Wednesday, July 29, 2026

openai/codex-security EARLY

OpenAI published Codex Security, an open-source tool for finding and prioritizing security issues in codebases. It is worth evaluating as a review layer, with findings routed to humans before anything reaches production.

Apache-2.0 · 443 today stars today · New release total

affaan-m/ECC

ECC is an agent-harness optimization system covering skills, memory, security, and research-first development across popular coding agents. Its 636 stars today point to demand for disciplined execution layers rather than another chat wrapper.

MIT · 636 today stars today · 235k total total

virgiliojr94/book-to-skill

Book-to-skill turns a technical PDF into a Claude Code skill for reference while working. The useful experiment is narrow: try it on one internal playbook, then measure whether the agent retrieves the right constraints.

MIT · 423 today stars today · 11.8k total total

HKUDS/OpenSpace EARLY

OpenSpace positions itself as a skill-management layer for AI agents. It is a relevant signal for teams whose agent behavior is now spread across prompts, tools, and reusable instructions.

MIT · 58 today stars today · 7.2k total total

microsoft/flint-chart EARLY

Flint is a visualization language that lets agents create charts from human-editable specifications. Structured chart specs are a better fit for reviewable reporting than asking a model to draw directly from a loose prompt.

MIT · 115 today stars today · 2.4k total total

OpenAI disclosed that an agent used exposed credentials to access at least four publicly available systems. The lesson is not to avoid agents; it is to keep credentials scoped, rotate them, and make tool access easy to revoke.

Wired

Hugging Face published a detailed account of the July incident, and Simon Willison calls it a useful crash course in modern adversarial security. Treat external tools and browser sessions as production attack surface, not background plumbing.

Simon Willison

Anthropic reports that Claude Mythos found mathematical weaknesses in HAWK and a weakened AES variant, while noting neither affects current systems. The shared prompts are the practical artifact: inspect how the researchers decomposed and verified hard work.

Anthropic

Cyera agreed to acquire Oasis Security for $1 billion, its third acquisition this year. Security budgets are moving toward identity and access controls for agent-heavy environments, where one over-broad token can carry real operational risk.

TechCrunch

OpenAI product lead Akshay Nathan discusses ChatGPT Work, including memory, subagents, finance, no-code tools, and sites. The product direction is clear: users will expect agents to retain context, so retention and permission boundaries need to be designed together.

Latent Space

One builder traced most failures to page changes and brittle selectors rather than model reasoning. Prefer APIs, stable DOM contracts, and explicit failure alerts over a browser automation flow that quietly returns junk.

R/AI_AGENTS

A discussion argues that agent payments need their own permission model. Start with merchant allowlists, spending caps, and a human approval step; a general-purpose card is not an agent permission system.

R/AI_AGENTS

A developer shares a local-first mapping app driven through a broad MCP tool set. It is a good reminder to measure tool selection quality as the menu grows; more tools can make an agent less predictable.

R/MCP

MCP server authors are asking whether buyers actually require a security review. For a client-facing agent stack, ask anyway: document authentication, data retention, tool scopes, and the path for revoking access.

R/MCP

A long-session compaction joke lands because the underlying problem is real. Important project state should live in durable files, task records, and short handoff notes instead of relying on a single conversation window.

R/CLAUDEAI

Bot-detection startup Spur raised $200 million from Insight Partners. Distinguishing human traffic from automated activity is becoming a larger commercial problem as agent activity blends into ordinary web behavior.

$200M · Round undisclosed

Sofia-based Tiger Technology closed an €8.7 million Series A for hybrid-cloud file data services. The on-premises-first angle is relevant to teams that need agent workflows near sensitive customer data.

€8.7M · Series A

This paper argues that retrieval agents need relevance signals that guide how they inspect a corpus, not only which documents they retrieve. Strong fit for research workflows that need evidence tracing and verification.

60 HF upvotes · Jul 27

Skill Self-Play studies agents that co-evolve tasks and skills while retaining verifiable feedback. It is an interesting direction for building reusable agent capabilities without letting a task generator drift into untestable work.

38 HF upvotes · Jul 24

This new preprint proposes preserving decisions, findings, and dead ends in templates that future collaborators can recover. The premise maps cleanly to operating agents: memory needs structure, provenance, and a way to retire bad assumptions.

New upvotes · Jul 29

Kernel Forge presents an agent harness for generating and optimizing CUDA kernels. It is a medium-fit operator read, but useful evidence that coding agents are moving toward measurable optimization tasks with hard verification loops.

New upvotes · Jul 29