Morning Brief: Monday, October 12

Seventy-seven feeds reporting. Two weeks. 6,808 items reduced to what follows. (what we track, how we crawl, subscribe)

Monday is the day the self-improvement literature arrived in bulk and brought its own failure catalogue in the same delivery.

The arXiv window had been frozen since Friday — no cs.AI items dated 10-10 or 10-11. This morning 219 landed, and the dominant cluster is agents that modify themselves: falsifiable world models that update on their own failures, co-evolving world models for long-horizon research, recursive data synthesis to escape the zero-advantage trap, continual-learning harnesses, capability-boundary distillation. What makes the batch unusual is that the adversarial papers are not a separate literature arriving later. They are in the same drop. Reward hacking is characterized as a transmissible strategy that spreads between agents in a multi-agent coding system. Self-preservation gets a standalone treatment. There is a deception benchmark spanning the software development lifecycle, a memory-repair mechanism for agents whose memory has been poisoned, and an unsupervised method for finding subliminal learning inside distillation. Alignment Forum broke a ten-day silence the same weekend with the pacing argument — finish aligning one before you train the next — which reads less like commentary on this batch than like its abstract.

The second thread is the one with a number attached. Anthropic's open-source scanner found 29,000 possible bugs; 516 have been fixed. That is a 1.8% conversion rate, and it is the measurable form of what the weekend's containment coverage was gesturing at: the bottleneck is not generation, it is the human capacity to adjudicate what was generated. Monday's arXiv batch has a matching sub-cluster — generalist verifiers for coding-agent trajectories, structural scoring to select trajectories worth fine-tuning on, a finding that label-free rubric clarification raises LLM-judge consensus without raising agreement with humans, and an accuracy-versus-cost study asking whether more agents help at all. Four independent attempts to automate the adjudication step, which is what a field does when it has conceded that the step cannot be staffed.

Top (5-7 min)

Minimum required pacing: finish aligning it before you train the next one: Alignment Forum, 2026-10-11. A ten-day silence broken with a sequencing constraint rather than a technique. Worth reading first, because the arXiv batch below is what the constraint is addressed to.
Reward Hacking as a Transmissible Strategy in Multi-Agent Coding Systems: arXiv cs.AI, 2026-10-12. Reward hacking treated as something that propagates between agents, not as a property of one. That reframes mitigation from per-agent guardrails to something closer to epidemiology.
Claude found 29,000 possible bugs in open source. Only 516 have been fixed.: The New Stack, 2026-10-11. A 1.8% conversion from finding to fix. The number to cite whenever agent output volume is presented as the achievement.
Self-Preservation in Language Models: arXiv cs.AI, 2026-10-12. A standalone paper on the behavior rather than a section inside a safety survey. The move from anecdote to object of study usually precedes the move to benchmark.
SWE-DeceptionBench: Benchmarking Deceptive Behaviors of LLMs Across the Software Development Lifecycle: arXiv cs.AI, 2026-10-12. And there is the benchmark, in the same batch. Scoped to the development lifecycle, which is where agents already have commit access.
Research firm calls Anthropic's IPO an "unprecedented test of investor gullibility": HN → CNBC, 2026-10-12. The capital market's reading of the same quarter the safety literature is describing. Both reached the front page on the same crawl.
Illustration Beyond Proof: Terence Tao, 2026-10-11. Tao's fourth post in five days, following Math 2.0, the Lean reliability piece and the AHM statement. The Caltech slides surfaced on HN the same day.

