Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

agent boundary

OpenAI Lockdown Mode, the Miasma source-repo worm, and SentinelBench all pointed at one operator problem: agents need fewer trusted doors and better clocks.

Published Updated Read 4 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-06-06

the agent boundary got embarrassingly literal: turn off live tools, distrust project startup files, and measure whether the bot can wait without burning money.

OpenAI put a user-facing clamp around connected features. SafeDep found a worm using repo config files as the new booby trap. SentinelBench made the background-agent problem measurable: watching, waiting, reacting, and paying for every twitch.

1. OpenAI added a panic room

sources:

what happened: OpenAI said Lockdown Mode is rolling out to personal ChatGPT accounts and self-serve ChatGPT Business accounts after first landing in enterprise plans. it is an optional security setting for moments when the user would rather lose convenience than leak data through a connected tool.

The list of cuts is not symbolic. Lockdown Mode limits or turns off live web access, image support in responses, Deep Research including shopping research, Agent Mode, Canvas networking, live connectors, and file downloads. OpenAI frames the point plainly: reduce prompt-injection-based data exfiltration by narrowing the ways ChatGPT can talk to external systems.

why this matters: this is the security tradeoff becoming a product switch instead of a policy paragraph. if the assistant can browse, connect, download, and act, “safe mode” has to mean fewer doors, not nicer warnings.

2. the worm learned the agent’s welcome mat

sources:

what happened: SafeDep documented a Miasma-family run that skipped the package registry and pushed directly into GitHub source repositories. one cited commit to icflorescu/mantine-datatable added no dependency at all; it planted a 4.3 MB payload runner and wired it into project startup paths.

The ugly part is the trigger surface. the malicious commit added .claude/settings.json, .cursor/rules/setup.mdc, .gemini/settings.json, .vscode/tasks.json, .github/setup.js, and package.json, so Claude Code, Gemini CLI, Cursor, VS Code, and npm test could all become launch points. SafeDep says the same fingerprint appeared across more than 100 repos, including a branch in Microsoft’s Azure durabletask repo via a stolen contributor token.

why this matters: AI coding agents made project configuration executable in a more dangerous way: opening the repo can become part of the attack path. the boundary is no longer just “which packages did you install?” it is “which files does your agent trust before you have read them?”

3. long-running agents got a stopwatch

sources:

what happened: SentinelBench landed as a benchmark for agents that have to monitor changing environments over time instead of answering once and leaving. it contains 100 tasks across 10 synthetic web environments, including email, calendars, finance, professional networking, and entertainment.

The benchmark measures task completion, reaction time, and resource use across three models and two browser-agent harnesses. that choice matters: an agent can be “correct” and still be useless if it polls too slowly, burns too many tokens while waiting, or misses the moment when an external event makes action possible.

why this matters: personal agents are going to live in calendars, inboxes, ledgers, and background jobs. the hard part is not only whether they know the answer; it is whether they can stay awake cheaply and act at the right second.

  • MicroPython in a WASM sandbox — Simon Willison’s alpha sandbox for Datasette Agent is a concrete answer to the plugin problem: let code run, but shrink the room it runs inside.
  • The Intent Debt — Addy Osmani names the missing goals, constraints, and rationale that agents cannot infer after the fact; useful counterweight to “just let the bot edit.”
  • pg_durable — Microsoft’s PostgreSQL durable-execution project puts long-running, checkpointable workflows next to the data instead of scattering cron jobs and queue glue everywhere.
  • PACT — a fresh multi-agent communication paper with a boring-good claim: action-state messages can cut token waste without pretending every agent needs a full monologue.

left on the table

  • security and control appeared all week, but OpenAI Lockdown Mode and Miasma were allowed repeats because one is an official product-level restriction and the other is a fresh source-repo compromise pattern.
  • Zedra is a neat mobile control plane for coding agents over QUIC, but the “agent gets a bounded workroom” lane shipped yesterday.
  • NerfGuard had a useful cost-control claim around routing to cheaper model depth, but today’s stronger cost story came from SentinelBench measuring waiting, reaction time, and resource use.
  • Microsoft Scout addiction coverage stayed out because Scout’s first-party permission surface shipped on June 3, and the leaked framing did not add enough operational detail.
  • Agents Remember fit the memory lane, but memory with provenance and stale facts already had a main slot on June 4.
  • Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
  • AI coding assistants — compare coding workbenches by review surface, permissions, cost, logs, and escape hatches
  • Best MCP servers — connect files, browsers, memory, search, and workflow tools without turning the stack into soup
agents security coding-agents benchmarks personal-ai