Daily · Aug 18, 2026 · 5 min read
Deno's Claw Patrol treats agents as untrusted software, and full history beats compaction
Plus: 6 papers, 2 talks, a 56,000-line Fortran migration. 5 min.
Curated and summarized by an agent pipeline built by Yadnesh; reviewed before send. How this is made →
The lead
talk · Story page
Ryan Dahl showed Claw Patrol, an MIT-licensed proxy Deno puts in front of incident-response agents that read and write production Postgres, Kubernetes, ClickHouse, AWS, GitHub and Slack. It treats the agent as untrusted software and parses every byte leaving it.
- The details:
- It works below HTTP, so an agent that spawns psql and tunnels to a database through an EKS endpoint hits the same rules as an API call; no MCP definition or HTTP filter sees that path. Rules live in HCL, in git, unit tested against fixture requests; Deno's own file runs about a thousand lines. Credentials stay in the proxy, never in the agent.
- Yes, but:
- This is one company's design shown in a talk, not a measured defense. Everything rests on the policy file being complete, and a thousand lines of HCL is a thousand places to leave a gap; the excerpt reports no measurement of what the rules miss.
- Why it matters:
- If your agents hold production credentials and your defense is the model refusing, you now have a runnable proxy and a layout to copy: secrets and enforcement move into a process the agent can't reach, and the rules become tested code.
- Deno created Claw Patrol, software that checks what action-taking artificial intelligence sends outside itself.
- It sits outside the artificial intelligence and examines outgoing data, including database connections that bypass normal web traffic.
- It keeps passwords and access keys hidden, so the artificial intelligence never receives them.
- Written rules decide which outgoing requests are allowed.
- Teams can enforce limits outside artificial intelligence that has access to live databases and company services.
Research & Papers
05
talk · Story page
Across 11 context presets on an open-source AI tutor, sending the full history beat every compaction technique on recall, cost and latency, because 97% of tokens came from cache and rewriting the context invalidates it. Full history recovered specific details 95% of the time against 32% after summarizing.
- A test of 11 setups found that keeping complete conversations beat every tested shortening method on memory, cost, and response speed.
- Previously processed conversation text can be reused, making repeated text much cheaper to handle.
- Rewriting conversations as summaries prevents that reuse, so shortening must be very large before it saves money.
- Keeping full conversations recovered specific details 95% of the time, compared with 32% after summarizing.
- People building conversational artificial intelligence may save money and preserve details by keeping history, unless local memory limits prevent it.
paper · Story page
A preliminary study of LSP against grep at equal task success, on Python and TypeScript repos with Claude Opus 4.8, Sonnet 4.6 and Haiku 4.5. On symbol localization the LSP cost 6% to 118% more tokens and the agent ignored it when free; on reference completeness it bought precision, not savings.
- A preliminary study found code-analysis software usually processed more text than basic search while completing the same task.
- Basic search finds matching words everywhere, including definitions, uses, and comments.
- Code-analysis software distinguishes those roles, but requires setup and separate lookups for each named item.
- That precision helped find complete references, but it did not reduce the text processed.
- Developers choosing search tools for code-writing artificial intelligence should not assume precision reduces the amount of text processed.
paper · Story page
A differential method pins a failed or costlier run on the skill it loaded by comparing it with a no-skill or matched-skill run of the same task. On SkillsBench and SWE-Skills-Bench that yields 307 skill-induced failures, 125 functional and 182 efficiency.
- A study found 307 cases where reusable instructions caused artificial intelligence to fail tasks or work less efficiently.
- Researchers compared each instructed run with the same task completed without those instructions or with a similar set.
- These side-by-side comparisons show what changed and whether the instructions caused failure or extra cost.
- SkillTriage organizes the differences into consistent reports supported by evidence from both runs.
- Teams adding reusable instructions can use this method to check whether they improve results or quietly increase costs.
paper · Story page
Train a policy against one LLM user simulator and it overfits that simulator's dominant mode, then transfers poorly to other simulators and real users. Verbalized Sampling lifts held-out success by up to 9%; co-training against a population of simulators reaches 14%.
- A study found that training with one simulated user made artificial intelligence perform poorly with other simulators and real people.
- The artificial intelligence learned narrow tactics that worked mainly against the simulated user's most common behavior.
- Verbalized Sampling makes the simulated user produce a wider range of responses instead of its usual pattern.
- Co-Training practices against several changing simulators, preventing the system from adapting to only one.
