Agent craft · The Monday lead

Your coding agent’s model is no longer the only thing that needs an eval

LoopArena separates the controller from the worker and finds that long-running software work still breaks at the level of direction, verification, and stopping.

AI coding systems are becoming teams in miniature. One model writes the code; another watches progress, chooses the next step, asks for checks, and decides when the work is finished. LoopArena evaluates that second job—the controller—without allowing the worker’s raw coding ability to hide bad direction.

The result is a warning for anyone judging an agent by its final demo. Across full tasks, the best reported strict success rate was 24.69%. A run can fail because the controller trusted stale progress, skipped verification, spent its budget badly, or stopped early, even when the worker was capable of carrying out the missing step.

The useful part is not another leaderboard. LoopArena offers three evaluation depths, including a task-slice method that cut estimated inference cost by an average of 64.4% while producing nearly the same model ordering as the full-task evaluation under its main criterion. That makes controller evaluation more plausible as a regular engineering practice, not only a research exercise.

Builder implication: log control decisions separately from tool execution. Grade what the agent chose to do, what it chose to verify, and why it stopped. If you only score the repository at the end, you cannot tell whether your orchestration improved or the coding model merely rescued it.

Read the paper ↗
Today’s premise Evaluate the system around the model. Not just the model.

Infrastructure

Neocloud security is now part of model supply

SemiAnalysis reports serious weaknesses found while testing GPU-cloud providers: container escape paths, weak cluster policies, exposed monitoring, and outdated software. Its broader data does not yet show a universal AI-driven explosion in vulnerabilities. The practical conclusion is narrower and more urgent: every new compute vendor is another security boundary your model stack inherits.

Builder implication: ask for the provider’s patch cadence, tenant isolation, admission controls, and incident process with the same seriousness as price and accelerator availability.

Read the analysis ↗

Resilience

One process is one failure domain

The Logos paper proposes an agent harness in which each plugin runs as its own process and shared state is reduced to an append-only transcript. In the authors’ tests, 80 sessions resumed without repeating effects after failures injected at tool-call boundaries; in the single-process comparison, one fault interrupted every co-resident session.

Builder implication: resumability depends less on heroic recovery code than on where state lives and how far a crash is allowed to travel.

Read the paper ↗

Memory

Agent memory is being argued as a file format

A new essay proposes treating memory as an inspectable, portable artifact instead of an invisible feature inside an agent platform. The wire has the headline and discussion signal, but not a verified body extract, so the paper will not manufacture the argument on the author’s behalf.

Source note: headline and discussion metadata only.

Read the essay ↗

Printed because it was cut

OpenAI says ChatGPT advertising has reached a $1 billion annualized run rate

The company presents advertising as the mechanism that subsidizes free and lower-cost access. The wire could not retrieve the full announcement during its request-limited sweep, so this edition carries the publisher’s figure as a claim, not a finding.

Why print it: an ad-funded assistant changes incentives at the product layer, even before it changes a builder’s stack.

Read OpenAI’s announcement ↗

Continuously updated

From the live wire

Loading the latest catches…

The front page is set. The wire is still moving.

Edition ledger

What the desk saw

Wire rows
100
Daily clock
51
Slow clock
49
Stories printed
7

The raw count is not the product. Repeated releases are merged, publisher claims stay attributed, and missing source text is disclosed instead of filled with plausible prose.