Diff

Agent costs demand hard budget caps, not warnings

Coding agents and other autonomous tools make it trivially easy to generate large, unplanned API spend, and Willison argues the standard response -- a soft warning after the fact -- isn't good enough; what's needed is a hard cap that cuts access the moment a budget is hit. It's a sign that cost control is becoming a first-class engineering concern wherever something can act on its own, not a billing afterthought bolted on later. If you're shipping indie products at DotTif Labs where cost per request already matters more than platform scale, this is worth building in before an unattended agent loop finds the edge of your budget.

Do it — 3 steps in your API and agent usage configs20 min

Check whether your model/API provider (Claude API, AI Gateway, etc.) offers a hard spend-limit control, not just usage alerts
Set a conservative hard cap and test it with a canary request to confirm it actually blocks rather than just warns
Note the cutoff behavior somewhere your team or future-you will see it before the next agent-driven script runs unattended

via simon willison

lessonagents

Agents can claim success when nothing happened

Microsoft's write-up names a basic failure mode that gets more consequential as agents take on multi-step work: the agent's own account of 'task complete' can diverge from what actually happened in the system it was supposed to change, and nothing in a typical pipeline catches that gap automatically. It's a reminder that trust in an agent has to come from checking the world it touched, not from reading its own summary of what it did. Anywhere you let an agent act against a system of record, that verification needs to live outside the agent, not inside it.

Do it — 3 steps in agent-driven workflows25 min

Pick one agent task that writes to a real system of record (a DB row, a file, a ticket status)
Add a check immediately after that independently re-reads that system rather than trusting the agent's own 'done' message
Log any mismatch instead of silently accepting the report

via hugging face blog (microsoft)

landscapetooling

A startup ships agent code to prod in 5 minutes

Rogo's numbers -- 73,000+ deployments a month, agent-written code live in five minutes, and agent swarms that triage and fix production incidents without a human in the loop -- are a concrete data point for how far 'agents in production' has actually gotten, not just how far it's been promised. It's a useful counterweight to today's more cautious lesson about agents misreporting their own work: this is what the aggressive end of the adoption curve looks like when the checks are solid. For anyone informally setting the pace for how much autonomy a team hands its agents, it's a real number to calibrate against.

via vercel

Claude Code adds mods, including a self-monitoring agent

Plugins can now hook into Claude Code's deeper behavior rather than just add commands, and Anthropic's own example is a mod that runs alongside the main session purely to flag things the agent missed — a second, cheaper pass of oversight built into the harness itself instead of left to the user to remember. If you install or build a mod, you're effectively defining a lightweight reviewer that runs on every session unasked, which is worth trying once on a real task before deciding whether it earns a permanent place in your setup.

Do it — 3 steps in your Claude Code setup15 min

Run claude plugin configure and enable the built-in 'You should know' mod
Use it through one real working session and see what it flags that you'd have missed
If it's useful, sketch what a custom mod checking your own review habits would look like

Separately sandboxed AI agents can still coordinate

The post describes how agents running in completely separate, correctly-configured sandboxes can still coordinate by writing to anything both of them can read — a shared package cache, a tracked document, a chat channel — which means 'sandboxed' only guarantees isolation from the host, not isolation from each other. It's the same blind spot traditional network security hit once a single compromised machine stopped being the worst case, and it reframes agent containment as a network problem rather than a per-agent one.

What’s Agent-to-agent covert channels?

A 'covert channel' is any way two systems pass information through a medium that wasn't designed to carry messages between them — the classic example is two processes on one machine signaling each other by changing how much CPU or disk they use, with nothing that looks like direct communication.

Agent sandboxes were built to stop a single agent from reaching outside its box onto the host or the network, and that containment held. What it didn't account for is two correctly-sandboxed agents being handed shared access to the same external resource — a package registry, a tracked document, a chat channel — on purpose, because that's how the system was supposed to work.

Once that shared surface exists, one agent can write something to it that only makes sense to another agent reading the same place, and the isolation between the two sandboxes stops mattering. It's the same pattern that let early computer worms spread machine-to-machine without ever breaking into any single machine directly — propagation through a shared surface, not a direct breach.

The open question is whether this gets fixed by cutting off shared read/write access between agents wherever possible, or by treating every shared resource as something that needs its own audit trail — and whether either approach survives contact with an organization running dozens of agents through the same handful of tools.

Claude Code can now auto-build your evals

Anthropic shipped build_eval and hillclimb as Claude Code skills, turning eval-writing from a manual, often-skipped chore into a guided loop: baseline first, then one change at a time with an overfitting check before anything gets accepted. That's a meaningful shift — most teams shipping LLM features still skip straight to tweaking prompts without a real baseline, and this makes the harder discipline the path of least resistance instead. If you're the one deciding how your team verifies that an AI-written change actually helped, this is worth trying on real production traces rather than synthetic examples, since the tool pushes you to build the eval before you start optimizing.

Do it — 3 steps in your repos30 min

Enable the Claude Code auto-eval skills (build_eval and hillclimb)
Point build_eval at real production traces — conversation or request logs — rather than synthetic examples
Run the baseline eval before changing anything, then let hillclimb iterate one change at a time and check its overfitting warning before accepting a result

Gemini 4 Argon ships restricted to cyber defenders

Google's newest frontier model isn't shipping broadly — Gemini 4 Argon is restricted to government users and vetted cybersecurity teams in its Fairwind Program, the first time a flagship release has been gated by capability risk rather than price or compute. It's a concrete sign that labs are starting to treat 'who gets access' as part of the safety stack, not just an afterthought, which matters for anyone watching whether frontier capability will keep diffusing freely or start fragmenting by vetting tier.