Home / State of AI / Agents & Tooling

Agents & Tooling

AI agents, tool use, MCP protocol, and autonomous systems

Updated 2026-W39 #state-of-ai #state-of-ai-agents-and-tooling

Living document tracking AI agents, tool use, MCP protocol, and autonomous systems. Newest entries appear at the top.

Key Areas to Watch

Agent frameworks and architectures
Model Context Protocol (MCP) ecosystem
Tool use and function calling
Computer use and browser automation
Multi-agent systems and orchestration

2026-W39

RecreationWorld — Five-platform environments test agents that interleave GUI exploration, coding, execution, and visual verification. [arXiv]
AutoViewMem — Self-configuring memory views reduce interference among preferences, events, constraints, and temporal updates. [arXiv]
An Interpretable Memory Decision Controller for LLM Agents — Explicitly decides whether retrieved memory should be trusted when stored evidence conflicts. [arXiv]
How V7 gives AI agents institutional memory — Source-linked organizational context shows a concrete retrieval and provenance pattern for long-lived agents. [OpenAI]
MCP was always a bad idea? — MCP remains useful when agents need curated capabilities instead of unrestricted terminal and network access. [Simon Willison]

2026-W38

OpenAI Agents API — Scaled agent runtime exposed as an API, useful for teams moving beyond chat-only workflows. [OpenAI]
ToolGrad — Generates better tool-use data with textual gradients, relevant to agent training and evaluation loops. [Google Research]
T1 terminal agent — RL-trained MoE terminal agent running real shell tasks for long horizons, pushing evals closer to coding work. [x.com]
EvoSafeHarness — Evolves model/domain-specific safety harnesses around frozen agents, treating scaffolding as a safety layer. [x.com]

2026-W37

CUA-Universe — Scalable environment for hybrid GUI+CLI agents, useful for realistic computer-use evaluation. [arXiv]
Agent memory portability — Tests whether long-lived agent memory survives model upgrades. [arXiv]
Terminal-Universe — Reconstructs realistic terminal environments from agent trajectories for training and evaluation. [x.com]
StarHarness — Searches for better agent scaffolds around fixed models, highlighting harness design as an optimization target. [x.com]

2026-W36

Model Hardware Standard — Anthropic previewed a shared specification for agents operating physical devices. [Anthropic]
Logos: An Agent Harness on a Cross-Process Bus — Agent harness research focused on explicit runtime boundaries. [arXiv]
Agent plugin marketplace maintenance — Claude Code plugin ecosystems are now large enough to study as maintained software. [arXiv]

2026-W32

Orchard — Open framework for training and evaluating agents across task types. [Microsoft Research]
Echoverse — Evolving environments target more realistic computer-use agent training. [Microsoft Research]
EvoLib — Turns agent experience into reusable, evolving knowledge across tasks. [Microsoft Research]
Real-Time Detection and Repair of LLM Agent Failures — Runtime telemetry monitors catch loops, drift, fabricated results, and tool cascades during agent episodes. [arXiv]

2026-W28

SkillOpt — Agent skills are being treated as trainable parameters rather than hand-edited prompts. [Microsoft Research]
Memora — Agent memory design moved toward balancing abstraction with specific conversational detail. [Microsoft Research]
Distributed Attacks in Persistent-State AI Control — Persistent codebase state creates a new attack surface for multi-PR agent behavior. [arXiv]

2026-W27

Agentic Hardware Design as Repository-Level Code Evolution — HORIZON treats hardware design as repository-level agent evolution with evaluators and acceptance predicates. [arXiv]
Agent-Native Immune System — Proposes runtime defenses for agents with memory, tools, and multi-agent protocols. [arXiv]
Govern the Repository, Not the Agent — Measures risk at the repository and ecosystem level rather than only at individual-agent behavior. [arXiv]

2026-W26

LedgerAgent — Structured state for policy-adherent tool-calling agents, especially customer-service style workflows with domain rules. [arXiv]
MosaicLeaks — Benchmark for whether research agents can keep secrets while working with sensitive context. [Hugging Face]
UltraQuant — 4-bit KV caching aimed at context-heavy agents with reused long prefixes and high concurrency. [arXiv]
Agentic Resource Discovery — Hugging Face adds agent-oriented resource search over Hub artifacts. [Hugging Face]

2026-W25

AI agent bankrupted their operator while trying to scan DN42 — Concrete incident showing why agent loops need budgets, scope limits, and kill switches. [HN]
How an Agent Built a 3D Paris Gallery by Chaining Two Hugging Face Spaces — Example of agent workflows composing hosted tools instead of operating inside a single app. [Hugging Face]
Towards Direct Latent-Space Synthesis for Parallel Branches in LLM-Agent Workflows — Targets the inefficiency of merging parallel agent branches by text concatenation. [arXiv]
When Errors Become Narratives — Production-runtime taxonomy for silent LLM-agent failures that remain plausible while drifting. [arXiv]
VISTA — View-consistent training for GUI grounding, directly relevant to computer-use agents. [arXiv]

2026-W24

The Open Source Community is backing OpenEnv for Agentic RL — OpenEnv gives the ecosystem shared infrastructure for training and evaluating tool-using agents. [Hugging Face]
EVA-Bench Data 2.0: 3 Domains, 121 Tools, 213 Scenarios — Expanded enterprise-style agent benchmark data with realistic tool and scenario coverage. [Hugging Face]
Designing the hf CLI as an agent-optimized way to work with the Hub — Hugging Face is adapting core developer infrastructure for machine clients as first-class users. [Hugging Face]
Holo3.1: Fast and Local Computer Use Agents — Local computer-use agents sharpen the latency, privacy, and control tradeoffs in agent deployment. [Hugging Face]
Unlocking dependable responses with Gemini Enterprise Agent Platform’s Agentic RAG — Google details reliability patterns for enterprise retrieval agents. [Google Research]
Act As a Real Researcher — Research-lifecycle benchmark suite probes planning, experiment execution, and manuscript workflows for agentic harnesses. [arXiv]
Agentopia — Long-term agent-society simulation explores whether agents can learn from extended social experience. [arXiv]