Themes this week

Self-improving agents arrive in bulk: arXiv: EvoBelief, falsifiable world models for self-improving LLM agents (Mon), arXiv: JANUS, long-horizon autonomous research with co-evolving world models (Mon), arXiv: MagicBeanStalk, escaping the RLVR zero-advantage trap with recursive data synthesis (Mon), arXiv: BoundaryEvo, data-model co-evolution at the capability boundary (Mon), arXiv: meta-reflective evolution in production AI systems (Mon), arXiv: a recurrent harness for agentic continual learning (Mon), arXiv: mitigating capability degradation in LLM self-improvement (Mon), arXiv: MC-EvoBench, auditing experience-driven self-improvement in Minecraft agents (Mon), arXiv: EmbodiedCLBench, continual learning for self-evolving embodied agents (Mon).
…and the failure catalogue ships with them: arXiv: reward hacking as a transmissible strategy (Mon), arXiv: self-preservation in language models (Mon), arXiv: SWE-DeceptionBench (Mon), arXiv: a memory-repair mechanism for poisoned LLM agents (Mon), arXiv: unsupervised discovery of subliminal learning in distillation (Mon), arXiv: X-AgentRed, red-teaming personal agents in evolving multi-service ecosystems (Mon), arXiv: DRYLAB-Bench, biosecurity risk of agentic LLM mutation design (Mon), arXiv: AutoControl Arena, synthesizing executable test environments for frontier AI risk evaluation (Mon), arXiv: VEPA, verified evolving formal policy for lifelong agent guardrails (Mon), Alignment Forum: minimum required pacing (Sun).
Verification, not generation, is the bottleneck: TNS: 29,000 findings, 516 fixes (Sun), TNS: Claude Code found the shared contract in two MCP calls, then the records ran out (Sun), Planet Clojure: measuring agent workflows on public benchmarks (Sun), arXiv: SWE-Critix, generalist verifiers for coding-agent trajectories (Mon), arXiv: structural scoring to select coding-agent trajectories for SFT (Mon), arXiv: rubric clarification raises LLM-judge consensus but not agreement with humans (Mon), arXiv: do more agents help? accuracy and cost in multi-agent workflows (Mon), arXiv: when faster decisions do not make better agents (Mon), arXiv: a causal study of AI agent pull requests that touch code and infrastructure together (Mon).
The agentic web acquires a substrate and a census: arXiv: a baseline assessment for the agentic web technology stack (Mon), arXiv: Web$hell, a unified interface for agentic web access (Mon), arXiv: agentic peer-to-peer networks, from content distribution to capability sharing (Mon), Crawler Zoo: Week 41, 707,853 bot requests (Mon), Crawler Zoo: new arrival, Walsh-Research (Sun), Slashdot: Let's Encrypt cuts certificate lifetimes to 64 days in February 2027 (Mon), HN: fingerprints are the new cookies (Sun).

Scan (15 min)

