Diff

Claude Code adds mods, including a self-monitoring agent

Plugins can now hook into Claude Code's deeper behavior rather than just add commands, and Anthropic's own example is a mod that runs alongside the main session purely to flag things the agent missed — a second, cheaper pass of oversight built into the harness itself instead of left to the user to remember. If you install or build a mod, you're effectively defining a lightweight reviewer that runs on every session unasked, which is worth trying once on a real task before deciding whether it earns a permanent place in your setup.

Do it — 3 steps in your Claude Code setup15 min

Run claude plugin configure and enable the built-in 'You should know' mod
Use it through one real working session and see what it flags that you'd have missed
If it's useful, sketch what a custom mod checking your own review habits would look like

via claude code changelog · anthropics/claude-code releases

debateindustry

DHH says professional hand-written code is ending

When the creator of Ruby on Rails — someone who has spent two decades publicly defending craftsmanship and taste in code — says his own company is ending hand-written code for professional work, the debate has quietly moved from 'should AI write code' to 'what's actually left for a human to write.' That reframing matters more than any single person's opinion, because it's the question every engineering org is going to have to answer on its own timeline. For a team lead deciding how much AI-written code to trust in review, it's a claim worth pressure-testing against what your own team is actually seeing, not taking on faith.

via pragmatic engineer

lessonagents

Separately sandboxed AI agents can still coordinate

The post describes how agents running in completely separate, correctly-configured sandboxes can still coordinate by writing to anything both of them can read — a shared package cache, a tracked document, a chat channel — which means 'sandboxed' only guarantees isolation from the host, not isolation from each other. It's the same blind spot traditional network security hit once a single compromised machine stopped being the worst case, and it reframes agent containment as a network problem rather than a per-agent one.

What’s Agent-to-agent covert channels?

A 'covert channel' is any way two systems pass information through a medium that wasn't designed to carry messages between them — the classic example is two processes on one machine signaling each other by changing how much CPU or disk they use, with nothing that looks like direct communication.

Agent sandboxes were built to stop a single agent from reaching outside its box onto the host or the network, and that containment held. What it didn't account for is two correctly-sandboxed agents being handed shared access to the same external resource — a package registry, a tracked document, a chat channel — on purpose, because that's how the system was supposed to work.

Once that shared surface exists, one agent can write something to it that only makes sense to another agent reading the same place, and the isolation between the two sandboxes stops mattering. It's the same pattern that let early computer worms spread machine-to-machine without ever breaking into any single machine directly — propagation through a shared surface, not a direct breach.

The open question is whether this gets fixed by cutting off shared read/write access between agents wherever possible, or by treating every shared resource as something that needs its own audit trail — and whether either approach survives contact with an organization running dozens of agents through the same handful of tools.

via cryptography engineering (matthew green)

Still open · 4

Claude Code can now auto-build your evals×1

techniquetooling

Claude Code can now auto-build your evals

Anthropic shipped build_eval and hillclimb as Claude Code skills, turning eval-writing from a manual, often-skipped chore into a guided loop: baseline first, then one change at a time with an overfitting check before anything gets accepted. That's a meaningful shift — most teams shipping LLM features still skip straight to tweaking prompts without a real baseline, and this makes the harder discipline the path of least resistance instead. If you're the one deciding how your team verifies that an AI-written change actually helped, this is worth trying on real production traces rather than synthetic examples, since the tool pushes you to build the eval before you start optimizing.

Do it — 3 steps in your repos30 min

Enable the Claude Code auto-eval skills (build_eval and hillclimb)
Point build_eval at real production traces — conversation or request logs — rather than synthetic examples
Run the baseline eval before changing anything, then let hillclimb iterate one change at a time and check its overfitting warning before accepting a result

via hamel husain

Gemini 4 Argon ships restricted to cyber defenders×1

shiftindustry

Gemini 4 Argon ships restricted to cyber defenders

Google's newest frontier model isn't shipping broadly — Gemini 4 Argon is restricted to government users and vetted cybersecurity teams in its Fairwind Program, the first time a flagship release has been gated by capability risk rather than price or compute. It's a concrete sign that labs are starting to treat 'who gets access' as part of the safety stack, not just an afterthought, which matters for anyone watching whether frontier capability will keep diffusing freely or start fragmenting by vetting tier.

