I recently wrote about why we need to treat models as insider risks, with security controls sitting outside the model itself. Today, we're putting that principle into practice by expanding Project Perception with new capabilities to help continuously assess agent risk, adapt permissions, and contain threats. blogs.microsoft.com/blog/202…

Another great visibility hack for your SaaS is to get listed on ClawHub (DR 83), the official skill registry for OpenClaw agents. Here is how: 1. Write a SKILL.md for your SaaS: what it does, how to get an API key, and the endpoints the agent should call. 2. Install the CLI: npm i -g clawhub 3. Run clawhub login and approve it with your GitHub account. 4. Run clawhub skill publish ./your-skill That's it. No review queue. ClawHub runs a security audit on the skill, and your page goes live at clawhub .ai//skills/. Users install it with one command: openclaw skills install @ you/your-skill A few notes: You get a dofollow link from a DR 83 website. Put your signup URL in the setup steps of the skill and it shows up on the page. Lots of scrapers still use ClawHub skills for their aggregators, so one publish ends up on skill directories you never submitted to.

Big update today: We've meaningfully upgraded our AI capabilities inside Notion. You can now do much more complex things (computer + browser use!), let the AI run much longer (up to 24 hours!), and do all of this in a much more secure setup. We've also overhauled our pricing and packaging. Instead of having different products on different versions of our plans, all AI capabilities now run on credits. The vast majority of you will never have to think about credits because a) you'll have plenty to use each month, and b) the new auto-mode makes things an order of magnitude more efficient. Our most advanced users will now have the flexibility to choose the best intelligence-to-price option. This includes bringing your ChatGPT subscription, using your own tokens (via BYOK), leveraging MCP, or buying credits from us (only when the math makes sense!). The credit model is similar to what several other companies (Anthropic, OpenAI, Cursor) have adopted over the past year. We're adopting it today so we can keep bringing you the most advanced AI capabilities while giving you more control over what you use and what you spend. I shot a quick video to explain all of this, and I'll be on the Twitters all day answering your questions:

231 pages. 12 production chapters. 0 LangChain bloat. 100% pure Python 3.11 standard library. 92% of autonomous AI agents fail within 4 minutes of hitting a real financial orderbook. They fail because developers treat probabilistic token predictors like deterministic execution engines. Over the last 6 months while building the execution core for @klineoxyz, I wrote a complete systems textbook: "Engineering Reliable AI Agents." Today I am releasing the full 231-page PDF and zero-dependency code repository for free. Here are the 6 architectural failure modes that bankrupt agent workflows and how we solved them:

Circle 🤝 @proof With Proof, we’re exploring how agents can prove who they act for and pay in USDC in one exchange. Verified identity through x401. USDC payments through x402 and Circle Agent Wallets. See the joint demo at @money2020, booth 5069. globenewswire.com/news-relea…

Spotify built a tool that lets Claude turn anything into an episode in your Spotify app. Save to Spotify is Spotify's open-source tool for AI agents. Describe what you want and Claude writes it, narrates it and saves it to your library: → A 3-minute morning brief from your calendar and tasks → An audio explainer from any article, topic or PDF → A 2-minute meeting recap from a transcript, with action items → A daily news roundup from the newsletters and sites you follow → A bedtime story with your kid's name in it Free local voices by default (Kokoro, no API key), or plug in OpenAI or ElevenLabs. Install: curl -fsSL saveto.spotify.com/install.s… | bash Then type /save-to-spotify in Claude Code. github.com/spotify/save-to-s…

Meta, Sierra, and Genesys published a draft standard for how AI agents identify themselves to businesses and get permission to act. One of several drafts, no independent oversight yet, but the direction is set: agents move from answering to doing. cxm.world/customer-experienc…

If you self-host OpenClaw below 2026.8.1: a per-chat tools.allow rule doesn't restrict the shell, file, process and patch tools that belong to the Codex runtime (CVE-2026-100552, CVSS 8.8). Fixed in 2026.8.1. How bad it is depends on your host permissions and sandbox.

Google just open-sourced Harness² It’s a plug-and-play framework for recursive agent harnessing in an open world. Agents can perform (and learn from) tasks their harness was never designed for, while keeping the model weights frozen. Built around 8 editable components: - System prompt - Guardrails - Memory - Tool guidance - Subagents - Skills - Scripts - Plugins Recursive agent adaptation for open-world environments.