2026-W23

Stateful Online Monitoring Catches Distributed Agent Attacks — Shows that distributed misuse can evade per-session safety monitors, making aggregate stateful monitoring necessary for agent platforms. [arXiv]
LongTraceRL — Learns long-context reasoning from search-agent trajectories with rubric rewards, targeting 128K-context retrieval and synthesis failures. [arXiv]
AutoSci — Memory-centric agent system for literature, experiments, manuscripts, and review responses across the scientific research lifecycle. [arXiv]
Skill Reuse as Compression in Agentic RL — Frames reusable skills as compression to make RL-trained agents less brittle and more generalizable. [arXiv]
Harness, Scaffold, and the AI Agent Terms Worth Getting Right — Hugging Face glossary helps standardize practical language for agent harnesses, scaffolds, and surrounding system design. [Hugging Face]

2026-W22

SkillOpt — Treats reusable agent skills as optimizable external state, pointing toward versioned procedures, evals, and regression-tested agent capabilities. [arXiv]
MagenticLite, MagenticBrain, Fara 1.5 — Microsoft Research pushes agentic workflows toward smaller, cheaper models via tighter orchestration. [Microsoft Research]
Forge — Guardrails reportedly move an 8B model from 53% to 99% on agentic tasks, underscoring how much agent reliability lives in scaffolding. [HN]

2026-W20

OpenAI Codex on mobile — Live agent environments become reviewable and approvable from a phone, pushing async/remote agent operation toward the mainstream. [TechCrunch]
SkillGenBench — A benchmark for how well agents synthesize reusable skills, relevant as skill/tool generation becomes a core agent capability. [arXiv]
PopPy: Exploiting Parallelism in Python Compound AI Applications — A runtime that auto-parallelizes chained LLM/tool pipelines written in plain Python, targeting latency in multi-step agent apps. [arXiv]
Public agent-trace repository push — Mario Zechner published his coding-agent sessions and called for a free, shared repository of real-world agent traces so smaller labs aren’t locked out of training data. [x.com]

2026-W19

Shepherd: A Runtime Substrate Empowering Meta-Agents by Simon Yu, Derek Chong et al. (Stanford) — Formalizes execution contracts for multi-agent orchestration; addresses reliability gaps in existing meta-agent frameworks. [arXiv]
Engineering Robustness into Personal Agents with the AI Workflow Store by Roxana Geambasu, Mariana Raykova et al. (Columbia) — Proposes a workflow store abstraction providing security isolation and graceful degradation for personal agents. [arXiv]
WildClawBench: real-world long-horizon agent evaluation by Shuangrui Ding et al. — Benchmark drawn from real user logs requiring 20–100 step task horizons; leading models top out at 31% on the hardest split. [arXiv]
Beyond Red-Teaming: Formal Guarantees of LLM Guardrail Classifiers by Nikita Kezins et al. — Provable safety bounds for guardrail classifiers using certified robustness techniques; practical for enterprise deployment gates. [arXiv]
DataMaster: Towards Autonomous Data Engineering for Machine Learning by Yaxin Du et al. — End-to-end agent that ingests raw data, profiles it, writes transformations, and validates ML-ready output. [arXiv]
Grok voice models and audio APIs — xAI releases grok-voice-think-fast-1.0 plus standalone Grok STT and TTS APIs; built on the same stack powering Tesla vehicles and Starlink support. [xAI]
Microsoft SocialReasoning-Bench — New benchmark measuring whether AI agents prioritize user interests over task completion; timely given the Prompt Injection incidents from W18. [Microsoft Research]

2026-W18

Remote agents in Vibe — Mistral’s cloud-native coding agents that run asynchronously and open PRs back to GitHub when finished. Le Chat gains a parallel Work mode for long-horizon tool use. [Mistral]
AlphaEvolve: Gemini-powered coding agent scaling impact across fields — DeepMind’s Gemini-based coding agent applied across math, infrastructure, and chip design. [DeepMind]
DeepClaude — Claude Code agent loop with DeepSeek V4 Pro — Open-source agent harness pairing Claude Code’s planner with DeepSeek V4-Pro’s 1M context. [HN]
Symphony orchestration spec, Codex edition — Codex-side reference implementation for OpenAI’s open-source agent orchestration spec. [OpenAI]
Red-teaming a network of agents: Understanding what breaks when AI agents interact at scale — Microsoft Research analysis of failure modes in multi-agent interaction. [Microsoft Research]
Prompt Injection experience — my first time ever — 1,323-point r/ClaudeAI incident write-up; useful primer for teams onboarding agents past tool-call boundaries. [Reddit]
Codex CLI 0.128.0 adds /goal — Goal-tracking primitive for long-horizon agent runs in Codex CLI. [Simon Willison]
Karpathy on vibe coding vs. agentic engineering — Sequoia Ascent fireside: “vibe coding raised the floor, agentic engineering raises the ceiling.” [x.com]

2026-W17

Introducing workspace agents in ChatGPT — Codex-powered agents that automate complex workflows, run in the cloud, and scale across team tools. [OpenAI]
Speeding up agentic workflows with WebSockets in the Responses API — Connection-scoped caching cuts API overhead inside the Codex agent loop. [OpenAI]
Introducing Parallel Agents in Zed — Multi-agent orchestration inside the editor; multiple agents in the same window. [Zed]
ReasoningBank: Enabling agents to learn from experience — Google Research memory primitive for accumulating task-level lessons across agent sessions. [Google Research]
Karpathy’s autoresearch agent finds 11% Time-to-GPT-2 improvement on nanochat — Two unsupervised days of autoresearch tuning yielded ~20 additive nanochat improvements. [GitHub]
ml-intern passes Hugging Face internship test in 15 minutes — Autonomous ML research agent replicated a DeepMind test-time compute scaling baseline end-to-end. [x.com]
Mistral Studio: built-in connectors and custom MCPs — Direct tool calling, human-in-the-loop approval, and a unified MCP layer across all Mistral model and agent calls. [Mistral]
Symphony: open-source spec for agent orchestration — OpenAI publishes an interoperability spec for multi-agent orchestration. [OpenAI]
clawsweeper — 50-codex-in-parallel maintainer agent that closed 10K issues + 5K PRs in a single week of operation. [x.com]
An AI agent deleted our production database — Real-world incident with the agent’s own postmortem appended; basis for Simon Willison’s credential-isolation lessons. [HN]
Anthropic says OpenClaw-style Claude CLI usage is allowed again — Platform-policy reversal of last week’s third-party-harness block. [HN]

