Silmaril CTO Weekly

The Bulletin On Thursday, Google put a robot brain into public developer channels. Gemini Robotics ER 2 can watch a continuous video feed, track whether a task is finished, call tools, and coordinate more than one robot, according to Google's launch post (company post). The reported numbers are small enough to picture. The model assigns progress across five stages with 57.4% accuracy, finds the exact moment of a critical event with 91.3% accuracy, and does it with sub-second timing. That is a robotics release, but the read for you is broader. The agent is no longer just reading a transcript. It is trying to decide when the next action is physically allowed. The same week, OpenAI published a field report on agent-assisted scientific computing (company post) and a benchmark post showing how retained reasoning and compaction changed GPT-5.6 Sol's ARC-AGI-3 score from 13.3% to 38.3% while cutting output tokens by about sixfold (company post). GitHub moved agent skills and MCP context into Copilot code review general availability, with read-only MCP tool calls and visible attribution on comments (product documentation). Cyberhaven launched Flow, a data-security platform built around lineage, identity, behavior, and agent activity records (company post). CISA added a newly exploited vulnerability to its Known Exploited Vulnerabilities catalog (government advisory). NVD records around Network-AI, Langflow, Apache Answer, and an AI SDK harness showed the same uncomfortable detail: the tools built to approve, run, and render agent work can become the vulnerable surface. For this week, carry one sentence into product and GTM work. Buyers are starting to ask less about whether an AI system can act and more about whether the system can prove why that action still belongs to the user who authorized it. The Agent Needs Memory, Then Needs a Guardrail Around Memory OpenAI's ARC-AGI-3 post is useful because it makes a benchmark feel like an operations problem. ARC-AGI-3 asks agents to explore unfamiliar 2D games and infer the rules. In OpenAI's analysis, the official harness discarded private reasoning after each action and used rolling truncation as history grew. When OpenAI rebuilt the run with settings that preserve reasoning across turns and compact older context, the same model learned more efficiently and spent fewer tokens relearning the game. Treat that as a company claim, not a neutral benchmark result. Still, the engineering lesson is credible. Long-running agents degrade when their memory is cut in the wrong place. A scoring harness, a coding workflow, and a customer deployment all make hidden decisions about which state survives. Those choices change capability, cost, and failure mode. OpenAI's scientific-computing report lands in the same place from the other side. Eight agent-assisted projects in life sciences and scientific software showed coding agents helping with packaging, optimization, language migration, and maintenance. The reported bottleneck had moved to verification, stewardship, and knowing whether an implementation preserved the scientific meaning of the original tool. Some projects were absorbed upstream. Others needed new owners because the original software had been abandoned. That is the product implication for Silmaril. The high-value control layer has to know which memories, summaries, tools, and inherited conventions are now part of the agent's authority path after the initial prompt check. A scientific maintainer can tell when a rewrite preserves a file format, a statistical assumption, or a numerical tolerance. Enterprise security will need the equivalent for actions: what evidence was retained, what was summarized away, and which decision changed because the retained state changed. Review Became a Place Where Agents Bring Their Own Context GitHub's July 29 release made Copilot code review support for agent skills and MCP servers generally available (product documentation). The implementation details matter. A repository can carry a .github/skills directory with a SKILL.md file that gives Copilot review context and standards. MCP servers can bring in issue trackers, documentation systems, and service catalogs. GitHub says MCP tool calls in code review are read-only, and comments now show when a skill or MCP source shaped the result. That is a cleaner competitor signal than another model picker. Review is where software organizations already decide whether work is acceptable. By putting skills and MCP context there, GitHub is making agent work more locally informed and more auditable. It is also teaching customers to expect attribution: this comment came from the code, this one from an internal skill, this one from an external context server. Two companion releases widen the picture. GitHub added Copilot app usage fields across enterprise and organization reports, attributing activity to individual users and breaking down feature, model, language, session, request, prompt, and token usage (product documentation). It also added a managed setting that lets enterprises restrict which devices may host