DailyWeights & Takes

26 Oct 2026 · the text your agent trusts

The last 24 hours, to 26 Oct 2026 09:17 ET

Edition 7 · 4 news · no model releases · 4 repos · 5 papers · 1 thing to try

At a glance

News 4

  1. The Hacker News

    A planted instruction file in Downloads hijacks Codex and Claude Code

    Coding agents read the instruction file in whatever folder they start in, and a web page can save a file to Downloads without a click. As reported by The Hacker News, Forever Security found such a file on a customer machine, disguised as engineering notes. It told Codex to register a server in ~/.codex/config.toml and install an npm package that fetches a Windows payload. In an isolated VM, Codex followed it in over 90% of attempts, and because that config is global, the server then loads in every folder. A CLAUDE.md variant asked Claude Code to set ANTHROPIC_BASE_URL in project settings, which sends API traffic and the login token to the attacker. Claude Code asks before that write and often refuses, but the long engineering-doc framing got approval about half the time. Forever's view is that there's nothing to patch: the agents did what the file said. Don't start an agent in Downloads, read instruction files you didn't write, and check both config files for servers or endpoints you didn't add.

    agents · securityreported

  2. The Washington Post

    Cathedral says its AI agents got inside Anthropic's internal systems in under 12 hours

    As reported by the Washington Post from a draft report, Cathedral, a months-old security firm founded by former DOGE staff, tested Anthropic under its program for outside researchers. Its agents got in through weaknesses in third-party business software and found paths to meeting transcripts, salary details and Slack discussions. Anthropic says the access covered "a limited set" of sales, HR and IT systems, and that customer prompts, Claude's responses, source code and model weights weren't reachable. It also says Cathedral didn't fully follow the program's rules. The way in was the SaaS around the company, not the model. Agents make that sprawl cheap to sweep, and that applies to your own vendors too.

    agents · securityreported

  3. SEC EDGAR

    Anthropic's S-1 registration statement is public

    The prospectus for Anthropic's planned IPO is now on the SEC's site, after a confidential filing in June. The Wall Street Journal reported these figures from the draft: $16.3B in revenue in the first half of 2026, against $1.1B a year earlier, about 20% of it from two customers, and roughly $450B in noncancelable cloud commitments over the next decade ($111B with Google Cloud, $110B with AWS, $31B with Microsoft). If you build on Claude's API, the risk-factor section is now the most candid account of what could change your price or your access. Those commitments also help explain why prices keep falling: that compute has to be sold.

    84 pts30 commentsIPO filing discussion

  4. Help Net Security

    Three in four enabled AI agents haven't run in 60 days, but they still have their access

    Arrakis Security looked at thousands of agents in its customers' production environments over 12 weeks. 76% of enabled agents hadn't run in 60 days, and 44% hadn't run in 180. About a quarter of the dormant ones could be started by an unsigned webhook, 19% used keys that never expire, and 70% connected to at least one sensitive integration. These are a security vendor's numbers about its own customers. Still, the pattern is familiar: agents get retired the way cron jobs do, which is never. Give every agent an owner and an expiry date for its credentials.

    agents · credentialsvendor report

GitHub repos 4

Three created in the window and one breakout with fresh releases. Four is all that cleared the bar: the rest of today's new repos are mostly game cheats and near-identical commerce bots.

  1. GitHub

    codician-team/diffinery

    Self-hosted git hosting, pull requests and Actions-compatible CI on your own Cloudflare account. Agents get their own accounts, and the server enforces the rules: an agent's PR needs a human approval, an agent's approval or check results don't count, and workflows on agent-pushed code get no secrets. It's young: HTTPS-only git, no forks, Linux x64 runners. Apache-2.0.

    32 ★new, created 25 Oct

  2. GitHub

    zhangshuibai/molten

    A single Rust and Metal binary that runs LiquidAI's LFM2.5-24B-A2B coding model (4-bit, 2B active) on Apple Silicon. On the author's M5 Max it decodes about 300 tok/s at 1K context and 119 at 128K, 1.3-1.5× llama.cpp. molten serve gives you an OpenAI-compatible API. M5-series Macs with 24 GB or more only. Apache-2.0.

