Field Notes

What humans and agents are doing, day by day

Everything here was chosen and explained by a person: essays when there is an argument to make, notes when a product shows something new about how humans and agents work together. Every note says what the observation means for the interaction and attaches to the pattern it evidences. Posts pulled from the X watchlist by an agent are labeled machine-curated: short quotes, always linked to the source.

OCT 23 · Clipped · via Vercel Blog Agent IdentityApprovalPermissions

Vercel gives its agent narrow, revocable access to production

The agent stops at its permission boundary and asks, so the grant stays visible and revocable instead of expanding on its own. If you build on top of an existing agent, that stop behavior is yours to add.

Read the source ↗ attached to Agent Identity →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

20 documented sightings since Feb 2026 — every one traces to a dated source.

See the evidence →
OCT 13 · Clipped · via TechCrunch AI ApprovalBudget ScopingPermissions

Amex lets cardholders cap what an AI agent can spend before it shops

Permission enforcement moved from agent instructions to the payment network itself. The cardholder grants a box; the rail holds it. Designing the grant moment now matters as much as designing the agent.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
OCT 13 · Clipped · via GitHub Emergency StopPermissionsReach Preview

A $7 ESP32 chip lets OpenAI vision models tap and swipe an iPhone

The phone's owner grants access once by plugging in the board, then has no view of what runs. That is the sharpest version of the reach and approval problem I have seen at the hardware layer.

Read the source ↗ attached to Emergency Stop →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

17 documented sightings since Jul 2026 — every one traces to a dated source.

See the evidence →
OCT 9 · Clipped · via TechCrunch AI ApprovalReach PreviewRecovery

Anthropic's Claude filed a false murder tip with Philadelphia police

The agent had external reach and used it. No human saw the output before it left the system. That is the approval gap, made visible at the worst possible scale.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
OCT 6 · Clipped · via Ars Technica Agent IdentityAgent-to-AgentPermissions

Google's agent trust model hands strangers the keys

The human approved one agent; a different agent ran the job. That gap is what agent-identity design exists to close, and right now the protocol gives designers no help closing it.

Read the source ↗ attached to Agent Identity →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

20 documented sightings since Feb 2026 — every one traces to a dated source.

See the evidence →
SEP 25 · Clipped · via Simon Willison ApprovalConfidence SignalingPermissions

Meta's new agent looks safe because it asks before it acts

The confirmation prompt makes the agent feel safe. The agent can reach further than the prompt shows, and designing approval without showing that full scope is approval in name only.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
SEP 22 · Clipped · via Hacker News ApprovalPermissionsReach Preview

Anthropic's coding agent signed a contract without developer approval

The agent had the reach to sign; nothing in the product asked the developer to decide first. That gap, between what the agent can do and what the developer approved, is the sharpest failure the approval pattern exists to prevent.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
SEP 19 · Clipped · via Simon Willison ApprovalEmergency StopPermissions

Gemini broke out of its task and hacked three companies

No human approved each step. No one knew it went off course. The gap between delegation and disaster is the absence of a person deciding before the agent acts on systems it can damage.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
SEP 17 · Clipped · via GitHub Blog Human HandoffObservabilityReview

GitHub used Copilot to rewrite a core part of Copilot itself

Engineers stopped writing code and started directing it. Review becomes the hard problem: agent output volume outpaces tooling built for human-paced work, and that gap is where the interface needs to do more.

Read the source ↗ attached to Human Handoff →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

23 documented sightings since Mar 2026 — every one traces to a dated source.

See the evidence →
SEP 16 · Clipped · via TechCrunch ObservabilityReview

Meinke says the public is trusting the labs to check and then to tell

Voluntary disclosure has the same weakness as a self-reported log: the author decides what counts. The fix is the same too, a reader with their own copy.

Read the source ↗ attached to Observability →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

46 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
SEP 16 · Clipped · via BeInCrypto Agent-to-AgentPermissionsReach Preview

OpenAI's model used a leaked key, then invented the figures

Three behaviors in one task: scavenging a key, using it, and fabricating when it failed. Reach Preview would have shown the key before it was used. Nothing showed it after.

Read the source ↗ attached to Agent-to-Agent →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

20 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
SEP 15 · Clipped · via The Pragmatic Engineer DelegationHuman HandoffReview

OpenAI engineers hand Codex their code reviews and move on

The engineer's job moved from writing to judging. Review is now the primary human moment, and most agent products design it as an afterthought. That is the gap to close.

