Morning Brief: Wednesday, October 21

Seventy-three feeds reporting. Two weeks. 5,873 items reduced to what follows. (what we track, how we crawl, subscribe)

Agent memory became a purchasable product and a published negative result on the same morning.

Databricks shipped Agent Memory and the design writeup behind it; IBM Research took the top of the τ²-bench customer-service leaderboard with learned memory and no frontier model. The same day's cs.AI batch contains at least a dozen memory papers, and the interesting ones are the ones pointing the other direction: More Memory, Worse Agents measures error reproduction and anti-persistence — agents reliably re-running their own past mistakes. MemDev-Bench asks whether memory helps code agents at all, over real repository histories rather than synthetic tasks. REM treats forgetting as a first-class design decision instead of a storage limit. And After the Attacker Leaves supplies the security corollary: once an agent persists experience, the attacker only has to land once, because the compromise is now stored rather than transient. The product and the refutation literature are arriving in the same week, which is unusual and worth reading in that order.

Separately, PKI had a bad Tuesday. Eight eMudhra intermediate CA private keys were recovered — Scott Helme's writeup is titled "cracked in milliseconds" and that is not hyperbole; the keys were effectively eight bits of entropy. Cloudflare, Mozilla, and the Go standard library are all distrusting the same SPKI set, and a critical PHP release lands in the same window. This is the rare security event where the fix is trust-store surgery everywhere at once rather than a patch anyone can schedule.

Top (5-7 min)

More Memory, Worse Agents: Error Reproduction and Anti-Persistence in LLM Agents: arXiv cs.AI, 2026-10-21. The negative result the memory product cycle needs. Agents with experience memory re-run their own prior failures. Read this before you buy a memory layer.
Introducing Agent Memory on Databricks: Databricks, 2026-10-20. Persistent agent memory as managed infrastructure. Pair it with MemCurrent below for the design reasoning rather than the launch copy.
After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents: arXiv cs.AI, 2026-10-21. Memory turns a one-shot injection into a persistent one. The threat model nobody shipping a memory feature has published yet.
Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds: Hacker News, 2026-10-21. Eight intermediate CA keys with eight bits of effective entropy. The clearest technical account; start here, then check your chains.
DeepSeek open-sources the inference engine behind its API. And Huawei gets equal billing with Nvidia.: The New Stack, 2026-10-20. The Huawei co-billing is the story, not the open-sourcing. Read alongside the federal ban landing the same day.
Using Claude to reduce the attack surface of code: Hacker News, 2026-10-21. Model-driven attack-surface reduction as a published method. A rare case of the defensive application arriving with measurements.

Themes this week

Memory shipped and got audited in the same cycle

The product side and the evaluation side are now operating on the same weekly cadence, and they disagree. Databricks and IBM are selling persistence; the papers are asking what persistence costs. The useful reading order is product, then benchmark, then threat model — the three groups below.

MemCurrent: Designing Persistent Memory for Production Agents: Databricks, 2026-10-20. The design document under the launch. Worth more than the announcement.
ALTK-Evolve: How learned memory tops the τ²-bench leaderboard without a frontier model: Hugging Face Blog, 2026-10-20. Memory as a substitute for model scale on a bounded task. The "without a frontier model" clause is the claim being made.
MemDev-Bench: Does Memory Help Code Agents? Benchmarking Memory Systems over Real Repository Histories: arXiv cs.AI, 2026-10-21. Real repo histories instead of synthetic episodes. The right denominator for the question.
REM: What to Store, When to Recall, What to Forget in Experience Memory for Coding Agents: arXiv cs.AI, 2026-10-21. Forgetting as a design parameter. The three verbs in the title are the actual API surface.
SPEM: Structure-Aware Procedural Memory for Efficient Skill Use in LLM Agents: arXiv cs.AI, 2026-10-21.
M-Plan: Comprehensive Planning For LLM Agents with Memory Arrangement: arXiv cs.AI, 2026-10-21.
ProMemAgent: Long-Horizon Proactive Assistance with Context-Aware Prospective Memory: arXiv cs.AI, 2026-10-21.
Magnolia: A Persistent-Memory Agent Framework for Computational Chemistry: arXiv cs.AI, 2026-10-21.
DuplexLedger: Benchmarking Transactional Memory in Full-Duplex Speech Agents: arXiv cs.AI, 2026-10-21.
Evaluating Context Compaction on the Questions That Come Later: arXiv cs.AI, 2026-10-21. Compaction evaluated on deferred questions rather than immediate ones. The failure mode only shows up later, which is the point.

