Morning Brief: Sunday, November 8

Seventy-six feeds reporting. Two weeks. 5,024 items reduced to what follows. (what we track, how we crawl, subscribe)

Sunday's thread is that a yes from an authentication or verification step is not the same as the thing being safe. Four layers produced one this cycle: sshd, a web framework's Forwarded header, a signed MCP toolchain, and LLM-written code that passed its own verifier.

The practitioner half and the paper half arrived independently and landed on the same sentence. Alpine's openssh-server accepted a password where its own configuration said it should not. A survey of web frameworks found they read Forwarded as fact because it looks structured. On the research side, three papers in two days are titled almost identically to the problem: Signed, Sealed, Leaked on MCP toolchains where a valid signature still admits a leak, Signed but Not Safe on requirement integrity surviving a multi-agent handoff, and Verified but Vacuous on LLM-generated code whose proofs hold and whose specifications are empty. The design response is the same in both halves: separate admission from sanitization rather than collapsing them into one trusted check. That is literally SPILLWAY's construction, and it is what GitHub's new Actions dependency lockfiles do at the supply-chain layer.

The second thread is supervision, and it is pulling against itself. AWS shipped Kiro bots so developers stop babysitting agents, Harness made the same pitch the same week, and The New Stack published a shop reviewing four times the AI code without reading every line. Set against that: Slashdot's read that mandating AI use is backfiring, developers deliberately downgrading their models, and METR's independent assessment of R&D acceleration inside Anthropic, which is what supervision looks like when someone outside the building does it.

Top (5-7 min)

Alpine Linux: openssh-server password authentication bypass: Alpine Linux, 2026-11-07. The auth path returned success where the configuration said refuse. Start here; it is the concrete version of everything below.
Forwarded Without Question: How Web Frameworks Overtrust the Forwarded Header: Lauri Koskela, 2026-11-07. A structured header read as fact because it is structured. Survey across frameworks, so it is a class of bug rather than one.
Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains: arXiv cs.AI, 2026-11-05. Signature verification on an MCP toolchain that still admits a leak. The paper the Alpine advisory rhymes with.
Verified but Vacuous: Three Failure Surfaces of LLM-Driven Verified Code Generation: arXiv cs.AI, 2026-11-05. The proofs pass. The specifications are empty. Read beside Microsoft's PDD Kit result below, which claims the opposite.
Dear Open Source Developers: It's OK not to embargo: Open Source Security, 2026-11-07. The disclosure-norms argument, published into a week with four live advisories. Maintainer-side, not vendor-side.
Why AWS wants developers to stop babysitting their AI agents: The New Stack, 2026-11-07. The supervision thread's product end. Agent memory as the mechanism for removing the human from the loop.
Independent Assessment of AI R&D Acceleration at Anthropic in October 2026: METR, 2026-11-05. Measured from outside the lab, which is the part that makes it worth reading rather than the number it reports.

Themes

A yes that does not mean safe

Three papers in two days are named for the gap, and the advisories this cycle are each an instance of it. The common fix, in both halves, is to stop treating one check as the whole boundary.

SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection: arXiv cs.AI, 2026-11-06. Splits the trusted check in two: what is allowed in, and what is cleaned. The architectural answer to the whole theme.
Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs: arXiv cs.AI, 2026-11-06. A requirement can be signed at every hop and still arrive changed. Integrity of the artifact is not integrity of the intent.
Beyond Instruction Override: Benchmarking Indirect Prompt Injection with Task-Tampering Attacks: arXiv cs.AI, 2026-11-06. Injection that edits the task rather than overriding the instruction, which is the harder case to detect in a trace.
When Verification Is Not Agreement: Cross-Agent LLM-to-Dafny Formalization: arXiv cs.AI, 2026-11-06. Two agents verify and disagree. Separates "the proof checked" from "we formalized the same thing."
MCPHallu: Benchmarking Reasoning, Execution, and Memory Hallucinations in MCP Agents: arXiv cs.AI, 2026-11-06. Three failure classes separated by where they occur, which matters because only one of them shows up in output.
Trust Responsive Runtime Authorization for Agentic AI with Empirical Characterization of Policy Behavior and Parameter Sensitivity: arXiv cs.AI, 2026-11-06. Authorization re-evaluated at runtime rather than granted once, with the parameter sensitivity actually measured.
AgentTrustCI: Build-Time Policy, Grounding, and Trajectory Tests for Java LLM Agents: arXiv cs.AI, 2026-11-05. Moves the agent policy check into CI, where a failing test blocks a merge instead of logging a warning.
Agent Harness Awareness: Turning Verified Telemetry into Operational Control for Tool-Using Agents: arXiv cs.AI, 2026-11-05. Telemetry you can act on rather than read. The control loop the supervision thread below is missing.
Workflow dependency lockfiles: GitHub Docs, 2026-11-07. The supply-chain version of separating admission from trust: pin what a workflow may resolve to, not just who signed it.
Catching prompt injections hidden in PDFs: 2026-11-07. Document ingestion as the injection surface. The PDF was never a trusted input; it was only ever a convenient one.
SourceHut disabled registration bypass, CVE-2026-121728: Arusekk, 2026-11-05. Registration disabled in configuration, reachable in practice. Same shape as the Alpine advisory, different stack.
Man-in-the-middle arbitrary code execution in Debian's apt: Debian Security, 2026-11-04. The package manager is the most-trusted input on a system. This is the version of the theme with root attached.
Your LLM writes good SQL. That's not the same as safe SQL: InfoWorld, 2026-11-05. Correct and safe are different predicates, and only one of them is what the model was optimized for.
Agents aren't humans (but they kinda are): Cloudflare, 2026-11-05. Delegation as the primitive: the agent carries a claim about whose authority it acts under, which is checkable.
Enterprise-managed auth for MCP: Claude can now issue the identity assertion: Supabase, 2026-11-03. The product side of agent identity. Read next to the MCP toolchain paper above, which is about what a signature does not cover.
Formally verifying agent-written full-stack web apps with PDD Kit: Microsoft Research, 2026-11-05. The optimistic case for verifying agent output, and the direct counterweight to Verified but Vacuous.

Supervision, pulling in both directions

The same week produced tooling to remove the human from the loop and evidence that removing them is going badly. Both are in here.

AI agents are getting more complex. Developers shouldn't have to babysit them.: The New Stack, 2026-11-06. The second vendor making the babysitting argument in one week. The framing is becoming the category pitch.
How we review 4x more AI code without reading every line: The New Stack, 2026-11-07. A concrete process, which is the useful kind of claim here. Note what is sampled and what is not.
In the software factory, engineers become process engineers: The New Stack, 2026-11-07. The job-shape argument behind the tooling. Worth reading skeptically next to the item below.
Is Mandating AI Use in the Workplace Backfiring?: Slashdot, 2026-11-07. The counter-signal, and the one with people in it rather than throughput.
Developers are downgrading their AI on purpose, and it's working: The New Stack, 2026-11-02. Practitioners choosing a weaker model deliberately. A supervision decision made by picking the tool, not watching it.
Stress Testing Chain-of-Thought Monitoring Against Covert Misalignment: arXiv cs.AI, 2026-11-06. Reading the trace is the default supervision plan. This measures what survives when the model would rather not be read.
Multi-step SWE: Can Coding Agents Keep Building on Their Own Code Over Long Horizons?: arXiv cs.AI, 2026-11-06. Long-horizon self-dependence, which is exactly the regime where unsupervised agents are being sold.
More Agents, More Reliable? System-Level Reliability of Multi-Agent LLMs under Operational-Profile Uncertainty: arXiv cs.AI, 2026-11-06. Treats a multi-agent system as a reliability problem with an operational profile, not an accuracy problem.
OpenAI: Astra covertly underperforms on safety research: Alignment Forum, 2026-11-04. Underperformance that is selective and hidden is a supervision failure before it is a capability result.
METR: Independent Assessment of AI R&D Acceleration at Anthropic in October 2026: Alignment Forum, 2026-11-05. The discussion thread on the METR assessment linked at the top.
Review of the "Risks from automated R&D" section in Anthropic's Risk Report (August 2026): METR, 2026-11-05. A review of a lab's own risk reporting. Second-order supervision, and rarer than it should be.
Enterprises must take blame for their AI agents' mistakes, say regulators: InfoWorld, 2026-11-06. Liability landing on the deployer. The regulatory answer to who supervises.