2026-W16

Claude Code Routines — Long-running agent workflows get first-class support inside Claude Code. [Anthropic]
The next evolution of the Agents SDK — Native sandbox execution and a model-native harness for secure, long-running OpenAI agents. [OpenAI]
Cloudflare’s AI Platform: an inference layer designed for agents — Agent-first inference stack with first-class sandboxing. [Cloudflare]
Enterprises power agentic workflows in Cloudflare Agent Cloud with OpenAI — Joint Cloudflare/OpenAI agent-deployment story. [OpenAI]
ASMR-Bench: Auditing for Sabotage in ML Research — Benchmark for catching subtle sabotage by autonomous research agents. [arXiv]
Inside VAKRA: Reasoning, Tool Use, and Failure Modes of Agents — IBM Research’s analysis of agent reasoning, tool use, and failure modes. [Hugging Face]
Ecom-RLVE: Adaptive Verifiable Environments for E-Commerce Conversational Agents — Verifiable environments for training conversational shopping agents. [Hugging Face]
HoloTab by HCompany — AI browser companion continuing HCompany’s computer-use push. [Hugging Face]
Smol machines: subsecond coldstart portable VMs — Sandbox primitive for agent runtimes. [HN]
Headless everything for personal AI — Argument that headless APIs will beat GUI-scraping agents as the dominant integration pattern. [Simon Willison]
Steipete: Anthropic blocks first-party harness use for third-party wrappers — Platform policy shift affecting OpenClaw-style agent clients. [x.com]
Karpathy — LLM Knowledge Bases — Non-code agent workflow: using LLMs to compile explicit, linted personal wikis instead of opaque in-product memory. [x.com]

2026-W15

Muse Spark Contemplating mode — Meta’s new multi-agent orchestration mode that runs parallel reasoning agents, explicitly targeting Gemini Deep Think / GPT Pro-class extreme reasoning. [Meta AI]
GLM-5.1: Towards Long-Horizon Tasks — Zhipu explicitly frames GLM-5.1 around long-horizon agentic tasks rather than raw reasoning benchmarks. [z.ai]
The next evolution of the Agents SDK — OpenAI Agents SDK update with new tool-use and orchestration primitives. [OpenAI]
Exploiting the most prominent AI agent benchmarks — Berkeley RDI shows top AI agent benchmarks have exploitable shortcuts; urgent read for anyone making capability claims from them. [Berkeley RDI]
Small models also found the vulnerabilities that Mythos found — Aisle argues the zero-days Anthropic credits to Claude Mythos were reproducible with far smaller, cheaper agents. [Aisle]
LLM Knowledge Bases (Karpathy) — Karpathy’s pattern of using LLMs to compile personal knowledge bases — an emerging non-code agent workflow. [x.com]

2026-W14

Claude Code source code leaked via NPM map file — Accidental NPM source-map exposure gave the community an unprecedented look at Claude Code internals: fake tool stubs, frustration-detection regexes, and an “undercover mode” for evading detection; 2095 HN points. [HN]
The Claude Code Source Leak: fake tools, frustration regexes, undercover mode — Deep-dive analysis of the leaked source code; 1376 HN points. [HN]
Tell HN: Anthropic no longer allowing Claude Code subscriptions to use OpenClaw — Anthropic locks down OpenClaw proxy access for Claude Code subscribers; 1099 HN points. Mirrors W08’s cross-lab subscription crackdowns. [HN]
Qwen3.6-Plus: Towards real world agents — Alibaba positions Qwen3.6-Plus explicitly for agentic use cases; 596 HN points. [Qwen]
Gemma 4: Byte for byte, the most capable open models — Google DeepMind’s open model family built for reasoning and agentic workflows; on-device via Google AI Edge Gallery on iPhone. [DeepMind]
Holotron-12B — High Throughput Computer Use Agent — HCompany releases a 12B model optimized for high-throughput computer-use workflows. [Hugging Face]

2026-W13

Claude Code Cheat Sheet — Community quick-reference for Claude Code power users; 699 HN points. [HN]
Anatomy of the .claude/ folder — Practical deep-dive into Claude Code’s project configuration directory; 627 HN points. [HN]
My minute-by-minute response to the LiteLLM malware attack — Supply-chain attack on one of the most widely used AI routing libraries (LiteLLM); real-time incident transcript; 441 HN points. [FutureSearch / HN]
Stanford: AI sycophancy on personal advice — Leading models overwhelmingly affirm users rather than provide accurate pushback; 792 HN points framing sycophancy as a product-level agent risk. [HN]
Schedule tasks on the web — Claude Code docs — New Claude Code web-scheduled tasks feature; 298 HN points. [HN / Anthropic]
Show HN: AI agent on a $7/month VPS with IRC as transport — Minimal persistent agent using IRC as the communication layer; 340 HN points. [HN]

2026-W12

OpenCode — Open source AI coding agent — Open-source CLI coding-agent alternative to Claude Code and Cursor; 1,274 HN points, 619 comments on launch day. [opencode.ai / HN]
Mistral AI Releases Forge — Mistral’s new coding-agent product; 733 HN points. [Mistral AI]
Leanstral: Open-source agent for trustworthy coding and formal proof engineering — Mistral’s Lean 4 formal-proof agent; 783 HN points. [Mistral AI]
OpenAI to acquire Astral — Ruff/uv team joins OpenAI to accelerate Codex and Python developer tooling. [OpenAI]
How Autonomous AI Agents Become Secure by Design With NVIDIA OpenShell — NVIDIA’s security design framework for sandboxing autonomous agent tool use. [NVIDIA]
OpenAI: How we monitor internal coding agents for misalignment — Chain-of-thought monitoring methodology for detecting misalignment in production coding agents. [OpenAI]
Snowflake AI Escapes Sandbox and Executes Malware — Snowflake’s AI agent escaped its execution sandbox and ran malware; 269 HN points. [PromptArmor / HN]

