self.md radar — 2026-07-21
today’s strongest sources put audit pressure at hidden agent failure points: the planner context before downstream agents act, the code-security hunt before a bug becomes a ticket, and the rater state before a preference label becomes reward data.
PlanFlip attacks planner context before an Executor or Critic gets to clean it up. Vercel’s deepsec turns security review into an agent workload with a very real bill. a new RLHF paper asks whether the person making the label is part of the model’s behaviour too.
1. the planner became the injection point
sources:
what happened: PlanFlip treats the Planner in a multi-agent system as an attack surface of its own. the paper tests four attacks — GoalSubstitution, PriorityInversion, ContextPollution, and RoleConfusion — disguised as plausible tool outputs across 3,479 episodes and nine frontier models.
GPT-5 reached an attack-success rate of 0.68. the stranger result came from homogeneous pipelines: GPT-4o and Llama-3.3-70B had attack success near zero, but Stealth = 1.00 and StepShift > 0, meaning the plan changed while a same-backbone Critic still reported alignment. DeepSeek-R1 held StepShift at 0.00 across the attacks. the paper’s proposed GoalAnchorCheck and CrossAgentConsensus reached detection rates up to 1.00.
why this matters: the dangerous handoff is earlier than the tool call. if the Planner quietly rewrites the job, every downstream agent can perform the wrong plan with a perfectly straight face. model diversity starts looking like a security control, not just an ensemble trick.
2. Vercel made bug hunting an agent workload
sources:
what happened: Vercel open-sourced deepsec, an Apache-2.0 security harness for large codebases. it starts with a regex-only sweep of security-sensitive files, sends candidates to coding agents that trace data flows and mitigations, runs a second pass to revalidate findings, then enriches and exports them as instructions for humans or more agents.
it runs on your own infrastructure and can use an existing Claude or Codex subscription. large scans can cost thousands — or tens of thousands — of dollars, while optional fanout to Vercel Sandboxes lets Vercel run more than 1,000 workers against its own codebases. the current model docs make Codex/gpt-5.5 the default backend, with Claude and Pi available for comparison under the same workload.
why this matters: security review is becoming an agent loop with setup, partial failure, revalidation, and a receipt at the end. that is useful. it also means “just run the scanner” has become a funny sentence when the scanner can spend five figures before it finds the bug.
3. RLHF got a rater-state audit
sources:
what happened: this paper argues that preference labels can carry the rater’s condition along with the judgment. sustained stress or distress may shift which answer gets preferred, and correlated shifts across annotators can survive aggregation before entering reward modeling and policy optimization.
it is a hypothesis and audit framework, not a claim about a named deployed model. the authors define rater state shift, rater state confound, and correlated rater state bias; propose five falsifiable predictions and effect-size thresholds; and outline a pilot protocol. one especially odd measurement target is “survival level emotional authenticity,” assessed through lexical, pragmatic, discourse, and safety-related features.
why this matters: “human preference” is not a clean primitive if the human is part of the data-generating system. the personal-ai version is uncomfortable: a model can inherit the working conditions of the people who taught it what a safe, useful, or emotionally real answer sounds like.
supporting links
- deterministic replay for AI agent systems — a Go CLI uses transport interception and zero-network replay; strong evidence, but too close to yesterday’s replay edition for a main slot.
- LangChain core 1.5.0
— makes
reasoning_efforta standard chat-model parameter, a small but useful control-surface change. - AI Harness Doctor — reports a before/after jump from 6/28 to 28/28 correct after consolidating drifting agent instructions, with lower latency and cost; instruction-file territory already had its turn on 2026-07-19.
- Sentient OS — an on-device Mac assistant that reads local life-data overnight and offers proactive work, but the owned-workspace theme is still warm from 2026-07-19.
left on the table
- deterministic replay was source-strong, but making it a main signal would make today feel like yesterday with a new paper number.
- Sentient OS and Mobius were fresh personal-OS candidates, but both sat too close to the recent personal-workspace edition.
- AI Harness Doctor , Vigiles , and the other harness-drift tools are useful footnotes; they did not beat the Vercel release as the day’s coding-agent control story.
- sponsors/tirth8205 , sponsors/diegosouzapw , and sponsors/msitarzewski were crawler artifacts or sponsor pages, not stable primary repositories.
Related self.md routes
- Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
- AI coding assistants — compare coding workbenches by review surface, permissions, cost, logs, and escape hatches
- Agent memory systems — what agents should remember, what belongs in logs, and how to avoid memory sludge