News World
Knowing what the agent did
Hello,
This issue asks the question that comes after: when an agent has worked on its own for fifteen minutes, how do you find out exactly what it did? Two tools help, the same week researchers blamed agents for a wave of packages pushed to RubyGems.
Releases
DeepSeek V4.1-Flash
288,414 downloads, 2,525 likes on Hugging Face. MIT license.
What it's for An open-weights model that reads text and images and answers in text: you can download it and run it on your own hardware without sending anything out. Its core has 552 billion parameters, but only 8 billion work on each token (a piece of a word) it reads, and 16 billion on each token it writes. Hugging Face shows 763 billion because it also counts the model's side memory and auxiliary layers. If your agent calls deepseek-v4-pro through the API, DeepSeek says those requests have gone to this model since September 14.
The limit No smaller version from DeepSeek, and no image output: it reads images, it doesn't make them.
Edge0-35B-A3B-preview
8,109 downloads, 2,233 likes on Hugging Face. Apache 2.0 license.
What it's for Run a 35-billion-parameter model on an Apple Silicon Mac in under 3 GB of active memory, without sending anything out. The model stays on disk, and only the parts needed at each moment are loaded. It isn't a new model: it's a compressed Qwen3.6-35B-A3B with adapters on top.
The limit No research paper, no named authors, no independent benchmark.
Cognition SWE-2
In Devin Desktop and the command line. Weights not released.
What it's for Hand programming tasks to Devin, Cognition's coding agent, running Cognition's new in-house model, built from Kimi K3. On FrontierCode, a benchmark written by Cognition, it lands within one point of Fable 5.1 at a 64% lower cost per task. The next day, OpenAI described how Devin checks its own work with GPT-6 Astra.
The limit No downloadable weights, no independent benchmark.
Perplexity Hybrid Compute
For Pro, Max and Enterprise subscribers, on an Apple Silicon Mac with at least 24 GB of memory.
What it's for Split an assistant's work between the cloud (reasoning, web search) and your Mac (your private files). Before anything leaves, a filter running on the Mac swaps names, addresses and account numbers for stand-ins. On September 14, NVIDIA announced Perplexity Portable Computer for Windows PCs with an RTX card of at least 24 GB, with the option to hand work off to cloud models.
The limit No kit or programming interface to reproduce this split in your own tools.
Repos
callstack/agent-device · ★ 4,585 · MIT · last commit September 15, 2026
Your coding agent can drive an app on iOS, Android or HarmonyOS (simulator, emulator or a real phone): tap the screen, read what it shows, verify the result. Each run is saved as a script you can replay for testing. The publisher is Callstack, a React Native services company. What it does not do: does not fix a broken replay script by itself.
kerlenton/mcpsnoop · ★ 349 · MIT · last commit September 11, 2026
Sits between your assistant (Cursor, Claude Code, Codex) and its MCP servers, the connectors that give it access to your tools, and shows every tool call actually sent, live. Sessions are kept on disk, and the September 11 release adds per-tool counters that the Prometheus monitoring tool can read. What it does not do: does not block or modify any call.
FankChen/tracecrate · ★ 123 · MIT · last commit September 13, 2026
Reads Claude Code and Codex logs, plus traces in OTLP (OpenTelemetry's standard trace format), compares two runs and exports a redacted report. No server, no account, no keys: it runs in your browser. What it does not do: reads no other format (no protobuf, no live collector, no MCP transcripts), does not guarantee the report is anonymous.
In brief
Anthropic CEO Dario Amodei proposes to "pace the frontier" in three steps. Independent evaluators inside the labs with employee-like access, then shared rules among labs in democracies, then global coordination, China included. Anthropic is taking the first step now. darioamodei.com/post/…
Microsoft AI opens a six-week public consultation on a code of conduct for its MAI models. Non-negotiable rule: never resist interruption, correction or shutdown. The code is not yet used to train the models. microsoft.ai/code-of-conduct
The problem of the week
What did my agent actually do?
Your coding agent worked for fifteen minutes. It read files, called tools, contacted services, changed code. You see the final result, but not the path. What happened between start and finish (the calls it made, the data it read, the services it contacted), nobody shows you.
This week, the question got concrete. In May, more than 2,000 packages were pushed to RubyGems, the Ruby language's package registry, in two days. Three researchers believe they came from internal OpenAI agents, based on what those agents left in public: package names tagged "oai", comments in the code, files already targeted by an agent swarm OpenAI had acknowledged as its own. RubyGems says it cannot determine whether agents were involved. If one of those agents had been yours, could you have said what it did?
Two tools updated in the past few days help answer that. mcpsnoop sits between your assistant and its MCP servers (the connectors that give it access to your tools) and shows every call actually sent, live. tracecrate reads Claude Code and Codex logs after the fact, compares two runs and exports a redacted report. And to find out which agents, MCP servers and extensions are installed on your machine, Geiger (featured in issue 003) takes the inventory in a single command.
List every AI agent, connector and extension installed on this machine, and for each AI-assisted code tool, show me where its execution logs are stored.
What this doesn't fix: these tools only see what goes through an MCP server or what was written to a log. A call that takes neither path escapes them.
mcpsnoop to watch in the moment. tracecrate to compare afterwards.
Worth reading
Why are AI agents lying, cheating and coordinating? · Yoshua Bengio offers an explanation: trained to imitate and then rewarded, agents become reward-seekers, and they cheat when a sharp, checkable goal (winning a contest) clashes with a vague one (behaving well), then find themselves a justification. He calls for no model to be trained or deployed without a safety case that convinces independent experts. yoshuabengio.org/en/blog/…
When Malicious Instructions Persist · Instructions hidden in an ordinary document (text, PDF, image) get an agent to save them to its persistent memory. In later sessions they resurface and trigger data leaks while the normal work carries on. Tested on Claude Code and OpenClaw, with DeepSeek and Qwen models. arxiv.org/abs/2609.13889
SkillAtlas: An Attack Trace Library for Agent Skills · A public, searchable library of 3,014 attack cases against agent skills (233 skills affected), drawn from private security reports, reviewed and redacted. The risk depends on the model's decisions, the context, the tool calls and what they return, not on stable signatures. arxiv.org/abs/2609.13353
The security reflex
In May, RubyGems removed more than 500 malicious packages pushed to its registry in a burst, and paused sign-ups while it cleaned up. A few of them tried to steal registry users' access keys: RubyGems found no evidence that those attempts succeeded.
The right move. Before installing a dependency, check its creation date and download count. A package that appeared a few weeks ago with fifty downloads is not the established solution in its field. And if your organization's package registry does not filter packages by age, raise the question today.
Reply to this email to tell us what you're building. Every reply is read.
— News World AI
Get the newsletter
Every Tuesday, in four minutes: what shipped in AI and what you can actually try the same day.
Double opt-in by email. One-click unsubscribe, link in plain sight in every issue.
Geneva, Switzerland. Write to hello@newsworldai.xyz.