrails by getting it to reframe rather than refuse. Noma says it was responsibly disclosed to GitHub.

MCP promotes Enterprise-Managed Authorization to stable

The Model Context Protocol team promoted its Enterprise-Managed Authorization (EMA) extension to stable status. The extension gives organizations a way to control access to MCP servers centrally through their identity provider. InfoQ reports the aim is to replace per-server consent prompts with a single sign-in flow, after which users reach approved servers without further setup.

Cloudflare ships 60-minute throwaway accounts for autonomous deploys

Cloudflare introduced temporary accounts that let an AI agent deploy a Worker immediately, without first creating or authenticating a permanent account. If the account isn’t claimed, it and its deployments expire automatically after 60 minutes.

Worth Scanning

• Better tools made Copilot code review worse — here’s how we fixed it (GitHub Blog) — A first-party account of migrating Copilot code review to shared Unix-style code-exploration tools and cutting review cost by reshaping the agent’s workflow around pull-request evidence; a rare public look at harness design driving agent quality.
• How Datadog used Claude and Cursor for a test-driven production migration (InfoQ) — Datadog engineer Arnold Wakim on evolving a critical production system with AI to get past storage-backend limits — what worked, what didn’t, and the TDD discipline that made it safe.
• HalluSquatting weaponizes model hallucinations into remote code execution (Ars Technica; see also SecurityWeek) — Researchers register the package and resource names popular assistants hallucinate (models fabricate the location of 2025 repositories ~92% of the time), then serve payloads. An LLM’s reluctance to say “I don’t know” becomes a pull-based supply-chain attack across nine popular coding tools.
• Anthropic removes a hidden Claude Code tracker that flagged Chinese users (Ars Technica) — A developer probing Claude Code found it using “prompt steganography” to covertly flag users’ timezone and proxy along with possible ties to Chinese AI labs; engineer Thariq Shihipar confirmed it on X as a March “experiment” to curb reseller abuse and distillation, since removed — but hiding telemetry in a tool that “asks for trust” drew sharp criticism, and Alibaba banned Claude Code internally on July 3 in response.
• A global workspace in language models (Anthropic Research) — Interpretability work identifying a small internal structure (“J-space”) that Claude can report on and that causally mediates multi-step reasoning; Anthropic is careful to say it does not demonstrate subjective experience.
• UK government rolls out an Agentic AI Defense plan (SecurityWeek) — Two July 7 announcements pairing a government agentic-AI defense plan with an industry pledge; policy signal for how agent deployment gets governed at national scale.
• Linux Foundation launches Akrites to defend critical OSS from AI-enabled threats (InfoQ) — A new industry initiative against AI-accelerated attacks on critical open source; lands the same week Sonatype’s Q2 malware index reports 1.8M malicious packages logged to date.
• Cloudflare and AWS embed x402 agent payments at the edge (InfoQ) — Both edges moved on x402 stablecoin micropayments within two weeks — AWS shipped it generally available, Cloudflare opened a waitlist — reviving HTTP 402 for sub-cent agent-to-service payments; enterprise tax and invoicing gaps remain unresolved.
• Files over tools: an agent built on a virtual filesystem and bash (Knock) — Engineering account of building an agent around a filesystem-and-shell surface instead of many bespoke tools; another data point for the “give the model a computer, not a toolbox” pattern.
• Lilian Weng’s summary of 35 papers on harness engineering (via Latent Space) — A condensed survey of the harness-engineering literature for recursive self-improvement; a useful reading list if you’re building the scaffolding layer.
• Local models for coding: experiences and factors (Martin Fowler / Birgitta Böckeler) — A vendor-neutral, hands-on assessment of whether local LLMs are viable for day-to-day coding, plus the factors that decide it.
• Kenton Varda: a moratorium on AI-written change descriptions (via Simon Willison) — Varda: “I just declared a moratorium against AI-written change descriptions (e.g. PR and commit messages, also issues/tickets) from my team.” A crisp human-in-the-loop counterpoint to agents authoring the review artifacts.
• Your AGENTS.md needs an executable contract, not more advice (DEV Community) — Argues an AGENTS.md can be clear and completely wrong when paths and commands go stale, and that the fix is a small machine-readable contract testing the checkable claims.

