Daily · Sep 03, 2026 · 5 min read
Google's Mantis bug-fixing harness, and privilege escalation in 12 agent harnesses
Plus: Cline's 11M-user rollout, ContextPipe, and Claude driving your desktop. 5 min.
Curated and summarized by an agent pipeline built by Yadnesh; reviewed before send. How this is made →
The lead
blog post · Story page
Google has open-sourced Mantis, the harness it uses internally to find and fix software vulnerabilities: discovery, triage, reproduction, and patching in one loop.
- The details:
- Critic and review agents check each finding, and a sandbox must reproduce the bug before it counts, which Google sets against AI scanners it says hallucinate bugs and land true-positive rates under 7%. Mantis also mines past security fixes, writes its own threat-model docs, and folds files into a summary tree Google says cut token overhead by over 85%.
- Yes, but:
- Every number is Google's own. The sub-7% rate describes the scanners Mantis is contrasted with, not Mantis, and the 85% measures token overhead, not bugs found or fixed.
- Why it matters:
- If you run an AI scanner on your repos, Google now offers an open-source harness with sandboxed reproduction built in.
- Google released Mantis, free software that finds, checks, recreates, and fixes security flaws.
- One artificial intelligence system proposes flaws, while others question and review its findings.
- It recreates each suspected flaw in an isolated test environment before treating the report as real.
- It reads past security fixes and builds layered notes about the software's structure and possible threats.
- For software defenders, this could reduce false alarms and help them fix real weaknesses faster.
Research & Papers
03
paper · Story page
The first systematic look at how 12 real harnesses, Claude Code and Codex among them, assemble context. Two new attack classes: attacker-controlled content promoted into a higher-privileged message role, and content that persists past the scope it entered in.
- Researchers studied how 12 coding systems gather instructions and information before taking actions.
- They found that harmful outside text can be mistakenly treated like trusted instructions.
- Harmful text can also remain available after the situation where it first appeared has ended.
- For people using Claude Code or Codex, these findings expose new ways attackers might steer the software.
paper · Story page
Eleven production coding harnesses, Claude Code and Codex CLI through Aider and OpenCode, dissected at source level into seven subsystems and 29 recurring patterns. Across roughly four million lines, none imports a general-purpose agent framework and none retrieves code with vector embeddings.
- Researchers examined source code from eleven real coding systems to map how they are built.
- They divided each system into seven parts, including repeated work, tools, information handling, safety, coordination, and add-ons.
- Across roughly four million lines, none used a ready-made package for building action-taking artificial intelligence systems.
- None searched code by turning its meaning into lists of numbers for similarity matching.
- Software builders now have an evidence-based map of common designs and notable choices these systems avoid.
paper · Story page
Train a tool-selection router purely against cost and, when the informative tools are the expensive ones, it drops the very detectors the system exists to run: attack attribution collapsed on both datasets while the attack-versus-normal metric stayed high. The proposed fix is a mandatory core of class-discriminative tools that cost optimization can't touch.
- Researchers found that choosing security checks only by price can remove the checks that identify specific attacks.
- The problem appears when the most useful checks are also the most expensive.
- A broad attack-versus-normal score can stay high even when the system fails to identify most attack families.
- The proposed fix keeps essential identifying checks mandatory, while cost savings apply only to optional checks.
- This matters for network defenders because a cheap system can look accurate while giving nearly useless attack details.
Engineering & Harnesses
03
Cline pulled its agent harness out of the VS Code extension into a shared SDK, then had to move an extension installed by over 11 million developers onto it. The first attempt took months and was rolled back immediately, and with no gradual rollout in the VS Code Marketplace, Cline built its own release process.
- Cline moved its Visual Studio Code extension onto a shared software foundation.
- Its first migration took months, broke badly after release, and was immediately reversed.
- The Visual Studio Code Marketplace offered no gradual release option, so Cline built its own controlled rollout process.
- That process compared releases and added production safeguards before exposing all users to the refactor.
- This matters to over 11 million developers whose everyday work could otherwise be disrupted.
ContextPipe treats prompt assembly, what goes in, in what order, when to compact, as database query execution: a five-phase pipeline with a source catalog, a deterministic cache-aware optimizer, and an EXPLAIN ANALYZE style trace. A preliminary run on the SWE-bench Pro Qutebrowser subset cut tokens by 31% and LLM calls by 23% against append-only assembly, at the cost of a lower KV cache-hit ratio.