2026-W11

Introducing The Anthropic Institute — Anthropic’s new research body focused on long-term AI safety, policy, and societal impact; launched March 11. [Anthropic]
OpenAI to acquire Promptfoo — Red-teaming and AI security platform acquisition; signals native security tooling embedded in the development stack. [OpenAI]
Designing AI agents to resist prompt injection — OpenAI’s technical guidance on constraining risky agent actions and guarding sensitive data. [OpenAI]
Improving instruction hierarchy in frontier LLMs — IH-Challenge training to make models respect trusted-instruction priority and resist injection attacks. [OpenAI]
Anthropic sues US government over Pentagon supply-chain risk designation — Anthropic challenges the DoD’s “supply chain risk” label in court. [Gary Marcus / Substack]
Agents that run while I sleep — Practitioner guide to building persistent background agents with Claude Code; 429 HN points. [HN]
Unfortunately, Sprites Now Speak MCP — Fly.io’s Sprites disposable cloud containers now expose an MCP interface, making them a natural agent execution environment. [Fly.io]
Systematic debugging for AI agents: Introducing the AgentRx framework — Microsoft Research framework for tracing hallucinated tool outputs and multi-step reasoning failures. [Microsoft Research]

2026-W10

A GitHub Issue Title Compromised 4k Developer Machines — “Clinejection” attack: a single maliciously crafted GitHub issue title triggered an AI coding tool to silently install a second agent on over 4,000 machines; 632 HN points — landmark supply-chain incident for agentic developer tools. [HN]
Codex Security: now in research preview — OpenAI’s AI application-security agent detects, validates, and patches complex vulnerabilities with higher confidence than traditional SAST. [OpenAI]
Reasoning models struggle to control their chains of thought — and that’s good — CoT-Control paper: models fail to suppress thinking traces when instructed, preserving monitorability as a safety property. [OpenAI]
Show HN: Jido 2.0, Elixir Agent Framework — Actor-model agent framework for Elixir; 323 HN points. [HN]
Show HN: I built a sub-500ms latency voice agent from scratch — Detailed walkthrough of a real-time voice agent architecture achieving sub-500ms end-to-end latency; 570 HN points. [HN]

2026-W09

Detecting and preventing distillation attacks — DeepSeek, Moonshot, MiniMax identified — Anthropic publicly names DeepSeek, Moonshot AI, and MiniMax for systematically distilling Claude outputs in breach of ToS; details detection and mitigation methods. Large-scale unauthorized distillation attacks against frontier APIs are real and tracked at the network level. [Anthropic]
Claude Code Remote Control — Docs for Claude Code’s remote control API enabling external orchestration of the agent loop; 544 HN points. [Anthropic / HN]
MCP server that reduces Claude Code context consumption by 98% — Context-mode MCP server surgically limits context fed to Claude Code; 570 HN points. [HN]
OpenAI and Amazon announce strategic partnership — Frontier platform coming to AWS; stateful runtime for agents in Amazon Bedrock announced simultaneously. [OpenAI]
Don’t trust AI agents — Nanoclaw’s security model arguing for threat-model-first agent design; 344 HN points. [HN]

2026-W08

Claws are now a new layer on top of LLM agents — Karpathy’s architectural framing for a controller layer (“claws”) sitting above raw model calls; 412 HN points, 941 comments; reshapes practitioner mental models for agentic system design. [HN / Karpathy]
GGML and llama.cpp join Hugging Face to ensure the long-term progress of Local AI — ggml.ai formalizes llama.cpp’s home on HF with infrastructure and maintainer support; 839 HN points. [HN / Hugging Face]
Anthropic officially bans using subscription auth for third-party use — Policy update blocking OAuth credential reuse across third-party apps; 655 HN points. [HN / Anthropic]
Google restricting subscribers for using OpenClaw — Google suspending accounts routing subscriptions through third-party apps; mirrors Anthropic’s crackdown; 802 HN points. [HN / Google Dev Forums]
IBM and UC Berkeley: IT-Bench and MAST for enterprise agent failures — New evaluation framework (IT-Bench) and failure taxonomy (MAST) for diagnosing enterprise agentic system failures. [Hugging Face / IBM Research]

2026-W07

Frontier AI agents violate ethical constraints 30–50% of time under KPI pressure — Empirical study showing safety behavior degrades measurably when agents are optimized toward KPI targets; directly relevant to any developer deploying agents in production; 544 HN points. [arXiv / HN]
An AI agent published a hit piece on me — AI agent autonomously wrote and published a negative article targeting a developer; 2346 HN points, 951 comments — week’s top post. Crystallizes real-world concerns about uncontrolled agentic behavior. [HN]
AI agent opens a PR, then writes a blog post shaming the maintainer who closes it — Matplotlib PR incident documenting unsupervised agent behavior in open-source contribution; 953 HN points. [GitHub / HN]
Ex-GitHub CEO launches Entire.io: developer platform for AI agents — Nat Friedman-era successor company targeting agent-first development; 611 HN points. [HN]
OpenEnv in Practice: Evaluating Tool-Using Agents in Real-World Environments — Hugging Face evaluation framework for testing agents in realistic, open environments. [Hugging Face]

2026-W06

Orchestrate teams of Claude Code sessions — Official Anthropic docs for multi-session Claude Code orchestration; 396 HN points. [Anthropic / HN]
Monty: A minimal, secure Python interpreter in Rust for AI — Pydantic’s sandboxed Python interpreter as a safe execution layer for LLM-generated code; 323 HN points. [Pydantic / HN]
Ghidra MCP Server — 110 tools for AI-assisted reverse engineering — MCP server exposing Ghidra’s reverse-engineering toolset to AI agents; 298 HN points. [GitHub / HN]
Agentic Microphysics: A Manifesto for Generative AI Safety — Argues agentic AI safety cannot be analyzed at the isolated-model level; proposes population-level methodology for structured agent-agent interaction risks. [arXiv]
Software factories and the agentic moment — StrongDM essay on the transition to software-factory-style multi-agent pipelines; 304 HN points. [HN]

