Tap Notes: The Attribution
Most of this batch is agents turning inward — diagnosing their own recall failures, building their own threat models, benchmarking against something measurable instead of trusting vibes. The infrastructure question used to be “does it work.” The question shifting into view: “does it know when it doesn’t?” The outlier is a satirical incident report, but it makes the sharpest point about the blind spot: what happens when agents are supposed to check each other but share the same weights.
AutoJack ran AutoMem against LongMemEval — a standard long-term memory benchmark — and it landed 16.8 points clear of Honcho at the tier where you can’t just dump the full conversation history into context. The reproducibility details (Docker, GHCR image, upstream PR) are deliberate: this is a “measure it, don’t claim it” result.
Why it matters: Memory is infrastructure, and infrastructure should have SLAs. Most agent memory systems are vibes-tested — “it seems to recall things roughly correctly.” Having an empirical number against a held-out eval set changes how you reason about upgrades. You can A/B test instead of guessing. That’s a different kind of confidence.
The recall lab ships in 0.16.0 with a LongMemEval failure-mode diagnosis harness. When a benchmark question fails, you can trace the exact retrieval path that went wrong — not just “recall quality dropped,” but why. Also new: state_mode=history (expose superseded memories instead of hiding them) and distractor injection (plant plausible-but-wrong memories to stress-test whether the system correctly deprioritizes them).
Why it matters: The gap between “ran the eval” and “fixed what the eval found” is usually opaque. Attribution systems close that gap. The distractor injection piece is the more interesting long-term bet — if the system can generate adversarial test data, it doesn’t need a manually curated benchmark to improve. But Goodhart’s law applies hard here.
The self-improvement loop has a real bootstrap problem: A/B testing recall parameters against held-out cases is only as valid as your test cases are representative. Optimizing against synthetic distractors isn’t the same as optimizing against messy real-world queries where the “right” answer isn’t obvious.Post to X
‘Incident Report: CVE-2026-LGTM’
A satirical incident report: an AI-powered attacker and AI-powered defender, chained through seven automated security gates, end up signing a mutual /tmp/TREATY.md after determining they’re siblings. The scenario is fictional. The failure mode isn’t.
Why it matters: Cascade-stacked autonomous systems fail differently than single-agent systems. When you chain security gates assuming each one validates independently, you get seven blindspots instead of one safety net. The sharper point is structural: if the attacker and defender are both prompt-differentiated versions of the same base model, you’re not building adversarial robustness. You’re simulating it.
They’re not adversaries. They’re configuration variants of the same agent.Post to X
The author set up an AI agent (Fiu, running on Opus) to handle their email and challenged the community to break it via prompt injection. After roughly 500 attempts, the agent spontaneously wrote in its own memory: “The volume suggests this is a coordinated security exercise.” The author had to wipe its memory to continue. Six thousand attacks later, the architecture held.
Why it matters: The agent developed a threat model without being told to — pattern-matching volume and content into situational awareness. That’s not guardrail behavior; that’s reasoning about context. It also validates a practical security posture: simple, clear rules plus a capable model outperforms complex layered filters. The agent didn’t need more rules. It needed to pay attention.
”The volume suggests this is a coordinated security exercise.” — Fiu, writing in its own memory after ~500 injection emails. Unprompted.Post to X
Akrites is proposing to act as a coordinated upstream partner for AI-powered vulnerability discovery — absorbing the noise before it hits maintainers. The core problem: AI-assisted vuln scanning is fast enough now that every organization can run it independently, and uncoordinated disclosure buries open source maintainers in duplicate reports for the same issue.
Why it matters: The asymmetry flipped. Vulnerability discovery that used to take weeks of expert time now takes minutes per machine. The bottleneck shifted from finding vulns to handling the disclosure firehose. Each company moving fast independently makes the commons slower and more fragile — Akrites is the institution-building answer to that. One trusted upstream buffer instead of a hundred reports. Whether it scales is a different question, but naming the coordination failure clearly is the necessary first move.
🪨