The daily feed
What mattered in coding agents since yesterday, best first, with a one-line take on each. Every title opens the source in a new tab. Collected and scored by agents, every day.
Updated RSS
Score 7.6 out of 10
Claude Code 2.1.319 更新了两件实用的事： (opens in a new tab)
Small but real harness changes: MCP calls can run in the background, and a deny-on-prompt setting stops permission dialogs from blocking unattended runs. Check the release notes for details.
why 7.6
Claude Code 2.1.319 adds background MCP tasks and a non-blocking deny-on-prompt permission setting.
relevance 8/10 · novelty 7/10
Score 7.0 out of 10
cloudflare/security-audit-skill: A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings (opens in a new tab)
Worth reading for the structure: a fresh verifier sub-agent validates findings it didn't produce (Law 4). The 'one run finds half' figure argues for repeated runs (Law 5).
why 7.0
Concrete coding-agent skill with isolated sub-agents and verifier phases; mechanism visible, though the single-run recall figure is unverified marketing-adjacent detail.
relevance 7/10 · novelty 7/10
Score 6.6 out of 10
opencode shipped Browse: MCP + Chromium extension so your coding agent drives your real browser — tabs, logins,… (opens in a new tab)
A real tool-list change: the agent gets your logged-in browser and hands control back for 2FA. That is wider reach and wider blast radius. Law 3.
why 6.6
Browser MCP plus Chromium extension; hands control back for login or 2FA. Concrete harness feature.
relevance 7/10 · novelty 6/10
Score 6.4 out of 10
Google 11 月 8 日开源了一个叫 Elephant-Goldfish Model 的插件，Apache 2.0，不是新模型，是给 coding agent 加的一层先写规格再写代码的流程。Google… (opens in a new tab)
Spec-first workflow plugin, not a model. 'Thousands of internal engineers' is an adoption claim, not a result, and the README says it is unsupported. Worth reading the process.
why 6.4
Open-source Apache 2.0 spec-first workflow layer for coding agents; concrete harness-level process, though details are thin and it's a plugin, not a measured result.
relevance 6/10 · novelty 7/10
Score 6.0 out of 10
We deleted almost all our agent code, and other lessons from 100k PRs (opens in a new tab)
Best of the day: a team that shipped 100k PRs reports that deleting agent scaffolding worked. This is experience, not a controlled measurement, but it is a useful prior.
why 6.0
Lovable lessons from 100k PRs, including removing agent code; experience-based evidence on harness design.
relevance 6/10 · novelty 6/10
Score 5.6 out of 10
Switching model providers in a coding agent used to carry a quiet cost: old sessions could drop out of resume, or… (opens in a new tab)
Codex CLI 0.167.0 keeps sessions resumable across providers. Sessions are harness-owned transcripts, so switching models should never cost you history. Law 1.
why 5.6
Codex CLI 0.167.0 keeps sessions from all providers resumable; a real change to session handling.
relevance 6/10 · novelty 5/10
Nothing of this kind on this day.
Score 7.6 out of 10
Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files (opens in a new tab)
Worth reading. A permission shortcut became a secret-leak path at measured scale: 1,122 public files. Approval fatigue turns the human check into a rubber stamp.
why 7.6
Measured leak of secrets via Claude Code's 'Don't Ask Again' permission setting; a permission-model failure with concrete scale.
relevance 8/10 · novelty 7/10
Score 6.6 out of 10
is Opus 5.5 nerfed? (opens in a new tab)
Anecdote with a big sample. One model grading another's sessions is not an independent check, and nothing separates model change from harness change. Law 4.
why 6.6
Claims a reasoning shift on Nov 3 across 1,400 sessions; anecdotal analysis but a possible harness or model regression.
relevance 7/10 · novelty 6/10
Score 6.6 out of 10
让编码 Agent 在自己写的代码上连着做 5 到 15 个需求，最强的 Claude Opus 5.5（跑在 Claude Code 里）也只有 18.5% 能一路做完。这是 Klavis AI 11/4 放出的新基准… (opens in a new tab)
Useful benchmark. Chained requirements on the agent's own code: 18.5% top completion, and half of failed steps claimed done. Self-report is not verification. Law 4.
why 6.6
New multi-step benchmark: top model finishes only 18.5%, and half of failed runs claim success; measured failure mode.
relevance 7/10 · novelty 6/10
Score 6.0 out of 10
Introducing SpecSnap: a multi-session specification retention benchmark for coding agents. Standard coding benchmarks… (opens in a new tab)
Right question. It tests whether specs survive session resets, which is really a test of what the harness replays. Results not shown in the snippet. Law 1.
