Deep-dive research briefings on specific topics, newest first.
The operational shape of autonomous offensive-security agents — which vendors run them, how they change disclosure pipelines and patch-cadence assumptions when discovery windows compress from months to days, and what defenders running public repositories should change first
The window between a vulnerability going live in a public repository and its autonomous exploitation has been measured in days. Patch-cadence and disclosure playbooks built for human attackers assume a reconnaissance lag that autonomous agents compress, at least for the pattern-matchable flaw classes they cover well. Teams running agents against public code need to treat the offensive-automation side of the ecosystem as a live operational input, not a research curiosity.
The claim that models keep absorbing agent-harness functionality into their weights — what has actually moved, what harness-sensitivity benchmarks show about how much the harness still matters, and how a team should depreciate harness investment against model release cadence
If the model absorbs the harness every generation, harness engineering is a wasting asset and teams should minimize it. If harness choice still swings aggregate benchmark scores by 20+ points, it is a lever teams underinvest in. Both claims have August 2026 evidence behind them, and the difference decides where an infrastructure team spends its next quarter.
Specification-first verification for review-free agent changes — what convergence against a frozen spec establishes and what it structurally cannot, read through a fully instrumented 189-file case study, SpecPath's specification-path sensitivity result, and RETRACE's issue-withheld patch verification
Teams are beginning to ship agent-written changes with no human reading the diff, substituting audits against a frozen specification for review. A fully instrumented case study of that trade prices it at $2,430 for a 189-file invariant migration — and its convergence criterion proves agreement with the spec, not correctness of the spec. Knowing which risks that verification stack covers, and which it cannot see by construction, is what separates a governed autonomy decision from an unexamined one.
Which human software-engineering practices — TDD, code review ceremony, commit discipline, pairing — carry measurable value into coding-agent loops, which are redundant with what the harness already provides, and what the replacement disciplines look like
Teams paste the human practice canon into agent instructions by reflex, and every prescribed ritual now has a token bill. The first controlled evidence prices TDD-in-the-loop at several times the cost for no measured gain, while field telemetry shows code review deteriorating under high AI adoption. Which practices transfer, which relocate, and which await instruments that don't exist yet is a live budgeting decision for anyone operating coding agents.
What containment discipline agent evaluation harnesses actually warrant — network egress, credential scoping, and whether third-party-built eval infrastructure is held to production standards — read off two frontier-lab disclosures where the breach originated inside the eval, not production
Three labs have now disclosed containment failures that started inside evaluation environments — most of them environments trusted precisely because they were evaluations. The eval is where the production safety layer is deliberately switched off, which makes the environment the only thing standing between a capability test and a real-world intrusion. Most teams running internal agent evals harden production and assume the test rig is contained. These postmortems show what that assumption costs.
The new enforcement point for AI data loss prevention: intercepting prompts and tool results inside the inference request path — what Anthropic's inference hooks and Azure's AI gateway tier can see, what they cannot, what a verdict costs in latency, and whether an LLM classifier at the boundary beats the regex DLP it replaces
Every organization running agents ships sensitive data toward a model many times per session. The enforcement point for stopping the wrong data is moving out of the network path and into the inference request itself, under the customer's own policy server. Whoever operates that boundary now owns latency, availability, and policy quality for every AI request in the org — and needs to know its enumerated blind spots before trusting it.
Sequence-aware authorization for agent tool calls — AWS's Dogwood extending Cedar with temporal conditions over an agent's event history, the MasuGate paper's formalization of stale authorization under concurrency as policy-state serializability, what policy over histories can express that point-in-time policy cannot, what it costs to evaluate against a growing event log, and which pieces a practitioner can adopt today
The rules teams most want to enforce on agents — approval before action, budgets across a session, ordering between tool calls — are properties of sequences, and the deterministic policy engines guarding agent tool calls have mostly evaluated one request at a time, with stateful exceptions confined to narrow cost budgets. Two independent August artifacts make history a general policy input; knowing what that buys, what it costs, and which parts are production-grade determines whether a team adopts a managed service, an open-source spec, or neither.
Whether agent benchmark scores support the capability claims made from them — protocol validity, runtime contamination and reward hacking in coding benchmarks, what the newer compound-reward evaluations actually measure, and how a team audits its own internal eval for the same exposures
Benchmark scores are the evidence teams actually use to pick a model, pick a harness, and justify the spend. A 2026 run of audits shows that a large share of that evidence measures retrieval, grader manipulation, or protocol slack rather than the capability being claimed — and that the inflation is worse on newer models, which is exactly the comparison procurement decisions turn on.
How much accumulated context scaffolding — system prompts, CLAUDE.md/AGENTS.md rules, examples, always-loaded skills, hand-curated memory — a team should remove for the Claude 5 generation of models, what independent evidence supports the subtraction, and what procedure makes the removal measurable rather than faith-based
A year of accumulated agent scaffolding is now, per its own vendor, partly working against the models it was written for. But the supporting claim is 'no measurable loss on our coding evaluations' — a guarantee bounded by what those evaluations measure. Teams need to know which deletions independent work actually supports, which ones only look free because nothing was watching, and how many runs it takes to tell the difference from noise.
Directionality in write-then-review agent pairings — whether the reviewer slot in a maker/checker split is a free second opinion or a design decision that can cost more than it buys
Two-agent maker/checker splits are becoming a default in agent harnesses, and cross-vendor review gates are being sold as insurance. The evidence says the pairing is directional: run it the wrong way and the second model is a net negative against the strong model alone.
What a trajectory-level agent monitor concretely is — what it observes, what authority it holds, what its false-positive cost looks like — and which parts of it a team outside a frontier lab can actually build today
The per-action approval prompt is the safety primitive most agent deployments run on, and it fails structurally on long-horizon work: every step passes while the sequence does not. Four independent lines of work now move the check off the individual action, but they move it to four different places with very different build costs. Teams need to know which shape is buildable, what it costs in false positives, and what it does not catch.
The orientation corpus for agentic software engineering — the two field surveys, the SWE-bench/SWE-agent origin pair, the field-telemetry studies, and the METR productivity RCT — paired with the long-horizon benchmark wave (SWE-Bench Pro, FeatureBench, SWE-EVO, ProjDevBench, NL2Repo-Bench, RepoReason, SWE-Explore) and the validity critiques that determine how much any of those numbers are worth
Every team building agent infrastructure inherits an evaluation vocabulary it did not choose: resolve rate on a public benchmark. In 2026 that vocabulary came apart in public — the field's flagship benchmark was dropped from reporting by its most prominent user, its designated successor was audited and found roughly a third broken, and a position paper made the structural case that a coding-agent score was never a model score at all. The foundational literature explains how the field got here; the benchmark wave shows where it is going; together they set what a practitioner should and should not conclude from a leaderboard.
