News World
News World AI
Hello,
In issue 006, Drop boxed your agent in on Linux, and in 007, Box did the same on the Mac. This week, Microsoft ships its own, for Windows 11, macOS and Linux. Then a real iPhone driven by an AI, and three steps to stop reviewing all of your agent's code on your own.
Releases
Microsoft Execution Containers, or MXC (Microsoft)
Announced on October 7 on the Windows Developer blog; version 1.0.0 was released the same day on its GitHub repository. On Hacker News: 227 points, 69 comments.
What it's for Running an AI agent locked inside a box: rules written in advance set what it is allowed to do. MXC runs on Windows 11, macOS and Linux.
The limit Two of the four boxes in Microsoft's post exist only on Windows 11, and no independent test has been published. Like any box, it limits what the agent can do; it does not judge whether an allowed action is legitimate.
blogs.windows.com/windowsdeveloper/…
Repos
onehumanbeing/esp32-iphone-agent · ★ 1,411 · MIT · last commit October 13, 2026
An AI model uses a real iPhone through an ESP32, a small $7 circuit board. The screen goes over AirPlay to your computer, and the board, plugged in over USB, shows up on the phone as an ordinary mouse and keyboard: the agent touches what you touch on the device (see The security reflex). Any vision model compatible with OpenAI's API picks the next gesture. Nothing to install on the phone, no developer account, no jailbreak. What it does not do: it does nothing without the board, or without a macOS or Linux computer switched on and on the same network. The agent does not see passcode entry, Apple Pay or protected videos. No reliability measurement has been published.
In brief
OpenAI says it has banned two AI-backed influence operations that spread geopolitical messages while hiding their origin: the Iranian one under the bylines of seven fake journalists, the Russian one behind a front think tank. A monitoring agent swallows this kind of source like any other: a byline is no substitute for checking who is behind it. openai.com/index/…
According to NVIDIA, PC applications are ready for RTX Spark, a single chip that brings together up to 128 GB of memory and 1 petaflop of AI compute (a quadrillion operations per second), whose laptops, announced last week by NVIDIA and Microsoft, go on sale on Friday, October 16. Windows PCs will be able to keep large open models in memory for their agents (see MXC, at the top of this issue). blogs.nvidia.com/blog/…
NVIDIA releases its whole Run:ai platform as open source, open to its customers, developers and partners. If you share graphics cards across several AI jobs, you can install it without a paid license; what remains paid is listed in the post. developer.nvidia.com/blog/…
The problem of the week
My agent writes more code than I can review: how do I avoid becoming the bottleneck?
In the evening, you ask your agent to add a payment page. In the morning, thirty files have changed, and their line by line listing (the diff) means nothing to you. According to a study reported by Ars Technica (see Worth reading), the gains from coding agents are "absorbed" by this human review. The way out: only review yourself what no machine can check.
First step, stop reviewing what a machine can refuse. Geoffrey Huntley, quoted by Simon Willison on October 13, finds that fixing AGENTS.md, the rules file the agent reads, leaves a gap, which drifts. Instead, he writes a pre-commit hook: a small check that reads the changes before they are saved, refuses the ones that break the rule and sends the instruction back to the agent. In his words: "ten out of ten". For our page, the hook refuses any API key in the code and any change to the payment code without a test. The Copilot instructions that GitHub describes guide the agent; the hook refuses.
Worth reading
AI coding agents generate more code, but not more software · A study reported by Ars Technica: the gains from coding agents are "absorbed" by human review. arstechnica.com/ai/2026/10/…
500+ Billion Tokens Later: Letting AI Agents Decompile A First-Person Shooter · The account of a very long job handed to agents: recovering the code of a shooter game from the finished program, more than 500 billion tokens (the pieces of words models work with) later, between 600 and 700 billion according to the author. The game launched, but the code was wrong: each function had to be compared, byte by byte, with the original. momo5502.com/posts/…
VEPA: Verified Evolving Formal Policy for Lifelong LLM Agent Guardrails · Guardrails that, before any irreversible action by an agent, return an allow or deny decision that can be inspected and does not vary, instead of relying on the model's judgment. Read it alongside MXC: the box limits the agent, the rule decides what gets through. arxiv.org/abs/2610.12813
The security reflex
Are you about to let an agent use your phone or your accounts? This week, a $7 board is enough for an AI to tap on a real iPhone. With your phone or your credentials, the agent has your permissions: it touches what you touch, and nothing tells its actions apart from yours.
The right move. Give each agent its own account and its own key, never yours. And if it uses a phone or a browser, give it a place of its own: a test device or a dedicated browser profile, with no bank, no main inbox, no saved passwords.
Reply to this email and tell us what you're building. Every reply gets read.
— News World AI
Get the newsletter
Every Tuesday, in four minutes: what shipped in AI and what you can actually try the same day.
Double opt-in by email. One-click unsubscribe, link in plain sight in every issue.
Geneva, Switzerland. Write to hello@newsworldai.xyz.