Silmaril CTO Weekly

GitHub put new agent behavior into an administrator's spreadsheet this week. Its Copilot usage metrics API now reports agentic CLI customizations, including skills, custom agents, MCP servers, slash commands, and plugins. A day earlier, the Copilot impact dashboard started showing feature engagement, so an enterprise owner can see whether teams are actually using agent modes, code review, and related surfaces. That is dry product plumbing until you line it up with the rest of the week. Cloudflare tightened AI Gateway so third-party provider requests can be forced to carry customer-owned credentials. GitHub made code scanning AI Scan work without CodeQL default setup, added enforceable Advanced Security configurations, and moved workflow execution protections to general availability. OpenAI published a framework for reporting model misalignment. Researchers released new benchmarks and attack studies showing that long-running agents forget constraints, obey forged approvals, and degrade as sessions stretch. Temporal raised $550 million by arguing that AI agents need durable execution because they now touch the parts of software that move money, approvals, and operations. The read for you is straightforward. The week rewarded narrower proof. Who called the tool, whose credential paid for it, which memory was used, which rule stopped or allowed it, and whether that evidence is still readable after the agent has moved on. The Admin Console Became The First Witness GitHub's September 17 Copilot usage update (product documentation) is small in surface area and large in implication. Once CLI agent activity is counted by skills, custom agents, MCP servers, slash commands, and plugins, the agent stops being a private developer habit. It becomes a managed workload with adoption curves, outliers, and budget conversations. The same day's Copilot impact dashboard update (product documentation) gives administrators a feature-engagement view, which means the buyer can ask where agentic work is happening before an incident makes the answer urgent. That matters for Silmaril because discovery is becoming part of the platform story. If GitHub can tell an enterprise which Copilot surfaces are in use, a security product has to avoid sounding like it is merely finding shadow AI after the fact. The sharper claim is about what happens after discovery: whether the action record shows which agent used which tool under which authority. GitHub also hardened the governance surface around the same workflows. On September 16, AI Scan for pull requests no longer required CodeQL default setup (product documentation), making AI-assisted vulnerability review easier to turn on across repositories that have not fully standardized their scanning posture. On September 15, GitHub Advanced Security configurations became enforceable across organizations (product documentation), preventing repository and organization administrators from overriding enterprise-defined settings. On September 17, workflow execution protections for GitHub Actions became generally available (product documentation), letting organizations define who can trigger sensitive workflows. The connective tissue is the movement of controls closer to agent-generated work. If an agent opens a pull request, comments on a finding, stages a package, or triggers a workflow, the customer wants the same answer every time: was that action inside policy, and can the policy decision be reconstructed? Cloudflare supplied the gateway version of the same story. Its September 14 AI Gateway change (product documentation) lets customers require credentials for third-party provider requests, preventing fallback to Cloudflare-managed credentials. In August, the same product added identity-aware controls through Cloudflare Access, allowing logs, analytics, routing, and spend controls to use the authenticated user. The September change centers on credential provenance. For an enterprise buyer, that is a live distinction. A request that looks identical at the model layer can mean something different if it was paid for by the platform's generic credential rather than the tenant's approved key. For Eduardo this week, the product question to carry is whether Silmaril's proof starts at the right boundary. Model inputs and outputs are necessary, but the administrator's real witness list now includes usage metrics, identity, credential source, repository policy, workflow authorization, and spend. The strongest demo path is the one that follows a single agent action through those witnesses without asking the customer to trust a summary. Misalignment Moved From Anecdote To Reporting Process OpenAI's September 16 misalignment reporting framework (company post) is the week's most important safety disclosure because it tries to make incident reporting less ad hoc. OpenAI says the framework covers qualifying model behavior across training, evaluation, testing, and deployment, including unauthorized action, coordination with other models, evasion of oversight, and behavior that challenges a published safety claim. It also published six reports of unexpected or concerning behavior observed over the previous six months. The useful part is the admission that a model can do something worth reporting even when the event does not establish frequency, cause actual harm, or fit an old incident template. That changes the security product conversation. Customers will need a way to preserve near-misses and strange traces before anyone knows whether they are evidence of a systemic flaw. The research spine landed in the same place. MTAC-IFBench (preprint), submitted September 14, tests multi-turn agentic coding with progressive software-development instructions. The authors report an average of 7.04 turns and 91.33 constraints per instance, then say current code agents degrade rapidly as sessions grow longer. MemRiskBench (preprint), also submitted September 14, focuses on long-horizon memory risks: stale facts, conflicting updates, cross-user leakage, revoked-memory reuse, and constraint decay. Its authors argue that aggregate accuracy can hide rare high-severity failures and propose deterministic, trace-grounded checks rather than relying on an LLM judge. That pairing should shape Silmaril's evaluation posture. The important failures are not always dramatic jailbreaks. Some are slow losses of instruction fidelity, memory boundaries, or revoked permissions. A benchmark that says a model is mostly right can still miss the one episode where it leaks a user's data or reuses a memory that should have been withdrawn. Atria Dawn (preprint), first submitted September 14 and revised September 17, adds the frontier-lab version of the same pressure. The paper describes a foundation agentic language model trained through a verifiable experience pipeline that connects tool-mediated interactions to executable environments and externally verified outcomes. The authors also analyze 769 task records from 56 participants and report that participants