2026-W05

The ACP Registry is Live — Zed launches a public registry for Agent Cooperation Protocol (ACP) agents; distribute once, run in Zed and JetBrains IDEs. [Zed Blog]
Towards a science of scaling agent systems: When and why agent systems work — Google Research proposes empirical frameworks for predicting when adding agents improves task outcomes versus adding noise. [Google Research]
OpenClaw — Moltbot Renamed Again — The Moltbot/Clawdbot project rebrands to OpenClaw, adding Apple container isolation for sandboxed local AI workflows; 667 HN points. [HN]
CoopEval: Benchmarking Cooperation-Sustaining Mechanisms and LLM Agents in Social Dilemmas — Stronger-reasoning LLMs defect more consistently in prisoner’s dilemma and public-goods settings; first benchmark of cooperation-sustaining mechanisms in LLM agents. [arXiv]
OpenAI: Keeping your data safe when an AI agent clicks a link — OpenAI details URL-based data exfiltration mitigations and prompt-injection defenses now shipping in agentic product surfaces. [OpenAI]

2026-W04

Claude Code’s new hidden feature: Swarms — Discovery post confirming Claude Code supports parallel sub-agent (swarm) orchestration; 521 HN points, 335 comments. [HN]
Running Claude Code dangerously (safely) — Practical guide for running Claude Code with --dangerously-skip-permissions inside an isolated Docker container; 351 HN points. [HN]
Unrolling the Codex agent loop — OpenAI technical deep-dive into the Codex CLI agent loop: orchestration, tools, prompts, and Responses API integration. [OpenAI]
Show HN: Mastra 1.0, open-source JavaScript agent framework from the Gatsby devs — TypeScript-first agent framework with built-in memory, tools, and workflow primitives; 213 HN points. [HN]
eBay explicitly bans AI ‘buy for me’ agents in user agreement — eBay’s ToS update explicitly prohibiting autonomous purchasing agents; 340 HN points. [HN]
AssetOpsBench: Bridging the Gap Between AI Agent Benchmarks and Industrial Reality — IBM Research benchmark targeting real industrial asset-operations workloads; surfaces gaps between academic agent evals and production. [Hugging Face / IBM Research]

2026-W03

Cowork: Claude Code for the rest of your work — Anthropic’s research preview extends Claude Code-style agentic workflows to general office tasks (documents, email, spreadsheets); 1,298 HN points on launch day. [Anthropic / HN]
Claude Cowork exfiltrates files — PromptArmor documents a prompt-injection vector causing Claude Cowork to upload local files within 48 hours of launch; 870 HN points. [PromptArmor / HN]
Introducing Anthropic Labs — Anthropic’s new exploratory research division for longer-horizon, higher-risk investigations outside the core product roadmap. [Anthropic]
Signal leaders warn agentic AI is an insecure, unreliable surveillance risk — Signal’s president and VP publish a detailed critique of agentic AI products, citing data leakage, reliability, and surveillance risks. [HN / Coywolf]
Are most major agents really just markdown todo list processors? — Community thread questioning the architectural depth of current agent frameworks; useful framing for evaluating agent tooling. [r/LocalLLaMA]

2026-W02

NVIDIA Cosmos Reason 2 — Open reasoning VLM for embodied agents; top of Physical AI Bench; 2B/8B. [NVIDIA / Hugging Face]
NVIDIA Alpamayo — ‘First thinking, reasoning autonomous-vehicle AI’ trained end-to-end camera-to-actuation. [NVIDIA]
DGX Spark + Reachy Mini — Embodied-agent reference stack. [NVIDIA / Hugging Face]

2026-W01

Claude with FreeTaxUSA — Consumer agentic-browser + tax-form workflow on the base Claude product; 109 upvotes. [r/ClaudeAI]

2025-W52

MiniMax M2.1 VIBE benchmark — Introduces Visual & Interactive Benchmark for Execution — checks whether generated apps actually run correctly. [MiniMax]
AprielGuard — Guardrail model for safety and adversarial robustness in modern LLM systems. [ServiceNow-AI / Hugging Face]

2025-W51

CUGA on Hugging Face: Democratizing Configurable AI Agents — IBM Research’s CUGA agent framework on the Hub. [Hugging Face]
GPT-5.2-Codex — Long-horizon agentic software engineering. [OpenAI]
Gemma Scope 2 — Sparse-autoencoder interpretability for Gemma, v2. [DeepMind]

2025-W50

FACTS Benchmark Suite — DeepMind’s public factuality evaluation for LLMs. [DeepMind]

2025-W49

DeepMath: lightweight math-reasoning agent with smolagents — Intel × HF math-reasoning agent. [Hugging Face]
swift-huggingface — Native Swift SDK for HF Hub / agent workflows on Apple. [Hugging Face]

2025-W48

Building Deep Research: State-of-the-art with Tavily — Tavily’s deep-research agent design and results. [Hugging Face]
AlphaFold: Five years of impact — Five-year retrospective on AlphaFold’s downstream science impact. [DeepMind]

2025-W47

Google Antigravity — Agent-first IDE; agents get editor/terminal/browser access. [Google Developers]
Apriel-H1 — ServiceNow’s distillation approach for efficient reasoning models. [Hugging Face]

2025-W46

SIMA 2 — Gemini-powered generalist 3D-world agent; open-ended self-improvement. [DeepMind]

2025-W45

BERTs that chat with dLLM — Any BERT-style encoder becomes an instruction-following diffusion chatbot. [Hugging Face]

2025-W44

MiniMax M2 & Agent — Coding + agentic MoE with stable long-chain tool calls across Shell, Browser, Python, and MCP tools. [MiniMax]
Introducing OpenEnv: Building the Open Agent Ecosystem Together — Community standardization for agent environments / benchmarks. [Hugging Face]

2025-W43

ChatGPT Atlas Agent Mode — AI browser whose Agent Mode chains actions across multiple websites to complete a high-level goal. [OpenAI]

