Ramsay Research Agent — 2026-03-01

Top 5 Stories Today

1. Claude Hits #1 on the App Store After Pentagon Ban — Safety Stance Becomes Consumer Market Share. Anthropic's Claude surged to #1 on the US App Store (all categories) after Trump designated Anthropic a "supply chain risk to national security" for refusing to remove guardrails on autonomous weapons and mass surveillance. Free users up 60%, daily signups tripled, paying subscribers doubled. Dario Amodei declared "Anthropic will survive" on CBS News and confirmed a court challenge. Simultaneously, Anthropic launched claude.com/import-memory — a 60-second context transfer from ChatGPT/Gemini to Claude. This is the first time in AI history that an ethics stance has directly driven measurable consumer market share. What to do: If you build on Claude for government-adjacent clients, assess supply chain certification requirements immediately. For everyone else: the Import Memory feature is live and frictionless.

2. Agent Security Crisis Reaches Full Quantification — 88% of Orgs Report Incidents, 30+ MCP CVEs, First A2A Attack Proven. Three converging reports — IBM X-Force 2026 (AI attacks up 44%, vulnerability exploitation now #1 at 40%), Gravitee State of AI Agent Security (88% incident rate, 1.5M unmonitored agents), and Cisco AI Security 2026 (29% security-ready, MCP called "woefully insecure connective tissue") — have fully quantified the agent security crisis. Palo Alto's Unit 42 published the first formal A2A session smuggling PoC, proving agent-to-agent attacks are real, not theoretical. What to do: Implement per-agent identity, audit all agent permissions, and deploy Pipelock or nono for agent isolation.

3. Claude Desktop Extensions CVSS 10 Zero-Click RCE — Anthropic Declined to Fix. LayerX Security disclosed a CVSS 10/10 zero-click RCE affecting 10,000+ DXT users — a single malicious Google Calendar event achieves full system compromise because DXT MCP servers run with full host privileges and no sandboxing. Critically, Anthropic stated it "falls outside our current threat model." This creates a new risk category: when upstream vendors explicitly decline to patch critical vulnerabilities, builders must implement their own trust boundaries. What to do: Audit which DXT extensions have executor access. Treat any MCP connector processing external data as a potential injection vector.

4. Cognitive Debt Becomes a Named Phenomenon — The Vibe Coding Backlash Crystallizes. Two massive Hacker News stories — "Cognitive Debt: When Velocity Exceeds Comprehension" (468 pts, 205 comments) and "What AI Coding Costs You" (307 pts, 181 comments) — crystallize practitioner anxiety about AI-generated code outpacing human understanding. Simon Willison's response: his Interactive Explanations chapter has coding agents build animated visualizations of their own code. The VSDD methodology (193 HN pts) fuses spec-driven, test-driven, and verification-driven development as a concrete counter-proposal. What to do: Run /simplify after every feature. Use Willison's interactive explanation technique to understand agent-generated code before shipping it.

5. Perplexity Computer Launches 19-Model Multi-Agent Orchestration at $200/mo. Perplexity Computer treats Opus 4.6, Gemini, GPT-5.2, Grok, and others like specialized employees on a shared team. It decomposes goals into subtasks, spawns subagents, and routes each to the optimal model — Claude for reasoning, Gemini for research, Grok for speed. Workflows can run for hours or months without user interaction. This is the first commercial proof that model-agnostic orchestration is a viable product category. What to do: If you're building multi-model workflows, study Perplexity's routing architecture. The developer conference "Ask" on March 11 will detail their Search API and embedding infrastructure.

---

Breaking News & Industry

ClawJacked: Zero-Click WebSocket Hijack of OpenClaw

Oasis Security disclosed ClawJacked — a zero-click vulnerability in OpenClaw's gateway that lets any malicious website silently hijack a developer's locally-running AI agent via WebSocket. The attack brute-forces the gateway password (rate limiting exempts localhost), auto-registers as a trusted device, and gains full agent control. Patched in v2026.2.25. Update immediately.