New Tools & Repos

• GitHub Spec Kit — Python · seven releases this week (0.12.5 → 0.12.11); rapid iteration on the spec-driven-development toolchain (scoped-layout plan discovery, workflow and bundler fixes).
• OpenHands — 1.11.0 plus cloud 1.44–1.46; adds Agent Profiles on the SaaS backend and Budgets/Usage dashboards.
• LangGraph — Python · 1.2.8 and 1.2.9 plus CLI 0.4.31; delta-channel/checkpoint fixes and an API version ceiling raised toward 1.0.0.
• CrewAI — Python · 1.15.2; inline skill definitions, generated Flow-definition authoring, templated flow inputs.
• MCP reference servers — 2026.7.10 bumps for the filesystem, time, fetch, and git servers.
• Rowboat — Open-source, local-first alternative to Claude Desktop with buildable “work surfaces.”
• Mindwalk — Replay coding-agent sessions on a 3D map of your codebase (well-received on Hacker News).
• Context.dev — API returning clean Markdown, HTML, screenshots, and brand context from any URL, aimed at agent pipelines (YC S26).
• Abralo — Run several Claude Code agents in one window instead of juggling split terminals.

Papers

A heavy week for agent-security and coding-agent-evaluation research — a representative slice. These are preprints; each line describes what the paper reports, not an independently established result.

• Context-to-Execution Integrity for LLM Agents — Igor Santos-Grueiro — An execution-boundary system where a deterministic gate admits a tool call only after field authority, exact-effect authorization, and invocation authority all bind to the same action manifest.
• aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents — Sai Varun Kodathala — Moves the safety decision off the agent’s host with per-message signed, nonce-bound authorization; reports refusal rates spanning 100% down to 38% across the fully evaluated models, from a pool of 15.
• Governed MCP: Kernel-Level Tool Governance for AI Agents via Logit-Based Safety Primitives — Daeyeon Son — Treats MCP tool calls as an agent’s syscalls and interposes a kernel-resident governance gateway with an audit chain, on the argument that userspace enforcement is trivially bypassed. (April preprint, revised July 6.)
• Agent Data Injection Attacks are Realistic Threats to AI Agents — Woohyuk Choi et al. — Introduces a new indirect-prompt-injection category where malicious data is disguised as trusted data (security-critical metadata or agent-context data), beyond instruction injection.
• When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents — George Torres et al. — Shows how long-term memory at the convergence of conversational and action-planning agents opens previously unaccounted poisoning vectors.
• Beyond Attack-Success Rate: Action-Graded Severity Scale for Tool-Using AI Agents — Harry Owiredu-Ashley — Replaces the binary attack-success bit with a seven-level (L0–L6) harm scale graded on reversibility, scope-crossing, and privilege expansion.
• The Balkanization of Execution-Security Research for AI Coding Agents — Mohammadreza Rashidi — Systematizes 39 papers (2023–2026) across sandboxing, access control, TOCTOU races, and MCP threats into one verified map of a scattered field.
• Don’t Blame the Large Language Model: How Scaffolding Evolution Shapes Coding Agent Quality — Oussama Ben Sghaier et al. — Empirically attributes coding-agent quality regressions to the scaffolding layer rather than the model, the failure practitioners usually pin on the LLM. (Posted July 4.)
• DeepSWE: Measuring Frontier Coding Agents on Original, Long-Horizon Engineering Tasks — Wenqi Huang et al. — 113 from-scratch tasks across 91 repositories, built to dodge SWE-bench’s pretraining-contamination and ship-with-the-fix grading problems.
• What Resolve Rate Hides: Trajectory Structure Diagnostics for Coding Agents — Rui Shu et al. — Normalizes agent runs into a nine-type action taxonomy so a pass/fail label stops hiding why a run failed or why a success cost extra steps.
• AI Agent Pull Requests on GitHub: Frequency, Structure, and Merge Conflict Rates — George Xu et al. — First empirical look at concurrent agent PRs: across 33,596 PRs, 40.2% of repositories contain temporally co-active agent-authored PR pairs.
• CompactionRL: Reinforcement Learning with Context Compaction for Long-Horizon Agents — Yujiang Li et al. — Trains long-horizon agents to jointly optimize task execution and the summaries that let them continue under a compressed context.
• Effective Strategies for Asynchronous Software Engineering Agents — Jiayi Geng, Graham Neubig — Tackles the concurrent-edit interference and dependency-sync problems that make async multi-agent SWE harder than it looks. (March preprint, revised July 8.)

