Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

trusted records

AI is touching records people usually trust: commit metadata, agent custody, and public repo policy.

Published Updated Read 4 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-05-03

AI work is moving into the records people usually trust: commit metadata, agent custody, and the question of whether a public repo is now a liability.

The useful run today is blunt. VS Code touched Git history, Mendral put the agent loop outside the sandbox, and NHS England appears to be pushing open repositories behind approval gates because AI vulnerability scanners made leadership nervous.

1. VS Code made Copilot a commit co-author by default

sources:

what happened: Microsoft’s VS Code PR 310226 changed the Git extension setting from "default": "off" to "default": "all", then made the repository fallback do the same. That put Co-authored-by: Copilot into commits even when users said they had written the message themselves; one report said it still happened with chat.disableAIFeatures set. A maintainer later called it a regression and listed three fixes for 1.119: disabled AI should block it, attribution should not hit non-AI changes, and the default needs more test coverage.

why this matters: The provenance problem stops being philosophical when the editor mutates Git history after the user writes the message. If AI authorship labels are going to exist, the toggle has to live inside the user’s transaction, not behind it.

2. The agent loop wants custody, not just a sandbox

sources:

what happened: Andrea Luzzardi’s Mendral post makes the harness the thing to secure: the loop that prompts the model, executes tools, and feeds results back should run on the backend while the sandbox only receives tool calls. The operational bill is specific: durable execution with Inngest, sandboxes resumed from standby through Blaxel in 25ms, memories and skills moved into a database, and path routing for /skills/ and /memory/ so the model still sees file-shaped tools. The ugly edge is bash: grep -r can bypass the virtual filesystem, so they parse shell invocations with tree-sitter and call it good enough for now.

why this matters: This is what multi-user agents turn into once they leave a laptop. The hard part is not whether the model can run bash; it is where credentials, shared memory, and broken sessions live when several engineers point the same agent at the same incident.

3. Mythos panic reaches the public repo

sources:

what happened: Terence Eden reports that NHS England guidance note SDLC-8, sent April 29, makes source repositories private by default and allows public access only with explicit, exceptional approval. The attributed internal quote names Mythos-style AI vulnerability discovery as the trigger and says most repos will be removed for security reasons; Eden says there are thousands of NHS GitHub repositories and that his own open-source NHS implementation caused zero security incidents. That runs into UK guidance saying services should code in the open unless there is a good reason not to.

why this matters: AI code-scanning changes the politics of transparency before it changes the code. Closing a public repo is easy; proving that secrecy reduced risk without killing reuse is the part the dashboard will not show.

left on the table

  • Altman’s UBI-to-ownership turn stayed out because yesterday already shipped the ownership angle; the Reddit repost added no hard delta.
  • The Linux kernel vulnerability follow-up stayed out because yesterday already used CopyFail as the security signal: selfhosted thread .
  • Blender’s AI policy stayed out because yesterday already covered the Anthropic/Blender terms collision: policy note .
  • Graphify had good numbers, but it was another repo-context tool in a week already full of context plumbing: launch thread .
  • Kimi K2.6’s benchmark chatter lost to the custody/provenance items; the model race was not the sharpest operational change today: benchmark writeup .
agents governance security open-source provenance