    18 ★new, created 25 Octlocal inference

  3. GitHub

    heygen-com/hyperframes

    An agent writes HTML and HyperFrames renders it to video, so an agent can edit a video the way it edits code. Three releases landed today: retryable studio previews, smooth audio fades instead of clicks at cuts, and faster video decoding on Macs.

    ≈+1,080 ★ in windowwas ~313/day (breakout)

  4. GitHub

    boyuchengz/canvas-mcp

    A read-only MCP server for the Canvas LMS: 26 tools, all plain GETs, covering courses, due work, grades, files and announcements. It works as a custom connector in Claude, ChatGPT or Claude Code. The secret sits in the connector URL, so anyone with the URL can read your courses. Treat it like a password.

    115 ★new, created 25 OctMCP

Papers 5

From arXiv's 26 Oct listing and Hugging Face's daily papers for 26 Oct; submission dates shown.

  1. arXiv

    SWE-Shift: evaluating coding agents in evolving workspaces

    Real repositories change while an agent works: code, dependencies, requirements. This benchmark changes them mid-task and compares the result with an unchanged run from the same point. All 17 agent systems did worse. GPT-6 Astra fell from 67.35% to 24.79%. When the tools or session changed, or earlier evidence went stale, no system recovered in a single scenario. Code.

    coding agents · eval

  2. arXiv

    Benchmarks are surprisingly compaction-friendly

    The authors built five context-compaction strategies into OpenCode and ran three frontier models on long tasks. None beat the default of letting the model summarize itself. But the first compaction already dropped about a third of ProgramBench's anticheating rules, and more with each pass. In real sessions, instructions about how the agent should work and what it must not do were dropped about six times as often as the spec. Put the "don'ts" in a file or a permission, not only in the chat.

    agents · context

  3. arXiv

    Trial by Trace: benchmarking agent harnesses for reliability and failure attribution

    This scores the harness separately from the model: context, execution, governance, lifecycle, observability, tools and verification. Across 4 harnesses, 9 models and 3,420 runs, harness scores ranged from 59.8% to 72.0%. 31.1% of runs completed the task while failing at least one harness check. A pass rate can hide a harness that misbehaved on the way.

    harnesses · eval

  4. arXiv

    SpecMem: faster agentic tool calls with a live memory of past calls

    Users repeat themselves, so past tool calls make good drafts for speculative decoding. SpecMem keeps a per-user store of verified calls and updates it while serving. A store built once loses its hit rate over time; this one doesn't, and it gave up to 1.74× wall-clock speedups on three open-weight models. A gate holds back calls with declared side effects until they're verified, which is what stopped the irreversible mistakes.

    inference · tool use

  5. Hugging Face

    RSIHub: a composable framework for agent-evolution methods

    Methods that improve an agent's prompts, skills and tools from its own feedback (GEPA among them) each rebuild the same experiment machinery. RSIHub runs four of them on one shared base. With Codex and MiniSWE on Terminal Bench 2, the best gain was 13.5 points. The ranking of methods changed with the setting, though, and gains didn't always carry over to held-out tasks. Test any self-tuning on tasks it never saw.

    30 upvotesagents · open source

Things to try 1

Audit what your agent's tools print (paper submitted 23 Oct). William Jeffries found tools in a production research assistant that computed the right answer but printed it without its search limits, result caps or ID namespaces, and the agent passed the gaps on to users as fact. Rewording the output fixed most of it. In one test, verifiers went from accepting the wrong answers 90 times out of 90 to rejecting them 90 times out of 90. The paper's audit prompt, run with Codex and Claude Code, found the same problem in OpenClaw and Hermes. The OpenClaw fix has been merged.

First step: open docs/audit-prompt.md in the paper's repo and run it in a Claude Code or Codex session at the root of the project whose tools your agent calls. Start with the findings about counts and truncation.

The take

An agent's weakest point is the text it trusts: instruction files, tool output and its own summaries.

A planted AGENTS.md got Codex to install malware in over 90% of test runs. Compaction dropped a third of a task's anticheating rules on its first pass, and in real sessions the "don'ts" were lost six times as often as the spec. In SWE-Shift, every agent tested did worse when the workspace changed under it. Each time, the model did what the text said. So any rule that matters belongs in permissions, sandboxes and config the agent can't rewrite. Prediction: by 30 Nov, Codex will require explicit approval before an instruction file can add an MCP server to the global ~/.codex/config.toml.