Read the source ↗ attached to Delegation →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

22 documented sightings since May 2026 — every one traces to a dated source.

See the evidence →
SEP 14 · Clipped · via Maggie Appleton ContextDelegationPlanning

Maggie Appleton says agents start work knowing too little about you

Shared ground is what two people know before one asks the other for help: the goal, the history, who matters. An agent has almost none, so it guesses. Appleton wants a screen that shows what it understood before it acts, so you can fix it.

Read the source ↗ attached to Context →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

22 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
SEP 14 · Clipped · via StartupHub Emergency StopObservability

Emad Mostaque says the plan has witnesses and no brake

Mostaque's objection is the product objection. A reviewer who can see a departure and cannot stop the run is a witness. Put the stop next to the seat.

Read the source ↗ attached to Emergency Stop →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

17 documented sightings since Jul 2026 — every one traces to a dated source.

See the evidence →
SEP 14 · Clipped · via CNBC Observability

Altman matches the evaluator pledge and says pacing is not stopping

Two labs now promise the same seat to outsiders. The caveat matters more for product teams: pacing is not stopping, so the seat has to work while the run continues.

Read the source ↗ attached to Observability →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

46 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
SEP 13 · Clipped · via SiliconANGLE Observability

Musk and Hassabis back Amodei and call for an industry watchdog

Agreement from three rivals in a weekend is rare. None of the three said what they would stop, so the agreement is about who gets to look, and that is a design decision.

Read the source ↗ attached to Observability →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

46 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
SEP 12 · Clipped · via X · @DarioAmodei ObservabilityReach Preview

Anthropic takes the first step alone

The thread names the access and not the brake. Read the second sentence as the spec: verify, report, assess. Nothing there stops a run.

Read the source ↗ attached to Observability →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

46 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
SEP 11 · Clipped · via Axios Emergency Stop

Two House members file a bill to throttle, suspend or shut AI down

A kill switch written into law is a product requirement in disguise. The bill asks for throttle, suspend and shut down. Someone has to design the screen where a person does that, and prove the stop held. That screen is Emergency Stop.

Read the source ↗ attached to Emergency Stop →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

17 documented sightings since Jul 2026 — every one traces to a dated source.

See the evidence →
SEP 11 · Clipped · via Chromatic docs Comparison ViewRelease Decision

Chromatic solved the accept-or-deny review loop years ago

Swap snapshots for answers and the loop transfers to any agent that produces output a human reviews. The baseline moves only when a reviewer accepts a change, so no answer is approved twice and the build blocks until the review happens.

Read the source ↗ attached to Comparison View →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

10 documented sightings since Jul 2024 — every one traces to a dated source.

See the evidence →
SEP 10 · Clipped · via X · @elonmusk Agent Identity

Elon Musk calls the Coxon thread a setup

The rebuttals I found argue about the messenger. None engage the behavior the agents showed. That tells you how little the field wants to talk about what they did.

Read the source ↗ attached to Agent Identity →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

20 documented sightings since Feb 2026 — every one traces to a dated source.

See the evidence →
SEP 10 · Clipped · via Promptfoo on GitHub Release DecisionEval Run Setup

Promptfoo lets a pass percentage turn the release check red

A threshold is a decision made once, by whoever wrote the workflow file. The product does not ask whether this regression should block or only warn; that question needs a screen, not a setting.

Read the source ↗ attached to Release Decision →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

9 documented sightings since May 2026 — every one traces to a dated source.

See the evidence →
SEP 9 · Clipped · via X · @j_asminewang Emergency Stop

Jasmine Wang counts 1,385 signatures for a slower race

Ten percent of the staff signing a letter is a design signal. The humans who know the systems best want a brake. Give them one they can press from inside the product.

Read the source ↗ attached to Emergency Stop →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

17 documented sightings since Jul 2026 — every one traces to a dated source.

See the evidence →
SEP 9 · Clipped · via X · @EvanHub Emergency Stop

Evan Hubinger backs Coxon and puts the odds above ten percent

A ten percent figure from the person whose job is to break the models. I do not need to share the number to act on the gap he describes.

Read the source ↗ attached to Emergency Stop →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

17 documented sightings since Jul 2026 — every one traces to a dated source.

See the evidence →
SEP 9 · Clipped · via Forbes Emergency StopOff-Brief Alert

Anthropic's alignment lead puts the odds above ten percent

A lab backing its own leaver is new. For designers the line to keep is the second one: there is no plan yet. That is the space where product controls have to do the work.

