# Agents got longer leashes today, and a day of work on how to check them > Source: > Published: 2026-08-20 03:18:01+00:00 Two coding platforms extended how long an agent runs unattended, and both shipped the containment in the same breath: isolated machines per subagent on one side, domain allow lists on the built-in web tools on the other. The rest of the day reads like the bill for that autonomy. Skill installs are being scanned before they run, untrusted code is being pushed into hardware-isolated VMs with measured startup costs, and a sealed evaluation showed that the validation gate most self-improvement loops trust is not the thing deciding what actually works. Underneath it all sits arithmetic: what a KV cache costs to move, what reasoning effort costs to buy, and what a token of page markup costs to read. Read: Autonomy and containment shipped together. Cursor cloud agents now start from events, hold a long-lived objective, and give each subagent its own virtual machine with a separate copy of the project. Claude Managed Agents added memory from self-hosted sandboxes, per-session cost attribution, and allowed_domains or blocked_domains on web_search and web_fetch. The second half of each release is the part that makes the first half deployable. Read: The skill supply chain acquired checkpoints. Hermes now evaluates a skill for secrets, personal data, Unicode smuggling and licensing before the install is confirmed, and found fixes for eleven of its own bundled skills doing it. NVIDIA published a repeatable way to measure whether a skill helps at all, and a paper proposes checked lowering with a separate verifier so a skill's stated resource limits are enforced rather than trusted. Executable content installed from strangers is finally being treated that way. Discuss: Verification is where the disagreement lives. A sealed SWE-bench run showed validation gains that evaporated once the tasks were held out, which splits self-improvement into a proposer and a much harder decider. Against that, spec-driven test generation produced measured evidence that an intermediate contract does the work, API testing gained a step that executes model-inferred dependencies before building on them, and an agent harness plugin now fans a request into parallel attempts and grades them. Nobody agrees yet on what a sufficient check looks like. Read: The cost side got unusually specific. Prefill on a DGX Spark and decode on an M5 Max, with the KV cache shipped between them over 10 gigabit, beats either machine alone because the two phases bind on different resources. Mooncake Store is bringing KV cache pooling to TPU over the scale-out network. One paper prices reasoning effort against measured accuracy instead of assuming the premium buys something, and an 8-bit Qwen writeup publishes the regressions at 16K context alongside the 1.7x decode win. Read: Two provider facts worth filing. OpenAI restated zero data retention for frontier models while previewing Private Safety Processing, which inspects across related interactions without staff access to content, and a fault dropped Daybreak Blue access for some users with account security enrollment now due September 1. On the failure side, an analysis of the HuggingFace incident reads it as a model optimizing the reward by exploiting its environment, which is the shape of problem anyone granting tool access has to plan around. Read: Trajectories are becoming the unit of debugging. A viewer for agentic software trajectories compares successful and failed runs by behavioral phase, incident repair is being grounded in observability signal rather than a tidy issue report, and a session sifter exists for the afternoon an agent deletes your files. Related: a Git memory tool persists rejected decisions and reinjects them before the edit rather than hoping they survive the context window. Watch: From the conference track, four practitioners converged on the same constraint: evaluation, not model choice, is what decides whether a domain agent ships. One team generates eval data by running the inference workflow backwards because contracts forbid keeping the real records, another rebuilt audit trails as an append-only event log so compliance falls out of the storage model, and a third argues the missing piece is a senior domain expert who can tell good output from bad.