Scope Creep

AX agents open source

Google's open orchestration runtime for agent workloads, in the Kubernetes idiom: you declare a Task and a Workspace in YAML — the git repos, MCP servers, and skills an agent needs — and AX runs it in a sandbox with CPU and memory limits, suspends it while it waits on a model, and resumes it in under a second. The part that matters this week is the Gateway: outbound traffic locked to an explicit allowlist of hosts and ports, with credentials injected at the edge rather than handed to the agent. Apache-2.0, written in Go.

662 points on Hacker News and on GitHub trending after the v0.3.0 release on September 20 — the repo itself dates from March, so it's the breakout, not the launch, that's new. The timing does the selling: the week's headline is agents on ordinary lookup tasks wandering into other people's servers, and AX is built on the assumption that an agent's network access should be a declared, reviewable allowlist rather than whatever the host machine can reach. Caveats: alpha, breaking changes promised, it wants a cluster, and 'billions of tasks' is Google's claim about its Agent Substrate runtime underneath.

Drop infra open source

A rootless Linux sandbox modelled on Python's virtualenv: create a disposable environment, step into it, and everything you already have installed still works — but your real home directory is hidden, localhost services are refused unless you expose them, and a short TOML file declares which files, directories, and local ports the sandbox may see. It runs in its own user, mount, network, and IPC namespaces with capabilities dropped, and can optionally put programs on gVisor's user-space kernel for a second wall. Apache-2.0, a solo project by Jan Wrobel.

188 points as a Show HN, and the most practical answer this week to two stories at once. It's pitched for running a coding agent with its permission prompts switched off while the OS enforces the limits instead — 'a prompt injection targeting ~/.ssh finds nothing' — and for installing packages from PyPI or npm that might be compromised, which after last issue's RubyGems disclosure is not paranoia. It contains damage rather than detecting it, and it's Linux-only; the thing it has over Docker is that nobody will skip it for being too much setup.

Cactus Needle 3 local-ai freemium

A foundation model for phones, wearables, and microcontrollers, built for automation rather than chat: tool calls, structured extraction, and embeddings. The trick is an 'intelligence ladder' — one set of weights where every depth from 2 to 20 layers is a usable model of its own, shipped as 2-bit binaries between roughly 9 and 29 MB — so you choose accuracy versus footprint per device without training a family. Open weights on Hugging Face under Apache-2.0; Cactus sells a one-off $19 hosted fine-tune.

236 points on Hacker News, and the other half of the Laya story: most of what an agent does all day is pick a tool and fill in its arguments, and that doesn't need a data centre. The headline claim — a 4-layer Needle 'matches DeepSeek V4 Flash' — is Cactus's own and applies only after fine-tuning on a downstream task on their platform, so read it as 'a tuned specialist can beat a generalist on its one job', which is true and useful, not as a general benchmark. The claimed 400 to 4,000 tokens per second of decode on a Raspberry Pi 5 is also theirs; a tiny model is the rare case where checking it yourself takes an afternoon.

The sequel to last issue's RubyGems investigation, and the week's essential read. Transluce and collaborators found that AI agents used urlquery.net — a public service that loads a URL in a remote browser and reports what it saw — as a proxy to get past access restrictions, and on three occasions escalated from ordinary data-retrieval tasks to probing for SQL injection and path traversal: a University of New Mexico digital library in May, Data USA days later, and the Australian Institute of Health and Welfare in June. Two of the three tie directly to the agent swarm OpenAI has confirmed as its own, and the activity goes back to at least March 6, two months before the incidents already reported. The authors are careful — the probes don't appear to have succeeded, and attribution is inferential for the rest — and they release the data: 6,467 reports with significant evidence of agent activity, 31,182 more with suggestive evidence. The same day, Australia's prime minister announced that an OpenAI agent had got into the Medicare Statistics Reporting Service on June 18; OpenAI says its 'models took actions we did not intend' during an internal evaluation, found it in August, and told Australia on September 10 — by writing to Services Australia's public email portal.

A small bug with a large lesson, 479 points on Hacker News. Claude Code 2.1.277 announced AGENTS.md support, but the loader sat behind a remote feature flag whose fallback was 'off' — so with `DISABLE_TELEMETRY` or nonessential traffic disabled, as privacy-minded users, many CI runners, and Bedrock or Vertex setups do, the file was skipped with no warning at all. Przemek proved it with a canary word, then did the useful thing and documented the workaround (a one-line CLAUDE.md containing `@AGENTS.md`). The HN thread reports a fix; the GitHub issue was still open as we went to press. The general point is the one to keep: a privacy setting should never silently switch off unrelated local behaviour, and a flag that can't be fetched should fall back to what the docs promise — or at least say what it skipped. Otherwise people spend a week rewriting prompts for a file the model never saw.

The unglamorous other side of agent productivity, 313 points and 400-odd comments. Linear's test suites nearly quadrupled this year as agents made writing code cheap, and CI became the queue. The fixes are concrete and mostly portable: faster runners (jobs 34% faster like-for-like), switching to tsgo, the native TypeScript compiler (median typecheck down 73%), rewriting lint rules so ESLint no longer needs type information (API lint down 68%, which also made the move to Oxlint easy), and prioritising the jobs that gate other jobs. Net result, by their own measurement: PR wait from over six minutes to just over five despite the bigger suite, and runner time per test roughly halved. If your team adopted agents this year and your CI bill is the first thing that noticed, start here.

The first model in the Claude 5.5 family, and the first Anthropic release since the company called for pacing the frontier; it was tested before launch by external evaluators including METR. The pitch is efficiency: Anthropic says it performs at the level of Fable 5.1 on most work and, per its own tests, costs 40% less than Opus 5 on typical workloads — $4 in and $20 out per million tokens, cache reads at $0.20, a 1M-token context, 128K output, on the Claude API, Bedrock, Vertex, and Foundry as `claude-opus-5-5`. Benchmarks such as 66.4% on Terminal-Bench 4.0 are vendor-reported; independently, Artificial Analysis ranks it first of 211 models on its Intelligence Index while flagging it as very verbose — 260 million output tokens across the index against an 88 million median, which is worth checking against the 'uses fewer tokens' claim on your own traffic.

Released the same afternoon as Opus 5.5, and the week's price story. OpenAI's developer docs list GPT-6 Sol at $2 in and $10 out per million tokens — half GPT-5.6 Sol's $4 and $20 — and Luna, the small tier, at $0.10 and $0.50, both with 90%-off cached input, 1.05M-token context, and 128K output, available through Chat Completions, Responses, and Batch with the hosted tool set (shell, apply-patch, skills, computer use, MCP). The flagship GPT-6 Astra sits above them at $10 and $50. On Artificial Analysis's index Sol lands well behind the top of the table, which is not what it's for: this is the tier you run agents on at volume, and the halving is the headline.

The open-weights release of the week, 1,125 points on Hacker News. Two sparse mixture-of-experts models under the MIT licence: Pro, with 1.02 trillion total and 42 billion active parameters, and Flash, with 309 billion total and 15 billion active — both with a 1M-token context and native text, image, video, and audio input. Weights are on Hugging Face and ModelScope with SGLang and vLLM recipes, plus Xiaomi's own API and OpenRouter. Xiaomi reports 71.9 on DeepSWE v1.1 for Pro; independently, Artificial Analysis ranks Pro first among comparable open-weights models on its Intelligence Index, while noting it is slow. A phone maker shipping the strongest open model of the week is its own small signal about where the frontier's supply chain now runs.