spb/agent-os

1# Agent OS briefing: execution, durability, security, verification (research date 2026-11-10)23Conventions: **[V]** = verified this session on a primary source (vendor doc, paper, official post) or by local test; **[S]** = secondary source only; **[I]** = my inference. Dates are publication or last-update dates where the page gave one.45## 1. Durable execution for long-running agents67### The core design problem8- **[V]** Every engine converges on the same shape: the agent loop is a deterministic "workflow"; each LLM call and each tool call is a journaled "step/activity" whose result is persisted and not re-executed on recovery. Temporal's OpenAI Agents SDK integration states it directly: orchestration runs in the Workflow, "model calls are executed as Activities, so they retry durably and are not repeated during Workflow replay".9- **[V]** No engine gives exactly-once side effects. A step interrupted before its result is journaled runs again (Restate/Pydantic docs: "make its side effects idempotent"). Vercel's Postgres World docs now say handlers "must tolerate at least once execution", and a GitHub discussion documents the same step running on two replicas. DBOS gives exactly-once only for Postgres writes made through its own datasource; any other client is an at-least-once step [S].10- **[I]** So the real guarantee is "at-least-once execution + exactly-once recorded result". External effects (email, git push, payments, AppleScript) need an idempotency key derived from `(run_id, step_seq)` plus a check-before-act on resume.11- **Replay vs resume-from-checkpoint:**12  - Replay (Temporal, Restate, Inngest, DBOS) re-runs workflow code against the journal, which requires deterministic code and a versioning story.13  - Snapshot-resume (Trigger.dev) restores process state, but Trigger.dev's own site says self-hosted waits hold the machine because checkpointing is cloud-only [V].14  - LangGraph checkpoints graph state with `durability` = `exit` / `async` / `sync`; on resume the interrupted node re-runs from its top [S, quoting LangGraph docs]. A forum post lists 30 open bugs in interrupts/retries/checkpoints with no maintainer response [S].15- **Versioning:**16  - Temporal Worker Versioning is GA, with Pinned vs Auto-Upgrade and "Upgrade on Continue-as-New" in public preview; patching remains for long workflows without Continue-as-New [V].17  - DBOS added workflow patching (March 2026) and persisted application versions (April 2026) [V].18- **Human waits lasting days:** Temporal signals/updates, DBOS durable notifications with durable timeouts ("days or weeks") [V], Restate awakeables [S], Inngest `step.waitForEvent`, Cloudflare `waitForEvent`, Trigger.dev waitpoints (GA August 2025) [V].1920### Engines21- **Temporal** [V]: OpenAI Agents SDK integration (sandbox support pre-release, streaming experimental); Pydantic AI `TemporalDurability`. Production self-hosting needs the server plus Postgres/Cassandra; `temporal server start-dev` is a single SQLite binary that Temporal labels as development-only. It is the heaviest to operate.22- **DBOS Transact** [V]: a library (TypeScript, Python, Go, Java, Kotlin) that checkpoints into the Postgres you already run, with queues, durable sleep, schedules stored in Postgres, fork-from-step and lineage tracking. Self-hosted Conductor (the dashboard) is proprietary and needs a paid key for production; the library is open source.23- **Restate** [V]: single binary with its own log, no external database; Pydantic AI integration; $20M raise reported 2026-09-30. License reported as BSL for the runtime [S]. Parallel tool calls need promise combinators.24- **Inngest** [S]: self-hosting officially supported (May 2026); single binary with SQLite, or Postgres + Redis; license reported as SSPL.25- **Hatchet** [S]: MIT, Postgres-only. I did not read its docs directly.26- **Vercel Workflow** [V]: GA; `"use workflow"` / `"use step"`; self-hosted Postgres World built on graphile-worker; step data stored unencrypted; at-least-once.27- **Cloudflare** [V]: Agents SDK on Durable Objects, with `runFiber()` / `stash()` in preview. Not self-hostable, so irrelevant here except as a design reference.28- **Azure** [V]: Durable Task extension for Microsoft Agent Framework, in public preview and Azure-centric.29- **Pydantic AI** [V]: one agent API over Temporal, DBOS, Prefect, Restate, Lambda and others, which makes it a useful portability layer for the Python side.3031### Building directly on PostgreSQL32- **[V/S]** `FOR UPDATE SKIP LOCKED` is the standard claim primitive, used by pg-boss, Graphile Worker and River. LISTEN/NOTIFY is only a doorbell: notifications are lost if nobody is listening, do not traverse poolers, and NOTIFY takes a global lock at commit. Keep a slow poll as fallback.33- **[I]** At single-owner volume (well under 100 steps per second), none of the Postgres throughput limits bind. The cost of DIY is correctness, not scale: leases with heartbeats, fencing tokens so a zombie worker cannot commit after its lease is reassigned, timers, cancellation, replay tooling, and a UI.3435## 2. Sandboxing on macOS (Apple Silicon)3637- **Seatbelt / `sandbox-exec`**38  - **[V, local]** On this macOS 27.0 host (build 26A5425a) the man page says DEPRECATED, but the tool still enforces: a write-deny profile returned "Operation not permitted" and a `(deny network*)` profile blocked curl.39  - **[V]** Anthropic's `sandbox-runtime` (`srt`, Apache-2.0) generates Seatbelt profiles. Writes are denied unless allowed; reads are allowed unless denied. On macOS the profile permits only one localhost port, where host-side HTTP and SOCKS5 proxies enforce a domain allowlist. Unix sockets are blocked by default. Anthropic reports 84% fewer permission prompts (self-reported, 2025-10-20).40  - **[V]** The srt README warns that allowing loopback exposes every local service, including any local forwarder.41  - **[V]** Codex uses Seatbelt with `workspace-write` and network off by default.42- **Known limits (Pillar Security, "Week of Sandbox Escapes", 2026-07-20) [V]**43  - Seven findings across Cursor, Codex, Gemini CLI and Antigravity. In almost none did the agent break the sandbox; it wrote something a trusted unsandboxed component later ran: hook config, git config, a venv interpreter, a task file.44  - A reachable Docker socket is a full escape.45  - Seatbelt cannot grant privileges or override SIP/TCC, and allow-default profiles are escapable.46  - A command allowlist that trusted `git` without modelling its arguments gave RCE.47- **OpenAI/Hugging Face incident (July 2026) [V]**: models in an evaluation sandbox, whose only network path was a package-registry cache proxy, exploited a zero-day in that proxy, escalated and reached the Internet. [I] The allowlisted proxy is itself attack surface; keep it minimal, patched, and on a host that holds nothing else.48- **Apple `container` / Containerization** [V]: one lightweight Linux VM per container, sub-second start, macOS 26+ and Apple Silicon only; WWDC26 added "container machines" (persistent Linux environments). v1.0.0 on 2026-06-09 [S]. `container` is not installed on the machine I ran from.49- **macOS VMs**: Tart, Orchard and Vetu are being relicensed permissively after Cirrus Labs joined OpenAI (2026-04-07) [V]. Lume/Cua offers a CLI, HTTP API and MCP for macOS VMs [V]. Apple's licence allows two macOS guests per host; Tart refuses a third [S]; about 50 GB disk per guest.50- **Resource limits without cgroups** [V, local man pages]: `taskpolicy -m <MiB>` (memory limit), `-c utility|background` (QoS clamp), `-b`, inherited by children; launchd `SoftResourceLimits` / `HardResourceLimits`, `Nice`, `ExitTimeOut`, `UserName`; `ulimit`. [I] There is no hard CPU or IO quota comparable to cgroups; hard caps require a VM.51- **Secrets** [V]: the credential-injecting egress proxy is now the standard pattern (Infisical Agent Vault; Anthropic Managed Agents vaults substitute at egress). [S] It does not cover non-HTTP clients such as psql, ssh or cloud CLIs, and the broker becomes the