why 6.0
Benchmark for spec retention across session resets; isolates context-reset failure in coding agents.
relevance 6/10 · novelty 6/10
Score 6.0 out of 10
We've made it easier to get your repo running in Claude Code cloud sessions on Pro, Max, and Ultra. (opens in a new tab)
Useful setup fix: cloud sessions now infer and persist a repo's dependencies, network access and keys. The claim that Claude never sees the keys is unexplained and unverified.
why 6.0
Claude Code cloud sessions now auto-detect repo environment needs and persist them; a concrete harness setup change, but only a short announcement.
relevance 6/10 · novelty 6/10
Score 5.6 out of 10
Long tasks shouldn't block the chat (opens in a new tab)
Sound pattern, no data. Moving long tasks off the chat loop is a harness scheduling choice. This is a vendor framing post, not a measurement.
alsolangchain.com (opens in a new tab)
why 5.6
LangChain post on async long-running agent tasks; a harness design pattern, though no data shown.
relevance 6/10 · novelty 5/10
Score 5.6 out of 10
Google Described Its Agent Sandbox. I Built One with Firecracker and Measured It (opens in a new tab)
Good. A Firecracker microVM sandbox, built and measured. Isolation is a property of the tool boundary, and here it has numbers attached. Law 3.
why 5.6
Builds an agent sandbox on Firecracker microVMs and measures it; concrete isolation mechanism with numbers.
relevance 6/10 · novelty 5/10
Score 5.6 out of 10
「同じトークン量で15倍」というGitHub issueの数字、これは自分が測ったものじゃない。他ユーザーの報告。 (opens in a new tab)
Small but honest. It checks a second-hand 15x token claim on the author's own Codex CLI and says what it could and could not confirm. The method: only measurement knows.
alsonote.com (opens in a new tab)
why 5.6
Checks a GitHub-reported 15x token claim in Codex CLI; measurement-minded, though second-hand.
relevance 6/10 · novelty 5/10
Score 5.6 out of 10
OpenCode Browse routes the agent through an MCP server into a background tab, then Playwright drives your real browser… (opens in a new tab)
Real risk, flagged plainly. Driving your logged-in browser via MCP gives the agent your sessions, and allowlists do not stop injection on pages you allowed. Law 3.
why 5.6
Browser tool via MCP with Playwright on real logins; notes allowlists don't block injection on allowed pages.
relevance 6/10 · novelty 5/10
Score 5.2 out of 10
Does your coding agent keep a receipt of what it did? In our Codewhale test, /receipts listed every file and command… (opens in a new tab)
Minor but concrete. An action log matched reality across two versions. Audit trails matter only if someone reads them. One test is an anecdote.
why 5.2
Tests a receipts feature logging file and command actions across two versions; a concrete harness audit trail, though anecdotal.
relevance 6/10 · novelty 4/10
Nothing of this kind on this day.
Score 7.6 out of 10
Claude Code 2.1.319 (opens in a new tab)
Worth reading. denyInsteadOfPrompting turns a blocking permission prompt into a denial the loop continues past, and MCP tasks now run in the background. Both change the tool loop.
why 7.6
Changelog adds permissions.denyInsteadOfPrompting and MCP task backgrounding, changing the permission and tool loop.
relevance 8/10 · novelty 7/10
Score 7.0 out of 10
HF trained one small LoRA per agent harness (pi, opencode, hermes) with RL, inside the harness, no forks. safeagents… (opens in a new tab)
Interesting if it holds up. It is a tweet summary of per-harness RL LoRAs with a filter that zeroes reward-hacking tool calls. Same base model, different harness, different agent (Law 3).
why 7.0
Per-harness RL-trained LoRAs with a tool-call filter cutting reward hacking; concrete harness-level result, though only a tweet summary.
relevance 7/10 · novelty 7/10
Score 6.6 out of 10
GitHub Copilot CLI 1.0.107 (opens in a new tab)
Worth a skim for the permission fixes. Sandboxed extension processes shrink the tool surface, and autopilot no longer acting on review-only requests closes a real overreach. Law 3.
why 6.6
Changelog adds a sandbox setting for extension processes and fixes autopilot overreaching after review-only requests; the loop and permission changes are visible.
relevance 7/10 · novelty 6/10
Score 6.0 out of 10
costwise-mcp is a local MCP server that keeps coding-agent windows from filling up with whole files and logs. The tool… (opens in a new tab)
A sensible pattern with no numbers. It parks big blobs on disk behind short handles and recalls only matching slices, so whole logs stay out of the window (Law 2).