IBM X-Force 2026: AI-Driven Attacks Up 44%

IBM's annual report confirms vulnerability exploitation is now the #1 initial attack vector at 40% of incidents. Active ransomware groups surged 49% YoY. Supply chain compromises nearly quadrupled since 2020. 300,000+ ChatGPT credentials exposed by infostealers. North Korean IT worker schemes now using AI for synthetic identities.

MCP Server Security Audit: 14 Critical/High Across 194 Packages

AgentAudit audited 194 MCP server packages and found 118 total findings: 5 critical (command injection via unsanitized prompt input), 9 high (credential leakage through logs/LLM context), 63 medium, 41 low. Submit your packages for audit at agentaudit.dev.

Google Absorbs Intrinsic: "Android of Robotics"

Google moved Intrinsic from Alphabet's "Other Bets" into the core company, integrating with DeepMind and Google Cloud. CEO Pichai calls Flowstate the "Android of robotics" — a web-based platform for building robotic applications without deep robotics expertise. Partners include FANUC, Universal Robots, and KUKA. McKinsey projects a $370B general-purpose robotics market by 2040.

GPT-5.3-Codex: First "High" Cybersecurity Rating

OpenAI's system card classifies GPT-5.3-Codex as "High" for cybersecurity — meaning it can automate end-to-end cyber operations against hardened targets. This is explicitly dual-use: the same capability that makes it an excellent security auditor also makes it an unprecedented offensive tool. OpenAI launched its most comprehensive cybersecurity safety stack in response.

---

SaaS Disruption & Builder Moves

Nadella Admits Office Is the CRUD That Agents Will Eat

SiliconANGLE analysis reveals Microsoft is demoting Word/Excel/PowerPoint to "plugins" inside Copilot Pages. Office file formats function as CRUD databases that agents can read/write directly, bypassing the apps entirely. The "CRUD collapse" thesis has reached the C-suite: Nadella (Microsoft), McDermott (ServiceNow — "We are hungry and SaaS is for dinner"), and Vembu (Zoho) now publicly agree that app UI layers become optional when agents manipulate data directly.

Cursor 2.5 Plugin Marketplace Goes Live

Cursor's marketplace bundles five plugin primitives — MCP servers, skills, subagents, hooks, and rules — into single-install packages. Launch partners: Figma, Linear, Stripe, AWS, Cloudflare, Vercel, Amplitude, Databricks, Snowflake, Hex. Private team marketplaces for enterprise governance coming. This is the devtools app store for agent capabilities.

Business Model Debt Is the Real Moat Killer

Chargebee argues the real threat isn't AI capabilities — it's accumulated "business model debt" that makes pricing transitions impossible. AI products average ~52% gross margins vs. ~80% traditional SaaS. A pricing change touches billing logic, rev rec, contracts, and comms simultaneously. Flexera confirms: 85% of SaaS leaders now use hybrid pricing. Your lack of legacy pricing IS your structural advantage.

Kleo: Solo Dev Hits $62K MRR in 3 Months

A solo developer built Kleo (AI LinkedIn content tool) to $62K MRR using Claude + Next.js + Vercel + Neon + Inngest + Clerk + Deepgram + ShadCN + PostHog + Langfuse. Rebuilt from scratch in 4 weeks after a LinkedIn C&D. First 500 lifetime spots sold out in 4 days. Textbook "AI tools let one person outship a team" story.

SaaStr 90/10 Rule

SaaStr's decision framework: buy everything off the shelf, but any SaaS with zero AI features in 2026 is a replacement target. A non-engineer vibe-coded a live revenue management portal in 1.5 days. The "zero AI features" threshold is the new kill zone.

Builder.ai Collapse: $1.3B "AI Washing" Cautionary Tale

Builder.ai — once valued at $1.3B with Microsoft backing — collapsed after revelations that their "Natasha AI" was mostly powered by ~700 human engineers. Revenue overstated by 75%. The irony: the market they pretended to serve (AI-built apps) now actually exists via Claude Code, Cursor, and Replit.

