/
RSS Feed
This episode turns the week's strongest evidence into four controls for consequential agent work: enforce authority outside the model, isolate the code that agent-approved commands execute, judge durable state rather than completion messages, and preserve source-linked evidence for accountable review.
Recorded October 11, 2026, covering October 3 through October 9. Duration: 11:40 at normal speed, or about 9:20 at 1.25 speed. The opening retains the scheduled Saturday, October 10 briefing date.
Chapters
- 00:00 – AI Tech Signals
- 00:10 – An allowed process can still produce an unauthorized outcome
- 00:34 – Put the boundary outside the model
- 03:16 – Authorize the execution environment, not the command name
- 05:46 – Check the durable result, then attack the test
- 08:32 – Preserve evidence that another person can challenge
- 10:58 – This week's assignment
Sources and evidence limits
- Anthropic, Investigating unintended model actions, October 9. Vendor-selected incidents, mostly from evaluations or internal use, with minimal observed impact and no incidence denominator.
- GitHub, Local sandboxing for GitHub Copilot now generally available, October 7. Product-control release, not an independent isolation assessment.
- Vercel, Agents can now buy domains with the Vercel CLI, October 9. A useful commit-gate pattern without published adversarial testing.
- Felix, shell-execution isolation commit, October 9. Main-branch hardening in a small project; packaged availability and independent exploitation were not verified.
- Agent Router (formerly Envoy AI Gateway) advisories GHSA-qcwp-vgvh-h3cm, GHSA-q522-4f3c-h4g8, and GHSA-953h-535j-jg2v; Payload advisories GHSA-jjm7-864w-gg8q and GHSA-cqr4-hjg9-833p; Docker MCP Gateway GHSA-jfp6-4vv7-6m6c, October 6-8. Separate defects and mechanisms support fail-closed tests, not a common incidence claim.
- Kubernetes SIG Agent Sandbox, v1.0.6 release notes, October 8. Release features rather than outcome evidence.
- Microsoft and Hugging Face, The Agent Said It Was Done. The Database Disagreed, October 3. Synthetic stateful workflows produced by interested organizations, with pinned code and executable checks.
- TestPrism, submitted October 8. Preprint using finite authored panels; production prevalence and evolving specifications were outside scope.
- Evidence-Grounded Oversight, submitted October 5. Preprint with partly model-judged metrics and five illustrative paired Codex cases.
- AgentHorizon Judges, submitted October 8. Preprint built around subtle near-misses, not the complete failure distribution.
- OpenHands, verification harness commit, October 8. Project-specific implementation evidence without independent replication.