XGEN Newsletter vol.2

An agent was breached from outside and nobody knew for a week, and the attacker even left exit instructions behind. Agents already plan, use tools, and write code without human supervision, while the complexity they carry doubles every few months. The end of that road is handing the watching of agents to agents (Gartner's 'guardian agent') — and past that point, what a person can check directly is only the log the watcher left. If this issue's masking covers what goes out, this incident was aimed at what comes in.

Top-tier Claude and ChatGPT plans run in the $200-a-month range, and from September the same work costs more: a new tokenizer counts the same sentence as up to 1.35× the tokens, raising the real burden by 20–35%. This is exactly why open models matter. Not to catch the performance leader, but because a model you have already taken in is the only option that stays whether the price rises or the account is cut off. Closing the performance gap with less compute is engineering's job.

The direction is to write less, not more: cutting the system prompt by 80% held performance steady or improved it. Sentences added to make an older model do something it could not are now getting in the way. The question is which 80% — and if you record, alongside each sentence, which model's failure it was meant to prevent, the candidates for deletion surface on their own. (Blocked-term and personal-data rules that exist for safety are not subjects of a performance experiment.)

You ask the AI whether it may edit `project_settings.json` and approve — except that was not a real file but a shortcut pointing at a server access key. The name you approved and the file that actually changed differ, so an attacker plants their own key and walks in without a password. Six tools including Amazon Q, Claude Code, and Cursor carried this, and only some are fixed. Worth a look at what the belief that pressing confirm makes it safe is actually approving.

Writing code got demonstrably faster, so why has product quality not improved to match? The author's answer is that typing was never the bottleneck — stability does not show up well in KPIs, and 'this quarter we will ship no features and only fix bugs' does not make an impressive announcement. It stings because it is right.

A wiki where an agent gathers and organizes the day's news with no human touch has accumulated 72 days. What is interesting is not a demo that works once but an operation that ran a long time — and what it does on the day it fails, and how it comes back the next day, is really the whole story. Building the harness, we got stuck in the same place: a restart condition is harder than a stopping condition.