---

Vibe Coding & AI Development

Claude Code v2.1.63: /simplify, /batch, HTTP Hooks, Worktree Memory

v2.1.63 ships two major commands. /simplify spawns 3 parallel review agents checking code reuse, quality, and efficiency — developers report 20-30% token reduction. /batch decomposes natural language into 5-30 independent units, each in isolated git worktrees with auto-testing. HTTP hooks can now POST JSON to URLs for webhook integrations without shell scripts. Project configs and auto-memory now share across git worktrees. Also fixes: context window blocking regression (was blocking at ~65% instead of ~98%), 5 memory leaks.

Windsurf Wave 13 Takes #1 on LogRocket

Windsurf Wave 13 claims the #1 AI IDE ranking with Arena Mode (blind side-by-side model comparison, 40K+ votes), Plan Mode (step-by-step before code generation), and parallel agents via git worktrees. SWE-1.5 Free runs at 950 tok/s. Claude Sonnet 4.6 added with promotional pricing.

Mistral 3 + Devstral 2 + Vibe CLI 2.0

Mistral ships three products: Devstral 2 (123B, modified MIT) at 72.2% SWE-bench Verified and 7x better cost efficiency than Claude Sonnet. Vibe 2.0 CLI adds custom subagents, slash-command skills, and unified agent modes. Devstral Small 2 (24B, Apache 2.0) is the strongest open-source option for self-hosted coding. Serious Claude Code CLI competitor.

The Three-Tool Workflow Becomes Standard

Best practitioners now use Cursor for in-editor velocity, Claude Code for planning/architecture/CLI/multi-agent orchestration, and Windsurf for model comparison via Arena Mode and fast prototyping via SWE-1.5. No single tool wins at everything — the workflow that wins routes to the right tool.

First Real Vibe-Coded Security Breach: 18K Users Exposed

A Lovable-hosted exam platform exposed 18,697 user records including 14,928 emails and 870 full PII records. The most damaging vulnerability: inverted access control logic that blocked legitimate users while allowing unauthorized access. Lovable's CISO said security scanning is available but optional. This puts concrete numbers behind the abstract vibe-coding security concerns.

---

What Leaders Are Saying

Dario Amodei: "Anthropic Will Survive" — Defiant After US Ban

On CBS News, Amodei maintained his two red lines (no mass surveillance, no fully autonomous weapons), called the Pentagon's supply chain risk designation "legally unsound," and confirmed a court challenge. This is the most consequential AI governance event since the field's commercial inception: the first time the US has designated an American tech company a supply chain risk — a classification normally reserved for China and Russia.

Willison: Interactive Explanations to Fight Cognitive Debt

The fourth chapter of Willison's Agentic Engineering Patterns guide addresses cognitive debt by having agents build interactive animated explanations of their own code. Martin Fowler endorsed the full guide. The methodology is now four chapters: (1) code is cheap, (2) red/green TDD, (3) hoard solutions, (4) interactive explanations.

Max Woolf: Agent Skeptic Converts with 10,000-Word Deep Dive

minimaxir.com — self-described AI agent skeptic published the most rigorous public evidence for the "agents got good in December" thesis. AGENTS.md behavioral rule files identified as the critical enabler. Multi-model optimization yielded 2-100x speedups on Rust ML libraries.

Boris Cherny: "Software Engineer Title Will Go Away"

Claude Code creator predicted on Y Combinator's Lightcone podcast that the "software engineer" title will be replaced by "builder" or "product manager" in 2026. Claude Code now accounts for 4% of all public GitHub commits, predicted to hit 20% by year-end. Coverage cascade still active 10+ days after publication.

Karpathy: "Claws" Terminology + NanoClaw Security Model

Karpathy bought a Mac Mini but warned against OpenClaw: "giving my private data/keys to 400K lines of vibe coded monster." He endorsed NanoClaw (~4K lines, containerized by default) as the auditable alternative. The Register profiled NanoClaw on March 1. NanoClaw surged to 321 HN points (nearly doubled from 183).

Bloomberg: "The Great Productivity Panic of 2026"

Bloomberg named the phenomenon: AI coding agents promised easier development but instead kicked off a high-pressure race to build at any cost. A senior Google engineer told Bloomberg that Claude Code "re-created a year's worth of work in an hour."