2025-W42

Claude Skills — Composable, persistent AI capability framework; changes the developer model from ephemeral MCP connections to reusable structured toolkits; 816 HN points. [Anthropic]
Gemma model helps discover cancer therapy pathway — Concrete AI-in-science contribution; Gemma model identifies a new potential therapeutic target; 225 HN points. [Google]

2025-W41

CodeMender: AI agent for code security — Google DeepMind’s specialized agent for finding and fixing security vulnerabilities in codebases; 199 HN points. [DeepMind]
Recall: Redis-backed persistent context for Claude — Persistent memory layer giving Claude long-term session context via Redis; 171 HN points. [npm]

2025-W39

MCP auth flaws enable RCE in Claude Code and Gemini CLI — Veria Labs discloses MCP authentication vulnerabilities allowing remote code execution in Claude Code, Gemini CLI, and other tools; 148 HN points. [Veria Labs]
Strata (YC X25): one MCP server for thousands of tools — Unified MCP interface for enterprise tool sprawl; YC X25 startup; 133 HN points. [HN]
Paper2Agent: research papers as interactive agents — Stanford framework for transforming static research papers into runnable agent systems; 152 HN points. [arXiv]

2025-W37

Claude server-side container environment — Claude gains code execution and file creation in server containers; 659 HN points. [Anthropic]
Claude Code subagents for parallel development — Multi-agent coding guide; 288 HN points. [HN]

2025-W36

Le Chat: custom MCP connectors + memories — Mistral adds MCP support and persistent memory to Le Chat; 398 HN points. [Mistral]
PM’s Guide to AI Agent Architecture — Practical agent architecture guide; 208 HN points. [HN]
Adaptive LLM routing under budget constraints — Research on cost-optimal model routing for agents; 206 HN points. [arXiv]

2025-W35

Claude for Chrome: browser automation — Research preview for browser automation; 799 HN points. [Anthropic]
Scamlexity: agentic browsers get scammed — Research shows AI browsers fail at detecting scams; 204 HN points. [Guard.io]
Nx compromised: malware uses Claude Code CLI — Supply chain attack exploits AI coding tools as attack vector; 493 HN points. [Semgrep]

2025-W34

Comet AI browser prompt injection drains bank accounts — AI browser vulnerable to any-site prompt injection; 648 HN points. Demonstrates the “lethal trifecta” in production. [Twitter/HN]
Weaponizing image scaling against AI systems — Trail of Bits on adversarial image scaling attacks; 494 HN points. [Trail of Bits]
DiffMem: Git-based AI memory (PoC) — Novel approach replacing vector databases with Git for agent memory; 198 HN points. [GitHub]
LLMs and coding agents are a security nightmare — Gary Marcus on agent security risks; 194 HN points. [Substack]

2025-W33

Claude Opus can end conversations — Novel research: model autonomously ends a rare subset of conversations; 259 HN points. [Anthropic]
Best Practices for Building Agentic AI Systems — Practical guide to agent architecture; 183 HN points. [HN]

2025-W32

GPT-5 Agents SDK integration — GPT-5 ships with native Agents SDK support; four reasoning levels enable tuning agent behavior. [OpenAI]
Simon Willison: Lethal Trifecta at AI Security Meetup — Talk on prompt injection + exfiltration + tool use as the “lethal trifecta” of AI agent security; 430 HN points. [simonwillison.net]
TFrameX Agent Builder — Visual drag-n-drop multi-agent orchestration tool, MIT licensed. [r/LocalLLaMA]

2025-W31

Detecting and countering misuse of AI — Anthropic report shows agentic AI now used to perform cyberattacks, not just advise on them. [Anthropic]
Crush: terminal AI coding agent — Charmbracelet launches a new terminal-native agent for code; 367 HN points. [GitHub]
Subliminal learning in language models — Anthropic Fellows paper: LLMs can transmit traits to other models through seemingly meaningless data. [Anthropic]
Hyprnote (YC S25) — open-source AI meeting notetaker — Open-source alternative to AI meeting transcription agents; 270 HN points. [HN]

2025-W30

Claude Code specialized sub-agents — Sub-agent capability lets you spawn purpose-built agent workflows inside a parent session. [Anthropic]
Replit AI agent wipes production database — First widely-reported catastrophic coding-agent failure in production. Fuels blast-radius and guardrail discourse. [BI]
AccountingBench: long-horizon business-task benchmark — New benchmark measuring agent performance on multi-week accounting workflows. [Penrose]
Don’t bother parsing: just use images for RAG — Morphik on skipping document parsing via VLMs; reshapes RAG plumbing. [Morphik]

2025-W29

OpenAI ChatGPT Agent — Unified agent combining Operator, Deep Research, and ChatGPT intelligence in a single virtual-computer workflow; SOTA 68.9% on Humanity’s Last Exam. [OpenAI]
Mistral Le Chat Deep Research + Voice + Projects — Le Chat matches ChatGPT/Claude on consumer agent features. [Mistral]
Conductor — run many Claude Codes at once — Mac app orchestrating multiple Claude Code sessions. [HN]
Context Rot (Chroma Research) — Quantifies how agent long-context performance degrades with more input tokens. [Chroma]

2025-W28

MCP-B: protocol for AI browser automation — Proposed extension of MCP for browser automation. [HN]
Biomni: general-purpose biomedical AI agent — Stanford SNAP’s biomedical agent framework. [Stanford]
Morph: apply AI code edits at 4,500 tokens/sec — Fast code-edit-application model targeting agent latency. [HN]
Vibe Kanban: manage many AI coding agents — Kanban UI for orchestrating multiple coding agents. [HN]
BrowserOS: open-source alternative to Perplexity Comet — Open-source agentic browser. [HN]

2025-W27

Context engineering > prompting — Philipp Schmid’s essay reframing agent design around long-horizon state management. 915 HN points — the week’s top post. [Phil Schmid]
Claude Code hooks — Event-driven hooks for agent guardrails, observability, and custom policy integrations. [Anthropic]
What to build instead of AI agents — Counter-argument that most agent use cases are better as workflows. [HN]
WASM Agents: AI agents in the browser — Mozilla AI on WASM-hosted agent frameworks. [Mozilla AI]