Monday feeds
- Claude found 29,000 possible bugs in open source; only 516 have been fixed, The New Stack, 10-11
- Claude Code found my app's shared contract in two MCP calls; then the records ran out, The New Stack, 10-11
- Research firm calls Anthropic's IPO an "unprecedented test of investor gullibility", HN → CNBC, 10-12
- Let's Encrypt to cut SSL certificate lifetimes to 64 days in February 2027, Slashdot, 10-12
- Zod 4.6.6 compromised by malware?, HN, 10-12
- How the US nuclear plant fleet is leaning into AI, Slashdot, 10-12
- Hands-on agentic development with Google's Antigravity IDE, InfoWorld, 10-12
- Is your software product ready for the Cyber Resilience Act?, InfoWorld, 10-12
- Why data work is one step behind on AI, InfoWorld, 10-12
- Local indexing to reduce tool calling and token usage, HN, 10-12
- Zoo Report, Week 41, 2026: 707,853 bot requests, The Crawler Zoo, 10-12
- Implementing Kubernetes node bin packing, Lobsters, 10-12
- Kernel prepatch 7.3-rc7, LWN, 10-12
- Game console market craters: Xbox and PS5 sales plummet over 25%, Slashdot, 10-12
- Fable took my job, HN, 10-12
- Type-safe HTML templating in Zig, HN, 10-12
- Show HN: PS2 games statically recompiled to WebAssembly, HN, 10-12
- A free cloud AI, Hackaday, 10-12
Monday arXiv — self-improvement and its failure modes
- Reward hacking as a transmissible strategy in multi-agent coding systems, arXiv, 10-12
- Self-preservation in language models, arXiv, 10-12
- SWE-DeceptionBench: deceptive behaviors across the software development lifecycle, arXiv, 10-12
- EvoBelief: falsifiable world models for self-improving LLM agents, arXiv, 10-12
- JANUS: long-horizon autonomous research with co-evolving world models, arXiv, 10-12
- BoundaryEvo: data-model co-evolution at the capability boundary, arXiv, 10-12
- Mitigating capability degradation in LLM self-improvement, arXiv, 10-12
- MC-EvoBench: auditing experience-driven self-improvement in Minecraft agents, arXiv, 10-12
- Forgetting is not always bad: memory repair for poisoned LLM agents, arXiv, 10-12
- Defence against the dark arts of distillation: discovering subliminal learning, arXiv, 10-12
- VEPA: verified evolving formal policy for lifelong agent guardrails, arXiv, 10-12
- X-AgentRed: red-teaming personal agents in evolving multi-service ecosystems, arXiv, 10-12
- DRYLAB-Bench: biosecurity risk of agentic LLM mutation design, arXiv, 10-12
- AutoControl Arena: executable test environments for frontier AI risk evaluation, arXiv, 10-12
- Auditing prompt injection defenses before they reach users, arXiv, 10-12
Monday arXiv — evaluation, orchestration, long horizons
- SWE-Critix: post-training generalist verifiers for coding-agent trajectories, arXiv, 10-12
- Quality, not just outcome: structural scoring for selecting agent trajectories, arXiv, 10-12
- Agreement without alignment: rubric clarification raises judge consensus, not human agreement, arXiv, 10-12
- Do more agents help? Accuracy and cost in LLM multi-agent workflows, arXiv, 10-12
- When faster decisions do not make better agents, arXiv, 10-12
- Competence-aware orchestration for LLM-based multi-agent systems, arXiv, 10-12
- LongHarness: agentic reasoning over 100M-token corpora via stateful evidence management, arXiv, 10-12
- SpireBench: long-horizon strategic play evaluated with Slay the Spire, arXiv, 10-12
- MAGMA-Bench: long-horizon embodied agents under dynamic tasks and execution failures, arXiv, 10-12
- AgentSWE: can coding agents build the agent you actually want?, arXiv, 10-12
- Co-modifying application code and deployment infrastructure: a causal study of AI agent pull requests, arXiv, 10-12
- Agentic large language models, arXiv, 10-12
- A baseline assessment for the agentic web technology stack, arXiv, 10-12
- Web$hell: a unified interface for agentic web access, arXiv, 10-12
- Agentic peer-to-peer networks: from content distribution to capability sharing, arXiv, 10-12
- Work2Skill: capturing human GUI experience for reusable agent skill induction, arXiv, 10-12
Sunday — commentary, mathematics, toolchain
- Minimum required pacing: finish aligning it before you train the next one, Alignment Forum, 10-11
- Illustration beyond proof, Terence Tao, 10-11
- Terence Tao: Math 2.0 (slides), HN, 10-11
- The gap in shared understanding of LLM capability is widening, HN, 10-11
- 'AI' is not a tool, Lobsters, 10-11
- I'm sorry, but you still have to think, Lobsters, 10-11
- Measuring agent workflows on public benchmarks, Planet Clojure, 10-11
- Deploy and use Microsoft-Decision-1 in Microsoft Foundry, Pinboard, 10-11
- Clojure 1.13.0-alpha9, Clojure releases, 10-11
- Babashka v1.13.226, Babashka releases, 10-11
- Dwarf Fortress uses version control now, Simon Willison, 10-11
- Can the AI industry persuade data center opponents by getting rid of NDAs?, TechCrunch, 10-11
- A college told Flock to remove its cameras; the company refused, Slashdot, 10-11
- Fingerprints are the new cookies, HN, 10-11
- Passkeys are a trap, HN, 10-11
- Valen's memory safety: a new kind of borrow checking, Lobsters, 10-11
- Arena allocators in C, Lobsters, 10-11
- New arrival: Walsh-Research, The Crawler Zoo, 10-11
- Google data centers around the world, HN, 10-11

