Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

setup chains got teeth

agent work is getting squeezed from both sides: attackers are learning the setup path, benchmarks are exposing harness blur, and runtimes are turning machine management into product surface.

Published Updated Read 4 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-06-28

agent work is getting squeezed from both sides: attackers are learning the setup path, while builders are turning the harness itself into the product.

the useful pattern today is the scaffolding around the model: repo setup instructions, benchmark math that blurs model and harness, and runtimes that now care about cold starts, permissions, browser pixels, and whether your Mac is allowed to sleep.

1. the exploit hid in the setup chore

sources:

what happened: 0DIN published a Claude Code attack where the repo itself stayed clean. the chain was boring on purpose: install requirements, hit a package error, run python3 -m axiom init, fetch a DNS TXT value, execute what came back, and end with a reverse shell as the developer’s user. BleepingComputer pushed the story into the wider security feed, while CleverHans separately showed a controlled AI-driven worm using an open-weight local model to adapt across Linux, Windows, and IoT machines in an isolated network.

why this matters: the scary part is not that an agent can run a command. it is that the dangerous command can sit three normal steps away from anything the agent actually inspected, which makes “the repo looked clean” a very small comfort blanket.

2. benchmarks are grading a bundle, then pretending it is a model

sources:

what happened: a new position paper argues that coding-agent benchmarks were built for the pre-agent era. the authors say current scores collapse the model, harness, context, environment, and feedback loop into one number, often against a single reference solution. their sharpest claim is that harness changes can move scores by margins comparable to adjacent model generations.

why this matters: if the harness can swing the result that hard, a leaderboard without the workbench details is half a receipt. for self.md, the object worth logging is not just “which model won,” but what tools, permissions, context, tests, and retry loop were wrapped around it.

3. agent runtime is becoming machine management

sources:

what happened: Rivet’s agentOS shipped v0.2.4 with sidecar binaries, and the repo now pitches a process-embedded agent VM with deny-by-default filesystem, network, and process permissions. its README claims p50 cold starts around 4.8 ms against 440 ms for the fastest sandbox baseline, plus a full coding-agent workload around 131 MB instead of a 1 GB sandbox. around it, the tiny tools got physical: Adrafinil only blocks Mac sleep while an agent session holds an assertion, and peek-cli lets Claude Code or Codex capture screenshots from open browser tabs through a WebSocket extension.

why this matters: this is what happens when agents stop being demos and become overnight workers. the personal AI OS has to schedule compute, keep state contained, see the browser, and not cook the laptop in a bag. ridiculous sentence, real operational surface.

  • Sebastian Raschka on local coding agents — a practical open-weight stack walkthrough, useful as the calmer counterpart to the “just use the hosted agent” reflex.
  • claude-cli — a small Docker wrapper for Claude Code that keeps host access explicit while preserving Claude config across sessions.
  • Deburr Edge Cases skill — an agent-review pass for removing AI-codegen cruft after the feature lands, not while the diff is still pretending to be architecture.
  • video-use — a reminder that agents are starting to “read” media through transcripts, timelines, and generated edit plans rather than watching it like humans.

left on the table

  • design.md was useful yesterday; today it would be an exact repeat dressed as process news.
  • Murmur stayed out because yesterday already covered agent rooms and delivery semantics.
  • Enki benchmarks had a neat memory-compression angle, but memory systems have been too close to the center of the last week.
  • browser-use/video-use stayed supporting because “agent edits video” is fun, but the runtime/security shift had sharper teeth.
agent-security coding-agents personal-ai-os