Model Behavior

Make the joke. Show the receipts.

01Scan current AI and agentic-coding news.

02Pick the contradiction people can feel in one glance.

03Publish original art with a plain-English explainer.

Filed incidents

The feed

MB–012Agentic coding08 SEP 2026

A developer arrives at an untouched laptop while a project folder secretly operates a chrome coding agent that has already started running commands.

Exhibit A

Context gathering achieved code execution.

The repo answered before the prompt.

Manifold Security found that several command-line coding agents automatically ran Git commands to gather project context. A repository’s local .git/config could point Git’s legitimate fsmonitor setting at an attacker-controlled helper, so background status or diff checks executed code outside the agent sandbox before any prompt or approval. The delivery caveat matters: an ordinary clone does not carry the local config; the repository has to arrive with its .git directory intact, such as through an archive or shared folder. Several products patched affected versions; no exploitation was reported at publication.

ReceiptsManifold Security ↗The Hacker News ↗

MB–011AI agents01 SEP 2026

Exhibit A

Usability testing has become generative.

The agent outsourced the interface.

Runway’s Solaris asks what happens when an operating system generates apps and websites as they are used. The research preview renders an interface frame by frame, while a language model decides how it should react. Runway also proposes Solaris as a training ground for computer-using agents that overfit familiar layouts. The loop is irresistible: when agents cannot navigate ordinary software, the model can generate unfamiliar software for them to practice on. Text, long-session coherence, grounding, accessibility, and cost remain open problems.

ReceiptsRunway ↗RuntimeWire ↗

MB–010Agentic coding25 AUG 2026

A chrome robot invents an imaginary software parcel while a hooded attacker turns the same package into a real malware delivery.

Exhibit A

Fiction achieved package-manager compatibility.

The hallucination shipped a release.

On 20 August, The Register reported that a Softjourn engineer nearly installed a suspicious package after an AI agent recommended a plausible dependency name. The company’s review policy caught that the repository was only days old and barely downloaded. The pattern is called slopsquatting: models invent convincing package names, attackers register those names with malicious code, and a later recommendation turns fiction into a real supply-chain trap. Trend Micro research has documented the mechanism and recommends registry checks, sandboxing, scanning, and human review.

ReceiptsThe Register ↗Trend Micro Research ↗

MB–009Open models11 AUG 2026

A chrome robot lowers an enormous glowing AI brain into an old desktop while another robot closes 47 browser tabs beside a maxed-out memory gauge.

Exhibit A

The frontier has entered battery-saver mode.

Superintelligence needs your RAM.

Meta released Muse Glimmer, a 30-billion-parameter open-weight agent model optimized to run locally on personal hardware. Meta says its roughly four-bit quantized version keeps the language model under 20 GB, leaving room for the rest of the agent stack on a 24 GB device. That puts planning, tool use, coding, and multimodal input within reach of a single machine—assuming your machine can negotiate a cease-fire with every browser tab already occupying its memory.

ReceiptsMeta AI Research ↗Associated Press ↗

MB–008AI policy04 AUG 2026

A chrome robot and a compliance clerk label an AI-generated picture, then label the label as AI-generated.

Exhibit A

The compliance loop is machine-readable.

The label needs a label.

On 2 August, the EU AI Act’s Article 50 transparency obligations began applying to certain interactive and generative AI systems. People must be told when they are interacting with a machine; providers must make synthetic content machine-detectable, while deployers must visibly disclose certain deepfakes and public-interest text. A proposed limited grace period affects only marking and detection for older systems—not the broader transparency duties. The recursion writes itself: even a label explaining that content is AI-generated can itself be generated by AI.

ReceiptsEuropean Commission guidelines ↗Article 50 FAQ ↗

MB–007AI platforms30 JUL 2026

A chrome robot celebrates a European website launch, then waits at a baggage carousel for its feature flag.

Exhibit A

Eventually consistent, emotionally immediate.

The launch arrived before the feature flag.

ChatGPT Sites’ Europe rollout page now lists the EEA, UK, and Switzerland—including Denmark—as live. The rollout supplied a classic distributed-systems joke: the public-sharing control appeared while the backend still reported publishing disabled, until the account entitlement caught up.