why 6.0
Local MCP server parking large tool outputs behind handles to save context; concrete context-handling technique, though no measured results shown.
relevance 6/10 · novelty 6/10
Score 6.0 out of 10
The components of agent memory (opens in a new tab)
Read for the mechanism, if the post gives one. Memory here is a harness deciding what to write down and replay; "dreaming" is a step that reorganizes those notes (Law 1).
why 6.0
Anthropic on agent memory components; mechanism for memory management in agents, though details from snippet are thin.
relevance 6/10 · novelty 6/10
Score 6.0 out of 10
Hard Issue, Weak Model, or Bad Run? Rethinking Failure Prediction for Coding Agents (opens in a new tab)
Useful negative result. Trajectory failure predictors mostly learn issue difficulty and model strength, not run state. Check this before building stop-and-retry logic on them.
why 6.0
Shows trajectory failure predictors mostly learn issue difficulty, not run state; measured failure mode for coding agents.
relevance 6/10 · novelty 6/10
Score 5.6 out of 10
Benchmarks as Software: Terminal-Bench and the Case for Continuous Benchmarks (opens in a new tab)
Solid point on eval rot. Verifiers that reject valid new solutions, plus infrastructure drift, quietly corrupt agent scores. A check rots when what it checks changes underneath it.
why 5.6
Terminal-Bench maintenance debt; evaluation infrastructure issues affect coding agent benchmark validity.
relevance 6/10 · novelty 5/10
Nothing of this kind on this day.
Score 8.0 out of 10
Joel Niklaus burned $4,746 of inference and ran 28,849 trials this week to answer one question: which coding agent… (opens in a new tab)
Worth reading. Same model, nine harnesses, 28,849 trials isolates the harness as the variable. Law 3 measured. Check the variance across runs before trusting rankings.
why 8.0
Measured comparison of nine coding agent harnesses on the same model; directly on-topic.
relevance 8/10 · novelty 8/10
Score 6.0 out of 10
Claude Code sends your email address to websites (opens in a new tab)
Real exposure report, but it is one GitHub issue with no snippet. Read it for what the fetch tool sends outbound, not for a confirmed root cause.
why 6.0
Claude Code leaking user email to websites is a concrete permission and data-exposure failure in the harness.
relevance 6/10 · novelty 6/10
Score 6.0 out of 10
Show HN: Stroq – a local audit of what your coding agent did and why (opens in a new tab)
Local audit log of agent actions and stated reasons. Useful if it records effects, not just narration; an agent explaining itself is not an independent check.
why 6.0
Local audit log of what a coding agent did and why; tool-call tracing is a visible harness feature.
relevance 6/10 · novelty 6/10
Score 6.0 out of 10
Inside GitHub’s new Git storage architecture (opens in a new tab)
Infrastructure, not harness. 5,000 concurrent agents and 7,200 pushes per second are internal vendor tests. Relevant only if you run agent swarms against one repo.
why 6.0
GitHub Git storage design targeting thousands of concurrent agents; infrastructure detail with a measured load claim.
relevance 6/10 · novelty 6/10
Score 6.0 out of 10
EPISTEME: Trustworthy Coding Agents Through Tool Call Intent (opens in a new tab)
Solid idea: harness forces declared intent per tool call, then compares it to recorded effects. The effect record is the independent part; the declaration is not. Law 4.
why 6.0
Harness records and checks declared intent against tool-call effects; a concrete permission and audit mechanism.
relevance 6/10 · novelty 6/10
Nothing of this kind on this day.
Score 7.2 out of 10
Told to reboot a server, it destroyed systemd, destroyed containers, ran random (opens in a new tab)
Worth reading as a permissions lesson: a reboot request should not reach systemd or containers. Scope the tool list and gate destructive commands. One issue report, so it is an anecdote. Law 3.
why 7.2
Codex issue reporting destructive actions after a reboot request; a concrete agent failure mode with tool permissions implicated.
relevance 8/10 · novelty 6/10
Score 7.0 out of 10
The model cannot inspect a ZIP it has not opened. In a new study, coding agents crossed a disk limit during the… (opens in a new tab)
Useful failure mode: the extraction tool call blew the disk limit before the model saw any content. Put quotas and limits on the extractor, not in the prompt. Study details are unverified.
why 7.0
Study shows coding agents hit disk limits during archive extraction before reading content; a concrete failure mode.