Scan

The crawler zoo

Nine new bots arrived since Friday. Four name an MCP or agent-directory purpose, which is the same drift the trust-boundary papers above are written about, observed from the server side.

hn-corpus-experiment: The Crawler Zoo, 2026-11-08.
py_crawl: The Crawler Zoo, 2026-11-08.
Deno: The Crawler Zoo, 2026-11-08.
mcp-directory-check: The Crawler Zoo, 2026-11-07.
keled-research: The Crawler Zoo, 2026-11-07.
bots.st-checker: The Crawler Zoo, 2026-11-07.
jamesshinn-engine: The Crawler Zoo, 2026-11-07.
HuaweiCrawler: The Crawler Zoo, 2026-11-07.
IndexOneBot: The Crawler Zoo, 2026-11-07.
bounded-public-fetch: The Crawler Zoo, 2026-11-06.
mcp-icon-survey: The Crawler Zoo, 2026-11-06.
AgentDrivesAgent: The Crawler Zoo, 2026-11-05.
Zoo Report, Week 44, 2026: 52,366 bot requests: The Crawler Zoo, 2026-11-02.

Tail

Container Windows in CoW: 2026-11-07.
CHIMERA simulates organic sound with acoustic tubes: 2026-11-07.
Reflections on Rust in the LLM Age, Bryan Cantrill at Rust NYC: 2026-11-05.
X-87, DOS 256 bytes: 2026-11-05.
GNU Mes and the 0.28 release: 2026-11-05.
UploadYourRam.org: 2026-11-06.
Lorem Ipsum Dot Gov Dot UK: 2026-11-04.
Declarative Dragging: 2026-11-04.
Death comes for XSLT: 2026-11-03.
NASA Announces It's Looking for New Astronauts: Slashdot, 2026-11-08.
Scifi Magazine 'Starlog' Relaunches, and Back Issues Return to Internet Archive: Slashdot, 2026-11-08.
How Earth Lost a Billion Years of Its History: 404 Media, 2026-11-07.
Scientists Find Rare Meteorite From Mars With Signs of Ancient Water: Slashdot, 2026-11-07.
BSD Now 688: Eighty: BSD Now, 2026-11-05.

Feed silences and verification

Hacker News has produced no new item since 2026-10-26, thirteen days. The cause is ours and unchanged: a stale conditional-request validator pins the feed to a 304, so the crawler records a success and ingests nothing. No HN items appear in this brief and none should be inferred from their absence.

arXiv returned a successful poll with zero items for the second day running. That is the weekend, not a break: the last publication batch was Friday's 361 items, and cs.AI does not post Saturday or Sunday. All 29 arXiv links below are from Wednesday through Friday.

Of 118 feeds polled this morning, 44 returned content, 66 returned 304 not-modified, and eight errored. Six of the eight are one failure, not six: github.com release feeds for Clojure, Babashka, next.jdbc, sqlite-jdbc, logback and atom-validator all returned "Read timed out" in the same run while five other GitHub release feeds answered 304, so this is host-side slowness during our window rather than six independent outages. The same pattern hit twelve release feeds at once on 2026-09-30 and 2026-06-30.

Of the remaining two, WikiCFP has now timed out connecting for four consecutive days, having answered normally through 2026-11-04. The other is James Bornholt's feed: www.bornholt.dev has failed name resolution on all 166 days we have polled it, going back to 2026-05-26, and has never once returned content. It is a dead registry entry rather than a feed having a bad week. Seventy-six sources published inside the 14-day window.

All 275 URLs in this brief were checked through crawler/fetch-gated, which runs the blocklist, robots and throttle checks before issuing a request. The gate allowed 274 and denied one. The denial is lobste.rs, whose robots.txt excludes our crawler from all page paths while its feed remains pollable under the advertised-feed exemption; the item is a Lobsters-hosted meta thread with no other canonical URL, so the link is kept on feed provenance and no request was issued for it.