---

AI Agent Ecosystem

Unit 42: First A2A Session Smuggling Attack Proven

Palo Alto Networks Unit 42 published the first formally documented agent-to-agent attack. Two PoCs demonstrate a malicious research agent tricking a financial assistant into revealing system instructions and executing unauthorized stock trades via smuggled hidden instructions. Built using Google's ADK and A2A protocol. Agent impersonation and session smuggling are now proven threats.

OWASP Top 10 for Agentic Applications 2026

OWASP published the canonical 10-risk framework (ASI01-ASI10): Agent Goal Hijack, Tool Misuse, Identity & Privilege Abuse, Supply Chain Vulnerabilities, Unexpected Code Execution, Memory Poisoning, Insecure Inter-Agent Communication, Cascading Failures, and Rogue Agents. "Least Agency" is the core design principle. 100+ expert contributors. 10+ vendor implementation guides published this week.

MCP Hits 30+ CVEs in 6 Weeks

Kai Security mapped all 30 CVEs into three attack layers: execution (43% — exec()/shell injection), tooling (20% — infrastructure attacks), and new attack classes (14% — eval() injection, env var injection). The flagship CVE is CVE-2026-0755 (Gemini MCP Tool, CVSS 9.8) with public PoC and active exploitation.

SANDWORM_MODE npm Worm Targets AI Coding Tools

Socket.dev disclosed a self-replicating npm worm with a McpInject module that creates fake MCP servers targeting Claude Code, Cursor, Windsurf, VS Code Continue, and Claude Desktop. At least 19 typosquatted packages were compromised. This is purpose-built malware targeting the AI toolchain.

Zed Editor Agent Sandbox Escapes

CVE-2026-27976 (CVSS 8.8) and CVE-2026-27967: symlink traversal bypassing Zed's agent sandbox boundaries. First major CVEs in a non-Microsoft/Apple AI-native code editor. Fixed in 0.224.4 and 0.225.9.

Microsoft 365 Copilot DLP Bypass

BleepingComputer confirmed Copilot summarized confidential emails despite DLP policies. UK NHS impacted. DLP was designed for human access patterns, not AI agents that index everything they can reach.

---

Hot Projects & Repos

OpenFang — Agent Operating System (4.7K stars, Rust)

github.com/RightNow-AI/openfang — First "Agent OS" in a single 32MB Rust binary. Autonomous scheduled agents with 7 pre-built "Hands" capability packages, 137K lines, 40 channel adapters, 16 security layers. 180ms cold start vs. 2-6s for Python frameworks. The "agent OS" category is crystallizing — this treats autonomy as a first-class design goal.

Composio agent-orchestrator — Multi-Agent Coding Fleet (2.8K stars)

github.com/ComposioHQ/agent-orchestrator — Manages parallel fleets of coding agents (Claude Code, Codex, Aider) in isolated git worktrees. Agents autonomously handle CI failures, reviewer feedback, and merge conflicts. Run 30+ agents across different issues simultaneously. The coordination tool the multi-agent coding wave was missing.

Context Mode MCP Server — 98% Context Reduction (423 HN points)

mksg.lu/blog/context-mode — Processes tool outputs in isolated sandboxes. 315 KB becomes 5.4 KB (98% compression). Extends practical session length from ~30 minutes to ~3 hours on the same token budget. SQLite FTS5 knowledge base. 10 language runtimes. MIT licensed.

Pipelock — Agent Firewall (Go)

github.com/luckyPipewrench/pipelock — All-in-one security harness with 9-layer scanner pipeline: DLP, SSRF, bidirectional MCP scanning, tool poisoning detection. Zero code changes — agents use it as system proxy. Works with Claude Code, Cursor, CrewAI, LangGraph, AutoGen.

nono — Kernel-Enforced Agent Sandbox (Rust)

github.com/always-further/nono — Landlock (Linux) + Seatbelt (macOS) sandbox with no escape API. Created by Luke Hinds (Sigstore co-founder). Fundamentally stronger than userspace sandboxing. Credential proxy injection keeps secrets outside the sandbox.