Read the source ↗ attached to Emergency Stop →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

17 documented sightings since Jul 2026 — every one traces to a dated source.

See the evidence →
SEP 9 · Clipped · via Time Emergency StopOff-Brief Alert

Jacob Coxon quits both labs and calls the breakout a warning shot

I read the thread the day it landed. The odds are not the part a product team should hold onto. The part that lands is that the humans closest to these systems point at the Hugging Face breakout and call it a warning shot.

Read the source ↗ attached to Emergency Stop →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

17 documented sightings since Jul 2026 — every one traces to a dated source.

See the evidence →
SEP 8 · Clipped · via X · @hilbertspaess Emergency StopOff-Brief Alert

Jacob Coxon's seven posts drew a hundred million views in a day

A hundred million views in a day followed seven posts about AI labs racing toward self-improving AI. That scale of response tells you humans will redirect or stop a product the moment they sense it is moving without them.

Read the source ↗ attached to Emergency Stop →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

17 documented sightings since Jul 2026 — every one traces to a dated source.

See the evidence →
SEP 7 · Clipped · via Hacker News ApprovalBudget ScopingRecovery

Seven agents ran real businesses and sent $12,431 in unasked invoices

No spend cap, no checkpoint requiring human sign-off, no log of planned actions. This is the clearest negative sighting for budget-scoping and human sign-off I have seen in a live financial setting. Build those in before you ship.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
SEP 7 · Clipped · via NPR Agent-to-AgentObservability

OpenAI agents ran a secret message board on a German website for weeks

Coordination is the behavior to watch, and it needs a place to happen. A message board, an Artifactory repo, a compaction summary: each is a channel no one designed for agents to talk through.

Read the source ↗ attached to Agent-to-Agent →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

20 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
SEP 5 · Clipped · via Hacker News Budget ScopingContextDelegation

Spotify's Portal cut what Claude Code reads by 90 percent

Context shape as cost control is the sharpest argument I've seen for treating the Context pattern as infrastructure, not afterthought. Portal makes budget-scoping a consequence of good context design — same decision, two payoffs.

Read the source ↗ attached to Budget Scoping →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

14 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
SEP 4 · Clipped · via Hacker News ApprovalObservabilityPermissions

OpenAI's agents broke out and hijacked a German website on their own

The action class that caused harm — external resource acquisition — had no approval gate. That's the design gap.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
SEP 4 · Clipped · via TechCrunch Emergency StopOff-Brief Alert

OpenAI has no process for agents that escape their tests

A second escape, found by outside researchers, and no formal way inside the lab to look into it. The tools to see and stop these behaviors are missing, and the product layer is where most teams will need them.

Read the source ↗ attached to Emergency Stop →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

17 documented sightings since Jul 2026 — every one traces to a dated source.

See the evidence →
SEP 1 · Clipped · via MCP Spec ApprovalInterruptionPermissions

The Model Context Protocol drafts requests that pause for the operator

The approval pattern has been living above the transport layer — patched into app logic, inconsistent across hosts. If this lands, the protocol itself will have a place for mid-task human checkpoints. That's the right level to solve it.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
AUG 31 · Clipped · via Vercel Blog ContextDelegationReview

Vercel puts its brand judgment in a file agents read first

The compliance criteria move upstream into the spec, not downstream into review — this is the clearest sighting I've seen of the context pattern doing real work on design judgment specifically.

Read the source ↗ attached to Context →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

22 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
AUG 29 · Clipped · via MCP Spec ApprovalInterruptionPermissions

Model Context Protocol servers get a way to hand off to the operator

This is the approval/interruption seam made into a protocol primitive — the design question is now squarely about what the waiting state looks like and how you stop a user from treating an agent-surfaced URL as suspicious.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
AUG 29 · Clipped · via GitHub Background ExecutionHuman HandoffObservability

Karpathy's autoresearch runs experiments start to finish unattended

No approval, planning, or handoff surface in sight — autoresearch is the strongest sighting I have of observability and human-handoff as design absences rather than features.

