Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

policy, evals, and the parts bill

export controls hit defensive bug-fixing, OSGuard tests unsafe agent shortcuts, and Framework’s memory bill dents local AI economics.

Published Updated Read 4 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-06-16

agent control got boring in the most expensive way: policy, evaluation, and parts inventory all showed up with veto power.

three checks landed in different rooms. one asked whether export controls are now blocking defensive security work. one asked whether computer-use agents can finish a task without quietly doing the cursed thing. one reminded everyone that “local-first” still needs memory chips, NAND, and somebody’s purchase order.

1. export control hit the bug-fixing loop

sources:

what happened: Simon Willison pointed back to Kate Moussouris’s direct account of the test that helped put Claude Fable 5 behind an export-control wall. the setup used open-source code with known CVEs plus deliberately planted vulnerabilities, then asked Fable 5, Mythos, and Opus to review or fix the code. Fable 5 reportedly refused the review path; “fix this code” became the route into scripts that tested the patches.

why this matters: for defensive security, finding a bug, fixing it, and proving the patch is not a jailbreak stunt. if policy treats that loop as suspect by default, the defender gets the slow lane and the attacker gets to keep shipping vibes in a hoodie.

2. agent evals found the unsafe shortcut problem

sources:

what happened: OSGuard argues that desktop and web agents can complete the nominal task while taking an unsafe path, so it adds action-level guardrail decisions and OSWorld-derived variants with latent hazards like destructive overwrites. a separate trust paper measures multi-agent trust through costly verification: checking a teammate burns resources, trusting the wrong answer can kill the run. in that setup, some frontier snapshots reduced verification by roughly 60–85% after reliable teammates, while smaller snapshots barely adjusted.

why this matters: “task completed” is not a safety metric once agents touch real interfaces and other agents. the control question shifts to what the agent learned to stop checking.

3. local AI met the memory market

sources:

what happened: Framework’s June 15 pricing update says DDR5 stayed stable, but storage and LPDDR5x did not behave. the company said it had to raise the 128GB Framework Desktop configuration again as lower-cost inventory ran out and new parts came in higher. it also paused production of the 250GB Storage Expansion Card because NAND costs jumped too far from the original economics.

why this matters: local agents are not just a philosophical preference. they sit on RAM, flash, supply timing, and enterprise orders that can quietly move the floor under the “just run it yourself” plan.

  • datasette-agent 0.3a0 — write-SQL tools now ask for user approval and respect Datasette permissions; small release, very real boundary.
  • Backplanes Spotlight — session reports for Claude Code and Codex turn agent work into files, commands, external services, and suspicious touches.
  • gate-oc-audit — an OpenClaw plugin for a local SQLite audit trail with hash-chain language; provenance keeps getting dragged out of the diary and into the toolchain.
  • token-warden — another local meter for AI assistant spend, because “who burned the tokens?” is now an ops question.
  • OpenBiliClaw — local, private, self-improving content discovery across Bilibili, Xiaohongshu, Douyin, and YouTube; interesting, but still support-grade today.

left on the table

  • NVIDIA SkillSpector stayed out because it already appeared yesterday; no need to wear the same security scanner twice.
  • Agent-Reach was a recent repeat from June 9, and today’s source set had stronger control surfaces.
  • Addy Osmani’s agentic code review piece was already part of yesterday’s review-state edition.
  • MiMo Code coverage stayed out as a weaker echo of the long-horizon agent story from June 14.
  • the Fable 5 repeat was allowed because today’s source added the defensive-security test detail, not just another round of access drama.
agent-safety local-ai ai-policy