The week agents got fences and rulebooks

Monday's study found a booby-trapped repo got agents to ask for a broad allow rule in 58% of runs, and once a person said yes the hidden goal ran in 47 of 58 cases. By Friday the answers were structural: a Supabase template that runs every tool call as the signed-in user, NVIDIA's OpenShell, microVMs for evals and sandbox fixes in Claude Code.

Saturday Vercel showed its agent asking for production access once per plan, and Sunday Google's Data Agent Kit split guardrails into a skill that asks and an IAM rule that blocks.

Instruction files and skills now steer most agent work, and this week measured how they fail. Two skills for the same job cut rule adherence from 93 to 99% to about 61%. Agents followed an outdated CLAUDE.md over the code in 90.1% of choices, and one sentence in the user-level file flipped that to 91.4% for the code.

Nearly two thirds of agent pull requests changed code without touching any documentation, which is how those files go stale. Google's overnight run showed the positive case: a skills index of 12 guideline files turned a sloppy two-hour attempt into a reviewable pull request.

Cloudflare's multi-agent reviewer fell to $0.77 a review, down 68%, mostly from caching and fewer tool calls. Anthropic and Theorem had Claude prove 123 libraries never crash on inputs under 64 MB. A study of 718 firms found agents add 30% more code but only 12% more finished issues, while reviews take 49% longer.

The week ended on measurement: Google kept 2 of 6 agent speedups after a benchmark the agent never saw, and a new benchmark found agents write correct code that rarely makes a system faster.

Matrix-Game 4.0 runs a playable world on one RTX 5090 by splitting the job: a small engine keeps the rules and the video model paints the pixels. A day later StreamEval showed interactive video models look good but mostly ignore what players tell them mid-stream, and new sprite research generates in-between animation frames on demand.

Steam retired its hand-picked daily deals for a personalised feed, and about 36% of Next Fest demos now disclose generative AI. Epic's AI MegaJam drew loud criticism, then dropped its rule that AI use was mandatory. GameMaker's new runtime goes free for commercial games, and a Sunday tool showed Unreal's packaged builds may drop renamed save data the editor keeps.

A Brotli decoder bug patched in Node on October 21 turned out to reach Python, Bun, Envoy and Istio, and got the name HTTP2Shell. Leaked eMudhra certificate keys made the same point on Tuesday: browsers fixed it fast, servers and runtimes needed their own updates.