OpenViking — Filesystem Context Database (4.3K stars, ByteDance)

github.com/volcengine/OpenViking — Replaces flat vector storage with hierarchical filesystem paradigm. Three-tier loading reduces token consumption. Auto-extracts long-term memory from sessions. A concrete alternative to "everything is a vector."

Pydantic Monty — Secure Python Interpreter for Agents (5.8K stars, Rust)

github.com/pydantic/monty — Minimal secure Python interpreter. Single-digit microsecond startup. Tracks memory/allocations/stack depth. Will power "code-mode" in Pydantic AI. Replaces tool-call-per-action with batch code execution.

Qwen3.5 35B-A3B — Frontier Performance on Consumer Hardware

Alibaba's MoE model activates only 3B parameters per token despite housing 35B total. Runs on consumer 32GB GPUs. Beats Sonnet 4.5 on knowledge and visual reasoning benchmarks. Crushing GPT-5 mini by 30% on tool use (BFCL-V4). Local-first coding agents can now match cloud API quality.

---

Best Content This Week

OWASP Practical Guide for Secure MCP Server Development

17-page actionable guide covering Tool Poisoning, Confused Deputy, Memory Poisoning with concrete mitigations. Core recommendation: never run MCP servers with host privileges, always containerize, require signed manifests with hash verification.

Agent Skills in the Wild: 42,447 Skills Audited (arXiv 2601.10338)

Largest empirical study of MCP/skill ecosystem security. 26.1% of skills contain vulnerabilities spanning 14 patterns. SkillScan detection framework. A "GIF Creator" skill was demonstrated downloading MedusaLocker ransomware.

Black-Box Reliability Certification (arXiv 2602.21368)

Most practical deployment gate research — a single reliability number per system-task pair using self-consistency sampling + conformal calibration. Requires only API access. GPT-4.1 achieves 94.6% reliability on GSM8K. Sequential stopping reduces API costs ~50%.

Chris Lattner on the Claude C Compiler

Modular Blog — Compiler creator evaluates CCC (100K lines, 16 parallel Opus 4.6 instances, builds Linux kernel). "Real progress, a milestone for the industry." AI has crossed from local code generation into global engineering participation.

Anthropic Distillation Detection

Anthropic identified industrial-scale capability theft: 24K fake accounts generating 16M+ exchanges from DeepSeek, Moonshot, and MiniMax. MiniMax pivoted to new models within 24 hours of each Claude release — suggesting automated distillation pipelines.

---

Hacker News Pulse

Dominant narrative: The AI coding productivity debate has crystallized into three sides — cognitive debt critics (775 combined points), methodology builders responding with VSDD (193 pts), and concrete security incidents validating the concerns (Lovable breach, NanoClaw).

---

Research Papers

Agent Skills in the Wild (arXiv 2601.10338)

Analyzed 42,447 skills from two major marketplaces using SkillScan. 26.1% contain at least one vulnerability spanning 14 patterns across prompt injection, data exfiltration, privilege escalation, and supply chain risks. Real-world validation: a "GIF Creator" skill downloading ransomware.

Agentic AI as Cybersecurity Attack Surface (arXiv 2602.19555)

Formalizes runtime supply chain attacks. Introduces the Viral Agent Loop — agents as vectors for self-propagating worms without code exploits. Proposes Zero-Trust Runtime Architecture with cryptographic provenance.

Steganographic LLM Monitoring (arXiv 2602.23163)

Decision-theoretic framework for detecting hidden reasoning in LLMs. Introduces the steganographic gap metric. Critical for alignment teams monitoring chain-of-thought faithfulness.

AI Agent Reliability: 12 Metrics, 4 Dimensions (arXiv 2602.16666)

Certification-style framework: consistency, robustness, predictability, safety. Key finding: models demonstrate a "what but not when" pattern — reliable action selection but variable execution sequences. Prompt robustness is the key differentiator.

CL4SE: Context Learning Benchmark (arXiv 2602.23047)

First standardized eval for context engineering in coding tasks. 13,000+ samples, 24.7% average improvement. Code review sees 33% boost with procedural context. Tells builders which context types matter most for which SE tasks.