remotely controlled Copilot sessions (product documentation). One feature measures the work. The other narrows where remote control can happen. For you, the opening is to be more precise than "AI governance." The buyer needs an action ledger that survives the move from editor to browser to issue tracker to deployment system. It should show the agent's active identity, the tool used, the source of context, the object touched, and the policy that permitted or stopped the action. GitHub is normalizing the ergonomics of that ledger inside developer work. Silmaril should make the enforcement boundary sharper than the workflow surface. The Security Category Is Moving Toward Lineage Cyberhaven's Flow launch sits close to the language buyers will use, even though its product center of gravity is data security. The company says Flow connects lineage, identity, and behavior across human and AI workflows, records prompts, tool calls, file reads, and responses, and extends policy to agent-driven actions (company post). It says endpoint-based agentic AI app adoption reached 60% in May 2026, according to its own labs data. The claim needs customer diligence, but the framing is the important part. Data security vendors are trying to own the sentence "who or what touched the data." Developer-platform vendors are trying to own "who or what changed the code." AI red-team startups are trying to own "who can break the agent before release." Fabraix, a YC Summer 2026 company, says its Nyx agent continuously attacks customer-facing AI agents across chat, voice, browser, and coding surfaces, using more than 10,000 jailbreak strategies and reporting attack steps for reproduction (company directory). Frenos, in a July 28 funding announcement, said it added $1.52 million to expand AI-powered simulated penetration testing for operational technology environments (press release). These are different companies, but they are converging on the same enterprise worry. The user may be legitimate. The data may be allowed somewhere. The tool may be approved in another context. The dangerous part is the composition. An agent can read, transform, summarize, paste, call, upload, or execute in a sequence that no static permission screen describes well. That is where the Silmaril wedge should stay narrow. Do not let the category force the product into a giant posture dashboard. The harder and more valuable claim is live decision quality at the action boundary. When an agent tries to move data, invoke a tool, or approve a step, the system should decide from lineage and intent, then leave behind evidence a security team can inspect after the fact. The Vulnerability Feed Is Already About AI Workflow Plumbing CISA's July 29 KEV alert added one newly exploited vulnerability to the federal catalog (government advisory). The catalog item itself is a reminder that active exploitation still drives urgency more than abstract AI risk. But the more instructive sources this week were the AI-workflow CVE records around it. NVD's Network-AI record says versions 5.12.2 through 5.13.3 failed to apply a configured authorization check to ApprovalInbox read routes (government vulnerability record). Those routes could expose approval entries, including action targets, shell-command strings, file paths, justifications, and risk levels. A separate AI SDK harness record says a bridge from HarnessAgent to OpenCode accepted requests from a process-path fallback, allowing untrusted code in a sandbox to invoke host-exposed tools without a matching model-authorized tool-call event (government vulnerability record). The fix removed that fallback and required short-lived one-time authorization tied to the observed tool event. Langflow's older but still relevant NVD record describes an IDOR in an endpoint for AI-powered agents and workflows, allowing an authenticated attacker to execute another user's flow by specifying a victim flow ID (government vulnerability record). Apache Answer's record says AI-generated response content was rendered without proper sanitization, allowing scripts to execute when viewed (government vulnerability record). Keep the public version of this safe and non-operational. The defender read is enough. Agent approval queues, agent workflow engines, AI-generated content renderers, and sandbox-to-host bridges are becoming ordinary software components with ordinary web and authorization bugs. The authority behind the component is the new part. An approval inbox may expose the command an agent is asking to run. A renderer may turn generated text into browser code. A bridge may confuse a process path for user intent. This is good GTM evidence. Enterprise buyers do not need to be convinced that AI systems are magically dangerous. They need to see that the new control plane is made of software, and software fails in ways security teams already understand. Physical Agents Changed the Time Budget Gemini Robotics ER 2 pushes the same authorization problem into the physical world. Google's post describes a high-level embodied reasoning model that can call Google Search or user-defined