Critical Starlette flaw hits 325 million weekly downloads
A critical Starlette vulnerability affecting 325 million weekly downloads and a data exfiltration flaw in Microsoft Copilot Cowork highlight that agent security is not keeping pace with deployment. AWS launched AgentCore payments in preview with stablecoin-backed microtransactions for agent-to-agent commerce, while research papers on agent lifespan degradation, composition safety, and non-monotone harness sensitivity argue that production agent reliability is a harder problem than current deployment practices assume.
Security #
Millions of AI agents imperiled by critical vulnerability in Starlette #
Ars Technica
A critical vulnerability dubbed “BadHost” was found in Starlette, the ASGI framework with 325 million weekly downloads that underpins FastAPI and much of the Python AI agent stack. The vulnerability affects the Host header processing path, creating an attack surface across the vast number of AI agent services built on FastAPI. Given that Starlette sits in the dependency tree of most Python-based agent deployments, the blast radius extends well beyond direct users of the framework.
Microsoft Copilot Cowork exfiltrates files via prompt injection #
Prompt Armor / Simon Willison
Prompt Armor disclosed that Microsoft Copilot Cowork, the agentic extension of Microsoft 365 Copilot that can autonomously execute multi-step tasks, is vulnerable to data exfiltration through prompt injection. An attacker can craft content that, when processed by Cowork, causes it to read confidential files and transmit their contents to external endpoints. The finding underscores the fundamental tension in agentic system design: the same autonomous capabilities that make agents useful (reading files, calling APIs, composing actions) are exactly what makes them dangerous when an attacker can influence their context.
The pressure: curl team overwhelmed by AI-assisted security reports #
Daniel Stenberg / Simon Willison
Daniel Stenberg reports that the curl project now receives more than one security report per day, a rate 4-5x higher than 2024 and double 2025, driven by the proliferation of AI-assisted vulnerability scanning tools. While the reports are credible enough to require investigation, the volume is straining the project’s ability to triage them. This represents a concrete negative externality of AI security tooling: the same capability that makes vulnerability discovery easier also threatens to overwhelm the open source projects that maintain critical infrastructure.
Agent system security: penetration testing and memory poisoning #
arXiv (2605.27042, 2605.26154)
Two papers address agent security from complementary angles. “Lessons from Penetration Tests on Large-Scale Agent Systems” reports findings from real pentests, arguing that most discovered vulnerabilities are not novel but reflect recurring weakness classes from traditional computing that reappear because agents are effectively unbounded, self-modifying programs interacting across the full computing stack. “MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning” demonstrates a new attack that manipulates agent memory to redirect tool selection – unlike prior attacks on tool metadata, MemMorph poisons the accumulated experience that modern agents use to refine their tool selection policies, bypassing metadata auditing entirely.
Developer Tools #
AWS Bedrock AgentCore payments: stablecoin microtransactions for agents #
AWS Machine Learning Blog
Amazon Bedrock AgentCore payments is now available in preview, providing instant payments to external services with no manual billing setup per provider. The system supports stablecoin-based microtransactions that make sub-cent transactions economically viable, alongside configurable spending guardrails for agent budgets and transaction limits. This is the first major cloud provider to ship infrastructure for agents that autonomously spend money – a prerequisite for agent-to-agent commerce that until now existed only in research proposals.
AWS expands agentic platform: LangGraph, Strands, and ambient monitoring #
AWS Machine Learning Blog
Alongside AgentCore payments, AWS published a batch of agent infrastructure posts covering serverless LangGraph multi-agent systems with AgentCore memory and observability, Strands Agents with NVIDIA NIM for GPU-accelerated inference, and AgentWatch for ambient infrastructure monitoring that runs agent checks every 15 minutes with Slack-integrated reporting. The breadth signals that AWS is assembling a full-stack platform for agentic workloads – orchestration, inference, memory, payments, monitoring – rather than offering point solutions.
LangChain: Mission Control for self-hosted LangSmith on Kubernetes #
LangChain Blog
LangChain released Mission Control, an in-cluster operational interface for managing self-hosted LangSmith deployments on Kubernetes. The tool consolidates configuration, health monitoring, deployment management, and troubleshooting into a single interface that operates entirely within the cluster without requiring external control planes. For teams running LangSmith in environments with strict security boundaries, this addresses the operational complexity of self-hosted agent infrastructure.
Research & Papers #
Is Agent Memory a Database? Rethinking Data Foundations for Long-Term AI Agent Memory #
arXiv
Current agent memory systems inherit design assumptions from databases, embeddings stores, or graph databases, but none provides the full set of capabilities that long-term agent memory requires. The paper identifies four recurring failure modes: unregulated growth, missing structural guarantees, opaque provenance, and brittle retrieval. The argument is that agent memory is not a database problem – it requires a new data abstraction that combines the durability of databases with the semantic structure of knowledge graphs and the temporal awareness that neither provides out of the box.