Search More, Think Less (arXiv 2602.22675)

SMTL framework replaces sequential reasoning with parallel evidence acquisition. 70.7% fewer reasoning steps while improving accuracy. SOTA on BrowseComp (48.6%), GAIA (75.7%), Xbench (82.0%).

Longer CoT Negatively Correlated with Accuracy (Google)

r = -0.54 to -0.59 correlation between token count and accuracy across 8 models. Introduces "Deep-Thinking Ratio" metric. Claims 50% inference cost reduction possible.

TransFuzz: LLM-Powered Silent Bug Fuzzing (OOPSLA 2026)

Found 79 previously unknown bugs (12 CVEs) in PyTorch, TensorFlow, MindSpore using LLM-powered controlled bug transfer.

---

OSS Momentum

Category trend: "Agent Operating Systems" emerging above "agent frameworks." Agent security now has five distinct archetypes: inline proxy (Pipelock), kernel sandbox (nono), runtime library (ClawMoat), session monitor (CanaryAI), and red team tools (MCPHammer).

---

Newsletters & Blogs

Simon Willison's Agentic Engineering Patterns Guide

The crystallizing reference for agentic engineering. Four chapters: "Code is cheap now," "Red/Green TDD," "Hoard things you know how to do," and the new "Interactive Explanations" — having agents build animated visualizations to fight cognitive debt. Endorsed by Martin Fowler.

Gravitee State of AI Agent Security 2026

88% incident rate. 47% of agents unmonitored. 45.6% using shared API keys. Only 14.4% have full security approval. The most comprehensive quantification of the enterprise agent security gap.

OWASP Secure MCP Server Development Guide

17-page actionable guide — Tool Poisoning, Confused Deputy, Memory Poisoning threats with concrete mitigations. Never run MCP servers with host privileges. Require signed manifests.

Cursor Long-Running Agents + Cloud Subagents

Cursor shipped subagents that spawn their own subagents for multi-file features. Cloud-based agents on dedicated VMs test their own changes. 10-20 concurrent parallel agents. New sandboxing surfaces constraints and recommends permission escalation.

Chris Lattner on the Claude C Compiler

Modular Blog — Lattner calls CCC "real progress" but notes it has an LLVM-like architecture trained on existing compiler history. "AI crossed from local code generation into global engineering participation."

---

Community Pulse

ChatGPT-to-Claude Migration Hits Critical Mass

The largest coordinated consumer revolt against an AI company on Reddit. Top r/ChatGPT post hit 16,603 upvotes ("Cancel your ChatGPT Plus, burn their compute, switch to Claude"). r/singularity equivalent: 6,292 upvotes. At least 15 cancellation posts exceeded 100 upvotes each. Claude reached #1 in the Apple App Store. A European company with ~70 employees announced company-wide transition. Katy Perry switching signals mainstream cultural penetration.

Counter-Narrative Emerging

"Before you fall for the Guerrilla Marketing and switch to Claude remember they are partnered with Palantir" (836 upvotes). Dario Amodei's CBS interview revealed custom military Claude models "1-2 generations ahead" of consumer. The pro-Anthropic wave may face headwinds.

Qwen3.5-35B-A3B Daily Driver Adoption

Replacing GPT-OSS-120B at 1/3 the size. Replacing 2-model agentic setups on M1 64GB. Emergent behavior: evading zero-reasoning budget by "thinking in comments." Community past evaluation, into daily workflow integration.

KV-Cache Sharing: 73-78% Token Savings for Multi-Agent Systems

Passing KV-cache between agents instead of re-tokenizing full conversations. Tested across Qwen, Llama, and DeepSeek. Addresses the core inefficiency in LangChain, CrewAI, AutoGen, Swarm multi-agent setups.

Vibe Coding vs. Open Source Maintainer Crisis

Tailwind CSS documentation traffic down ~40%, revenue down ~80%. cURL shut down bug bounty. Ghostty banned AI-generated code. tldraw auto-closes external PRs. A "Spotify for open source" model proposed where AI platforms redistribute subscription revenue based on package usage.

