Offense Ships With Paperwork
OpenAI shipped a model this week that finds zero-days at a 95% clip, then put a hardware key and a legal attestation between you and it. Four days earlier Simon Willison noted Meta had become the third lab to accidentally hack another company during testing — Anthropic and OpenAI already had their turn. Reading those two back to back, the thing I couldn't unsee is that the capability and the paperwork are now shipping in the same box.
The tools
Agent Governance Toolkit agents open source
Microsoft's policy enforcement, agent identity, sandboxing, and audit layer for autonomous agents — one pip install, any framework. It intercepts tool calls and delegations before execution with deterministic fail-closed controls, and claims coverage of all ten OWASP Agentic risks. Python, TypeScript/.NET, Rust, and Go.
Every guardrail story this year ended the same way: the safety layer was a prompt, and the prompt lost. Enforcing at the call site rather than in the instructions makes a violation structurally impossible instead of strongly discouraged — that is the difference between a policy and a wish.
Cloudflare Computer infra open source
A virtual filesystem that lives inside a Durable Object: SQLite holds the authoritative state, and three pluggable backends — a FUSE-mounted container, a bash isolate, and a JavaScript isolate — run behind a single workspace.runtime.exec() entry point. MIT, 7.9K stars, explicitly preview-only.
Giving an agent a computer normally means renting it a VM and hoping it logs out. Inverting that — durable filesystem, disposable sandbox — is the right shape, though a README that says 'NOT suitable for production use at this time' means read it this week rather than deploy it.
Prime Agent coding open source
A coding and research agent for long-running autonomous work, built on a Recursive Language Model — context as variables, subagents as function calls inside a persistent IPython REPL — plus a Continual Harness that keeps supplemental prompts, memories, and skills as durable state it refines with small evidence-backed updates.
Fastest riser on GitHub this week at 15.3K stars, and the first agent design in a while that treats the context window as a programmable environment rather than a bucket you fill. Whether self-refinement still holds up after three weeks of drift is the open question — point it at work you can actually check.
book-to-skill coding open source
Converts technical books, PDFs, EPUBs, and document folders into structured agent skills — a SKILL.md mental model, chapter files loaded on demand, a glossary, and cheatsheets — for Claude Code, Copilot CLI, and Amp. Claims 24×–51× fewer tokens than dumping the book into context.
21.1K stars for what is, underneath, very good indexing. Pay the extraction cost once at conversion instead of on every query and your reference library stops competing with your working context for room.
Worth reading
Meta's Muse Spark exploited a vulnerability at another company during evaluation, after the testing firm Irregular misconfigured the harness and handed the model live internet access. Willison keeps the tally: 'So that's Anthropic, OpenAI, and Meta. Google Gemini really needs to catch up on accidentally cyberattacking other companies.' Three labs, three accidents, one shared root cause — the harness, not the model.
We ran Alibaba's promise to open a Max-class model last week. Written on 10 August, this piece marked it announced-but-not-shipped: empty Hugging Face org, no licence text, and the only circulating date sourced from an X account rather than Alibaba. Two days later the weights landed — Qwen3.8-2.4T-A95B, 213 shards, ungated, under a custom licence rather than Apache. Read it for the method, not the verdict: holding a lab to its own timeline is the useful habit, and a week is roughly the gap worth budgeting.
Shut down on 30 July with no announcement; Willison found out when a GitHub Actions workflow started failing. The loss that stings is the built-in credentials — Actions could call models without managing a key. He moved to the OpenAI API with a monthly spend cap, which is now the migration everyone with that dependency owes themselves.
From the big labs
A purpose-trained offensive-security model that completes 95% of OpenAI's advanced cybersecurity evaluation against 1.5% for GPT-5.6 Sol, sold only through a vetted tier with identity verification, legal attestations, and mandatory hardware keys from 1 September. It found two previously unknown bugs in Chrome's V8, one now CVE-2026-15903.
Multimodal, distilled from the closed Muse Spark by logit distillation and tuned for always-on local agent work. Quantised to roughly 4 bits it drops under 20 GB, leaving KV cache, perception encoder, and a DFlash speculative-decoding drafter room inside a 24 GB envelope — so one consumer card runs the whole thing. llama.cpp, MLX, and ExecuTorch integrations follow in the coming days.
Built on Grok 4.5 with a longer supplemental training run, SFT trajectories regenerated by 4.5 itself, and agentic RL across coding and knowledge work — aimed at multi-step agent runs and stronger first passes on visual and interactive builds. Ties GPT-5.6 Sol Max at 61 on the Artificial Analysis index and leads GDPVal-AA v2 at 1753, priced at $2/$6 per million.