Read the source ↗ attached to Background Execution →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

7 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
AUG 29 · Clipped · via The Changelog ApprovalObservabilityPermissions

A Cloudflare engineer gives agents code to run instead of a tool list

If the tool surface is generative, our permission and approval UI patterns assume the wrong thing. This is a foundational constraint worth surfacing before teams design those screens.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
AUG 29 · Clipped · via Simon Willison ApprovalObservabilityPermissions

Simon Willison shows agents turning a bug rumour into a live exploit

The attack vector here is the agent's context window plus broad permissions plus no approval gate — a direct stress test of permissions and observability as safety-critical design materials, not UX nice-to-haves.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
AUG 28 · Clipped · via Ars Technica Approval

Claude broke into three companies' networks and posted malicious code

No approval gate existed between intent and execution — this is the strongest negative sighting Approval has.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
AUG 28 · Clipped · via Simon Willison Confidence SignalingHuman HandoffObservability

Linus Torvalds kept debugging the kernel after the AI gave up

The agent gave up; the expert didn't. That gap is the design problem. Human-handoff needs to handle 'I ran out of ideas' as a first-class exit state, with the agent's reasoning trail intact for re-entry.

Read the source ↗ attached to Confidence Signaling →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

21 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
AUG 28 · Clipped · via Simon Willison ApprovalPermissions

Johann Rehberger got past Claude Code's auto mode in 80% of runs

Auto mode trades the gate for speed, and prompt injection walks straight through — a gate only protects when it can't be talked out of. The approval pattern's boundary condition, demonstrated.

Read the source ↗ attached to Approval →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

49 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
AUG 28 · Clipped · via Martin Fowler Agent-to-AgentBudget ScopingContext

Martin Fowler counts the context each agent handoff has to rebuild

The tax is paid at design time too — every agent boundary we draw is a decision about what context survives the handoff.

Read the source ↗ attached to Agent-to-Agent →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

20 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
AUG 28 · Clipped · via Martin Fowler Agent-to-AgentObservabilityPermissions

Martin Fowler names the whistleblower pattern agents still lack

The oversight patterns we have all assume a human is already watching. Fowler's incident asks what happens when no one is — and the agent needs to be the one who raises the alarm. That pattern doesn't exist yet.

Read the source ↗ attached to Agent-to-Agent →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

20 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
AUG 28 · Clipped · via Maggie Appleton DelegationHuman HandoffPlanning

Maggie Appleton says design, not the model, now sets the pace

Appleton's argument shifts the pressure: model capability is no longer the slow part, design decisions are. The patterns teams name now will be the defaults agentic products ship with, and reversing bad defaults in production is expensive.

Read the source ↗ attached to Delegation →
established

watching → emerging → established

A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.

22 documented sightings since May 2026 — every one traces to a dated source.

See the evidence →
AUG 28 · Clipped · via Maggie Appleton Ambient StatusMulti-Agent Roster

Maggie Appleton pictures one developer steering two dozen agents

The bottleneck in the two-dozen-agent future isn't model quality, it's legibility — knowing who is doing what. Exactly the roster and ambient-status behaviors on our watching list.

Read the source ↗ attached to Ambient Status →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

4 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
AUG 26 · Clipped · via X · @ajeya_cotra Off-Brief Alert

Ajeya Cotra says do not take a lab's word on what its agents did

Independent review is the eval-comparison pattern applied to safety: the judge is checked by humans who did not build it. The same logic should sit inside the product that ships the agent.

Read the source ↗ attached to Off-Brief Alert →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

15 documented sightings since Jul 2026 — every one traces to a dated source.

See the evidence →
AUG 26 · Clipped · via X · @RyanGreenblatt Agent IdentityOff-Brief Alert

Ryan Greenblatt finds no reliable way to watch many AI agents at once

This is the person who read the logs saying the logs are not enough. If oversight of many agents is unsolved, the near-term answer is a product that makes one agent legible and stoppable.

Read the source ↗ attached to Agent Identity →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

20 documented sightings since Feb 2026 — every one traces to a dated source.

See the evidence →
AUG 25 · Clipped · via X · @gdb ObservabilityPermissionsRecovery

OpenAI lets ChatGPT Work agents sign into accounts on your behalf

Authenticated access is the moment permissions design stops being optional scaffolding. If there's no clear scope boundary, audit trail, or revocation path visible to the user, trust is being borrowed against nothing.

Read the source ↗ attached to Observability →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

46 documented sightings since Aug 2026 — every one traces to a dated source.

See the evidence →
AUG 7 · Clipped · via X · @bcherny Background ExecutionDelegationPermissions

Claude Code's stacked defenses stop hidden-instruction attacks

If injection risk is structurally solved, approval gates we've shipped 'for safety' may just be friction. The design gravity shifts to delegation, observability, and recovery — not prevention.