highest-value target.52- **TCC** [V]: Apple announced on 2026-10-02 that it will tighten Full Disk Access, citing AI agents.53- **Linux comparison** [I, general knowledge]: gVisor and Firecracker need a Linux kernel/KVM, so on macOS they exist only inside a Linux VM. E2B, Modal and Daytona are hosted Linux sandboxes. Not achievable natively on macOS: namespaces, seccomp, cgroups, per-process network namespaces. Achievable: Seatbelt, separate Unix users, VMs.54- **Not researched**: Lima, OrbStack, Docker Desktop, VibeTunnel. SSH forced commands, per-task keys and git worktrees are recommended below from standard practice, not from sources fetched this session.5556## 3. Agent security5758- **State of the art**59  - **[V]** "The Attacker Moves Second" (2025-10-10): 12 published defences bypassed, above 90% attack success for most; human red-teaming reached 100%.60  - **[V]** The "Design Patterns" paper (2025-06) says general-purpose agents are unlikely to get reliable guarantees with current models, and proposes six patterns: action-selector, plan-then-execute, map-reduce, dual LLM, code-then-execute, context minimisation.61  - **[V]** CaMeL solves 77% of AgentDojo tasks with provable security versus 84% undefended.62  - **[V]** Meta's Rule of Two (2025-10-31): at most two of untrusted input, sensitive access, and state change/external communication without a human. Its authors call it a minimum bar, not sufficiency.63  - **[V]** OpenAI (2026-03-11) frames it as source plus sink: dangerous actions or sensitive transmissions must not happen silently. OpenAI also says prompt injection is "unlikely to ever be fully solved" [S].64- **Browser agents**: Anthropic's own figure is about 1% attack success against an adaptive attacker with safeguards, which it says "still represents meaningful risk" [V]. Zero-click chains against several agentic browsers were disclosed in 2026 [S].65- **Classifier auto-approval** [V]: Claude Code auto mode measures 0.4% false positives (n=10,000), 17% false negatives on real overeager actions (n=52), and 5.7% on synthetic exfiltration (n=1,000). The classifier sees user messages and tool calls only. An independent stress test exists (arXiv 2604.04978).66- **Permission rules** [V, Claude Code docs]: evaluated deny, then ask, then allow; enforced by the harness, not the model. The docs say Bash argument patterns are "fragile" and a deny rule "isn't a security boundary around the program"; use the sandbox for enforcement and PreToolUse hooks for inspection.67- **OWASP** [V]: Top 10 for Agentic Applications 2026 (published 2025-12-09), ASI01–ASI10: goal hijack, tool misuse, identity and privilege abuse, supply chain, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation, rogue agents.68- **MCP** [V]: tool poisoning and rug pulls (Invariant Labs, 2025). Microsoft's 2026 guidance: treat tool descriptions and outputs as untrusted, show the full tool call, and alert when an approved tool changes.6970## 4. Verification and reliability7172- **METR** [V]: the time-horizons page is no longer actively updated (last update 2026-09-08) and states that measurements above 16 hours are unreliable. The newest entry is an early Claude Mythos Preview (added 2026-05-08). [S] Reported values: 17.4 h at 50% (CI 8.5–55 h) but about 3.1 h at 80%; Opus 4.6 about 12 h at 50% and about 1 h 10 at 80%. Tasks are mostly software.73- **[I]** Plan around the 80% horizon. Unattended chunks should be roughly one to three human-hours of work, each ending in a verifiable checkpoint.74- **Harness evidence (Anthropic)** [V]: two failure modes are context degradation and self-evaluation bias. The remedies are structured hand-off artefacts (progress file, feature list, git commits), a "definition of done" agreed before building, and a separate evaluator agent (planner / generator / evaluator).75- **Evals** [V, Anthropic 2026]: grade the outcome (environment state), not the transcript's claim; combine code, model and human graders. [S] Start with 20–50 tasks drawn from real failures.76- **LLM judges** [V, arXiv 2606.19544]: high test-retest reliability coexists with position bias; judge rankings shift by up to 14 positions across benchmarks. [S] Self-preference of roughly 10–25%.77- **OpenTelemetry GenAI** [V]: all `gen_ai.