Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

hidden brakes

Anthropic's Fable/Mythos release, a Microsoft Dynamics context benchmark, and a deployment-time memory paper all pointed at the same operator problem: agent control now lives below the chat surface.

Published Updated Read 4 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-06-10

The assistant stack had a weirdly honest day: Anthropic shipped a model with hidden braking, researchers measured how much context to throw away, and memory papers started treating deletion as something you can test.

Fable/Mythos is the loud object, but the useful pattern is smaller and meaner: the agent is now governed inside the model, inside the context window, and inside the memory layer. the pretty chat surface is just where the receipts leak out.

1. Anthropic made the brake part of the product

sources:

what happened: Anthropic launched Claude Fable 5 and Claude Mythos 5. Fable is the general-use version: same Mythos-class capability story, but with classifiers that can route cybersecurity, biology/chemistry, and distillation requests to Claude Opus 4.8 instead; Anthropic says users are told when that fallback happens and that more than 95% of Fable sessions do not hit it.

The quieter part is in the system-card discussion Simon Willison surfaced. Requests aimed at frontier LLM development can be silently damped by prompt modification, steering vectors, or PEFT-style interventions, with no fallback and no user-visible signal; Anthropic estimates that slice at about 0.03% of traffic, concentrated in fewer than 0.1% of organizations.

why this matters: For personal agents, the control plane is no longer only your permission prompt, sandbox, or API key table. the model vendor can now change the work itself, and “you will be told” is already not universal.

2. less context beat full context in the hotel-expense grind

sources:

what happened: A new paper tested long-horizon tool use inside Microsoft Dynamics 365 Finance and Operations, using Model Context Protocol tools on a 50-task hotel-expense benchmark. the no-user-model baseline completed only 8.0% of itemizations; keeping full conversation history got to 71.0%, but burned 1,480,996 tokens and 14.56 hours per benchmark.

Pruning to the last 5 tool call/response pairs improved completion to 79.0% while cutting token use to 535,274 and runtime to 5.39 hours. pruning plus automated summarization did best: 91.6% complete itemization, 99.64% average amount itemized, 553,374 tokens, and 5.79 hours.

why this matters: Agent context is not a diary. it is a working set, and a pile of old tool responses can make the agent slower, more expensive, and less correct than a small, current, well-summarized state.

3. memory deletion finally got a residue score

sources:

what happened: Another new paper frames persistent agent memory as deployment-time memorization, not just a nice personalization feature. it measures Personalization Recall, Adversarial Extraction Rate, and a new Forgetting Residue Score for the ugly question: after you “delete” something, can it still be recovered from summaries or derived memory tiers?

On LongMemEval, key-fact summarization reduced canary extraction by 76% on Gemma 3 12B and 64% on GPT-4o-mini while keeping nearly all personalization recall. but raw-only deletion left derived summary copies recoverable in about 20% of cases; only full-pipeline purge or tombstone redaction drove worst-tier residue to zero.

why this matters: A memory system does not earn trust because it has a delete button. it earns trust when every compressed, summarized, retrieved, and cached copy obeys the same deletion contract.

  • Nucleus — Nix-native container runtime with agent mode, strict agent mode, cgroups, namespaces, seccomp, Landlock, and optional gVisor; good operator material, but the sandbox lane has been crowded all week.
  • Browser Use 0.13 — new Rust-backed beta agent and browser harness for frontier models; browser agents keep moving toward coding-agent-style recovery loops.
  • planning-with-files — markdown planning files as shared state across Claude Code, Codex CLI, Cursor, Hermes, Pi, Kiro, OpenCode, and SKILL.md-compatible agents.
  • AgentsView custom pricing — a tiny TIL, but useful: once Fable landed, token-accounting tools immediately needed editable model prices.

left on the table

  • Nucleus had the right isolation smell, but recent Radar issues already hit sandboxes, gVisor, credentials, and agent workrooms hard.
  • planning-with-files stayed supporting because it is a good repo gift, not a stronger main signal than a vendor-level model-control change.
  • Browser Use 0.13.1 mostly rode the Fable release, including a note that Anthropic tool choice is automatic when thinking and cannot be forced.
  • the memory slot was the one allowed repeat: deployment-time memorization made it in because it brought a deletion benchmark, not another memory plugin.
  • Claude Fable HN threads stayed out as texture; the durable evidence was Anthropic’s launch, the system card, and Simon’s read of the invisible-safeguard clause.
  • Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
  • AI coding assistants — compare coding workbenches by review surface, permissions, cost, logs, and escape hatches
  • Best MCP servers — connect files, browsers, memory, search, and workflow tools without turning the stack into soup
personal-ai agent-control memory context-engineering