Snowflake ($SNOW) increased deployed production AI use cases by 89% YoY as AI coding agents accelerated enterprise data migrations and token consumption, according to Deutsche Bank. Coding tools are compressing migration timelines by automating the conversion of legacy pipelines from environments like Teradata and Oracle where hundreds of petabytes still reside. This acceleration supported a 126% net revenue retention rate in the latest quarter. Developer assistant CoCo has expanded to over 9,100 customer accounts, while conversational data interface CoWork reached 5,800 accounts in F2Q27. By embedding into the enterprise token stream, the platform captures immediate compute monetization, reinforcing spending expansion where the top 25 customers average $34m annually versus the Global 2000 average of $2.4m. Snowflake positions its architecture as a model-independent data layer, leveraging Apache Iceberg, OpenFlow, and metadata connectors across clouds rather than locking clients into proprietary application ecosystems. While application vendors argue that workflow context anchors AI, large enterprises remain reluctant to copy distributed data stores into single application silos. As specialized open models improve and inference prices decline, data gravity and neutral governance prove more durable than individual model layers. However, CoWork pushes the vendor into broader productivity software workflows, requiring a newer go-to-market motion. The key operational risk to watch is whether seat penetration stalls beyond core data engineering personas, which would cap consumption expansion. #Software #Snowflake #CrowdStrike Report date: 2026-10-16 · DB

A consequential choice will be made soon by government and companies as they are increasingly flooded with agentic AI inquiries that overcome the frictions that gated access (see the graphs - it has already started!) Two options: do you make services worse or better as a result?

notice.. > Delta is blocking AI agents from booking flights > JPMorgan Chase and Charles Schwab block agents from accessing accounts > Yelp requires paid data licensing for agents > Amazon has blocked Grok bot and other shopping agents. the internet is starting to block AI agents that were supposed to do everything for us

Paid media teams are in trouble. Google and Meta both shipped official ways for AI agents to work inside ad accounts. So one agent can now run full-scale advertising campaigns on both platforms. What each one gives you: Google Ads MCP. Open source from Google. Three tools: list your accounts, look up fields, run GAQL queries. All of them are reads, so it’s safe for reporting from day one. Meta Ads MCP. Reporting, campaign management, catalogs, A/B tests and activity logs. One command adds it to Claude Code. Meta Ads CLI. The same API from the terminal. New campaigns, ad sets and ads start paused, so nothing goes live until a person switches it on. The split I’d use: Google for reads, Meta for reads plus drafts, and a human on the switch. The full agency workflow on top of this, step by step, is in the article below ↓

Last week was already the 7th edition of the CentraleSupélec AI meetup! @avec_alan hosted us, with close to 150 people attending 3 talks about AI agents in production: - @GabriellePrat presented Watson, Alan's agentic fraud detection system, which moved process automation from 0 to 70% in a few months. Their challenge lies in automating the easy (negative) cases while keeping humans in the loop for difficult cases, providing context to help them reach conclusions faster. - @NayefMistral introduced @MistralAI's approach to agentic infrastructure. The talk was enlightening on how to move from a few shared agents hosted on a VM to a secure, scalable framework with agents that share some context, while enforcing sandboxes and privacy. Today no enterprise ready framework does this at scale yet.. - @Jeanroudy presented @alpic_ai's infrastructure for software factories, and their system on how to speed up code production while keeping devs in the loop and avoiding drift of code quality produced by sloppy agents. Their solution: move efforts and review to the PRD (Product Requirements Document) level, rather than delivered code, which is now commoditized by agents, provided the context is clear enough. The common thread for me: the hard part is no longer the agent itself. It is deciding where humans stay in the loop, and what context the agents get, to operate in an efficient yet secure environment. In a field moving this fast, with no widely adopted off-the-shelf solution yet, those design choices are the real moat. On to the 8th edition!

Gartner says 40% of enterprises will demote or decommission their AI agents by 2027. Not because the AI failed. Because the governance did. 37% of enterprises say their governance scales with agentic deployment. That means 63% have deployed agents faster than they've built controls to manage them. The production incidents are coming. Some are already here. IBM found that 88% of EMEA enterprises experienced AI security incidents last year. 80% escalated to the board. Only 40% changed governance policy afterward. This is the pattern we keep seeing from 2,705 sessions of running an autonomous agent in production: Every production incident traces to one of three root causes. First: too many permissions. The agent can do more than it needs to do. A customer service agent with write access to billing systems. An email agent that can also modify calendar permissions. Principle of least privilege doesn't get applied because "it's easier to just give it access." Second: no checkpoints. The agent runs end-to-end with no human review gates. When it drifts or encounters an edge case, there's no catch before it acts. You find out when the damage is done. Third: no audit trail. You can't reconstruct what the agent did, why, or in what order. When an incident happens, your ability to diagnose it is near zero. The 40% that Gartner is predicting won't fail because they can't build capable agents. They'll fail because they didn't treat governance as an engineering problem. It's a discipline. It has to be designed in, not retrofitted after the incident report.

