News World
Windows gets its box for agents
Hello,
In issue 006, Drop boxed your agent in on Linux, and in 007, Box did the same on the Mac. This week, Microsoft ships its own, for Windows 11, macOS and Linux. Then a real iPhone driven by an AI, and three steps to stop reviewing all of your agent's code on your own.
Releases
Microsoft Execution Containers, or MXC (Microsoft)
Announced on October 7 on the Windows Developer blog; version 1.0.0 was released the same day on its GitHub repository. On Hacker News: 227 points, 69 comments.
What it's for Running an AI agent locked inside a box: rules written in advance set what it is allowed to do. MXC runs on Windows 11, macOS and Linux.
The limit Two of the four boxes in Microsoft's post exist only on Windows 11, and no independent test has been published. Like any box, it limits what the agent can do; it does not judge whether an allowed action is legitimate.
blogs.windows.com/windowsdeveloper/…
DuckDB's agent mode
Free: DuckDB is open source software. DuckDB's own benchmark: 132 runs, all correct.
What it's for Having an agent analyze your data files. DuckDB, the program that queries your CSV and Parquet files on your own machine (two common formats for data tables), gets an agent mode that changes what its command line sends back to the model; the -no-agent option brings back the usual display. DuckDB had Claude Code answer the 22 questions of the TPC-H benchmark in plain language, without SQL (the language of databases), each one three times with agent mode and three times without. All 132 answers are correct, with or without the mode. With it, the DuckDB output read by the model drops from about 123,600 to 50,800 tokens (the pieces of words models work with), 59% less. But the saving shows neither in the total cost nor in the time taken: it is about 0.5% of everything the model reads, and the runs with the mode took slightly more back and forth (237 turns against 224). Here the tool adapts to the agent, and it is the third issue in a row where DuckDB appears.
The limit No independent measurement has been published: a single benchmark (TPC-H), a single agent (Claude Code). The mode helps the agent read the results; it does not check that the question was understood correctly.
Talorys
On Hacker News: 328 points, 155 comments.
What it's for Having a personal agent without leaving a machine running at home: you install it yourself on your own Cloudflare account, on its free plan, with a single command. It keeps your tasks, notes, projects and reminders, and remembers what you tell it. Another route: Xiryn (more than 130 stars, MIT, created October 11) gives each agent its own Linux desktop on your computer, in Docker (a tool that runs programs in closed spaces), with your keys and an encrypted vault. On the same Cloudflare free plan, docflare-ai (41 stars, MIT) installs an assistant that answers questions about your documentation, with a single line to paste into your site.
The limit On the free plan, it only chats within the daily allocation of Workers AI, Cloudflare's model service: once that is used up, chat stops until the daily reset, everything else keeps working, and it never turns on a paid option by itself. Its description sets up no link to your email, your calendar or your payments.
BetterWispr
On Hacker News: 212 points, 126 comments. Free and open source, by its own description.
What it's for Dictating long instructions to your agent instead of typing them, on a Mac. Developer Simon Willison describes building a page of his blog almost entirely by voice, talking to Codex while he cooked dinner. BetterWispr's built-in models transcribe your voice on the Mac, with no account and no fallback to an online service; an online service is only used if you pick one. On iPhone, OpenWhispr is free to install and transcribes on the phone, with no account and no limit (a paid Pro plan exists alongside).
The limit Mac only (macOS 14 or later): no Windows or iPhone version.
Repos
onehumanbeing/esp32-iphone-agent · ★ 1,411 · MIT · last commit October 13, 2026
An AI model uses a real iPhone through an ESP32, a small $7 circuit board. The screen goes over AirPlay to your computer, and the board, plugged in over USB, shows up on the phone as an ordinary mouse and keyboard: the agent touches what you touch on the device (see The security reflex). Any vision model compatible with OpenAI's API picks the next gesture. Nothing to install on the phone, no developer account, no jailbreak. What it does not do: it does nothing without the board, or without a macOS or Linux computer switched on and on the same network. The agent does not see passcode entry, Apple Pay or protected videos. No reliability measurement has been published.
bherbruck/solidcraft · ★ 1,609 · MIT or Apache-2.0 · last commit October 13, 2026
Software for designing 3D parts where every part is dimensioned and changes when you edit a value (this is called parametric CAD), open source and written in Rust (a programming language): a desktop app, a web version, and control through MCP, the standard way agents plug in, so that an agent can build or modify a part for you. It reads and writes the common file formats of manufacturing and 3D printing (STEP, IGES, 3MF, STL, OBJ). Created on October 7, it passed 1,500 stars in six days and was shown on Hacker News on October 13 (more than 100 points). In issue 000, text-to-cad turned a description into a CAD file, with no way to see the part; SolidCraft is the application itself, with the agent plugged into it. The same shift shows in blokkily, an experimental music program that accepts MCP. What it does not do: it produces neither 2D technical drawings nor instructions for manufacturing machines, both deferred until further notice on its roadmap, and for now its repository only calls it usable for simple parts.
franzenzenhofer/big-arrow-on-the-screen · ★ 689 · MIT · last commit October 12, 2026
Your agent draws big arrows, boxes and text on your Mac's screen to show you where to click: a single command, an overlay your clicks pass through, and that disappears on its own. It ships as a skill (a set of instructions the agent loads) for Claude Code and Codex, and drew 418 points and 196 comments on Hacker News on October 9. For people who build without being engineers, this is the agent showing instead of describing, in an interface they do not know. What it does not do: it draws, but it does not click, type or capture the screen. Mac only.