- Teams training human-facing artificial intelligence need varied simulated users to prepare behavior that works beyond one simulator.
paper · Story page
BENCH2ROBUST injects transient, persistent and silent tool failures into benchmarks that never fail, so retry, switch and stop become trainable choices. Across 7 models from 4 families the recovery gap is near universal; Bayesian Tool Memory adds up to 16.8 points without retraining.
- Researchers created controlled tests where tools can fail briefly, permanently, or without reporting an error.
- Each task forces action-taking artificial intelligence to retry, switch tools, or stop when no workable option remains.
- A memory system records tool reliability, helping the artificial intelligence choose whether to retry, switch, or stop.
- Guided practice separately teaches recovery behavior that remains useful when the memory system is absent.
- This gives teams a way to prepare action-taking artificial intelligence for failures that ordinary tests leave out.
Engineering & Harnesses
03
blog post · Story page
Google's guide for ADK agents that mutate production state names three infrastructure boundaries in place of system prompts: hardware-backed cryptographic signatures on database writes, gVisor kernel-level sandboxing for dynamic code, and deterministic semantic gateways that validate I/O.
- Google published a guide for securing artificial intelligence systems that can change live databases and run code.
- Each database change must carry a hardware-protected digital signature proving that an approved machine authorized it.
- New code runs inside gVisor, an isolated space designed to keep harmful programs away from the server.
- Fixed checking rules inspect information entering and leaving, instead of trusting written instructions to the system.
- These barriers aim to prevent hostile instructions from changing data or taking over servers.
A local-first runtime that separates what the model proposes from what the host authorizes and executes, with permissions, memory, replay, sub-agents and traces as explicit layers. The paper claims no formal safety guarantees; the point is an inspectable architecture.
- Researchers presented Agentao, software for controlling artificial intelligence systems that use tools and change information on a user's computer.
- The artificial intelligence system proposes an action, but the computer's controlling software decides whether to allow and perform it.
- Separate layers record permissions, stored information, repeated runs, added tools, delegated helpers, and communication with other systems.
- Its records let people inspect what happened and reproduce earlier actions.
- The design could help people oversee these systems, but the researchers do not claim it guarantees safety.
paper · Story page
Three prompt-specialized Claude Code roles, in isolated worktrees, converted 56,448 lines across twelve files and 225 subroutines of GAMESS from Fortran 77 to Fortran 2008, working from a spec the agents wrote and revised. Humans held a few gates; an exact domain oracle marked where safe delegation ends.
- Researchers used three specialized Claude Code setups to update scientific software from Fortran 77 to Fortran 2008.
- Fortran is a programming language, and the work moved old files into a newer version of that language.
- The setups followed a written plan they created and revised, while working in separate copies to avoid conflicts.
- People approved a few stages, while an exact scientific checker tested whether converted calculations stayed correct.
- The approach could help scientific teams update large old programs, while keeping people in charge where exact checking ends.
Hedge of the day
“Across human and mouse brain, heart, tonsil, colon, and prostate datasets, SpatialAgent outperformed established computational baselines and matched or surpassed expert scientists in key tasks.”
SpatialAgent: An autonomous AI agent for spatial biology (Semantic Scholar)
The key tasks are not named, and neither is which of them were matched rather than surpassed.
From X
01
Cursor says Origin, its code hosting platform, is live in beta from today: you sync repos from GitHub, and Vercel, Buildkite and Depot integrations are available already, with more promised.
- Cursor launched an early test version of Origin, its own service for storing and managing software projects.
- Users get started by connecting software projects stored on GitHub to Origin.
- Origin already connects with Vercel, Buildkite, and Depot, with more connections promised.
- Cursor says Origin is fast, easy to use, and closely connected with its coding product.
- Cursor users gain another place to store software projects while retaining connections to several existing services.
Quick links
- Rethinking Agent Security as a Networking Problem (Semantic Scholar)
- Step-up authentication for AI agents (WorkOS)
- The Sleeping Agent: What Gist-Based Context Compression Loses and Why (Semantic Scholar)
- Not All Tokens Are Equal: Inflation-Aware Routing for Agentic LLM Systems (arXiv)
- How to Kill the Code Review (Ankit Jain (Aviator))
Meme of the day
Drawn by an image model.
Corrections
Nothing to correct.
Related issues
Subscribe
Get the brief in your inbox
Pick daily, weekly, or both. Nothing is gated either way: every issue is on the site and in the feeds.
- Weekdays at 8:45am IST, one lead story and 6 to 9 items.
- Sundays, an argued synthesis rather than a recap.
- One click to leave, and quiet days say so in the subject line.