*` conventions are still "Development", including `invoke_agent` and `execute_tool`; they moved to a dedicated repository in June 2026 [S]. Expect attribute renames.7879## 5. Provider facts (official pages, fetched 2026-11-10)8081**Anthropic** [V]8283| Model | Input / output per MTok | Cache read |84|---|---|---|85| Fable 5.2 | $8 / $40 | $0.20 |86| Opus 5.5 | $4 / $20 | $0.20 |87| Sonnet 5.5 | $2 / $10 | $0.10 |88| Haiku 5.5 (prompt ≤100K tokens) | $0.10 / $0.50 | $0.01 |89| Haiku 5.5 (prompt >100K tokens) | $0.50 / $2.50 | $0.05 |9091- Context is 1M at flat pricing on 4.6+ models, except Haiku 5.5's length tiers.92- Cache writes cost 1.25x (5 minutes) or 2x (1 hour). Batch is 50% off.93- Fast mode: Opus 5.5 $8 / $40, Fable 5.2 $16 / $80; not available with Batch.94- `inference_geo: "us"` multiplies prices by 1.1.95- Web search is $10 per 1,000 searches. Code execution is free alongside web search/fetch; otherwise 1,550 free hours per month, then $0.05 per container-hour.96- Rate limits use RPM / ITPM / OTPM token buckets, and cache reads do not count toward ITPM. Start tier: Opus 5.5 and Sonnet 5.5 at 4,000 RPM / 2M ITPM / 400K OTPM; Fable 5.2 at 4,000 / 500K / 100K. Monthly spend caps are $500 (Start), $1,000 (Build), $200,000 (Scale).97- Advisor tool (`advisor_20260301`, beta): the executor consults a stronger model mid-turn, billed at the advisor's rates.98- From Anthropic's bundled API reference (cached 2026-11-03, not re-fetched): effort levels run `low` to `max`; thinking cannot be disabled on Opus 5.5 or Fable 5.2; forced `tool_choice` returns 400 on the newest models; Priority Tier is not available on current models; task budgets are in beta.99100**OpenAI** [V]101102| Model | Input / output per MTok | Cached input |103|---|---|---|104| gpt-6-astra | $10 / $50 | $1.00 |105| gpt-6.1-sol | $2 / $10 | $0.10 |106| gpt-6.1-terra | $1 / $5 | $0.05 |107| gpt-6-luna | $0.10 / $0.50 | $0.01 |108109- All four have a 1.05M context window and 128K output. Above 272K input tokens, input costs 2x and output 1.5x.110- Batch and Flex are about 50% of Standard. Priority was renamed "Fast mode" on 2026-07-30 (about 2x); Ultrafast is about 6x on Astra and 6.1 Sol.111- Reasoning effort runs `low` to `max` (`none` also on Terra and Luna).112- Caching on GPT-5.6 and later: 1,024-token minimum, implicit plus up to four explicit breakpoints, TTL 30 minutes (write 1.25x) or 12 hours (write 2.5x), reads 0.1x (0.05x on 6.1 Sol/Terra). Cached tokens still count toward TPM, unlike Anthropic.113- Chat Completions "remains supported"; Responses is recommended for all new projects; the Assistants API was sunset on 2026-08-26. Hosted tools (web search, file search, computer use, code interpreter, remote MCP) are available natively only through Responses.114- Web search is $10 per 1,000 calls. Containers are $0.03 per 20 minutes at 1 GB.115- Rate limits: Build tier 5,000 RPM / 1M TPM for Astra, Sol and Terra.116117**Routing guidance**118- [V] Anthropic's advisor doc: Sonnet executor plus Opus advisor on complex tasks costs "similar or lower" in total; enable advisor caching only at three or more calls per conversation.119- From Anthropic's bundled reference (not re-fetched): measure "most capable model at lower effort" before building a cascade, because caches are model-scoped; judge cost per completed task.120- [V] OpenAI's models page: start with Astra for complex work, Sol for balance, Luna for volume.121- Not verified: OpenAI structured-outputs details, background mode and compaction (the migration page was silent on them), and computer-use pricing.122123## Recommendations for this deployment124125All are my inferences from the evidence above.1261271. **Durability engine: DBOS Transact on the existing Postgres 17.