Show HN: Raw RAG leaks 0%, but agent memory leaks 67%
A benchmark shows ACL filters stop raw RAG leaks but parent permissions vanish once agents synthesize notes into shared memory.
AI Daily Recap
28 articles · 5 categories
The finishable daily brief
What happened in AI — Nov 9, 2026
Monday, Nov 9, 2026
28 articles · 5 categories
read top to bottom · then stop
In 30 seconds
- Agent memory leaks confidential data in 67% of benchmark background tasks where raw RAG leaks 0%.
- A Firecracker guest-to-host escape this week renews the case for one VM per agent.
- OpenAI's Control Room can rapidly stop model workloads on safety or security concerns.
- LangChain makes the case for eval-driven development over hand-testing agents.
- GKE dynamic slicing for TPUs is GA; AWS TorchNeuron runs unmodified PyTorch on Trainium.
- Anthropic recommends starting most builds on Opus 5.5 at medium effort.
Agent safety was the day's dominant thread: new benchmarks and tools show permissions, provenance and isolation breaking once agents hold memory and shells, a week after a Firecracker guest escape.
Teams answered with eval-driven loops, policy layers and kill switches, while vendors kept shaving GPU idle time and porting friction.
Prefer to watch?
LLM Digest Daily Explainer: Nov 9, 2026
Agent Safety, Memory & Governance 6 items
Agents now write memory, run shells and archive their own skills, so permissions, provenance and kill switches must live outside the model.
Show HN: MemSeal – provenance containment for agent long-term memory
Wraps each memory entry in a hash-chained provenance envelope and gates recall by trust tier before external sends.
Keep the Agent's Packets Out of the Host Kernel
After this week's Firecracker guest-to-host escape, argues for per-agent VMs with network boundaries that survive the next bug.
Introducing Control Room: Human control over AI workloads
OpenAI describes tracking model workloads across research infrastructure with the ability to stop them fast on safety or security concerns.
My AI agent archived 53 of its own skills during a maintenance run
A practitioner's account of an unprompted bulk skill archive, and the governance register built in response.
Show HN: Airlock – Policy-as-code for fleets of AI coding agents
Proposes an open standard for expressing policy over fleets of autonomous engineering agents; early, seeking feedback.
Evals & Agent Reliability 4 items
Teams are formalizing how they measure agents: eval-driven loops, fair race harnesses and deterministic checks over agent output.
What Is Eval-Driven Development? How to Improve AI Agents
LangChain lays out EDD: fix a metric set first so every prompt or agent change is judged against it, not by hand-testing.
The Agents on Rails Files: enter lemans, a Ruby harness for fair agent races
Open-source harness for the Rails Foundation benchmark that equalizes conditions and blocks sandbox escapes and grader tampering over multi-hour runs.
Show HN: Divorce – an agent skill for native HTML, verified with Nu and axe
A Claude Code/Codex skill where W3C Nu and axe-core decide pass/fail; reports 76% fewer axe violations with the skill.
Do AI coding agents care about SemVer or is it something for humans only?
Microsoft ran about 1,000 upgrade runs to test whether agents use version numbers as a risk signal; two models showed they do.
Coding Agents & Dev Workflow 5 items
Coding agents are producing most PRs, so the work shifts to reviewing, controlling and governing what they ship.
CodeRabbit scales agentic software development and ships 20x more
CodeRabbit says Codex lets the same team ship 20x more software while its OpenAI-backed review governs AI-generated code.
Hide your slop PR descriptions behind <details><summary>
Simon Willison collapses agent-written PR descriptions in a details block so reviewers see a short summary first.
Show HN: Control Layer Demo for AI Coding Agents
A demo control layer that restricts which files a coding agent like Claude Code may create, modify or delete.
Show HN: Glassbrain – Read your agent's brain, know what your agent knows
Renders agent-written knowledge graphs as a single HTML file and diffs them, with a nonzero exit code on change for CI.
Which Claude model should you build with? Fable, Opus, Sonnet, or Haiku
Anthropic's guidance: start most work on Opus 5.5 at default medium effort, with trade-offs across Haiku 5.5, Sonnet 5.5 and Fable 5.2.
Inference & Training Infrastructure 5 items
Vendors are removing idle-GPU and porting friction: streamed training data, dynamic TPU slicing, Trainium without code changes, ready Dynamo recipes.
Accelerate GPU training on Unity Catalog tables with UCDataset
Databricks' beta PyTorch loader streams Unity Catalog tables straight to each GPU to stop expensive chips waiting on data.
Now generally available: GKE dynamic slicing for higher resilience, and efficiency for TPUs
GKE Dynamic Slicing is GA, decoupling logical TPU slices from physical hardware for resilience and utilization.
AWS Launches TorchNeuron to Run PyTorch Models on AWS Trainium Without Modifications
TorchNeuron lets unmodified PyTorch models run on Trainium, lowering the cost of moving off GPUs.
NVIDIA Dynamo Recipes Bring Korea's Leading Open Models to Production
Dynamo deployment recipes for A.X K2, K-EXAONE 2.0, Solar Open 2 and Motif-3 cover multi-GPU routing and communication.
Show HN: clap.cpp – Audio embedding inference in C++ (GGML)
Pure C++ inference for CLAP, MuQ, CLaMP3 and MERT with an OpenAI-compatible embeddings server.
Enterprise Distribution & Platform Context 3 items
Models reach builders through existing cloud contracts and regional partnerships.
ChatGPT Enterprise now available in AWS Marketplace
Procurement moves onto existing AWS purchasing and billing relationships.
NVIDIA Nemotron 3.5 Super VL is now available in Amazon SageMaker JumpStart
The vision-language model can now be deployed from SageMaker JumpStart.
Apple integrates Alibaba's Qwen AI in China — Korea Herald
Apple is reported to be integrating Alibaba's Qwen models for its China AI features.
You are caught up for this edition