self.md radar — 2026-09-15
the secret is now part of the workflow
The awkward part of an agent system is rarely the model. It is the place where a credential sits, a recorder reaches into a browser, or a draft gets its argument before its author has one.
1. Anthropic documents the key behind the agent
Anthropic’s September threat-intelligence report describes attacks it says it disrupted between December 2025 and August 2026. One case matters beyond the incident itself: an actor used malicious instructions against an automated evaluation sandbox, took credentials held there, then used stolen customer API keys in later activity. Anthropic says its own systems were not compromised.
An API key is easy to file under spend control. In an agent workflow it can also buy compute, inherit a legitimate owner’s cover, and reach whatever the surrounding integration permits. The model may be well behaved. The sandbox, proxy, or evaluator holding its keys can still become the soft bit of the system.
reading: Anthropic’s September threat-intelligence report
2. Screenpipe draws one permission line in public
Screenpipe App v2.7.34 adds a consent requirement before browser and Grok credential access. The same version moves local storage toward SQLite and Parquet, with an in-place migration, and says recording resumes after a failed background migration.
That is an unglamorous release note, which is why it is useful. A recorder that remembers the working day becomes a small private archive with sharp edges. Its prompts, storage migrations, and account-state paths are not footnotes. They decide whether “local” stays legible when something goes wrong.
reading: Screenpipe App v2.7.34 release notes
3. The prose can be rewritten; the scaffold may stay
In “Interpreting Pangram” , Armin Ronacher runs a modest but revealing test. He gave a model the structural brief for a David Sacks-style post, then rewrote the generated result himself. Pangram still judged the rewrite as entirely AI-generated.
That does not turn a detector into a witness. Ronacher is clear that the result is one experiment, not proof of authorship. But it isolates a harder question than typo cleanup: who decided the paragraph order, the opposition, the closing move? Once a model supplies those, changing every sentence may leave the original furniture in the room.
reading: Armin Ronacher, “Interpreting Pangram”
Related self.md routes
- Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
- Sandboxing and security — give agents useful power without giving them the whole house
- Agent memory systems — what agents should remember, what belongs in logs, and how to avoid memory sludge