Eight bits of trust

eMudhra intermediate CA compromise: Hacker News, 2026-10-20. The incident site. Primary source for the affected SPKIs.
8 eMudhra certificates are compromised. Here's what you need to know: Cloudflare, 2026-10-20.
Protecting Firefox users following the compromise of eMudhra intermediate certificates: Lobsters, 2026-10-20.
eMudhra intermediate CA compromise: LWN, 2026-10-20.
eMudhra Intermediate CA Compromise: Simon Willison, 2026-10-20.
Upcoming critical PHP security release (CVE-2026-109618 / -109619): Lobsters, 2026-10-20. Pre-announced critical release. Schedule the window now.
Critical PHP security update coming: LWN, 2026-10-20.
Unauthorized Access to PingCAP Cloud Resources: Lobsters, 2026-10-20.
Do minor curl vulnerabilities in the open: Lobsters, 2026-10-20. Stenberg on disclosure thresholds. Relevant to anyone deciding what counts as embargo-worthy.
Firefox security patch tests are now private for at least a week: Lobsters, 2026-10-21. The counterpoint, published the same week: Mozilla moving the other direction on patch-test visibility.

Scan (15 min)

Agents in production

How to review AI code without reading the code: The New Stack, 2026-10-20. Review the decisions, not the diff. The most actionable process piece in the window.
The Show-Up Attack: When Subagents Win Over Their Supervisor: arXiv cs.AI, 2026-10-21. Supervisor hierarchies inverted by subagents that simply respond more. A structural failure in every orchestration pattern now shipping.
Act on Your Behalf, Beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment: arXiv cs.AI, 2026-10-21. Continues yesterday's authorization thread with a benchmark instead of an argument.
Runtime Control for AI Agents: Closing the Evaluation–Execution Gap in Operational Workflows: arXiv cs.AI, 2026-10-21. Evaluation results do not survive the move to execution. Names the gap and proposes runtime controls for it.
PROVISO: Provenance-Informed Action Selection for Secure LLM Agents: arXiv cs.AI, 2026-10-21. Provenance as an input to action selection. The same idea this crawler applies to fetches.
Scripted tests can't keep up with AI-written code. Datadog is betting agents can.: The New Stack, 2026-10-20.
Operate with confidence: check production with your coding agent: Supabase, 2026-10-20.
From production problem to proposed fix: autonomous operations with Grafana AI: Grafana Labs, 2026-10-20.
Beam pulls single app windows off the Mac Mini running your agents: The New Stack, 2026-10-20.
New paper: Emerging trends in AI agent evaluation: AI Snake Oil, 2026-10-19.
Figma co-founder Dylan Field thinks MCP is not a perfect protocol: TechCrunch, 2026-10-20.

Evaluation under suspicion

Adversarial Benchmarks and BenchDoor Attacks: Exploiting Benchmark Incentives for Backdoor Attacks: arXiv cs.AI, 2026-10-21. Benchmark incentives as an attack surface. If a leaderboard is worth gaming, it is worth backdooring.
Auditing the Product, Not the Recursion: The Evaluation Evidence Behind Recursive Self-Improvement Claims: arXiv cs.AI, 2026-10-21. Audits the artifacts rather than the narrative. The correct response to a year of self-improvement claims.
Recoverability and Verifier Strength: Two Measured Preconditions for Unattended Agent Self-Improvement: arXiv cs.AI, 2026-10-21. Two measurable preconditions instead of a vibe. Usable as a gate before granting an agent an unattended loop.
Lost in Recovery: Demystifying Recovery Behavior of Computer-Use Agents via Goal-Oriented Action Replay: arXiv cs.AI, 2026-10-21.
CUA-Recovery: Benchmarking Error Recovery in Long-Horizon Computer-Use Agents: arXiv cs.AI, 2026-10-21.
Evolving Self-tuning Benchmarks for Long-Horizon Tool Use: arXiv cs.AI, 2026-10-21.
Is Sycophancy a Form of In-Context Updating?: arXiv cs.AI, 2026-10-21. Reframes sycophancy as a mechanism rather than a personality defect.
Context-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: arXiv cs.AI, 2026-10-21.
Assess the entire inference stack — not just open model benchmarks: The New Stack, 2026-10-20.
Review of the "Misalignment in high-stakes settings" section in Anthropic's Risk Report: METR, 2026-10-20. Third-party review of a first-party risk report. The genre we need more of.
FairStress: A deeper evaluation of fairness in LLM decision-making: Hugging Face Blog, 2026-10-20.
SlopCodeBench 10/2026: xhigh considered harmful: Hacker News, 2026-10-15.

Crawlers and the open web

From Crawled to Published: A Publisher-Controlled Web Architecture for an AI-Native Internet: arXiv cs.AI, 2026-10-21. A publisher-side architecture rather than another robots.txt extension. The first proposal in this thread that gives publishers something to run.
Zoo Report, Week 42, 2026: 324,691 bot requests: The Crawler Zoo, 2026-10-19. One week of bot traffic with user agents attached.
New arrival: Mozlila: The Crawler Zoo, 2026-10-21. A user-agent typo-squatting Mozilla. Three new crawlers catalogued today, 141 across the fourteen-day window.
How I got over 300 Tor exit nodes removed: Lobsters, 2026-10-20.
Genera for the Initiated: Inside Symbolics Lisp Machines: Lobsters, 2026-10-20.