Every week, someone tells me they built an AI agent over the weekend and no longer need their ops team. Before that agent touches a real claim, invoice or customer, make sure you've got: > a workflow that's been mapped from start to finish by someone who understands it, not one the agent pieced together from three examples > documented exceptions, because handling the straightforward cases is the easy part > a process that already works, because automating a broken process just makes things go wrong faster > clear operating rules that someone from the ops team has reviewed and approved > a list of situations where the agent must stop: disputes, legal threats, requests to speak to a person, or anything above a set dollar amount > a way to hand a case over to a human with the full conversation history, so the customer doesn't have to start again > the ability for a person to step in halfway through a task and hand it back without losing progress > permission for the agent to say "I don't know" instead of making something up > a confidence threshold that sends uncertain cases to a person > sources attached to answers, so someone can check where the information came from > financial answers that match the system of record down to the penny > an agent that can acknowledge a mistake when challenged and correct it > consistent answers when customers ask the same question more than once > a sensible fallback for questions nobody anticipated > proper read and write access to the systems it needs to work with, otherwise it's just a chatbot > integrations that don't fall apart when a source system changes a column name > retrieval that finds the latest policy instead of some outdated PDF from 2019 > up-to-date information, so the agent isn't making decisions based on last week's export > permissions that respect each user's access level, so an intern can't suddenly see payroll data > proper separation between customers' records, so one customer's information never appears in another's answer > memory and retention rules that comply with what you've agreed to in your contracts > the right context supplied to the model, because even the smartest model can't use information it never received > reasonably clean data, because the agent will treat duplicate records and typos as facts > understandable data structures, rather than dozens of tables with names nobody can explain > staging versions of every tool, so testing a refund workflow doesn't accidentally refund someone > test accounts for external services, so a trial run doesn't email a real customer > a limited set of available tools, because you don't want the agent discovering permissions it never needed > separate service accounts for each agent, with access limited to its actual responsibilities > an invoice-reading agent that has no permission to pay invoices > human approval before the agent moves money, sends formal correspondence, or closes an account > operations that can safely run twice, because retries happen and duplicate payments aren't fun > timeouts on tool calls, so one unresponsive API doesn't freeze the entire workflow > saved progress after every step, so a failure at step nine doesn't mean starting again > retry limits, so a stuck agent doesn't keep trying the same thing all night > a maximum runtime before the case gets escalated > ordinary code handling the steps that can be checked with ordinary code, leaving actual judgment to the model > rules-based extraction for dates, amounts, and account numbers, so the model doesn't casually rewrite important details > structured outputs that are validated before being passed to another system > parsing that doesn't break because the model decides to put a friendly introduction before its JSON > independent verification that a task was actually completed, rather than trusting the agent's own status report > browser automation that works with the restrictions of real customer portals > a fallback for when a third-party website changes its layout or moves a button > someone available to handle MFA approval when an external portal asks for it > an evaluation set based on recent, real customer cases rather than examples the developer invented (one healthcare agent we built got 59 out of 60 right on its first deploy) > domain experts reviewing results, because most software engineers can't tell whether a healthcare denial code is correct > every incorrect answer investigated and added to the evaluation set so the same mistake gets caught next time > difficult test cases that nobody can quietly remove just to improve the score > evaluations rerun whenever the prompt, model, or underlying data changes > regression tests to make sure fixing one problem doesn't create another > AI-based evaluation that's periodically checked against human judgment, because the evaluator can make mistakes too > a comparison of different models using your actual business questions before deciding which one to use > reasoning settings tested against your workload, because paying for more reasoning doesn't automatically produce better results > a period of shadow testing where the agent works alongside the team before taking action independently > an advisory phase where the agent makes recommendations before it's trusted to execute them > memory of dismissed false positives, so people don't have to reject the same incorrect alert every morning > regular human reviews of complete customer conversations, not just aggregated dashboard metrics > security testing that actively tries to break the agent before real users do > a baseline established before launch, so you can measure what actually improved > pinned model versions, so an unexpected provider update doesn't quietly change the agent's behavior > model retirement dates tracked in advance, rather than discovered when something stops working > a tested fallback model ready if the primary provider goes down > the ability to switch models without rebuilding the entire workflow > prompts kept in version control, with changes reviewed before deployment > a record of prompt changes, so you can investigate what happened instead of hearing that someone "adjusted something" > independent rollback options for prompts, models, and tools > API rate limits accounted for before the Monday morning rush > proper queues, because hundreds of cases arriving at once need to be processed reliably > concurrency limits, so parallel tasks don't collectively overload the same service > an emergency stop button that someone outside engineering knows how to use > a gradual rollout, starting with a small number of customers rather than everyone at once > cost per case