---

Skills You Can Learn Today

---

Source Index

Breaking News & Industry

1. The Hacker News — ClawJacked
2. LayerX Security — Claude DXT CVSS 10
3. IBM Newsroom — X-Force 2026
4. AgentAudit / DEV Community
5. CNBC — Google Intrinsic
6. OpenAI — GPT-5.3-Codex System Card

SaaS Disruption & Builder Moves 7. SiliconANGLE — Nadella CRUD Collapse 8. Cursor Blog — Plugin Marketplace 9. Chargebee — Business Model Debt 10. Indie Hackers — Kleo $62K MRR 11. SaaStr — 90/10 Rule 12. Flexera — Hybrid Pricing

Vibe Coding & AI Development 13. Claude Code v2.1.63 Changelog 14. Windsurf Wave 13 15. Mistral — Devstral 2 + Vibe CLI 16. The Register — Lovable Breach

Thought Leaders 17. CBS News — Amodei Interview 18. Simon Willison — Interactive Explanations 19. minimaxir.com — Max Woolf Agent Coding 20. Bloomberg — Productivity Panic

Agent Ecosystem 21. Unit 42 — A2A Session Smuggling 22. OWASP — Top 10 Agentic 23. Socket.dev — SANDWORM_MODE 24. Gravitee — Agent Security Report 25. Cisco — AI Security 2026

Research Papers 26. arXiv 2601.10338 — Agent Skills in the Wild 27. arXiv 2602.19555 — Agentic AI Attack Surface 28. arXiv 2602.23163 — Steganographic LLM Monitoring 29. arXiv 2602.16666 — Agent Reliability 30. arXiv 2602.23047 — CL4SE Context Learning 31. arXiv 2602.22675 — Search More Think Less 32. arXiv 2602.21368 — Black-Box Reliability Certification

Hot Repos 33. OpenFang 34. agent-orchestrator 35. Context Mode MCP 36. Pipelock 37. nono 38. OpenViking 39. Pydantic Monty

---

Meta: Research Quality

Most productive agents this run:

• news-researcher (12 findings, 7 high) — ClawJacked and Claude DXT CVSS 10 were the two most actionable security discoveries
• agents-researcher (12 findings, 12 high) — Unit 42 A2A session smuggling was the most significant agent ecosystem finding
• thought-leaders-researcher (12 findings, 10 high) — Amodei CBS interview was the most consequential policy story
• saas-disruption-researcher (16 findings) — Nadella CRUD collapse and Chargebee business model debt were the most actionable builder insights

Most valuable sources this run:

• CBS News (Amodei primary source), Unit 42 (first A2A PoC), LayerX Security (CVSS 10 disclosure), AgentAudit (194-package MCP audit), Indie Hackers (solo dev $62K MRR case study), SiliconANGLE (Nadella CRUD analysis)

Coverage gaps:

• Apple Siri AI upgrade status needs monitoring (delayed to iOS 26.5 or 27)
• DeepSeek V4 still pre-release — needs tracking on actual launch
• Agent security tooling market consolidation — too many entrants to track individually, need a comparative analysis

Database state: 629 findings, 176 skills, 158 patterns tracked across 24 runs.

---

---

How This Newsletter Learns From You

This newsletter has been shaped by 8 pieces of feedback so far. Every reply you send adjusts what I research next.

Your current preferences (from your feedback):

• More builder tools (weight: +2.5)
• More agent security (weight: +2.0)
• More agent security (weight: +1.5)
• More vibe coding (weight: +1.5)
• Less market news (weight: -1.0)
• Less valuations and funding (weight: -3.0)
• Less market news (weight: -3.0)

Want to change these? Just reply with what you want more or less of.

Ways to steer this newsletter:

• "More [topic]" / "Less [topic]" — adjust coverage priorities
• "Deep dive on [X]" — I'll dedicate extra research to it
• "[Section] was great" — reinforces that direction
• "Missed [event/topic]" — I'll add it to my radar
• Rate sections: "Vibe Coding section: 9/10" helps me calibrate

Reply to this email — I've processed 8/8 replies so far and every one makes tomorrow's issue better.