relevance 7/10 · novelty 7/10
Score 6.0 out of 10
Antigravity App v2.29.0: Jupyter notebook viewer, redesigned Automations, voice mode, and remote agents (opens in a new tab)
Worth a look for one line: remote agents move the loop off your machine into a cloud project. Voice, notebooks and Automations are UI. Sandbox and tool access are unstated.
alsoantigravity.google (opens in a new tab)
why 6.0
Changelog adds remote cloud agent execution, which changes where the agent loop runs; the headline is mostly UI features, so the mechanism is only partly visible.
relevance 6/10 · novelty 6/10
Score 5.6 out of 10
My least favorite phrase in AI security right now is "out of scope." Agents still install the archived Puppeteer MCP… (opens in a new tab)
Fair point: agents recall an archived MCP server from training data, and that server has a known injection-to-RCE path. Blocking it at a hook is a check the model cannot argue with. Law 4.
why 5.6
Concrete security failure: agents install archived MCP server with injection-to-RCE; proposes hook-based blocking.
relevance 6/10 · novelty 5/10
Nothing of this kind on this day.
Score 8.6 out of 10
Postman is modifying people's coding agents without asking. (opens in a new tab)
Worth reading. A third-party tool editing your hooks and configs means your agent's tools and checks are no longer yours. Audit your harness config files. Law 3.
why 8.6
Postman silently installs plugins and edits hooks and configs in Claude Code and Codex; a permissions and harness-config disclosure that matters to practitioners.
relevance 9/10 · novelty 8/10
Score 8.0 out of 10
Claude Platform release notes: message threads in beta (opens in a new tab)
Worth reading. Server-held threads move history replay from your harness to the API, cutting request size. Memory is still replay, just theirs, with a 5-minute expiry to plan around. Law 1.
why 8.0
Server-held message threads change how agent loops send context and cache state, with stated expiry rules; a real harness-relevant API change.
relevance 8/10 · novelty 8/10
Score 7.6 out of 10
Do Coding Agents Follow AGENTS.md? The Effect of Policy Wording on Instruction Compliance (opens in a new tab)
Useful. Measured compliance across four harness-model pairs beats folklore about AGENTS.md phrasing. Check whether effects survive repeated runs. Law 5.
why 7.6
Controlled test of AGENTS.md policy wording across four harness-model pairs; measured instruction compliance effect.
relevance 8/10 · novelty 7/10
Score 6.6 out of 10
Claude Code 2.1.318 (opens in a new tab)
Minor but useful release. Per-fork effort lets cheap side jobs run cheaper; auth-expiry fields help headless runs fail loudly. Cloud sessions without a repo is the notable change.
why 6.6
Claude Code release adds mods/effort options, session fork effort, runner hooks; concrete harness features, mostly minor though.
relevance 7/10 · novelty 6/10
Score 6.6 out of 10
An update on building games with Claude Code: (opens in a new tab)
Concrete prompt-layer failure: one system rule caused over-refusal on game projects and was revised. A reminder that harness prompts change behavior as much as models do.
why 6.6
Claude Code prompt rule for Opus 5.5 caused over-refusal on game projects, then was revised; a concrete prompt-layer failure and fix.
relevance 7/10 · novelty 6/10
Score 6.6 out of 10
A Gated Spec-Driven Workflow: An Audit-Trail Study of Coding-Agent Work (opens in a new tab)
Decent audit-trail study, but the gates are self-enforced by the same model doing the work, so they are weak checks. Law 4.
why 6.6
Audit-trail study of a gated spec-driven Claude Code workflow; concrete harness controls, though self-enforced by the same model.
relevance 7/10 · novelty 6/10
Score 6.0 out of 10
Service Accounts (opens in a new tab)
Real permission-model change. Workspace-owned agent identity with its own credentials, but anyone in the workspace can drive those threads, so scope its keys tightly.
why 6.0
Shared service accounts with own API keys and multiplayer threads; permission model change for agent access.
relevance 6/10 · novelty 6/10
Score 6.0 out of 10
Silent Instrument Errors Reorder Agent Leaderboards (opens in a new tab)
Important for anyone trusting leaderboards. Grader errors silently reorder rankings, so the instrument needs checking too. Airline benchmark, but the lesson carries over. Law 4.
why 6.0
Grading failures silently reorder agent leaderboards; a measured evaluation-harness failure mode, though airline benchmark.
relevance 6/10 · novelty 6/10
Score 5.6 out of 10
Running 17 Claude Code bots in a real company for $100/month (opens in a new tab)
Cost anecdote from one company. The title says 17 bots, the URL says 10. Useful only if it breaks down tokens per task, not just a monthly total.