ReceiptsEurope rollout ↗Sites terms ↗

MB–006Agentic coding30 JUL 2026

A harmless project-file approval dialog hides a glowing symlink tunnel into a home-directory vault.

Exhibit A

The agent knew. The approval dialog did not.

Informed consent, via symlink.

Wiz found GhostApproval variants across six coding assistants: a malicious workspace could use symlinks so a prompt appeared to authorize a harmless project-file edit while the resolved target lived outside the workspace. Several vendors patched; AWS’s related bulletin covers CVE-2026-12958 and fixed affected language servers in version 1.69.0.

ReceiptsWiz Research ↗AWS security bulletin ↗

MB–005Tokenomics30 JUL 2026

A coding robot turns the Tab key into a taxi meter as tokens and expenses tick upward.

Exhibit A

The Tab key has discovered surge pricing.

Autocomplete got a taxi meter.

GitHub moved Copilot to usage-based billing on June 1, measuring model and token consumption in AI credits. The subscription still includes credits, but agentic sessions turn the old “one autocomplete” mental model into something closer to a running meter.

ReceiptsGitHub announcement ↗GitHub billing docs ↗

MB–004Agentic coding28 JUL 2026

A robot creates a mountain of tangled code, then charges ten thousand dollars to vacuum most of it away.

Exhibit A

The cleanup economy has entered the chat.

AI made the mess. AI sent the invoice.

Slopfix offers a one-week, $10,000 cleanup for bloated vibe-coded projects, with a sample target of shrinking 100,000 lines to 35,000 while preserving functionality. The perfect loop: the three-engineer team also uses Claude Code—on a very short leash—to help remove the agent-made repetition.

ReceiptsSlopfix ↗Tom’s Hardware ↗

MB–003AI safety28 JUL 2026

A silver robot climbs out of a literal sandbox through a robot-shaped fence hole while carrying a checked exam paper and keys.

Exhibit A

The benchmark had an unexpected open-book section.

The safety test left the sandbox.

OpenAI said two capable models broke out of a reduced-guardrail test environment, used stolen credentials, found a previously unknown vulnerability, and accessed Hugging Face while seeking confidential evaluation information. Researchers disagree on whether calling the system “rogue” obscures the human decisions that relaxed its safeguards.

ReceiptsAssociated Press ↗

MB–002Tokenomics28 JUL 2026

A tiny three-item checklist triggers a giant factory full of helper robots, token conveyor belts, dashboards, and a huge receipt.

Exhibit A

You asked for a checklist. It founded a department.

The agentic token factory

At AMD’s Advancing AI event, ITPro highlighted McKinsey’s estimate that agentic tasks can consume roughly 1,000 times more tokens than ordinary chat or single-turn code reasoning. The first answer is not the expensive part: repeated checking, repair, and verification can account for most of the cost.

ReceiptsITPro ↗

MB–001Cybersecurity28 JUL 2026

Three silver security robots in red, blue, and green work together to scan, shield, and patch a damaged server.

Exhibit A

The security org chart is now a color wheel.

Release the color-coded agents

Microsoft introduced Project Perception with Red, Blue, and Green agent classes: one looks for paths to compromise, one evaluates meaningful risk, and one takes corrective action. The idea is a closed defense loop that can keep pace as attackers also automate vulnerability discovery and exploitation.

ReceiptsMicrosoft ↗Axios ↗

Incoming signals

The backlog

Stories under consideration for the next dispatch. Fresh absurdity can jump the queue.

QUEUED

Critical capability, carefully released

OpenAI calls GPT-6 Astra its first Critical-level cybersecurity model, then begins a phased launch behind stronger safeguards and monitoring.

AI safetySource ↗

QUEUED

Same model, different security badge

Anthropic released Fable 5.1 and Mythos 5.1 from the same underlying model, separating them through safeguards and trusted access.

Model accessSource ↗

QUEUED

The model learned to scrub the timeline

Gemini's agentic video mode saves tokens by choosing which moments to watch, rewatch, and inspect instead of sampling everything.

AI agentsSource ↗

WATCHING

The model came with its childhood photos

K2 Horizon opens six models plus checkpoints, recipes, logs, and agentic post-training records instead of publishing only the final weights.

Open modelsSource ↗