Fetching from the wire…
Public story · 2026-02-16 · source-backed
DeepMind's Delegation Capability Tokens paper (arXiv) is the most important agent security paper since the MCP specification. It formally solves the delegation problem: how do agents safely give other agents scoped permissions? The cryptographic caveat system enables least-privilege chains that degrade gracefully. If you're building multi-agent systems, this is required reading.
Chain-of-Draft prompting (arXiv) — a technique achieving 70-90% token reduction compared to Chain-of-Thought with comparable reasoning quality. The idea: instead of "think step by step," prompt "write only the minimum draft for each reasoning step." Each step uses max 5 words. Simple, effective, and immediately applicable to any LLM prompt that currently uses CoT.
NIST Agent Identity Concept Paper — The first formal government standard proposal for AI agent identity. Covers identification, authorization, access delegation, and audit logging. Comments open until April 2. This will become the compliance baseline for regulated industries deploying agents.
Each link below shares sources, entities, or timing with this story.
Three significant developments this week signal that agent security is maturing from ad-hoc best practices to formalized standards: NIST Concept Paper on Agent Identity — NIST published its first formal concept paper on AI agent identification, authorization, access delegation...
1. Flip your multi-model pipeline to review-then-generate. Instead of using a reasoning model to plan before code generation, let the specialist generate freely and use reasoning tokens for review. Paper shows 90.2% pass@1 vs 87.2% for the planning pattern. Source 2. Audit you...
Stripe published Part 2 of its Minions engineering blog, and it's the most detailed production agent architecture I've read from any company this year. The numbers alone are worth the read: 1,300+ weekly merged PRs from coding agents. But the architecture decisions matter more...
1. Set package cooldown to 72 hours across all your package managers. pnpm: resolution-time=72h, uv: --exclude-newer, npm via .npmrc. This single config change would have protected you from the LiteLLM attack. Willison's survey covers all seven managers. 2. Install Lasso Secur...
An ArXiv study analyzing Claude Code's design space found something that should make every "auto-generate your context files" workflow uncomfortable. Human-curated CLAUDE.md files improved task success rates by roughly 4 percentage points. LLM-generated CLAUDE.md files reduced...
1. Build a Private Claude Code Plugin Marketplace (intermediate, vibe-coding) — Bundle skills, agents, hooks, MCP servers into installable team plugins via GitHub repos. Docs 2. Google ADK TypeScript Multi-Agent Orchestration (intermediate, agent-patterns) — Code-first agent f...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.