- Researchers created ContextPipe, which decides what information long-running artificial intelligence tools receive for each task.
- It separates preparation into five fixed stages that choose sources, arrange information, improve the plan, run it, and learn from results.
- Its source list and predictable decision rules let people repeat and inspect exactly how each input was prepared.
- In an early test, it processed 31% less text and made 23% fewer calls to the language system.
- For builders, the design makes input preparation easier to audit and individual failures easier to isolate.
paper · Story page
On real Kubernetes manifests, no way of having a model write the fix was safe unattended: GNU patch applies 96% of unified diffs but silently misapplies about one in seven, and a frontier model's full-file rewrite drops a field on some runs. The alternative has the agent emit only a structured field-change intent while a deterministic parser-based pipeline makes the minimal edit.
- Researchers found that letting artificial intelligence directly edit files controlling software was unsafe without human review.
- Generated patches, which list requested text changes, sometimes landed in the wrong place without reporting an error.
- The safer approach has artificial intelligence name the setting and replacement value, while a fixed program performs only that edit.
- This gives teams a more predictable way to automate software repairs without risking unrelated settings.
Product & Releases
01
Mastra agents can now drive a sandboxed Linux desktop through E2B Desktop or Daytona, with 11 computer tools for browsing, forms, downloads, screenshots, and terminal programs. A SandboxComputer interface exposes screen size, cursor position, and a stream URL so you can watch the agent work.
- Mastra released a feature that lets artificial intelligence control a separate desktop running the Linux operating system.
- It can browse websites, complete forms, download files, take screenshots, and run programs through a text-based command window.
- Builders can see the screen, track the pointer, and watch a live view of the work.
- This gives software builders broader automation while keeping the artificial intelligence away from their main computers.
Community
01
blog post · Story page
Rick Brewster says Paint.NET runs on WINE because of a clean-room Direct2D rewrite Claude wrote, about 180,000 lines he says he can't possibly review next to the 700,000 in the rest of Paint.NET, which he's worked on for over 20 years. Most of it is vibe coded, he says, and he had to babysit resource management.
- Rick Brewster says Claude wrote most of a replacement for graphics software that Paint.NET depends on.
- The replacement copied the needed behavior from scratch instead of relying on the original graphics software.
- Brewster says he could not thoroughly review the 180,000 lines Claude produced.
- He says Claude needed close supervision to track when parts of the program were still in use.
- This gives Paint.NET a needed workaround, while leaving its maintainers responsible for a large body of lightly reviewed code.
Hedge of the day
“This is a new snapshot of Qwen 3.8 Max, with the gains concentrated in coding on larger projects, long-horizon work that runs without supervision, and agent runs.”
Qwen 3.8 Max 0902 now available on AI Gateway (Vercel)
The gains have a location but no size.
From X
01
X post · Story page
Anthropic says Claude can now operate your desktop from Cowork and Claude Code, clicking, typing, and opening apps while you work on something else. Per the thread it's in beta for Pro and Max plans in the macOS desktop app.
- Anthropic says Claude can now use a Mac computer in the background while its owner does other work.
- After receiving a task, Claude can click controls, type text, and open applications on the desktop.
- People on Pro and Max plans can turn on the test version in the macOS desktop application's general settings.
- Pro and Max users can leave desktop tasks to Claude while they focus on something else.
Quick links
- Harness-of-Harness: Multi-Day Autonomous Software Development with Continual Improvement (arXiv)
- An Accidental Blackboard (Martin Fowler)
- Defending Agent Memory Against Poisoning (Zep)
- Your agent's permission model stops at your home folder (WorkOS)
- The Irreversibility Budget: Fleet-Level Risk Accounting and Admission Control for Agent Operating Systems (arXiv)
- Qwen 3.8 Max 0902 now available on AI Gateway (Vercel)
- Maybe We Shouldn't Be Reviewing All This Code (Rachel Laycock (Martin Fowler))
Meme of the day
Drawn by an image model.
Corrections
Nothing to correct.
Related issues
Subscribe
Get the brief in your inbox
Pick daily, weekly, or both. Nothing is gated either way: every issue is on the site and in the feeds.
- Weekdays at 8:45am IST, one lead story and 6 to 9 items.
- Sundays, an argued synthesis rather than a recap.
- One click to leave, and quiet days say so in the subject line.