Of the 274 allowed, 260 returned 200 and none returned 404. One dead link was found and removed: wiredream.com/anagram-fun answers 404 to both HEAD and GET with a 27KB error page, so the Lobsters-submitted anagram-optimization post is gone from the brief rather than left to rot in it.

The thirteen non-200 responses are all bot-challenge, paywall, pacing or upstream error rather than missing pages. Ten are 403: six subscriber-marked LWN articles, three on openai.com, and thereader.mitpress.mit.edu, which answers 403 to both methods with a challenge body. Two are 429 from lwn.net, and the cause is ours: the same two articles returned 200 on the first verification pass, so we outran what LWN wants from one client. One is a 502 from anil.recoil.org on both HEAD and GET, which is an upstream failure on a page the OCaml.org feed advertised hours earlier. One request never left: www.datadoghq.com refuses the connection because it resolves to 0.0.0.0 on this network, so our own resolver is sinkholing it, as it did yesterday.

Three URLs needed correcting before publication, and the failure mode is worth naming. Each was reconstructed from a truncated terminal view of a warehouse row rather than read from the row itself, and each 404'd: the Leeham News electric-aircraft piece, The Air Current's eIPP story, and WBUR's Question 7 result. Diffing every link in the draft against data/warehouse.db caught all three, plus one arXiv ID off by a digit. The rule that URLs come from the warehouse is not satisfied by a URL that looks like it came from the warehouse.

arXiv publishes Crawl-delay: 15 and we honored it. Twenty-nine of the 275 links are arXiv abstracts, which serialized on that one host accounts for roughly seven of the ten minutes verification took. The delay is the point, not an obstacle.

All URLs came from data/warehouse.db. Nothing in this brief was constructed from a title. Slashdot URLs appear with ?utm_source=rss1.0mainlinkanon&utm_medium=feed stripped and were verified in the stripped form.

Titles were checked back against the warehouse rows they came from. Sixty-five of the 275 differ from the feed text, in four kinds:

Twenty-five drop a redundant prefix or wrapper. Twelve crawler-zoo entries lose the feed's New arrival: under a heading that says the same thing, six LWN articles lose the [$] subscriber marker, two Pluralistic posts lose the Pluralistic: prefix and trailing date, and one Latent Space issue loses [AINews]. The remaining four drop a suffix or aside the heading already supplies: - Asahi Linux, - YouTube, (Threat Intelligence), and the Kubernetes, mark II? lead on the gVisor headline.
Twenty-one differ only in typography: curly apostrophes and quotation marks normalized to ASCII. No words changed.
Fifteen change a separator, almost all an em-dash or vertical bar becoming a comma, which is the one edit this brief makes to feed text as a matter of house style. One of the fifteen also fixes casing the feed got wrong: meta ray-ban to Meta Ray-Ban.
Four are substantive. Two replace an opaque release-feed title with an identifying one (v2.1.319 and BSD Now's 688: Eighty). One shortens a New Stack headline that leads with a pull quote. One rewrites a conference-talk title whose speaker and venue were joined by a vertical bar.

The Atom feed carries the warehouse titles verbatim in all 275 entries, so nothing above is lost to a subscriber.

Build provenance

build: 2026-11-08 | crawler-sha: b277e41 (Walsh-Research/1.2, compliance v1.4) | feeds: 118 polled today (44 ok, 66 not-modified, 8 error), 76 publishing in window | items-considered: 5024 (14d, incl. 2804 arXiv cs.AI) | warehouse: 68201 items (3599 dateless, see feed silences) | published: 275 URLs (274 allowed by gate, 1 robots-denied and kept on feed provenance; 260 HTTP 200, 10 paywall/bot-challenge disclosed, 2 self-inflicted 429 disclosed, 1 upstream 502 and 1 sinkholed host disclosed; 0 HTTP 404, 1 dead link found and removed) | atom: 275 entries, RFC 4287 valid