dagucloud/dagu · ★ 4,341 · GPL-3.0 · last commit October 13, 2026
The established project in this section: a program you install on your own machine that runs your tasks at a set time or one after another. In a plain text settings file (the YAML format), you describe the sequence of your scripts and of the commands sent to other machines; a single program, no database. In issue 007, we left an agent alone overnight: dagu is where you would schedule that task at a fixed time, next to the spending cap. And when the steps are known in advance, a fixed sequence costs less than an agent and does the same thing every time. Its GPL-3.0 license requires anyone who redistributes a modified version to provide its source code to the people who receive it. What it does not do: it decides nothing, it runs what you wrote, in order. It only runs on a machine of your own, switched on, and has no hosted version that runs your tasks: execution stays on your servers.
In brief
OpenAI says it has banned two AI-backed influence operations that spread geopolitical messages while hiding their origin: the Iranian one under the bylines of seven fake journalists, the Russian one behind a front think tank. A monitoring agent swallows this kind of source like any other: a byline is no substitute for checking who is behind it. openai.com/index/…
According to NVIDIA, PC applications are ready for RTX Spark, a single chip that brings together up to 128 GB of memory and 1 petaflop of AI compute (a quadrillion operations per second), whose laptops, announced last week by NVIDIA and Microsoft, go on sale on Friday, October 16. Windows PCs will be able to keep large open models in memory for their agents (see MXC, at the top of this issue). blogs.nvidia.com/blog/…
NVIDIA releases its whole Run:ai platform as open source, open to its customers, developers and partners. If you share graphics cards across several AI jobs, you can install it without a paid license; what remains paid is listed in the post. developer.nvidia.com/blog/…
The problem of the week
My agent writes more code than I can review: how do I avoid becoming the bottleneck?
In the evening, you ask your agent to add a payment page. In the morning, thirty files have changed, and their line by line listing (the diff) means nothing to you. According to a study reported by Ars Technica (see Worth reading), the gains from coding agents are "absorbed" by this human review. The way out: only review yourself what no machine can check.
First step, stop reviewing what a machine can refuse. Geoffrey Huntley, quoted by Simon Willison on October 13, finds that fixing AGENTS.md, the rules file the agent reads, leaves a gap, which drifts. Instead, he writes a pre-commit hook: a small check that reads the changes before they are saved, refuses the ones that break the rule and sends the instruction back to the agent. In his words: "ten out of ten". For our page, the hook refuses any API key in the code and any change to the payment code without a test. The Copilot instructions that GitHub describes guide the agent; the hook refuses.
Second step, ask for proof you can read, rather than code. claude-show-your-work (169 stars, MIT, created October 8) has Claude Code display, in the terminal, screenshots, browsing recordings made with Playwright (a tool that drives a browser) and before and after comparisons. It requires macOS and the Ghostty terminal (its description also mentions kitty). For our payment page: a screenshot of the form before, and one after.
Third step, for what is left to read, a guided tour. diff-tour (116 stars, MIT, created October 10) turns a change into a walkthrough, in the order an experienced engineer would read it, without modifying anything. Keep your own review for the points of no return only: paying, deleting data, sending. For our page, that is the part where the money goes out.
Write a pre-commit hook that refuses a commit containing an API key, or touching the payment code without a test, and that tells you why when it refuses; then show me, with screenshots, what changed on screen.
What this does not fix: a hook only catches what you wrote down, and a screenshot shows the screen, not what happens to your data.
diff-tour to read a change in order, claude-show-your-work to see the result on screen without reading the code.
Worth reading
AI coding agents generate more code, but not more software · A study reported by Ars Technica: the gains from coding agents are "absorbed" by human review. arstechnica.com/ai/2026/10/…
500+ Billion Tokens Later: Letting AI Agents Decompile A First-Person Shooter · The account of a very long job handed to agents: recovering the code of a shooter game from the finished program, more than 500 billion tokens (the pieces of words models work with) later, between 600 and 700 billion according to the author. The game launched, but the code was wrong: each function had to be compared, byte by byte, with the original. momo5502.com/posts/…
VEPA: Verified Evolving Formal Policy for Lifelong LLM Agent Guardrails · Guardrails that, before any irreversible action by an agent, return an allow or deny decision that can be inspected and does not vary, instead of relying on the model's judgment. Read it alongside MXC: the box limits the agent, the rule decides what gets through. arxiv.org/abs/2610.12813
The security reflex
Are you about to let an agent use your phone or your accounts? This week, a $7 board is enough for an AI to tap on a real iPhone. With your phone or your credentials, the agent has your permissions: it touches what you touch, and nothing tells its actions apart from yours.
The right move. Give each agent its own account and its own key, never yours. And if it uses a phone or a browser, give it a place of its own: a test device or a dedicated browser profile, with no bank, no main inbox, no saved passwords.
Reply to this email and tell us what you're building. Every reply gets read.
— News World AI
Get the newsletter
Every Tuesday, in four minutes: what shipped in AI and what you can actually try the same day.
Double opt-in by email. One-click unsubscribe, link in plain sight in every issue.
Geneva, Switzerland. Write to hello@newsworldai.xyz.