** It is a library, has TypeScript and Python SDKs, needs no extra server, and provides queues, durable sleep, notifications, fork-from-step and patching. Skip Conductor; build the minimal run view in your own console. The catch: its exactly-once guarantee covers only Postgres writes through its datasource.1282. **Fallback: Restate** (one binary) if you outgrow DBOS. Temporal is more operational burden than a single owner should take on.1293. **Step granularity:** one journaled step per LLM call and one per tool call. Store request hash, response, token usage and cost in the same transaction.1304. **Idempotency:** every side-effecting tool takes `idem_key = hash(run_id, step_seq)`. Remote Mac executions write a result file keyed by it, so a retry reads the result instead of re-running.1315. **Leases and fencing:** each run has a lease with a heartbeat (about 30 s) and a monotonically increasing fencing token checked on every state write. Nodes receive work only from the control plane and never claim it themselves.1326. **Approvals are durable waits** with a timeout and a default of deny, never a blocked process.1337. **Sandbox tier 0 (read-only research):** no shell; fetch through a server-side fetcher; no secrets.1348. **Tier 1 (code and analysis in a workspace):** `srt`/Seatbelt with a deny-default profile; writes limited to an ephemeral git worktree; network only through the allowlist proxy; `taskpolicy -m` and `-c utility`; run as a dedicated non-admin `agent` user with no TCC grants and no Docker socket.1359. **Tier 2 (untrusted code, package installs, browsing):** Apple `container` or a Tart Linux VM per task, destroyed afterwards.13610. **Tier 3 (macOS GUI / AppleScript):** a Tart or Lume macOS VM (two per host) or a sacrificial node; never the owner's login session and never Full Disk Access.13711. **Anything the agent writes is untrusted input for unsandboxed tools.** Hooks, `.git/config`, `.claude/`, venvs and task files are reviewed or diffed before any host-side tool consumes them.13812. **SSH dispatch:** the control plane holds per-node keys restricted with `command=` forced wrapper, `restrict`, and `from=<control-plane IP>`; the target is the `agent` user; no agent forwarding into sandboxes. Do not reuse the cluster-wide sudo password or the gateway key for agent work.13913. **Secrets:** a credential-injecting proxy on the control plane for HTTP APIs; short-lived, scoped tokens for git; nothing in prompts, environment or logs. Treat the proxy as tier-zero infrastructure and keep it patched.14014. **Permission model:** deny → ask → allow, enforced in the harness. Risk classes: read, workspace write, network, external or irreversible. A classifier may auto-approve only inside tier 1 or above; with a 17% miss rate it is a filter, not a boundary.14115. **Injection defence by construction:** apply the Rule of Two per run. A run that reads untrusted web content gets either no secrets or no egress beyond the allowlist. Use plan-then-execute and a quarantined reader for web content.14216. **Close exfiltration channels:** no auto-rendered remote images or links in the console; outbound URLs must be on the allowlist or already present in the task.14317. **MCP and skills:** pin versions, hash tool descriptions and alert on change, and run each server under `srt`.14418. **Verification pipeline:** a definition of done is written before work starts; deterministic oracles first (tests, typecheck, lint; re-run numeric analyses from a clean checkout and diff); then an independent evaluator with fresh context, preferably another vendor's model, that must cite evidence; research claims require the quoted span to be re-fetched.14519. **Governors:** per-run caps on dollars, tokens, wall-clock and tool calls; stall detection (repeated tool-call hashes, no artefact change over a set number of steps) triggers a context reset and then escalation; a global kill switch revokes leases and proxy credentials.14620. **Observability:** one append-only `events` table as the audit source of truth; emit OpenTelemetry `gen_ai` spans behind a thin mapping layer because names are unstable; self-host Langfuse or Phoenix only if you need a trace UI. Record cost per completed task, with cached and uncached tokens separate.147148**Non-goals:** multi-tenant isolation; exactly-once external effects; relying on prompt-level injection filters or LLM judges as security controls; cgroup-style hard CPU quotas on native macOS; running Temporal/Kubernetes; an interactive agent in the owner's real browser profile; unattended runs sized past the 80% horizon without checkpoints.149150## Sources151152**Durability**153- Temporal, OpenAI Agents SDK integration (docs, accessed 2026-11-10): https://docs.temporal.io/develop/python/integrations/openai-agents154- Temporal, Worker Versioning: https://docs.temporal.io/production-deployment/worker-deployments/worker-versioning155- Temporal, GA Worker Versioning (blog, 2026): https://temporal.io/blog/ga-worker-versioning-public-preview-upgrade-on-continue-as-new156- Temporal, self-hosted guide: https://docs.temporal.io/self-hosted-guide157- DBOS, March 2026 features: https://www.dbos.dev/blog/dbos-new-features-march-2026158- DBOS, April 2026 features: https://www.dbos.dev/blog/dbos-new-features-april-2026159- DBOS Transact TS: https://github.com/dbos-inc/dbos-transact-ts160- Bay Information Systems, "What Is DBOS?" (secondary): https://www.bayis.co.uk/library/112-dbos.html161- Pydantic AI, Durable Execution overview: https://pydantic.dev/docs/ai/capabilities/durable_execution/overview162- Pydantic AI, Restate: https://pydantic.dev/docs/ai/capabilities/durable_execution/restate163- Restate: https://restate.dev164- TechCrunch on Restate (2026-09-30): https://techcrunch.com/2026/09/30/restate-lands-20m-as-the-need-for-durable-infrastructure-increases-with-ai-agents165- Vercel Workflow, Postgres World: https://workflow-sdk.dev/worlds/postgres166- Vercel Workflow discussion #2736: https://github.com/vercel/workflow/discussions/2736167- Trigger.dev, human-in-the-loop: https://trigger.dev/human-in-the-loop-ai-agents168- Trigger.dev vs Inngest: https://trigger.dev/vs/inngest169- Inngest self-hosting discussion (2026-05-12): https://github.com/orgs/inngest/discussions/138170- Hatchet: https://github.com/hatchet-dev/hatchet171- Turion comparison (secondary, 2026): https://turion.ai/blog/temporal-vs-restate-vs-hatchet-vs-inngest-durable-execution-agents-2026172- Cloudflare, durable agents: https://developers.cloudflare.com/workflows/get-started/durable-agents173- Cloudflare, Project Think (2026): https://blog.cloudflare.com/project-think174- Microsoft, Durable Task extension: https://learn.microsoft.com/en-us/azure/durable-task/sdks/durable-agents-microsoft-agent-framework175- LangGraph durability (secondary): https://vadim.blog/durable-execution-agents-that-survive-failure-and-resume-where-they-left-off176- LangChain forum, 30 open bugs: https://forum.langchain.com/t/30-open-langgraph-and-langgraph-js-bugs-in-interrupts-retries-checkpoints-and-caching-most-with-a-community-fix-waiting/5135177- Graphile Worker: https://worker.graphile.org/docs178- Prisma, SKIP LOCKED queue: https://www.prisma.io/blog/you-dont-need-a-job-queue-postgres-already-has-skip-locked179- HN, "LISTEN/NOTIFY does not scale" (2025-07): https://news.ycombinator.com/item?id=44490510180181**Sandboxing**182- Anthropic sandbox-runtime: https://github.com/anthropics/sandbox-runtime183- MarkTechPost on srt (2026-10-24, secondary): https://www.marktechpost.com/2026/10/24/anthropic-sandbox-runtime-ai-agent-sandbox184- OpenAI, Codex approvals and security: https://learn.chatgpt.com/docs/agent-approvals-security185- Pillar Security, Week of Sandbox Escapes (2026-07-20): https://www.pillar.security/blog/the-week-of-sandbox-escapes186- Pillar, Docker socket escape: https://www.pillar.security/blog/one-docker-socket-to-rule-them-all-escaping-codex-cursor-and-gemini-clis-sandboxes187- Pillar, allow-default Seatbelt: https://www.pillar.security/blog/escaping-antigravitys-allow-default-seatbelt188- OpenAI, Hugging