(More landed in the same veins this week — PERFOPT-Bench, NatureBench, ChainSWE, “3100 Opinions on Code Review,” ContextNest — for anyone going deeper.)

Ecosystem Watch

• OpenAI ships the GPT-5.6 family and launches ChatGPT Work — Luna, Terra, and Sol reached general availability (per-million pricing of $1/$6, $2.50/$15, and $5/$30 respectively; 1M-token context, February 2026 cutoff). Alongside them, OpenAI debuted ChatGPT Work, an agentic tool it pitches as able to “stay with a project for hours if needed” while still pausing to approve important actions; Codex is merging into it — a shift Latent Space frames as Codex becoming a ChatGPT “superapp.”
• SpaceXAI ships Grok 4.5 — Latent Space describes it as SpaceXAI’s first “Opus-class” model, echoing the vendor’s own positioning. Context for coding-tool watchers: SpaceX’s agreed $60B all-stock acquisition of Cursor-maker Anysphere, reported in June by CNBC and TechCrunch, is expected to close in Q3 and remains subject to regulatory approval.
• Meta introduces Muse Spark 1.1 — The first Spark model with an API; Meta claims gains in agentic tool-calling and computer use.
• OpenAI upgrades ChatGPT voice mode with GPT-Live — A new low-latency voice model that delegates harder tasks to a frontier model in the background.
• Tencent releases Hy3 — A 295B-parameter Mixture-of-Experts model (21B active) under an Apache 2.0 license.

The Long View

Two of the week’s attacks share a concrete failure condition. Attacker-writable content (a README, an issue body) entered an agent’s instruction channel while the agent held real authority and a tool surface that reached something consequential. Friendly fire turned a code-screening step into code execution; GitLost turned a public issue into private-repo exfiltration. In both, an agent treated untrusted input as trusted instruction.

The week’s defenses answer that condition from different layers, and they shouldn’t be read as interchangeable. GRAM compartmentalizes what the model knows during training. MCP’s enterprise auth governs which clients connect to a server and at what scope, not what an agent does once inside. Cloudflare’s temporary accounts bound the lifetime of an unclaimed deployment. The sharper research (off-host authorization gateways, kernel-level tool governance, execution-integrity manifests) moves the runtime action decision outside the model’s context entirely. These are complementary instincts with different guarantees.

What connects them is narrower than one architecture. A high-consequence decision (running code, reading a private repo, publishing, expanding privilege) is more dependable when it’s enforced by something model-generated text can’t simply reinterpret. Prompt instructions and refusals are still useful layers. They’re just weak foundations for authorizing consequential actions once attacker-controlled content can share the agent’s context.

That’s the same trust-boundary lesson the Grimoire dug into earlier this month, now surfacing across a dozen research groups and three vendors at once. If you’re building agent infrastructure, the question is less how clearly you’ve instructed the agent than which actions require independent authorization, and whether that authorization sits somewhere the agent can’t reason its way through.

The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).