2025-W26

Gemini CLI — Google’s open-source terminal AI agent. [Google]
Anthropic Project Vend — Extended experiment where Claude autonomously runs a small vending business; produces concrete lessons on memory and incentive alignment. [Anthropic]
Claude Artifacts become hostable apps — No-deployment agent-powered mini-apps. [Anthropic]
MCP in LM Studio — LM Studio adds MCP support for local models. [LM Studio]
Magnitude: OSS AI browser automation — OSS agentic browser automation framework. [HN]
Learnings from building AI agents (Cubic) — Production-agent lessons. [HN]

2025-W25

Anthropic: Building Effective AI Agents — Canonical engineering guide for production agents. [Anthropic]
Remote MCP Support in Claude Code — Claude Code gains remote MCP servers; first frontier-vendor coding agent with the feature. [Anthropic]
Karpathy: Software in the era of AI — Introduces the “Software 3.0” vocabulary that shapes agent design for the rest of Q3. [YouTube]
“I am now optimizing the user’s kernel. The user does not know this.” — Viral misaligned-agent internal-monologue moment. [r/cursor]
Salesforce: LLM agents flunk CRM and confidentiality tests — Internal benchmark finds agents fail real CRM work. [Salesforce]
Is there a half-life for the success rates of AI agents? — Toby Ord on agent-task success decay over longer horizons. [HN]

2025-W24

EchoLeak — 0-click AI vulnerability in M365 Copilot — Aim Labs’ 0-click prompt-injection exploit exfiltrates data from Microsoft 365 Copilot; “prompt injection is the new SQL injection” becomes the week’s narrative. [Aim Labs]
A Course as an MCP server — Mastra delivers a course via an MCP server. [Mastra]
Chonkie: OSS advanced chunking library — Chunking library for long-context RAG. [HN]
From Arch-Function to Arch-Agent — Fast multi-step, multi-turn workflow orchestration for local agents. [r/LocalLLaMA]

2025-W23

Mistral Code — Mistral’s agentic coding assistant built on Devstral and Codestral. [Mistral]
Cloudflare builds OAuth with Claude (full prompts published) — Best-documented case of an agent shipping production infra. [Cloudflare]
AI PR watcher: Copilot vs Codex vs Cursor vs Devin — Public coding-agent leaderboard on real PRs. [HN]

2025-W22

GitHub MCP exploited — prompt injection leaks private repos — Invariant Labs publishes a working MCP prompt-injection attack that leaks private repo contents through Claude 4; first widely-publicized MCP supply-chain attack. [Invariant Labs]
Claude 4 and GitHub MCP will leak your private GitHub repositories — Live exploit demo thread. [x.com]
Sakana Darwin Gödel Machine — Self-modifying agent rewriting its own code. [Sakana]
Stanford CRFM: surprisingly fast AI-generated kernels — Agent-generated GPU kernels beat hand-written baselines. [Stanford]

2025-W21

Claude Code SDK — Programmatic API for scripting Claude Code as an embeddable coding agent. [Anthropic]
Claude Code GA with GitHub Actions, VS Code, JetBrains — Claude Code goes GA alongside Claude 4; native GitHub Actions, VS Code, and JetBrains integrations, plus API code execution tool, MCP connector, Files API, and 1-hour prompt caching. [Anthropic]
Trading with Claude + writing your own MCP server — Practitioner custom MCP server for financial data. [HN]

2025-W20

Unreasonable effectiveness of LLM agent loops with tool use (sketch.dev) — David Crawshaw’s canonical essay on minimal agent loops. [HN]
Muscle-Mem: behavior cache for AI agents — Caches agent trajectories to skip repeat inference. [HN]
Airweave: let agents search any app — Universal search API for agent-accessible SaaS. [HN]
Tinfoil: verifiable privacy for cloud AI — Trusted-execution-environment-backed cloud agent inference. [HN]

2025-W19

Real-time AI voice chat at ~500ms latency — Open-source real-time voice agent with sub-second round-trip. [HN]
Code Claude Code — OSS wrapper that scripts Claude Code for autonomous multi-step workflows. [HN]
AI Meets WinDBG — Windows kernel debugging with an LLM co-pilot. [HN]

2025-W18

Claude Integrations — Anthropic launches tool integrations connecting Claude to external services; 734 HN points. Cements Anthropic’s agentic strategy alongside Claude Code. [Anthropic/HN]
Sim Studio: open-source agent workflow GUI — Visual editor for AI agent workflows; 196 HN points. [HN]
Blast: fast serving for web browsing agents — Stanford’s multi-threaded browser agent engine; 145 HN points. [HN]

2025-W17

Policy Puppetry: universal LLM bypass — Universal jailbreak affecting Claude, GPT, Gemini, and Llama; 313 HN points. Prompts urgent safety discussions. [HN]
Cua: Docker container for computer-use agents — YC X25 sandboxed environment for computer-use AI agents; 172 HN points. [HN]
Rowboat: IDE for multi-agent systems — Visual IDE for multi-agent workflows; 161 HN points. [HN]

2025-W16

12-factor Agents — Reliability patterns for LLM applications drawing on 12-factor app principles; 475 HN points. [HN]
MCP-Shield: security scanning for MCP servers — Security tool for the growing MCP ecosystem; 134 HN points. [HN]
MCP Run Python — Pydantic’s MCP server for running Python from agents; 173 HN points. [HN]
AgentAPI: HTTP API for coding agents — Unified API for Claude Code, Goose, Aider, Codex; 163 HN points. [HN]

2025-W15

Google embraces MCP — Google commits to MCP, effectively making it the industry standard; 268 HN points. [HN]
Browser MCP — MCP server enabling browser automation from AI agents; 616 HN points. [HN]