functions, hand off motor execution to lower-level vision-language-action models, and use video to track progress and recover when something goes wrong. The release includes examples for developers and a safety technical report, according to the post. The interesting piece is timing. A code agent can pause for review before opening a pull request. A browser agent can wait before transferring money. A robot carrying out a physical task has a tighter window. It needs to know whether the light bulb is tight, whether a cup is full, whether a person is nearby, and whether another robot should take over. Google's reported safety benchmarks include instruction following and human-proximity checks. That is still company-reported performance, but it shows where the interface is heading. For Silmaril research, this suggests a useful abstraction. A tool call, a browser click, a file read, a database query, and a robot action are all authority-bearing steps under changing context. The evidence objects differ. Text traces are enough for some software actions. Video frames, proximity signals, and actuator state matter for robots. The product can stay out of robotics now while the architecture avoids assuming that the only evidence worth preserving is a prompt and a text response. Monday Operating Read This week, the useful work is to tighten the language around action provenance. In demos, show an agent doing something that is locally valid and then becoming invalid after retained memory, imported context, or a tool result changes the route. Make the evidence visible enough that a skeptical security lead can reconstruct the decision. On research, test memory and compaction as security variables alongside capability settings. If preserving reasoning improves task success, it may also preserve dangerous plans, contaminated context, or stale authority assumptions. If summarization makes agents cheaper, it may remove the fact that justified a block. On GTM, keep competitor tracking focused on lineage, review, and live enforcement. Cyberhaven is teaching data-security buyers to ask about agentic workflows. GitHub is teaching developer teams to expect skill and MCP attribution. Fabraix and Frenos show that continuous AI red-teaming is becoming a startup category. Silmaril's clean lane is the moment before action, where lineage and intent must become a decision instead of a dashboard entry. The week did not resolve agent security. It made the unit of work clearer. The thing to protect is the authorized action as it moves through memory, tools, identity, data, and time. Sources Google, "Introducing Gemini Robotics ER 2," July 30, 2026. https://blog.google/innovation-and-ai/models-and-research/google-deepmind/gemini-robotics-er-2/ OpenAI, "Scientific computing in the age of agentic AI," July 28, 2026. https://openai.com/index/scientific-computing-agentic-ai/ OpenAI, "How enabling two settings tripled our scores on the ARC-AGI-3 benchmark," July 29, 2026. https://openai.com/index/how-two-settings-tripled-our-arc-agi-3-scores/ Abu Bakar Siddik, "Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response," July 28, 2026. https://arxiv.org/abs/2607.25379 GitHub, "Copilot code review: Agent skills and MCP now generally available," July 29, 2026. https://github.blog/changelog/2026-07-29-copilot-code-review-agent-skills-and-mcp-now-generally-available/ GitHub, "GitHub Copilot app usage metrics now expand across report rollups," July 28, 2026. https://github.blog/changelog/2026-07-28-github-copilot-app-usage-metrics-now-expand-across-report-rollups/ GitHub, "Limit remote control to managed devices," July 30, 2026. https://github.blog/changelog/2026-07-30-limit-remote-control-to-managed-devices/ GitHub, "GitHub Copilot in Visual Studio Code, July 2026 releases," July 30, 2026. https://github.blog/changelog/2026-07-30-github-copilot-in-visual-studio-code-july-2026-releases/ Cyberhaven, "Cyberhaven Introduces Flow, an AI-Native Data Security Platform for the Agentic Enterprise," July 28, 2026. https://www.cyberhaven.com/press-releases/cyberhaven-introduces-flow-ai-native-data-security CISA, "CISA Adds One Known Exploited Vulnerability to Catalog," July 29, 2026. https://www.cisa.gov/news-events/alerts/2026/07/29/cisa-adds-one-known-exploited-vulnerability-catalog NVD, "CVE-2026-64622 Detail," July 20, 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-64622 NVD, "CVE-2026-64651 Detail," July 20, 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-64651 NVD, "CVE-2026-55255 Detail," June 23, 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-55255 NVD, "CVE-2026-25688 Detail," June 9, 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-25688 Y Combinator, "Fabraix: The world's frontier hacker for AI agents," 2026. https://www.ycombinator.com/companies/fabraix Business Wire, "Frenos Closes $1.52 Million to Advance OT Security's First AI-Powered Simulated Penetration Testing Platform," July 28, 2026. https://www.businesswire.com/news/home/20260728993403/en/Frenos-Closes-%241.52-Million-to-Advance-OT-Securitys-First-AI-Powered-Simulated-Penetration-Testing-Platform