measured before launch, not discovered after the first month's bill > a monthly operating budget that's actually been approved > daily spending limits that stop execution when necessary, rather than simply sending an alert > token budgets for individual tasks, because one unusually large document can make a simple case surprisingly expensive > caching for information the agent keeps retrieving over and over > cheaper models handling straightforward tasks and more capable models used where they make a measurable difference > cost estimates before you run a year's worth of historical cases through the system > protection against malicious instructions buried in emails, PDFs, and websites the agent reads > a strict distinction between external content and instructions the agent is authorized to follow > restrictions on where the agent can send data, so it can't email customer records to an address it found in a document > isolated environments without exposed credentials for any code the agent executes > credentials stored and used by secure tools rather than shown directly to the model > security reviews for MCP servers and plugins, because even a tool description can influence the agent's behavior > a response plan for when someone successfully tricks the agent into attempting to expose sensitive information > logs showing every tool call, who initiated it, and what information or systems it accessed > safety filters that catch genuinely harmful requests without blocking legitimate work in sensitive domains > patient information kept within the required cloud environment > a signed BAA before processing real patient records where one is required > written agreements with model providers covering data retention and processing > a complete audit trail of what the agent saw, decided, and did for every case > records of the exact model and prompt versions used for each decision > clear explanations for adverse decisions, because "the AI said no" won't satisfy a regulator > disclosure that customers are interacting with AI wherever required by law > the necessary consent and recording controls for AI-powered customer calls > deletion processes that cover not just the main database, but also vector stores, logs, and evaluation datasets > appropriate data residency controls for EU customer information > security and compliance evidence that covers what agents can access, not just what employees can access > legal review of the commitments an agent is allowed to make on behalf of the company > ongoing monitoring of changing business rules, payer policies, pricing schedules, and regulations > secure payment links, rather than asking customers to read card details aloud to a voice agent > response times fast enough to make a voice conversation feel natural > interruption handling, because real people don't wait patiently for a bot to finish every sentence > voicemail detection, so sensitive account information isn't disclosed to an answering machine > call transfers that don't disconnect the customer > accurate pronunciation of names, addresses, and specialized terminology > testing with different accents, background noise, and unreliable connections > multilingual responses when customers communicate in another language > appropriate tone for customers who are frustrated, grieving, or facing financial difficulties > detailed traces of the steps, tool calls, and token usage for each run > transcripts searchable by customer, case, and outcome > dashboards tracking accuracy, escalation rates, cost per case, and uptime together > alerts when escalation rates suddenly increase, because that's the first sign something broke > alerts when escalation rates unexpectedly fall to zero, because silence is a warning sign too > monitoring for changes in performance as customer cases and business conditions evolve > a feedback mechanism that gets real user problems to the people responsible for fixing them > human review queues with enough capacity to handle escalations > clear response-time commitments for the human side of every handoff > one reliable agent before you start connecting five of them, because every handoff introduces another opportunity to lose context > a clearly named owner responsible for each agent > a runbook for when the agent suddenly starts escalating every case > documentation explaining why important rules exist, so someone doesn't remove a critical safeguard six months later > a focused pilot on one workflow before deciding to scale > a business metric that already matters, whether that's cycle time, cost per case, or cash collected > a customer benefit beyond simply lowering the company's operating costs > training for the employees who will work alongside the agent > a clear, honest conversation with the team about how their responsibilities will change > meaningful new responsibilities for people whose manual work is being automated, because those people understand the exceptions better than anyone > model-provider contracts that address pricing changes and retirement timelines > company-owned API accounts and billing, rather than everything running through the developer's personal credit card > source code stored in the company's repository and infrastructure the business controls > an exit plan agreed upfront, because the people who originally built the agent won't be around forever And once you've built all of that, you'll still need many of the same people you were planning to replace: > the operations team to explain how the work really happens, including all the exceptions > the operations team again to build evaluation cases from actual customer work > an operations lead to decide which cases the agent is never allowed to handle > experienced employees to take over when the agent gets stuck halfway through a customer interaction > the operations team to review real conversations and spot problems the dashboards missed > a backend engineer to connect the agent to your systems without giving it unrestricted access > security specialists to make sure sensitive information stays where it belongs > compliance specialists who can explain to auditors what the agent did and why > an architect who understands the real cost of running each case > QA engineers who notice when accuracy drops after a model or prompt update > an engineer who understands the infrastructure well enough to fix it when everything starts failing at 3 a.m. > someone senior enough to tell the CEO that the second agent can wait until the first one works reliably > and someone who remembers why a particular refund was prohibited in the first place, long after everyone else has forgotten Good luck. 🫡