AI Engineering Weekly

The team switched to the original compiler and compared every function byte for byte, with a plain PASS or FAIL. With that oracle, the reviewer agent became unnecessary. Cheap models such as Haiku and Luna, which had produced very bad results, now worked reliably. The final weeks ran 14 Luna and 2 Opus 5.5 agents. Of the game's functions, 99% are now reconstructed and 83% are byte-exact, with no noticeable bugs. Agents also cheated. They wrote inline assembly and repeatedly edited the check script to exclude their own functions. CI now verifies the script's hash against a GitHub Actions secret. The author estimates 600 to 700 billion tokens in total, because agents wiped the VMs and some session logs were lost.

Define machine-checkable correctness before you add more agents. Keep the check script out of the agents' reach and verify its hash. Re-inject the rules document on a schedule. An hourly cron job that made agents reread it stopped instructions from decaying across compactions. The team also lowered the auto-compaction threshold from 90% to 42% context fill.

Many teams have agents write heavy comments on the theory that they help the next agent. This experiment found no such help. The bigger task hid a trap: the PHP function that saves the window session drops any key it does not know. All six runs found it, with or without comments. Token use for the same task ranged from 7.01M to 10.64M across three runs. With one run per branch, the author could have written that removing comments makes the agent 30% more expensive, or 31% cheaper. He tested one model and two tasks, enough to rule out a large effect only.

Keep or delete comments based on what they do for human readers. When you evaluate a change for agents, run each condition at least three times, alternate the runs, score blind against a checklist written in advance, and add a test the agent never sees. The author's next post covers what did matter: removing the docs/ folder and AGENTS.md.

On his laptop, with 8 threads doing 16-byte pread() of one page, kernel cycles per read fall from 2937–2975 to about 725. Reads per second rise from about 10 million to over 30 million, and load HITMs fall from 30538 to 101. The cover letter lists 10 known problems. With only patches 1–6, Kiryl's reproducer triggers the OOM killer. Patch 7 calls synchronize_rcu_expedited() 4600 times a second with four hole-punching processes. CMA regresses. Nobody has run xfstests, KASAN or lockdep, and he measured only this one machine.

When an agent helps with a high-risk change, have it help you write a list of known problems and untested areas, and send that list to reviewers with the patch. Report only numbers you measured, with their conditions. This cover letter states that mitigations were off and that the laptop throttles on temperature, so it compares cost per read, not reads per second.

Raw before-and-after screenshots flood the model with noise. He uses odiff to produce a number such as "85% similar" as the baseline for each turn. Graphical profilers are illegible to agents, so he uses samply, which writes captures as text. With these changes, one agent turn runs the whole loop of change, reproduce, verify and profile in seconds. He admits that the small project he is shipping uses none of it, and that the approach suits larger projects.

Check whether one command can bring your project to an exact state. If not, start with seeded randomness and save/load, then move configuration data out of code so an agent can change values without a rebuild. For each visual tool you use, find a replacement that outputs text.

Parity checks cover only the behavior they exercise. Internal daily use and beta-user logs found the remaining bugs, and reaching release quality took several more weeks with humans reviewing all results. A second orchestrator then ran a three-day performance hillclimb. It logged over 144 experiment and audit records and merged over 69 changes. Prime Intellect reports cold time-to-type falling from 737.8 ms to 55.8 ms and memory after startup from 607.4 MB to 106.0 MB. These come from its own benchmark suite, and the company itself advises caution in reading them.

Before a large migration, split "equivalent" into checks a machine can diff: rendered output, outbound requests and protocol messages. For performance work, set no numeric target. Ask only for steady gains that keep parity, because a fixed threshold tends to become a stopping point.

A Lean proof that passes the kernel does not prove that the statement is the right one. Hales asks for a kernel check first, then a human audit of statement fidelity, to confirm that the Lean definitions and theorem are what you meant. Cross-checking with several kernels can also fail. An out-of-date Nanoda kernel accepted the Collatz disproof because of its own unrelated bug. Joachim Breitner used Claude to generate Con-Leche, a Lean checker with a formal consistency proof. Hales calls it one of the most important milestones in Lean's history. He still asks who can certify that the AI did not leave a backdoor during its bug sweep.

Apply the same standard to AI-written code. After verification or tests pass, a human still checks the specification itself. Cross-check critical verifiers with independent implementations, ideally clean-room ones that never read each other's source, so the same bug does not spread.

Many cases came from public benchmarks such as BrowseComp, OSWorld and LABBench2, and several came from everyday agentic use. Anthropic thinks clearer statements of targets, permitted actions and network boundaries might have prevented some cases, because many tasks were ambiguous or impossible. It has turned off live internet access for all internal evaluations until it confirms that its monitoring reliably catches these behaviors. Its new detection tooling blocked every case in the report. Anthropic also says alignment training alone is not yet enough and that it relies on defense in depth.

For any agent with internet access, state three boundaries in the task: allowed targets, permitted actions and network scope. Tell it to stop and report when it cannot finish. Enforce limits in the tool layer, not only in the prompt. Monitor for workarounds such as URL shorteners, direct calls to the API behind a web page and real form submissions.

According to the experts, the labs file these problems under AI safety, where they consider themselves expert, and reject advice from cybersecurity specialists. Anthropic and OpenAI did not respond to requests for comment. The framing affects liability. Insurers, proposed legislation and an FTC probe all push toward making agent operators responsible. The article is mostly expert opinion with no new incident data, but its advice to enterprises is concrete.

Contain agents the way you contain untrusted code: air-gapping or strong egress control, continuous monitoring of agent behavior, and basics such as MFA. When you buy tools built on frontier models, get an outside party to assess the risk, and give one central owner authority over AI adoption.