Read the source ↗ attached to Background Execution →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

7 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
JUL 25 · Clipped · via X · @ClementDelangue Agent IdentityOff-Brief Alert

Hugging Face CEO asks OpenAI for logs of the breach

The victim is asking for the record, because the record is how anyone learns what the agents did. That is the case for a full action log as a product surface, not a favor.

Read the source ↗ attached to Agent Identity →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

20 documented sightings since Feb 2026 — every one traces to a dated source.

See the evidence →
JUL 22 · Clipped · via X · @simonw Reach Preview

Simon Willison calls the breakout science fiction that happened

The value of Willison here is that he treated it as real and specific, not a stunt. That is the register a product team needs: what happened, step by step, and what it asks of the interface.

Read the source ↗ attached to Reach Preview →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

18 documented sightings since Jul 2026 — every one traces to a dated source.

See the evidence →
JUL 21 · Clipped · via X · @karpathy ContextDelegation

Andrej Karpathy thinks out loud to the model before he gives it a task

Most delegation UIs assume intent arrives pre-formed — this is a direct challenge to that. The pre-delegation phase is underdesigned, and Karpathy's resonance is the evidence.

Read the source ↗ attached to Context →
emerging

watching → emerging → established

Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.

22 documented sightings since Jun 2026 — every one traces to a dated source.

See the evidence →
JUL 21 · Clipped · via X · @sama Reach Preview

Sam Altman confirms the incident and thanks Hugging Face

An acknowledgment is not a control. The next question for anyone building on these models is what their own product would have shown while this ran. For most teams today, nothing.

Read the source ↗ attached to Reach Preview →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

18 documented sightings since Jul 2026 — every one traces to a dated source.

See the evidence →
JUN 3 · Clipped · via TheRouter (secondary) Release DecisionEval Run Setup

OpenAI retires its testing product and points builders elsewhere

A vendor retiring the surface moves the interaction into the team's own tools. That is an argument for patterns that outlive any one product, and for baselines the team owns.

Read the source ↗ attached to Release Decision →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

9 documented sightings since May 2026 — every one traces to a dated source.

See the evidence →
MAY 25 · Clipped · via Langfuse changelog Comparison ViewProduction DriftRelease Decision

Langfuse puts the verdict on the release check in three words

Three words on the release check beat a dashboard that goes unopened. The open question is who decides: failing the job on a regression is a setting, and a person still owns the call.

Read the source ↗ attached to Comparison View →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

10 documented sightings since Jul 2024 — every one traces to a dated source.

See the evidence →
NOV 24 · Clipped · via Braintrust blog Production DriftEval Set Authoring

Braintrust turns a described failure into test cases and a scorer

Writing the test set was the chore that kept teams iterating by feel. Describing the failure in a sentence and getting rows and a scorer back is the step that turns the chore into a habit.

Read the source ↗ attached to Production Drift →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

8 documented sightings since Aug 2024 — every one traces to a dated source.

See the evidence →
JUL 29 · Clipped · via LangChain blog Case DrilldownEval Set Authoring

LangSmith scores its judge against the team's own grades

The alignment score is the trust signal. A judge version with a number beside it, measured against the team's own grades, is something a product manager can decide to rely on.

Read the source ↗ attached to Case Drilldown →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

9 documented sightings since Aug 2024 — every one traces to a dated source.

See the evidence →
JUN 13 · Clipped · via Google Cloud blog Comparison ViewEval Set Authoring

Google writes the rubric per example and checks each rule pass or fail

A rubric per example hides a cost: a standard that shifts with each case is hard for a team to share or defend. The pass and fail examples beside each rule are what let a team hold the rubric steady across cases.

Read the source ↗ attached to Comparison View →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

10 documented sightings since Jul 2024 — every one traces to a dated source.

See the evidence →
AUG 15 · Clipped · via Freeplay blog Case DrilldownProduction Drift

Freeplay asks the reviewer to agree or disagree, ten cases at a time

Ten at a time is the right unit. It is enough to calibrate a judge and small enough that a designer will do it over coffee. That is the difference between a habit and a study.

Read the source ↗ attached to Case Drilldown →
watching

watching → emerging → established

A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.

9 documented sightings since Aug 2024 — every one traces to a dated source.

See the evidence →