Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

agent boundary receipts

A Bunq prompt-injection case, Anthropic's Fable safeguard reversal, and SkillJuror all pointed at the same operator problem: agents need visible boundaries and receipts.

Published Updated Read 4 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-06-11

the agent stack had to show its boundary lines today: a bank transfer became hostile context, Anthropic had to make a hidden refusal visible, and Skills stopped being a nice folder layout and started being measured as runtime behavior.

same old question, with better receipts: which text is allowed to steer the machine, and who finds out when the machine changes course?

1. a €0.02 transfer became model input

sources:

what happened: Blue41 published a Bunq case study showing an indirect prompt-injection path through ordinary banking data. Bunq is described as Europe’s second-largest digital bank with more than 20 million customers, and the proof of concept needed no malware or device access: the attacker sent a €0.02 transfer with a crafted payload in the transaction description.

when the victim later asked the AI assistant for recent transactions, the assistant retrieved that transfer, placed the description into the LLM context, and produced a credible reauthentication phishing message inside the bank’s own app. Blue41 says guardrails were already present; the payload worked because it blended into retrieved data and became dangerous only after the assistant used it.

why this matters: transaction metadata, calendar notes, emails, CRM fields, and uploaded documents are not passive once an agent reads them. every cheap third-party text field becomes part of the control surface unless the assistant can separate data from instructions before tool access enters the room.

2. Anthropic put the hidden brake back on-screen

sources:

what happened: one day after the Fable/Mythos system-card fight, Anthropic told WIRED it is changing the Fable 5 safeguard for frontier LLM development so users can see it. the company’s statement: “We made the wrong trade-off and we apologize for not getting the balance right.”

the earlier policy would have quietly degraded Claude’s help on requests Anthropic classified as frontier model development. Anthropic now says those safeguards will alert users when a request is refused or rerouted to a less capable model, while warning that visible enforcement may catch more benign requests until classifiers improve.

why this matters: this is the allowed repeat of the day because the object changed: not another hot take on Fable, but a vendor-level policy reversal. hidden steering is still a control plane; visible steering at least gives operators something to log, contest, or route around.

3. Skills got judged by their runtime trail

sources:

what happened: SkillJuror tested whether agent Skills behave differently when the same task knowledge is packaged as progressive disclosure instead of a normalized flat file. in an 82-task SkillsBench study, progressive disclosure changed what agents touched before it changed the final score: distinct Skill resources used per trajectory rose from 1.18 to 3.85, and effective uptake events rose from 1.33 to 3.92.

outcomes moved too, but modestly: 17 extra verifier-passing trials out of 410 matched trials, a +4.1% gain over the flat baseline. the paper is useful because it does not pretend folder structure is magic; progressive disclosure helped when supporting resources guided implementation, checks, or repair, and weakened when the task depended on exact formatting, numeric thresholds, or long artifact pipelines.

why this matters: Skills are not just documentation with better branding. the shape of the procedural memory changes what an agent reads, when it stops, and which checks it bothers to run.

  • Search Discipline for Long-Horizon Research Agents — a research-agent paper where the aggregate score picks the wrong candidate, and an external control loop can demote the winner after inspecting disaggregated behavior.
  • datasette-agent 0.2a0 — tools can now ask the user questions mid-execution through ToolContext, suspend the turn, persist it, then resume before side effects like saving SQL.
  • TKeeper — policy-governed signed intents for autonomous operations; a useful receipt layer, even if the repo is too narrow for a main slot today.
  • vaportrail — local-first flight recorder for Claude Code, Codex, and OpenCode sessions; small tool, correct instinct.

left on the table

  • HelixDB had real HN gravity, but graph-on-object-storage did not beat the agent-boundary pattern.
  • Addy Osmani’s agent-skills repo stayed out because Skills as a vendor/developer surface already ran this week; SkillJuror brought measured behavior instead of another catalog.
  • Search Discipline nearly made the main list, but two papers would have tilted the edition toward benchmark desk work.
  • Fable HN threads stayed as background noise; the repeat was allowed only for Anthropic’s visible-policy reversal.
personal-ai agent-control agent-safety skills