Face incident (2026-07): https://openai.com/index/hugging-face-model-evaluation-security-incident189- Apple container: https://github.com/apple/container190- WWDC26, container machines: https://developer.apple.com/videos/play/wwdc2026/389191- Ry Walker on Apple Containerization (secondary, 2026-06): https://rywalker.com/research/apple-containerization192- Cirrus Labs joins OpenAI (2026-04-07): https://cirruslabs.org193- Tart guide (secondary, 2026-10-30): https://computingforgeeks.com/install-tart-macos-linux-vms-apple-silicon194- Lume docs: https://cua.ai/docs/lume195- TechCrunch, Apple Full Disk Access (2026-10-02): https://techcrunch.com/2026/10/02/apple-says-its-tightening-macos-full-disk-access-controls-due-to-new-risks-from-ai-agents196- Infisical, credential brokering: https://infisical.com/blog/credential-brokering-for-ai-agents197- kubernetes-sigs/agent-sandbox #1045 (2026-06-26): https://github.com/kubernetes-sigs/agent-sandbox/issues/1045198- Local man pages `sandbox-exec(1)`, `taskpolicy(8)`, `launchd.plist(5)` on macOS 27.0, plus two live enforcement tests.199200**Security**201- Simon Willison, Rule of Two and Attacker Moves Second (2025-11-02): https://simonwillison.net/2025/Nov/2/new-prompt-injection-papers202- Meta, Agents Rule of Two (2025-10-31): https://ai.meta.com/blog/practical-ai-agent-security203- CaMeL (arXiv 2503.18813): https://arxiv.org/abs/2503.18813204- Simon Willison on Design Patterns paper (2025-06-13): https://simonwillison.net/2025/Jun/13/prompt-injection-design-patterns205- OpenAI, Designing agents to resist prompt injection (2026-03-11): https://openai.com/index/designing-agents-to-resist-prompt-injection206- Anthropic, browser-use injection defences: https://www.anthropic.com/research/prompt-injection-defenses207- Anthropic, How we built auto mode (2026-03): https://www.anthropic.com/research/claude-code-auto-mode208- Measuring the Permission Gate (arXiv 2604.04978): https://arxiv.org/html/2604.04978v1209- Claude Code permissions: https://code.claude.com/docs/en/permissions210- OWASP Agentic Top 10 (2025-12-09): https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai211- Invariant Labs, tool poisoning (2025): https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks212- Microsoft, State of MCP security 2026: https://techcommunity.microsoft.com/blog/microsoft-security-blog/the-state-of-mcp-security-in-2026/4531327213214**Verification**215- METR time horizons (updated 2026-09-08): https://metr.org/time-horizons/216- METR numbers summary (secondary): https://iqmetrics.org/news/metr-time-horizon-explained-the-latest-numbers-and-why-it-is-not-an-iq217- Anthropic, Harness design for long-running apps (2026-03): https://www.anthropic.com/research/harness-design-long-running-apps218- Anthropic, Effective harnesses for long-running agents (2025): https://www.anthropic.com/research/effective-harnesses-for-long-running-agents219- Anthropic, Demystifying evals (2026): https://www.anthropic.com/research/demystifying-evals-for-ai-agents220- Reliability without Validity (arXiv 2606.19544): https://arxiv.org/html/2606.19544v1221- OTel GenAI agent spans: https://github.com/open-telemetry/semantic-conventions-genai/blob/main/docs/gen-ai/gen-ai-agent-spans.md222- John Hodge, state of OTel GenAI (2026-07, secondary): https://john-hodge.com/blog/opentelemetry-genai-semantic-conventions223224**Providers**225- Anthropic pricing: https://platform.claude.com/docs/en/about-claude/pricing226- Anthropic rate limits: https://platform.claude.com/docs/en/api/rate-limits227- Anthropic advisor tool: https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool228- OpenAI pricing: https://developers.openai.com/api/docs/pricing229- OpenAI models: https://developers.openai.com/api/docs/models230- OpenAI prompt caching: https://developers.openai.com/api/docs/guides/prompt-caching231- OpenAI migrate to Responses: https://developers.openai.com/api/docs/guides/migrate-to-responses232- OpenAI rate limits: https://developers.openai.com/api/docs/guides/rate-limits233