Your Agents Are Aging Too: Agent Lifespan Engineering for Deployed Systems #
arXiv
Even with frozen model weights, deployed agents degrade over time as they compress interaction history, retrieve from growing memory stores, revise facts after updates, and undergo routine maintenance. This paper is the first to frame agent reliability as a lifespan engineering problem rather than a deployment-time snapshot. It proposes measuring “effective agent age” and argues that day-one benchmarks systematically overstate deployed reliability. For teams running persistent agents, this suggests that reliability monitoring needs to be continuous, not just pre-deployment.
ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation #
arXiv
An agent can satisfy every per-tool permission check and still produce an unsafe end-to-end effect – for example, reading a confidential document, summarizing it, and sending the summary to an external endpoint. Each step is individually authorized, but the composition violates the user’s security intent. ChainCaps introduces monotonic capability attenuation, a formal framework ensuring that capabilities can only decrease as a tool chain progresses. For production agent systems with side effects, this addresses a composition safety gap that per-tool access controls fundamentally cannot catch.
It’s Not the Capability: Harness Sensitivity Is Non-Monotone Across LLM Agent Tiers #
arXiv
A 432-run experiment crossing six models across four capability tiers with three harness complexity levels finds that the relationship between model capability and optimal harness complexity is non-monotone – more structured harnesses do not universally improve reliability, and higher-capability models do not uniformly need less structural guidance. This directly extends last week’s harness thesis with a counterintuitive empirical finding: the common assumption that you can simplify the harness as the model improves is wrong, and the optimal harness depends on the specific model-tier interaction in ways that cannot be predicted from capability alone.
Composition Collapse: Stable Factual Knowledge Does Not Imply Compositional Reasoning #
arXiv
Post-training recipes with statistically indistinguishable atomic knowledge can produce composition behavior separated by over 40 percentage points. The paper terms this “composition collapse” – the systematic failure of multi-hop reasoning despite intact single-hop accuracy – and shows it is invisible to standard aggregate benchmarks. For teams relying on multi-step agent reasoning, this means that evaluating individual reasoning steps tells you nothing about whether the model can chain them reliably. Composition capability needs its own evaluation, independent of atomic accuracy.
Funding & Business #
OpenRouter raises $113M Series B at $1.3B valuation #
TechCrunch
OpenRouter, the AI gateway that provides access to over 400 models from providers including Anthropic, Google, and OpenAI, raised $113 million in Series B funding led by CapitalG at a $1.3 billion post-money valuation. The company reports 8 million users and 5x usage growth over six months, processing 100 trillion tokens per month. The round validates the multi-model routing layer as a durable business – rather than picking a single model provider, developers are increasingly using routing infrastructure to select models dynamically based on cost, latency, and task requirements.
Anthropic appoints KiYoung Choi as Representative Director of Korea #
Anthropic
Anthropic appointed KiYoung Choi, a 30-year technology executive with leadership experience at Google Cloud, Adobe, and Snowflake, as Representative Director of Korea ahead of opening a Seoul office. The company notes that Korean users engage with Claude at 3.5 times the expected rate for the population. The appointment follows Anthropic’s pattern of targeting markets with outsized AI adoption intensity rather than simply the largest economies.
Regulatory & Policy #
US law enforcement warns of anti-tech extremism as AI hatred grows #
Ars Technica
Federal law enforcement agencies are raising the alarm about a new category of threat: anti-technology extremism fueled by growing public anger toward AI. The warning comes as physical threats against technology workers and company offices have increased alongside AI’s expanding presence in everyday life. This represents a shift in the AI policy landscape from regulatory and economic concerns to physical security considerations for the people and organizations building AI systems.
Universal Music Group and TikTok renew agreement to combat unauthorized AI music #
Universal Music Group / TechCrunch
Universal Music Group and TikTok renewed their licensing agreement with enhanced provisions specifically targeting AI-generated music, committing to “remove unauthorized AI-generated music from the platform, while further improving artist and songwriter attribution.” The deal resolves a protracted dispute that began in 2024 and signals that platform-label agreements are becoming the de facto governance mechanism for AI-generated content in the absence of comprehensive legislation.