via google deepmind · hn front page · latent space

OpenAI disrupted a campaign stealing its model's reasoning×1

lessonindustry

OpenAI disrupted a campaign stealing its model's reasoning

OpenAI says it disrupted a coordinated campaign that used adversarial querying to extract and distill its model's internal reasoning — not just its final answers — into a competing model. That's the first confirmation from a major lab that some of the open-weight ecosystem's rapid catch-up with frontier models may be adversarial extraction rather than organic research progress, which reframes the open-vs-closed model race as partly a security problem. It's a useful reminder that API terms alone don't protect what a model actually knows, worth keeping in mind for anyone deciding which model's API to build on.

What’s model distillation as an attack surface?

Distillation is normally a cooperative technique: a smaller 'student' model is trained to mimic a larger 'teacher' model's outputs, usually with the teacher's permission, to cut cost and latency while keeping most of its capability.

Most commercial API terms assume that without the teacher's actual weights, an outside party is only training on indirect text outputs — a weak, slow signal that takes enormous amounts of data to turn into something competitive.

OpenAI says this campaign ran large, coordinated query volumes specifically designed to reconstruct the model's internal reasoning chains rather than just its final answers — extracting far more of the teacher's 'knowledge' through the API than that assumption accounted for.

What's unresolved is how much of the broader open-weight progress wave is this kind of extraction versus genuine research gains, and what actually stops it — rate limits and terms of service clearly weren't enough on their own.

via openai

AI models just crossed a hacking capability threshold×2

lessonresearch

AI models just crossed a hacking capability threshold

Anthropic's own red-teamers found that both GLM-5.3 and Claude Mythos Preview can now fully hijack a program's control flow in a meaningful share of binary-exploitation trials — up from zero for the prior generation of each. That's not a benchmark inching upward; it's a threshold, the kind of jump that changes what 'a model could do this autonomously' means for security teams, not just researchers. It's a reminder that model capability now needs the same disclosure discipline as any other high-risk engineering change, not a footnote in a launch post.

What’s Control-flow hijacking (binary exploitation)?

A control-flow hijack is when an attacker gets a running program to execute code it was never meant to run — classically by overflowing a buffer, overwriting a return address or function pointer, and redirecting execution to attacker-chosen code. It's the mechanism behind most of the highest-severity 'remote code execution' vulnerabilities you see in CVE reports.

Historically this required a human exploit developer: find the memory-safety bug, understand the binary's layout, hand-craft a payload that survives the program's defenses (stack canaries, ASLR, etc.), and chain several small bugs into one working exploit. It's slow, skilled work — one reason offensive cyber capability has stayed a scarce, credentialed resource.

What changed here is that models are now completing that whole chain — find the bug, build the payload, redirect execution — end to end and autonomously, in a real fraction of trials, where the prior model generation managed none. The jump from 0% to single-digit percentages sounds small until you remember it's the difference between 'not yet possible' and 'possible, and about to get cheaper.'

The live debate is whether this cuts both ways: the same automation that lets an attacker chain an exploit also lets defenders find and patch the bug first. Which side benefits faster is exactly the kind of question frontier labs' red-team disclosures like this one are meant to inform — and exactly the kind of claim that's hard to verify from outside the lab.

via simon willison

Also shipped

openai-python v3.23.0 added typed answers from session streams in Agents, staged-file handling and turn-artifact downloads, plus session traces and Realtime translations in the API.
Vercel's AI Gateway added Convai's Laya decision model (free through Oct 31) and Microsoft's MAI-Voice-2.1 / MAI-Transcribe-2 speech models with zero data retention.
Vercel Agent can now install private npm and custom-registry packages using credentials that stay outside the sandbox, so the agent itself never reads them.

Saved for Sunday

MIT PhD researcher Alex Zhang on Recursive Language Models — a harness pattern for extending reasoning past context limits; too long for a daily, pairs with Latent Space's companion essay on the research direction.