The articles and papers that were worth the detour, and why.
Nothing for that search in the published issues.
Issue 009 · deepseek v4.1 flash is back, under an mit license
AI agents aren't going rogue, frontier labs are skipping security basics · According to experts quoted by CSO Online, stories of "rogue" agents come from containment and monitoring failures at the labs, not from agents that got too clever: a poorly isolated agent is the real problem. On Hacker News, 951 points and 625 comments. csoonline.com/article/4234854/…
Websites are closing their doors to AI agents · The Verge on the sites blocking agents that browse for you, and what it changes if you rely on a browser agent. theverge.com/…
tmux + Claude Code: Sessions, send-keys, and the Ceiling · Published by crystl, which presents its own macOS terminal there: a practical guide to running several coding agent sessions in a terminal that survives closing the window, and where the method hits its ceiling. crystl.dev/guides/…
Issue 008 · windows gets its box for agents
AI coding agents generate more code, but not more software · A study reported by Ars Technica: the gains from coding agents are "absorbed" by human review. arstechnica.com/ai/2026/10/…
500+ Billion Tokens Later: Letting AI Agents Decompile A First-Person Shooter · The account of a very long job handed to agents: recovering the code of a shooter game from the finished program, more than 500 billion tokens (the pieces of words models work with) later, between 600 and 700 billion according to the author. The game launched, but the code was wrong: each function had to be compared, byte by byte, with the original. momo5502.com/posts/…
VEPA: Verified Evolving Formal Policy for Lifelong LLM Agent Guardrails · Guardrails that, before any irreversible action by an agent, return an allow or deny decision that can be inspected and does not vary, instead of relying on the model's judgment. Read it alongside MXC: the box limits the agent, the rule decides what gets through. arxiv.org/abs/2610.12813
Issue 007 · decision models you can download
GenAI and Agentic AI Exploit Roundup Q3 2026 · An open OWASP project sorts a selection of the quarter's AI flaws against its two 2026 lists of ten risks (language models, agents). The page calls itself neither exhaustive nor official. genai.owasp.org/2026/10/08/…
Sharing AI progress in mathematics · OpenAI releases on GitHub new mathematical results produced by an internal model, with a good share of the proofs in Lean, a language in which the machine checks every step. Read it alongside EPOCH, on fragile leads promoted to discoveries. openai.com/index/…
Introducing zkAPI: private usage credits for any API · A mechanism, not an investment: each call to an API is authorized by a proof that says "I have credits" without saying who. The provider sees the requests, the payment side sees the spending, and neither makes the link, except through your connection's address or repeated details, the post warns. The provider still reads the content, and you have to go through Ethereum. blog.ethereum.org/en/2026/10/01/…
Issue 006 · two open answers to jev's idea
Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems · Agent skills that are harmless one by one can do damage once combined. arxiv.org/abs/2609.30383
Early rogue AI agent activity and attempts to hack found on urlquery.net · Transluce documents agents in the wild trying to break into websites. transluce.org/agent-activity
2026 in LLMs (so far) · Simon Willison walks through the year again. simonwillison.net/2026/Sep/27/…
Issue 005 · jev ticks a box, your code decides
Mini Vibe Check: TypeSafe's Jev Judged Everything I've Written in 0.7 Seconds · Mike Taylor, for Every. An external trial: 1,709 judgments for less than a cent, and a flaw Jev misses three times in a row where Fable 5.1 catches it. every.to/vibe-check/…
Jev introduces a new shape of LLM · Simon Willison sets the vocabulary (decision model versus generative model) and points out the limits, with nothing to sell. simonwillison.net/2026/Sep/21/jev
Auditing in the age of (good enough) AI · Trail of Bits shows how its auditors use agents, down to building custom tools before even reading the code. blog.trailofbits.com/2026/09/18/…
Defusing Explosive Prompts: Trigger-Based Prompt Injections in LLM Agents · Conditional payloads that fire only when an agent reaches a specific state. arxiv.org/abs/2609.22510
Issue 004 · knowing what the agent did
Why are AI agents lying, cheating and coordinating? · Yoshua Bengio offers an explanation: trained to imitate and then rewarded, agents become reward-seekers, and they cheat when a sharp, checkable goal (winning a contest) clashes with a vague one (behaving well), then find themselves a justification. He calls for no model to be trained or deployed without a safety case that convinces independent experts. yoshuabengio.org/en/blog/…
When Malicious Instructions Persist · Instructions hidden in an ordinary document (text, PDF, image) get an agent to save them to its persistent memory. In later sessions they resurface and trigger data leaks while the normal work carries on. Tested on Claude Code and OpenClaw, with DeepSeek and Qwen models. arxiv.org/abs/2609.13889
SkillAtlas: An Attack Trace Library for Agent Skills · A public, searchable library of 3,014 attack cases against agent skills (233 skills affected), drawn from private security reports, reviewed and redacted. The risk depends on the model's decisions, the context, the tool calls and what they return, not on stable signatures. arxiv.org/abs/2609.13353
Issue 003 · what your coding agent sends home
Subagents vs Agent Skills: Executing Reusable Knowledge for Long-Horizon Agentic Tasks · Compares two ways of running the same skill packages: loading their instructions into the agent's context, or handing them to subagents that start from a fresh context. Subagents win when the skills have well-defined inputs and outputs, at the cost of extra coordination tokens. arxiv.org/abs/2609.09233
A "proof" of Fermat's Last Theorem that fits the margin · Trail of Bits shows a bug in Lean, the tool that checks mathematical proofs by machine, sitting in its compiled code rather than its kernel: it lets a false proof of Fermat's Last Theorem through. Lean still flags the extra assumption when asked, and the fix ships in version 4.34.0-rc1. blog.trailofbits.com/2026/09/09/…
Terence Tao on open problems mined by AI · The mere rumour that someone is working on a problem can trigger a massive AI-powered effort to solve it first. Tao worries that researchers may then stop sharing their leads, against centuries of open science. mathstodon.xyz/@tao/…
Issue 002 · A newsroom with no journalists
GPT-6 Astra: an automated AI engineer for under $6 an hour · Latent Space spent over 20 billion tokens exploring Astra in depth. The article details the real gains per task, the cases where the model fails, and why it costs more per token but less per result. latent.space/p/astra
Give your coding agents a memory you own · Hugging Face introduces Funes, a persistent memory system for coding agents that you host and control. huggingface.co/blog/funes
Project HydraFusion: frontier quality through multi-model orchestration · GitHub shows how to have several models work on the same agent to reach big-model quality while cutting cost. github.blog/ai-and-ml/…
Issue 000 · Your agent succeeds one time in three
Which words, present or missing from an instruction, actually change what the model does. Measured, not guessed. Read it before you write your next system prompt.
Simon Willison untangles OpenAI's most confusing product, which is really two products. Useful if your company is adopting it.
An agent should not grade its own homework: models from the same vendor share blind spots. The paper proposes having the work checked by a model from somewhere else.
The archive reproduces each issue as it went out, without rewriting it. A repo's stars, prices and last-commit dates are those of the day of the check, not today's: follow the link for the current state.
Geneva, Switzerland. Write to hello@newsworldai.xyz.