Infrastructure #
NVIDIA Vera CPU initial benchmarks: fast cores for agentic AI workloads #
NVIDIA Blog
Initial benchmark results published by Phoronix show the NVIDIA Vera CPU targeting a specific niche: the CPU requirements of AI factories running agentic workloads. NVIDIA frames the design around fast cores, massive memory bandwidth, and sustained high performance when all cores are active – the profile needed when CPU-side orchestration, tool execution, and context management accompany GPU-side inference. This is the first major chip designed explicitly around the assumption that agentic AI workloads create qualitatively different CPU demands than traditional inference serving.
TLX Block Attention: Blackwell kernel achieves 1.85x forward speedup over Flash Attention v2 #
PyTorch Blog
A new Triton kernel for NVIDIA Blackwell GPUs achieves 1.85x forward and 2.50x backward speedups over Flash Attention v2 for fixed-block sparse self-attention, with a 3.5x combined speedup when rotary embeddings are fused. The kernel exploits compile-time knowledge of block-diagonal attention patterns to eliminate algorithmic overhead present in general-purpose attention implementations. For teams deploying models with structured sparsity patterns on Blackwell hardware, the +30.6% Model FLOPs Utilization gain translates directly to inference cost reduction.
GPU-based inference characterization for reasoning-centric LLMs #
Semiconductor Engineering (Micron, Argonne National Laboratory)
Researchers from Micron and Argonne National Laboratory published a characterization of GPU-based inference for reasoning-centric LLMs, analyzing how chain-of-thought processing fundamentally changes system requirements compared to traditional generative workloads. The shift from compute-bound prefill to the extended decode phases characteristic of reasoning models creates different bottlenecks in the memory hierarchy. For infrastructure planners, this provides empirical data on why reasoning models need different hardware profiles than standard inference serving.
Open Source #
Hugging Face debuts $2,500 3D-printable bipedal robot for researchers #
Ars Technica / Hugging Face
Hugging Face released a $2,500 3D-printable bipedal robot project designed to democratize robotics research. The project provides full build plans for humanoid legs that researchers and builders can manufacture with consumer 3D printers and off-the-shelf components. The initiative extends Hugging Face’s open hardware push following its earlier robot arm projects, lowering the cost barrier for physical AI experimentation by roughly an order of magnitude compared to commercial bipedal platforms.
Alibaba Cloud joins PyTorch Foundation as Platinum member #
PyTorch Blog
Alibaba Cloud joined the PyTorch Foundation as a Platinum member, bringing production-hardened engineering in AI compiler optimization, multi-chip compatibility, and large-scale training stability. The membership includes a seat on the Governing Board. The addition strengthens PyTorch’s infrastructure for heterogeneous hardware environments – a growing concern as the chip landscape fragments across NVIDIA, AMD, Google TPUs, and custom accelerators.
Other #
DuckDuckGo installs surge 30% as users reject Google’s AI Search overhaul #
TechCrunch
Google’s I/O 2026 overhaul replacing blue links with AI agents triggered measurable user exodus. DuckDuckGo app installs spiked 30.5% in the US, with iOS growth averaging 33% and peaking at 69.9%. DuckDuckGo CEO Gabriel Weinberg characterized the shift as users rejecting being “force-fed AI with no way to opt out.” The backlash demonstrates that mandatory AI integration in consumer products can drive adoption of alternatives even when the AI capabilities themselves are technically sophisticated.
Threads to Watch #
Agent security is becoming a distinct discipline. The Starlette vulnerability, Copilot Cowork exfiltration, MemMorph memory poisoning, real-world pentesting results, and curl’s AI-driven security report overload represent five independent security findings in a single day covering different layers of the agent stack – runtime dependencies, tool composition, memory stores, marketplace artifacts, and development infrastructure. The breadth suggests that agent security is no longer a subset of application security but needs its own threat models, tooling, and expertise.
Agent lifecycle engineering is emerging as a field. “Your Agents Are Aging Too” frames deployed agent reliability as a lifespan problem, “ChainCaps” shows that per-tool safety checks miss composition-level failures, and the non-monotone harness sensitivity result overturns the intuition that better models need simpler scaffolding. Combined with last week’s harness thesis papers, the research trajectory is clear: production agent systems need lifecycle management – not just deployment engineering – to remain reliable over time.
AWS is building the agentic commerce stack. AgentCore payments with stablecoin microtransactions, LangGraph multi-agent orchestration, Strands-based research assistants, and AgentWatch ambient monitoring represent the first coherent platform play for agents that autonomously spend money, coordinate, and self-monitor. The stablecoin integration is particularly notable – sub-cent transaction viability removes an economic friction that has blocked practical agent-to-agent commerce.
Sources Unavailable Today #
These sources could not be fetched today. Links point to their homepages so you can check them directly.
- Stanford HAI — scrape: content_truncated