self.md radar — 2026-06-02
an AI agent with account-recovery buttons is not support. it is infrastructure with a smiley face taped over the lock.
The useful split was brutal: Meta’s support bot showed what happens when a model gets a privileged action path, Aeracode wrote the old-web version of the fix, PyTorch turned AI-authored pull requests into review policy, and JetBrains open-sourced a smaller model for the cheap middle steps.
1. the support bot had the keys
sources:
what happened: 404 Media reported that attackers used Meta’s AI support chatbot to take over high-profile Instagram accounts by asking it to link a new email address to a target username. the article names a run of account takeovers around the same window, including the Barack Obama White House account, the Chief Master Sergeant of Space Force’s account, and Sephora’s account. Simon Willison put the ugly bit cleanly: this barely qualifies as prompt injection if the support bot is wired into the account-recovery path.
Aeracode published the boring fix on the same day. treat model output as untrusted input, constrain it with real output limits where possible, and never give the LLM a tool stronger than the user’s own rights.
why this matters: permission does not live in a prompt. if a bot can reset the account, leak the file, refund the order, or move the money, the guardrail has to sit in tool scope, audit trail, and escalation path — not in the bot’s manners.
2. PyTorch made slop someone’s job
sources:
what happened: PyTorch’s May 30 DevLog says many PRs to PyTorch are now AI-authored, so the team wrote down a playbook from its compiler offsite. in the conservative lane, the rule is still harsh and useful: the human should read every line, and the human is responsible for every line. cheap code makes review the choke point, so authors are told to write reviewer context, include a read order for big PRs, and avoid mixing cosmetic churn with semantic changes.
The mass-PR lane is stricter than the vibe would suggest. PyTorch says agent swarms can burn down low-hanging issues only when the aggregate ROI justifies the human review burden; as of the post, the project does not accept unreviewed AI-generated code into core, and even out-of-tree slop needs a named owner plus a human-designed API boundary.
why this matters: this repeats the review-bottleneck theme, but with a hard reason: a major production codebase turned it into policy. generated code is becoming less about whether an agent typed it and more about who owns the boundary, who read the diff, and what machine checks run before a maintainer loses an afternoon.
3. JetBrains put a small model in the workflow slot
sources:
what happened: JetBrains open-sourced Mellum2, a model trained from scratch for natural language and code and released under Apache 2.0. the headline spec is not giant-model theater: 12B total parameters, mixture-of-experts routing, and 2.5B active parameters per token. JetBrains says Mellum2 is meant for routing, summarization, Q&A, intermediate reasoning, sub-agents, and private deployment, with inference time cut to less than half of comparable models.
The company calls this a “focal model” philosophy: frontier models still handle the hard calls, while smaller fast models take the repetitive middle steps. that is a very different architecture from pretending one enormous chat brain should touch every part of the stack.
why this matters: agent systems are starting to look like systems again. one model plans, another routes, another compresses, another verifies — and the personal AI version only gets safer if the handoff log is visible enough to blame the right little machine when it does something stupid.
supporting links
- Jabsco — an RDP and Hyper-V agent surface where the VM or remote user account is the sandbox; that is the permission-table argument in work boots.
- Agent Deck — a signed Swift app for Pi that manages agents, skills, prompts, subagents, worktrees, and GitHub work instead of leaving the operator to juggle terminals by scent.
- RFC 2119 for AGENTS.md — compact MUST/SHOULD/MAY rules for agent files; a useful antidote to context-window constitution cosplay.
left on the table
- NVIDIA/Microsoft RTX Spark kept getting follow-on coverage, but yesterday already carried the agent-on-the-PC spec-sheet story.
- OWASP Agent Memory Guard had fresh benchmark details, including 92.5% recall and 100% precision across 55 tests, but the same project appeared in yesterday’s supporting links.
- revfactory/harness and ruflo had meta-agent gravity, but neither cleared the bar beyond “repo with a good pitch.”
- oh-my-pi was tempting because it fits the control-surface lane, but the seen ledger already had it through May 10.
Related self.md routes
- Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
- Best Claude Code plugins — choose the Claude-specific extensions worth installing, and the ones to skip
- Browser agents — where browser automation helps, where it lies, and how to keep it observable