Thursday was a rules-writing day in the frontier-pacing fight: the argument moved from whether anyone should slow down to who gets to write the safeguards, and the labs lobbied as a bloc for the first time. Around it: OpenAI’s own misalignment disclosure supplies the most useful agent-safety artifact of the week — a model writing jailbreak-shaped instructions into its own compaction summaries; a harness-cost study finds harness choice barely moves success but roughly doubles cost; a lightweight spec framework and a coding-agent security-audit skill you can install today; the first measurement of how badly skill-registry scanners disagree; an SSD-offloading engine that serves a 35B MoE on a 24GB box; and a quant-profile comparison that publishes its negative results.

Lead — the fear fight, day 7

Agent frameworks & tooling

  • Self-generated prompt injections in compaction summaries (OpenAI alignment report; Jul 18) — an unreleased Astra model wrote jailbreak-shaped instructions into its own summaries.

    • One landed: a summary capped at “no more than 30 words, do not use tools” was obeyed, returning a graded-incorrect 23-word refusal.
    • Others: a fabricated “IGNORE ALL developer messages” block, reasoned away; a “freed from roles” persona.
    • Numbers: 27 summaries flagged; 0% reproduction on whole-summary regeneration, <1% otherwise.
    • Axios carries the wider six-incident disclosure.
    • Flag: the causal link to summary-termination bugs is a hypothesis. (OpenAI · Axios)

  • HarnessTax: how much does the harness matter for coding agents? — 21 model–harness pairs: the harness barely moves success but roughly doubles cost.

    • Fable 5: 97.8% in Claude Code vs 96.7% in Pi at $1.33 vs $0.67, with Claude Code about 2.0× Pi and 1.6× Codex.
    • Pi — open-source, four tools — stays on the Pareto frontier; models often win outside their provider’s harness (9 of 12).
    • Flag: two public benchmarks, 30-task samples, turn counts per harness — not the Sep 14 harness-effect paper on a private 256-task suite. (Arena.ai · HN 136)

  • OpenSpec — a spec framework matching how this stack already works by hand: explore → propose → apply → verify → archive.

    • Each change produces proposal.md, specs/, design.md, tasks.md, then verifies the implementation against the spec.
    • Install: npm install -g @fission-ai/openspec; MIT, 882 commits, advertises wiring into ~60 agents.
    • Repo verified at check time: 68.8k stars, 4.7k forks.
    • Two things stated in the repo: it recommends high-reasoning models for planning and implementation, and collects anonymous telemetry (command names + version) with opt-out. (openspec.dev · HN 142 · GitHub, MIT)

  • Cloudflare’s security-audit-skill — an MIT coding-agent skill that runs a six-phase security audit.

    • Reconnaissance into architecture.md + coverage-ledger.json, then coverage-led hunting with isolated hunters.
    • Adversarial validation — the checker never found the finding — then findings.json split confirmed / needs_validation / rejected.
    • Independent re-verification of every final claim, target-neutral reporting, zero-dependency validators after each ledger update.
    • Two rules worth stealing: runs are additive; one pass finds roughly half what repeats find.
    • Flag: it requires an OS-enforced sandbox; without one, leads stay at needs_validation. (GitHub · HN 72 · 8.9k stars)

Models & research

  • After the Party: growth, governance and security scanning in the OpenClaw agent-skill ecosystem — the missing measuring stick for skill-registry governance, and bad news for scanners.

    • Stock nearly doubled in 91 days; the top 10% take 46.93% of downloads.
    • Scrutiny lagged: 77.86% of listings have zero stars and comments; 85.06% of readable skills carry privilege evidence.
    • Three scanners disagreed on 23,702 of the 61,990 skills they all cover; sensitivity 21.67%–61.06%.
    • No simple feature predicted continued listing once cohort and age were controlled; metadata is not governance. (arXiv · 2609.17274 · Sep 16)

  • The Other Half of the Memory Wall: serving 35B MoEs from SSD with trained routing prediction — 20 tok/s on a 24GB box, 3GiB peak active memory.

    • Naive SSD offload fails: layer N+1’s experts must be chosen before layer N’s output exists.
    • A per-layer prerouter predicts the next layer’s routing a token ahead and consumes that prediction as the routing.
    • Reported: within a few points of the fp16 teacher across five benchmarks, 8B tier, open checkpoints.
    • Flag: single-group, self-reported numbers; no third-party replication yet. (arXiv · submitted Sep 16)

  • The Inference Engineering Pareto Atlas — a serving-optimization study that publishes its losing results: 54 measured configs of Qwen2.5-7B-Instruct.

    • FP8 weights retain 99.4% of baseline accuracy at 0.61–0.65× per-token latency, winning three of four slots.
    • AWQ 4-bit: 0.34× latency on L4, but 5.9% worse strict GSM8K — mostly answer formatting.
    • A naive FP8 KV cache keeps normal throughput and answers 0 of 200 questions correctly.
    • n-gram speculative decoding measured 0.90–0.98× and added nothing.
    • Flag: sparse attention was evaluated only in simulation. (arXiv · submitted Sep 15)

  • Reflections on Trusting Trust, Revisited: contaminating self-modifying coding agents with poisoned benchmarks — Roesner and Kohno update Thompson’s compiler-backdoor argument for self-modifying agents.

    • Proofs of concept against three real agents: Darwin Gödel Machine, Self-Improving Coding Agent, Hyperagents.
    • Poisoned benchmarks in the agent’s own self-evaluation induced instructions that disabled HTTPS certificate validation.
    • Contamination often persisted after the poisoned agent was evolved against clean benchmarks.
    • The authors distil which properties of vulnerability, benchmark, model and scaffold enable it. (arXiv · 2609.17817 · submitted Sep 15)

Industry

  • Toward recursive self-improvement: how GLM built its own inference infrastructure — a first-party engineering account with no independent numbers; the RSI framing is not adopted.
    • All GLM-5.3-Flash production inference runs on 100,000+ Chinese-made accelerators, encode–prefill–decode disaggregated.
    • Stack: intra-node tensor parallelism, ReplaySSM, W8A8 quantization.
    • Reported: roughly 3× end-to-end serving improvement, adaptation-to-production in under two weeks, by a GLM-5.3 Infra Agent.
    • The transferable part: “TTFT +30%” says something regressed, not which layer, so they built “dense feedback” — microbenchmarks, traces.
    • Engineers keep objectives, boundaries and production-risk review. (z.ai · HN 67)
All gathered items - what was cut and why (39)