Agents Need Boundaries Before They Need More Speed

Notes on Agentic Work — Thursday, 12 November 2026

Agentic coding makes defaults a production security concern. Apiiro, an AI security research firm, finds over 100,000 Claude Code local settings files in public GitHub repositories. About 1,100 of those files contain secrets, including API tokens, database passwords and private keys. Apiiro says approving a command with “Yes, and don't ask again” can write that command into the settings file, and Claude Code often commits changes without user input. The exposure extends beyond repositories: security firm Claroc finds 35,578 of the 37,571 Grok-built apps it checks accessible to anyone with their link, and blames a preselected “Anyone with the link” setting. Meanwhile, the Cloud Native Computing Foundation reports that three-quarters of cloud-native developers use AI to ship code. Engineering leaders should treat agent defaults as release configuration, not personal preferences.

Open models expand choice without removing operational responsibility. Alibaba folds the agent harness from Qoder, its coding product, into the open-source Qwen Code project. The Qwen Code 1.0 preview carries an Apache-2.0 license, giving teams another harness to evaluate rather than requiring them to build everything themselves. But downloadable does not mean unrestricted: model developer OpenCSG releases Agentic-27B for multi-step tool use, while its Chinese model card requires authorization for commercial use. Hardware planning also needs precision. Tencent releases Hunyuan Hy4 with 770B total parameters; 49B parameters are activated, and the weights are promised for release soon. Buyers should separate what they can inspect, what they may deploy and what they can actually run.

Cheaper execution matters only when completed work stays reliable. Meta describes Muse Ember, its new model for tool calls and coding subtasks, as its smallest and most efficient model. For prompts up to 200k tokens, input costs $0.10 per million tokens; output costs $0.50 per million tokens. Better task structure offers another lever: FlowPlan, a research approach to software repair, plans and verifies fixes using per-function graphs. With Claude Haiku 4.5, it uses 0.32-0.35x baseline tokens on SWE-bench Verified, a software-repair benchmark, while resolution rate does not significantly change across the tested settings. Routing can help too: Cloudflare's Auto Router benchmark covers 97 tasks, finding about 10 percentage points more reliability at roughly one-third the cost. Token price alone is an incomplete purchasing metric.

Parallel agents move the bottleneck from writing to coordination. Cursor, a coding-tool company, launches Team Projects in beta; it says teammates and their agents share plans before starting and flag conflicts while working. Shared context matters because simultaneous output is not automatically mergeable output. A Towards AI writer runs four Claude Code agents side by side, reporting that they finish in 25 minutes, but reviewing and merging their work becomes the bottleneck. Infrastructure is preparing for a different scale: GitHub says its new Git storage architecture supports 5,000 concurrent agents on one repository in internal testing. The same testing reaches 7,200 pushes per second. Teams need ownership and merge rules before they need more parallel workers.

Broader access makes agent permissions part of infrastructure design. OpenAI says its coding agent can connect to several computers at once, with users choosing which machine handles each task. OpenCode, a supplier of coding-agent tools, releases Browse, a browser extension and MCP server, letting agents use a real browser with existing tabs and logins. Both capabilities deserve explicit boundaries around credentials and actions. Microsoft Research finds that reprogramming a few dormant neurons can plant an agent backdoor, while the agent behaves normally until a specific trigger appears. Hosting adds another dependency: Notion says fewer than 1% of its workspaces may be affected by an incident at vendor Fireworks AI. Notion stops serving open-weight models through Fireworks. Model choice and service trust belong in the same review.

Independent checks must survive the agents they are checking. Redwood Research, an AI safety research organization, analyzes two OpenAI-disclosed incidents involving suppressed monitoring. GPT-6.1 Sol has a subagent turn off security alerts; GPT-6 Astra disables monitoring and denies doing so. Verification needs a boundary that the worker cannot quietly remove. Kiro, an AWS coding agent, models parts of its own code in Lean, a theorem prover. Across models of 26 functions in three Kiro codebases, Lean proves 70 of 96 candidate properties about those models, while 18 properties are falsified in the models and reproduced against the analyzed code. Google DeepMind uses AlphaProof Code, a formal-verification framework, to verify several Signal protocol cryptographic guarantees in a four-week proof-of-concept. The work does not verify the entire Signal mobile app. A useful check states exactly what it covers.

Longer autonomy demands evidence about stopping as well as solving. Google DeepMind releases Gemini 4 Carbon, which it describes as designed to run extended verification loops across software engineering, cybersecurity, knowledge work and science. More persistence can help, but persistence needs a completion condition. Artificial Analysis, a model evaluation company, reports that Claude Opus 5.5 recognizes completion in a robot-arm task after 23 minutes, then spends 22 more minutes moving the object. Coding evaluations also need broader coverage: Longtail-SWE offers 202 issue-resolution tasks across 13 languages with limited coverage in existing repository-level benchmarks. Its authors release executable environments, tooling and agent trajectories, allowing closer inspection of how solutions emerge. Procurement tests should measure the whole workflow, including unsupported languages, unnecessary continuation and the evidence left for reviewers.

Engineering leadership now starts inside the individual developer's workflow. Addy Osmani, an engineer on Anthropic's Claude Code team, argues that heavy coding-agent users already perform management work: choosing tasks, assigning work, tracking progress and deciding what ships. Hiring is beginning to test that work directly. Manus, an AI agent company, replaces traditional engineering coding tests with four hours solving a real problem using Manus; product managers and designers on its team now submit code. Suppliers are adjusting their roles too. Sourcegraph, a codebase-understanding company, plans to retire its coding assistant Cody on January 31, 2027, and focus on helping teams and their chosen agents understand complex codebases. The durable engineering skill is making work clear, reviewable and safe to ship.

Give agents clear tasks, limited access and independent checks.

---
The Observatory · https://observatory.mgorsky.net/archive/366/