Deep-dive research briefings on specific topics, newest first.
Quantifying and mitigating the integration cost of agent-generated code
As teams scale agent-assisted development, integration costs (merge conflicts, review overhead, coordination gaps) become the binding constraint
Documentation-driven injection and poisoning attacks against agent skill ecosystems
Agents that consume third-party skills are vulnerable to a new class of supply-chain attack that poisons documentation rather than code
Harness engineering as a named discipline — mental models, concrete patterns, and implementation guidance
Three independent sources converged on harness engineering this week; teams need a unified framework for designing agent scaffolds
OpenClaw security crisis — CVEs, ClawHavoc, architectural root causes, and defensive patterns
First major real-world agent security incident; establishes patterns every agent infrastructure team needs to understand
Convergence of SKILL.md, CLAUDE.md skills, AGENTS.md, and vendor-specific agent skill systems toward a shared format
The skills layer is where agent capability actually lives — practitioners need to know which format to invest in and what portability they can expect
Comparing emerging permission model architectures for AI agents
Every agent system needs a permission model — practitioners need to choose between classifier-based, role-based, and metric-based approaches
Transforming architectural decisions into machine-readable guardrails that coding agents respect
Over-permissioned agents cause 4.5x more incidents — teams need practical patterns for encoding architectural constraints agents can follow
Supply chain attack vectors and defensive patterns specific to AI agent infrastructure
AI infrastructure dependencies are high-value targets — teams need specific defensive patterns beyond general supply chain hygiene
Strategic implications of AI labs acquiring developer tooling companies
Practitioners depend on tools now owned by AI labs — understanding the strategic logic and risks informs tooling choices
Architectural patterns from Stripe Minions, Spotify Honk, and HubSpot Sidekick
Practitioners building internal coding agents need concrete architectural patterns validated at enterprise scale
Guidance injection attacks on coding agent bootstrap/skill files
Anyone building or deploying coding agents with skill ecosystems (CLAUDE.md, AGENTS.md, custom skills) needs to understand this novel attack surface
The emerging discipline of supervisory engineering in agent-assisted workflows
Teams adopting coding agents need to understand how engineering roles, skills, and team structures are shifting