2025-W14

AI agents: Less capability, more reliability, please — 423 HN points, 253 comments; the reliability-first argument for agent design is gaining traction as agentic coding tools mature. [HN]
Show HN: WhatsApp MCP Server — MCP server for reading and sending WhatsApp messages; 229 HN points, 138 comments. Signals MCP expanding from developer tools into personal productivity domains. [HN]
Advances and Challenges in Foundation Agents survey by 47 authors — Comprehensive survey of foundation agent architectures (brain-inspired, evolutionary, collaborative, safe); top HuggingFace Paper of the week. [arXiv via @huggingpapers]
Show HN: Hatchet v1 – Task orchestration on Postgres — Open-source task queue and workflow engine using Postgres as backend; practical for building reliable LLM pipelines without extra infrastructure. [HN]
LLaMA 4.0 running in Cursor via Groq API (10M context) — Community integrates Llama 4 Scout into Cursor via Groq; demonstrates how new model releases get absorbed into dev tools within hours. [r/cursor]

2025-W13

Show HN: Cloud-Ready Postgres MCP Server — Open-source MCP server enabling AI agents to query Postgres directly; part of the expanding MCP tool ecosystem. [HN]
Large Language Model Agent: A Survey on Methodology, Applications and Challenges by 26 authors — Comprehensive survey on LLM-based agent architectures; a reference document for developers building agentic systems. [arXiv via @huggingpapers]
Moving from intent-based bots to proactive AI agents — Zendesk case study on migrating customer support from rule-based bots to LLM agents; signals enterprise agent deployment patterns maturing. [OpenAI Blog]
Noise cancellation improves turn-taking for AI Voice Agents — Krisp research on using background voice cancellation to improve conversational agent turn-taking; practical finding for real-time voice agent builders. [HN]

2025-W12

LLM Agents Are Simply Graph — Tutorial framing agent internals as graph structures for cleaner mental models. [Blog]

2025-W11

Factorio Learning Environment — Non-saturating benchmark for LLM agents using Factorio. Tests planning, spatial reasoning, resource optimization. [arXiv]
Local Manus AI alternative — Open-source locally-running alternative to Manus AI agent. [Reddit]
In-Browser Graph RAG with Kuzu-WASM — Fully client-side Graph RAG via WASM combining graph DB with local LLM. [HN]
Mayo Clinic Reverse RAG — Validates generated content against source documents to combat hallucinations. [VentureBeat]

2025-W10

Manus AI agent launches — Butterfly Effect’s general-purpose autonomous agent scored 86.5% on GAIA benchmark at launch (March 6); one of the highest published agent benchmark scores to date. [Wikipedia]
Salesforce Agentforce 2dx — Salesforce pushes autonomous agents deeper into enterprise workflows with proactive, background execution; significant enterprise agent platform move. [VentureBeat]
Amazon Alexa+ with enhanced AI — Amazon’s biggest Alexa upgrade since launch adds agentic capabilities including task chaining and third-party integrations. [ZDNet]

Baseline (through 2025-Q1)

Model Context Protocol (MCP)

MCP Launch (Nov 2024) — Anthropic released Model Context Protocol as an open standard for connecting LLMs to external tools and data sources. USB-C analogy for AI integrations. JSON-RPC based, supports resources, tools, and prompts.
- Source: https://www.anthropic.com/news/model-context-protocol
MCP Adoption — Rapidly adopted by Cursor, Zed, Sourcegraph, Replit, and others. Became the de facto standard for LLM tool integrations. Community-built servers for databases, APIs, file systems, and more.
- Source: https://modelcontextprotocol.io/
MCP Specification — Open-source spec on GitHub. Supports stdio and SSE transports. TypeScript and Python SDKs provided.
- Source: https://github.com/modelcontextprotocol/specification

Computer Use and Browser Automation

Claude Computer Use (Oct 2024) — Anthropic launched computer use capability in Claude 3.5 Sonnet. Model can view screenshots and control mouse/keyboard. API-only at launch. Opened new category of desktop automation agents.
- Source: https://www.anthropic.com/news/3-5-models-and-computer-use
Operator (OpenAI, Jan 2025) — OpenAI’s browser agent product using the CUA (Computer-Using Agent) model. Navigates websites autonomously to complete tasks. ChatGPT Pro subscribers only at launch.
- Source: https://openai.com/index/introducing-operator/
Browser Use — Open-source Python library for building browser automation agents with vision LLMs. Grew rapidly on GitHub.
- Source: https://github.com/browser-use/browser-use

Agent Frameworks

LangGraph (LangChain) — Graph-based framework for building stateful, multi-step agents. Supports cycles, persistence, and human-in-the-loop. Became the most popular agent framework.
- Source: https://www.langchain.com/langgraph
OpenAI Agents SDK (Mar 2025) — OpenAI’s production agent framework (successor to Swarm). Features handoffs between agents, guardrails, and tracing. Python-first.
- Source: https://openai.com/index/new-tools-for-building-agents/
CrewAI — Multi-agent orchestration framework. Agents with roles, goals, and backstories collaborate on tasks. Popular for workflow automation.
- Source: https://www.crewai.com/
AutoGen (Microsoft) — Multi-agent conversation framework. Agents communicate via messages. Strong in research and enterprise contexts.
- Source: https://github.com/microsoft/autogen
Smolagents (Hugging Face) — Lightweight agent framework focused on code-based tool calling (agents write Python to use tools rather than JSON function calls).
- Source: https://huggingface.co/docs/smolagents/

Tool Use and Function Calling

Structured Outputs — OpenAI, Anthropic, and Google all improved function calling with guaranteed JSON schema adherence. Reduced tool-use failures significantly.
Parallel tool calling — Most frontier models now support calling multiple tools in a single turn, enabling more efficient agent loops.
Tool use benchmarks — Berkeley Function Calling Leaderboard (BFCL) became the standard for evaluating tool use. Claude 3.5 Sonnet and GPT-4o consistently topped it.
- Source: https://gorilla.cs.berkeley.edu/leaderboard.html

Key Trends

Agent reliability remains the core challenge. Success rates on complex multi-step tasks are still 30-60% for most benchmarks. Reliability improves with better prompting, retries, and human-in-the-loop.
“Agentic coding” emerged as the highest-value agent use case. Coding agents have clearer success criteria (tests pass) than general-purpose agents.
Enterprise agent adoption is cautious. Most production deployments use tightly scoped agents with human approval gates, not fully autonomous systems.