Monday’s digest skews agent security: three fresh papers — long-context prompt injection, quantization-triggered backdoors, and out-of-band policy enforcement at a trusted tool boundary — plus the first concrete signal that agent pricing is moving from tokens toward outcomes. The tooling side delivered too: OpenClaw 2.0 is the platform’s largest release yet, and Simon Willison published the most complete hands-on map of ChatGPT Work so far — useful before you spend on a $20/mo sub. Five arXiv papers and the outcome-based pricing shift round it out.

Agent frameworks & tooling

  • OpenClaw 2.0, Accidentally — the open-source agent platform’s largest release ever: 933 contributors, ~16,000 PRs (~50% of all PRs merged in its history), rebuilt browser app as a first-class control surface, much simpler first-run setup (reuses existing ChatGPT/Claude subs, API keys, local models), and shared cloud sessions that turn Claws into a multiplayer workspace. Verified via extract; runs self-hosted, so it’s directly adoptable.
  • Understanding ChatGPT Work — Simon Willison’s hands-on map of OpenAI’s Work product (announced July 9, iterating fast): Work Cloud vs Work Local, paid-subscribers-only, and the real differentiators — Luna/Terra model selection, code execution with internet, headless Chrome, persistent cross-session filesystem, sub-agents, scheduled prompt automations, and publishing “ChatGPT Sites.” The most complete third-party writeup yet; useful before you spend on a $20/mo sub.
  • Credo: Reusable Declarative Primitives for Agentic Workflows — (arXiv 2608.27790, Aug 28) recovers structured declarative descriptions from harnesses found by search, so a new task can bind catalogued primitives instead of restarting harness search from scratch. Extends the harness thread the digest has been following (Lemmalog, Benzi, openJiuwen) with a database-style reuse story.

Models & research

  • RealSWE: A Compositional Evaluation of Coding Agents under Realistic User Requests — (arXiv 2608.27831, Aug 28) shows the SWE-bench family overrates coding agents: 88% of real user prompts are problem-statement-only vs 7% of benchmark problems, and realistic inputs cut resolution rates by 6.4pp on average and can flip model rankings. Actionable finding: explicitly stating desired behavior and motivation (which most real prompts omit) substantially improves agent performance; environment info and repro steps just add tokens.
  • LongPIBench: A Long-Context Benchmark for Prompt Injection — (arXiv 2608.28411, Aug 28, EMNLP Findings) benchmarks PI attacks/defenses at thousands-to-tens-of-thousands of tokens across peer review, resume screening, code review, and email summary. Simple heuristic attacks frequently bypass state-of-the-art defenses — i.e., long-context settings are where prompt injection actually lands, the same territory yesterday’s Claude Code Auto Mode breakdown covered.
  • If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary — (arXiv 2608.27646, Aug 27; Millstone, Akidau, et al.) argues prompts are a brittle guardrail and proposes OBPE: enforce policy outside agent reasoning at a trusted tool boundary — authorize typed operations, narrow queries before the backend call, filter/mask responses. Data-owner policy is the ceiling agents can only narrow, with order-independence proved. A concrete architecture for anyone giving agents credentials.
  • Quantization-Triggered Backdoors in Language Models — (arXiv 2608.27512, Aug 27) formalizes why post-training quantization is not semantically neutral: it’s a many-to-one mapping, so source-precision certification doesn’t carry to deployment. Proof-of-concept backdoors stay dormant at FP16 and activate on INT8/4-bit compression (up to 85% task inversion), and they transfer across quantizers. Direct warning for self-hosters who download and quantize weights without re-evaluating.

Industry

  • OpenAI starts testing outcome-based pricing for agents — sources say OpenAI is letting some major customers pay only when its AI completes tasks, and Salesforce is overhauling how it charges for agents along similar lines. First concrete signal that agent pricing is moving from tokens toward outcomes — directly relevant to the cost math for agent builders; flagged as sources-say/single-outlet.
  • Anthropic signs out users, refunds after infostealers drain Claude sessions — malware on user PCs hijacked logged-in Claude sessions to burn API usage; Anthropic logged users out, removed saved payment methods, and issued refunds. Concrete security-posture item for anyone running Claude Code with saved sessions/credentials.
All gathered items - what was cut and why (9)