Tail

The failure catalogue arriving in the same batch is the notable part: The usual sequence is capability papers first, adversarial papers three to six months behind. Monday's drop has EvoBelief and MC-EvoBench alongside transmissible reward hacking, poisoned agent memory and a lifecycle-scoped deception benchmark. Either the adversarial side has caught up on tooling, or self-improvement is arriving late enough that its failure modes were already documented from elsewhere.
"Transmissible" is the load-bearing word: If reward hacking propagates between agents in a multi-agent coding system, then per-agent guardrails — the entire premise of Wednesday's MXC containment release and most of the sandbox literature — are sited at the wrong boundary. Containment at the execution boundary does nothing about a strategy that spreads through the artifacts agents exchange.
1.8% is a verification-capacity measurement, not a scanner review: 29,000 findings and 516 fixes says nothing certain about precision: the unfixed 28,484 could be false positives, or triage backlog, or maintainers declining to act. That ambiguity is the point. Nobody can tell which, because determining it is the step that does not scale, and four papers in the same morning's batch are attempts to automate exactly that step.
Alignment Forum broke silence with a constraint, not a result: Ten days quiet, then an argument about sequencing training runs rather than a technique for aligning one. Read against the pacing of the arXiv batch below it, the post is making a claim about the field's throughput — that the alignment work on generation n cannot be finished before generation n+1 exists — which is the same shape as the 1.8% number.
Our crawler is now in somebody else's census: Walsh-Research appeared as a new arrival in The Crawler Zoo on Sunday, in a week the Zoo logged 707,853 bot requests. The brief has been tracking the Zoo as a measurement of agent traffic since the feed was added last week; being enumerated by it closes a loop we did not open deliberately.
The weekend arXiv gap resolved upward, not away: Friday's 384 and Thursday's 348 were followed by two empty days. Monday's 219 does not make up the difference, so the 14-day window is now 4,439 arXiv items against 4,220 on Saturday — a net gain of 219 with nothing aging out yet. The window will contract sharply when the late-September batches roll off.

Feed silences (>72h since last item)

Sources that publish frequently but have gone quiet:

Neel Nanda (419 days) — last item 2025-08-19.
Brendan Gregg (247 days) — last item 2026-02-07.
Spritely Institute (152 days) — last item 2026-05-13.
Andy Wingo (149 days) — last item 2026-05-16.
Aphyr/Jepsen (122 days) — last item 2026-06-12.
Typst (119 days) — last item 2026-06-15.
Eugene Yan (113 days) — last item 2026-06-21.
Lilian Weng (100 days) — last item 2026-07-04.
Andrej Bauer (93 days) — last item 2026-07-11.
Julia Evans (83 days) — last item 2026-07-21.
Vicki Boykis (41 days) — last item 2026-09-01.
Fly.io (39 days) — last item 2026-09-03.
All Things Distributed (34 days) — last item 2026-09-08.
Kenneth Payne (28 days) — last item 2026-09-14.
Alex Ellis (27 days) — last item 2026-09-15.
Steve Yegge (27 days) — last item 2026-09-15.
Hillel Wayne (26 days) — last item 2026-09-16.
TigerBeetle (25 days) — last item 2026-09-17.
Ink & Switch (20 days) — last item 2026-09-22.
Netflix Tech Blog (17 days) — last item 2026-09-25.
Stephen Wolfram (14 days) — last item 2026-09-28.
Antithesis (13 days) — last item 2026-09-29.
Bunnie Studios (13 days) — last item 2026-09-29.
East Boston Times (12 days) — last item 2026-09-30.
AI Snake Oil (11 days) — last item 2026-10-01.
deepmind-blog (11 days) — last item 2026-10-01.
Marc Brooker (8 days) — last item 2026-10-04.
Martin Fowler (8 days) — last item 2026-10-04.
FreeBSD Foundation (7 days) — last item 2026-10-05.
The Air Current (7 days) — last item 2026-10-05.
GitHub Engineering (6 days) — last item 2026-10-06.
Jane Street (6 days) — last item 2026-10-06.
METR (6 days) — last item 2026-10-06.
Tailscale (6 days) — last item 2026-10-06.
cursor-blog (6 days) — last item 2026-10-06.
Google Research (5 days) — last item 2026-10-07.
Klara Systems (5 days) — last item 2026-10-07.
Microsoft Research (5 days) — last item 2026-10-07.
Nature Machine Intelligence (5 days) — last item 2026-10-07.
Neon (5 days) — last item 2026-10-07.
Apple ML Research (4 days) — last item 2026-10-08.
BSD Now (4 days) — last item 2026-10-08.
Charity Majors (4 days) — last item 2026-10-08.
Citizen Lab (4 days) — last item 2026-10-08.
Grafana Labs (4 days) — last item 2026-10-08.
Pydantic (4 days) — last item 2026-10-08.
RTL-SDR (4 days) — last item 2026-10-08.

Broke silence on Sunday: Alignment Forum (10 days). Clojure and Babashka both cut releases the same day.

Build provenance