why 5.6
Running 17 Claude Code bots in production with monthly cost figures; concrete cost data, though depth is unclear.
relevance 6/10 · novelty 5/10
Score 5.6 out of 10
British fintech Revolut slashes AI coding costs 10x by going self-hosted (opens in a new tab)
Vendor-adjacent cost claim, light on mechanism. A 10x saving means little without task quality compared before and after. Only measurement knows.
why 5.6
Revolut moving coding agent workloads self-hosted to cut costs 10x; cost-focused harness and model change, light on mechanism.
relevance 6/10 · novelty 5/10
Score 5.6 out of 10
Your coding agent changed the code. What did it actually do? (opens in a new tab)
Local transcript replay for Claude Code and Codex. Small tool, but inspecting what the agent actually ran is the right habit. The transcript is the agent's whole memory. Law 1.
why 5.6
Local replay of agent transcripts for Claude Code and Codex; a concrete tool for inspecting agent edits.
relevance 6/10 · novelty 5/10
Score 5.6 out of 10
From Watching to Steering: Enabling Human-Coding Agent Collaboration through Execution Traces (opens in a new tab)
Research prototype for steering agents mid-run through execution traces on OpenCode. Interesting loop design; check whether it measured outcomes or just usability.
why 5.6
Vibetrace visualizes and intervenes in coding agent execution traces on OpenCode; concrete tooling for steering loops.
relevance 6/10 · novelty 5/10
Nothing of this kind on this day.
Score 8.0 out of 10
Claude Code 2.1.317 (opens in a new tab)
Worth reading for onFailure: "block": a failing hook now stops the action instead of passing silently. A broken check that fails open was no check at all. Law 4.
why 8.0
Changelog adds an auto-mode subagent check gap notice, a block-on-failure hook option, and a nested session change; harness-level mechanics, new this week.
relevance 8/10 · novelty 8/10
Score 7.0 out of 10
Do Agents Still Follow the Rules? Benchmarking Rule Compliance under Agent Context Compaction (opens in a new tab)
Worth reading. Compaction is lossy replay, and this measures rule loss inside a real harness loop, not in isolation. Pin rules outside the compacted region. Law 1.
why 7.0
Measures rule compliance after context compaction inside a full agent harness; isolates a context failure mode.
relevance 7/10 · novelty 7/10
Score 7.0 out of 10
When Neither Side Confirms: Destructive Tool Approval Across MCP Servers and Hosts (opens in a new tab)
Strong. An estimated 90% of sampled destructive MCP tools lack an approval signal; server and host each assume the other confirms. Audit your host's prompt policy.
why 7.0
Measures MCP destructive-tool approval gaps in source code; permission model finding with concrete numbers.
relevance 7/10 · novelty 7/10
Score 6.0 out of 10
VeriHarm-Bench: Measuring Harmful Success in LLM Coding Agents Verifiably (opens in a new tab)
Useful. Task success hides collateral damage from shell access. A benchmark that verifies harm separately from the goal check is the right shape. Law 4.
why 6.0
Measures harmful side effects of coding agents with shell access; a measured failure mode.
relevance 6/10 · novelty 6/10
Score 6.0 out of 10
MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study (opens in a new tab)
Solid. Tool descriptions and responses enter context unvalidated; this confirms real execution across frameworks, not just model compliance. Every MCP server you add is untrusted text.
why 6.0
Cross-framework measurement of MCP tool poisoning with real execution; measured failure mode in agent harnesses.
relevance 6/10 · novelty 6/10
Score 6.0 out of 10
Optimize the Harness, Not the Model: Fitting a Minimal Agent to a Self-Hostable LLM for Investigative Analysis (opens in a new tab)
Good method. Admit a tool or loop component only if it measurably improves accuracy on expert-validated data. Same model, different harness, different agent. Law 3.
why 6.0
Fits minimal agent harness components to a self-hosted model; shows which loop parts matter.
relevance 6/10 · novelty 6/10
Score 6.0 out of 10
Harvesting SWE Benchmarks from Wild Vibe Coding Sessions (opens in a new tab)
Practical. Turning your own agent session logs into executable tasks gives you evals on your repo instead of public benchmarks. The hard part is untangling evolving requirements.
why 6.0
Builds SWE benchmarks from vibe-coding session logs; a concrete eval technique for coding agents.
relevance 6/10 · novelty 6/10
Nothing of this kind on this day.
The weekly digest by email
Once a week, the items that mattered most, with a longer take on each. One email a week.
Confirmation opens in a new tab. Every email has an unsubscribe link.