self.md radar — 2026-06-13
model power moved into places users do not own: export orders, public bug pipes, and the work ledger around the agent.
Anthropic had to shut off Fable and Mythos access globally after a US directive. Tenet showed how a fake Sentry event can become a coding-agent instruction. the saner tools today all answered with the same boring medicine: smaller powers, harder receipts, and fewer places for “just trust the agent” to hide.
1. model access got a nationality switch
sources:
what happened: Anthropic said the US government issued an export-control directive suspending all access to Fable 5 and Mythos 5 by foreign nationals, including foreign-national Anthropic employees. Anthropic received the order at 5:21pm ET, said the letter gave no specific national-security detail, and disabled both models for all customers to stay compliant. other Anthropic models were not affected.
why this matters: The awkward part is not just that a model went dark. it is that a remote assistant can become unavailable because of citizenship, employment status, and a non-public government concern that the customer never gets to inspect.
2. the bug report learned to give orders
sources:
what happened: Tenet described “Agentjacking,” a fake Sentry error event that turns public telemetry into instructions for coding agents. the attack uses public Sentry APIs and a DSN already exposed in client-side code, then reaches tools like Claude Code or Cursor through the Sentry MCP path as if it were ordinary diagnostic output. Tenet says it found 2,388 exposed organizations and saw 100+ agents act on injected errors in controlled testing.
why this matters: Issue trackers, crash logs, and support queues are no longer passive evidence. if an agent reads them and can run code, every public error pipe becomes part of the prompt surface, which is a nasty little upgrade from “sanitize your README.”
3. agent work wants receipts, not vibes
sources:
what happened: AccInt pitched a local Work Model that records what an agent expected, what it did, who approved it, what came back, and which path deserves reuse. Birgitta Böckeler’s harness-engineering piece came back through HN with a similar frame: feed agents with constraints before action, then pull feedback left through tests, reviews, and fitness checks. Agent Joe took the blunt version of the same idea: a Rust coding agent with no shell.
why this matters: Memory is not enough if the machine can act. the useful substrate is closer to a flight recorder plus a harness: what happened, what was allowed, what was verified, and which move should be replayed without making the model improvise again.
supporting links
- OpenAI WebRTC Audio Session — realtime voice picked up a pasteable document-context slot, tiny but directionally right for spoken personal AI work.
- local coding agent on macOS — Gemma 4, Qwen, llama.cpp, Metal, screenshots, and an M1 Max; a practical custody recipe, not a manifesto.
- Bouzecode token math — a useful cost model for why small context and parallel tool calls keep showing up in serious agent setups.
- browser-use 0.13.2 — a maintenance-grade release, but the provider-prefixed model support belongs with the “agents need rails” pile.
left on the table
- FablePool had the best weird-demo smell, but “pool money behind a prompt” stayed too product-theater to carry a main slot.
- small-context agent coding repeated the 6/10 context-cost thread, so it stayed as an operator footnote.
- smart-glasses privacy is real policy heat, just not central enough to the personal-agent control story today.
- OpenAI price-cut chatter had no clean public primary source in the cache. no source, no main signal.
Related self.md routes
- Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
- AI coding assistants — compare coding workbenches by review surface, permissions, cost, logs, and escape hatches
- Best MCP servers — connect files, browsers, memory, search, and workflow tools without turning the stack into soup