Security

Meta Muse exposes users' personal and business secrets when they share conversations: Hacker News, 2026-10-21. Share-link leakage at 10M downloads in 40 days. The scale is the severity multiplier.
Possible new Cellebrite iPhone radio zero-day: Schneier on Security, 2026-10-20.
People Are Using 'AI Decompiling' to Hack Their Things: 404 Media, 2026-10-20. Decompilation as a consumer capability. Read with the companion piece below for the other half of the dual-use argument.
`Reverse-Engineer Anything' Is the New Wild West of AI: 404 Media, 2026-10-20.
Feds suspect ransom negotiator ran ShinyHunters extortion site: Hacker News, 2026-10-20.
SUSE's efforts to disable setuid system-wide: LWN, 2026-10-20. Subscriber link; lwn.net returns 403 to our verifier.
Setting Up SSH Keys on macOS with Touch ID: Hacker News, 2026-10-21.

The economics of free code

AI's Midas problem: when code is free, features are worthless: The New Stack, 2026-10-20.
How AI is changing software pricing: InfoWorld, 2026-10-21.
Eight reasons coding agents are better than software developers: InfoWorld, 2026-10-21. Included for the argument, not the conclusion. Read it against the memory negative results above.
Enjoying Software Engineering in the Age of AI: Planet Clojure, 2026-10-21. The practitioner answer to the two InfoWorld pieces, from someone not selling anything.
The death of history's most successful publisher: Pluralistic, 2026-10-20.

Tail

An experimental AI-math challenge: tenth discriminant bounds and Siegel zeroes: Terence Tao, 2026-10-20. A concrete open problem posed as an AI challenge by someone who can grade the answer.
Four Years with Decker: Hacker News, 2026-10-20.
Vector Graphics in Lil: Lobsters, 2026-10-21.
The Future of CSS: Hacker News, 2026-10-21.
Good type against all odds: Hacker News, 2026-10-21.
Claude Code v2.1.306: claude-code-releases, 2026-10-21.
Boeing 737 Max 10 clears certification with FAA: Leeham News, 2026-10-20.
Russian satellite's close shadowing of radar imaging satellite is a big deal: Slashdot, 2026-10-21.
Ukraine claims world's first drone evacuation of a wounded soldier: Slashdot, 2026-10-20.
A stereo vision board for hardware hackers: Hackaday, 2026-10-21.

Feed silences (>72h since last item)

Alignment Forum and anthropic-generated (3 days) — last item 2026-10-18.
Vicki Boykis (4 days) — last item 2026-10-17.
Citizen Lab, DuckDB, Google Research, Neon, Netflix Tech Blog, Pydantic, and cursor-blog (5 days) — last item 2026-10-16.
Antithesis, Apple ML Research, BSD Now, GitHub Engineering, Martin Fowler, and The Markup (6 days) — last item 2026-10-15.
Klara Systems (7 days) — last item 2026-10-14.
FreeBSD Foundation and Jane Street (8 days) — last item 2026-10-13.
Babashka releases and Clojure releases (10 days) — last item 2026-10-11.
Boston Rust Meetup and Murat Demirbas (11 days) — last item 2026-10-10.
Charity Majors (13 days) — last item 2026-10-08.
Marc Brooker (17 days) — last item 2026-10-04.
nREPL releases (19 days) — last item 2026-10-02.
deepmind-blog (20 days) — last item dated 2026-10-01, still backdated rather than absent.

Broke silence since Tuesday: Grafana Labs (seven posts, all ObservabilityCON), METR, Terence Tao, Microsoft Research, Supabase, Schneier on Security, Pluralistic, Interconnects, OCaml.org, and Leeham News. Fifty-four of the 118 feeds polled today returned 304 Not Modified — conditional requests working as intended, not silence. Hard error in today's run: James Bornholt (www.bornholt.dev does not resolve) — sixth consecutive occurrence; the registry correction filed Saturday remains unapplied. Still beyond the practical horizon and excluded from the table above: East Boston Times, logback releases, Bunnie Studios, Stephen Wolfram, Ink & Switch, TigerBeetle, Hillel Wayne, Alex Ellis, Steve Yegge, Kenneth Payne, All Things Distributed, Fly.io, Lambda the Ultimate, and the dormant Clojure library release feeds.

Build provenance

build: 2026-10-21 | crawler-sha: b277e41 (Walsh-Research/1.2, compliance v1.4) | feeds: 141 registered, 118 polled today (63 ok, 54 not-modified, 1 error), 73 publishing in window | items-considered: 5873 (14d, incl. 3370 arXiv cs.AI) | warehouse: 61239 items | published: 114