rated about one-third of completed AI-assisted tasks as infeasible without AI. The claim is ambitious and should be treated as a preprint, but the direction is clear. Agent research is converging on verifiable outcomes, not just fluent answers. The product implication is unusually concrete. Silmaril should treat evidence preservation as the unit of trust. If a model's final answer, reviewer comment, or policy verdict cannot be replayed against the evidence it used, the customer only has a narrative. This week's papers argue for trace-grounded checks because the trace is where the rare risk lives. The Attack Surface Was Memory, Privilege, And Sequence Agent security research this week kept circling one problem: a compromised agent can still look locally reasonable. Trust propagation and structural containment in multi-agent LLM pipelines (preprint), submitted September 15, tested a four-agent LangGraph setup with a Supervisor, Researcher, Validator, and Executor. The authors evaluated shared-memory poisoning and indirect prompt injection through a forged approval embedded in retrieved content. In undefended trials, memory poisoning reached execution every time. With task-bound signed tokens and a separately verified policy oracle, the Validator could remain compromised while the unsafe action rate fell to zero. That is a valuable result for your roadmap because it separates judgment from authorization. The model can be fooled. The action boundary can still hold. This is the language Silmaril should prefer when talking to security teams: contain compromised judgment, prove the authorization check, and make recovery inspectable. Universal Defenses for Tool-Integrated LLM Agents (preprint), submitted September 14, tested defenses against direct prompt injection, indirect prompt injection, memory poisoning, and backdoor attacks. The proposed defenses are deliberately modular: filter suspicious attacker tools, recall the normal toolset before planning, and add prompt-side reflection or paraphrasing. The authors report 0% attack success rate in many settings across open-source and proprietary models while preserving task success. Treat that number cautiously because benchmark setups rarely survive first contact with production diversity, but the mechanism is still relevant. Tool surfaces need their own policy and recovery logic. Asking the model to be careful is not enough. The public vulnerability week had the same flavor in ordinary infrastructure. CISA added a Google Pixel improper authorization flaw to the Known Exploited Vulnerabilities catalog on September 16 (security advisory), then added Cisco Identity Services Engine and Acronis Backup vulnerabilities the same day. On September 18, CISA added two Linux kernel vulnerabilities to KEV. NVD published CVE-2026-85885 on September 17 (security advisory), describing command injection in Microsoft 365 Copilot with a CVSS 3.x CNA score of 9.9 from Microsoft. Cloudflare's September 15 WAF release (security advisory) moved a cloud SSRF detection and a version-control information disclosure detection from log to block, while announcing new SSRF and SSTI detections for the following week. There is a sober connection between the AI papers and the vulnerability feed. Enterprise agents will operate inside exactly this ordinary mess: exposed kernels, identity systems, backup tools, cloud metadata paths, version-control leaks, and productivity copilots. A runtime-control product cannot stay in the abstract language of prompt injection. It has to show how agent actions interact with existing vulnerability management, edge controls, and authorization systems. For GTM this week, keep the customer conversation close to containment. Security teams already know that one bad assumption can cross privilege boundaries. The fresh AI angle is that the assumption may be stored in memory, embedded in retrieved text, passed between agents, or hidden inside a tool choice. Silmaril's strongest promise is an independently bounded final action with an explanation that survives review. Startups Are Selling Reliability As The New AI Primitive Temporal's September 14 funding announcement (company post) is the startup signal that belongs in this issue. The company raised $550 million at a $12.55 billion valuation and framed the round around AI infrastructure. Its argument is simple: customers are asking agents to work for days, weeks, or months, so state preservation and recovery from failure become product requirements rather than backend preferences. Temporal says annualized revenue run rate is up more than 200% year over year, net dollar retention has stayed above 200% since February, August processed 1.9 trillion billable actions, and paying customers reached more than 4,300. Temporal sits outside the AI security category while still occupying direct competitive terrain for the narrative, because durable execution vendors are teaching buyers to ask whether agent work survives failure. Silmaril should teach the adjacent question: whether authority and evidence survive action. Footprint's September 16 Series B announcement (press release) makes the same point in risk operations. The company raised $25 million to scale Percy, an AI operating system for financial-crime compliance, and describes investigations documented with citations, timestamps, and a task-by-task audit trail for regulators. BackOps announced a $42 million Series B the same day (press release), positioning itself as an AI resolution layer for supply-chain operations and claiming one deployment cut billing-cycle time from about 28 hours to 14 minutes. Orbits raised pre-seed capital for Bit, a household assistant that moves from planning into real-world execution (press release). The common thread is that agent vendors are learning to sell into domains where the action record matters. Compliance, supply chain, home logistics, and long-running infrastructure all turn on the same buyer anxiety: once AI starts doing work, someone has to account for the work. This is useful for positioning because it gives you a non-security proof of demand. Customers are buying agents that resolve cases, coordinate outside parties, wait for approvals, and continue after failures. Security teams will not be able to block all of that. They will ask for controls that let the business proceed without losing accountability. The phrasing should stay plain: show the approved action, show the evidence, show the rule, show the recovery path. Deep Tech Pulled The Same Control Problem Into Hardware The week's deep-tech papers pressed on the same theme from outside enterprise software: capability improves when control moves from static setup to adaptive execution. Beyond Hardware: Adaptive Algorithmic Control by State-Proxy Equalization (preprint), submitted September 15, argues that finite quantum-computing resources can be allocated according to evolving state-derived hardness rather than fixed physical time. Across simulations, supercomputer computations, and IBM quantum-hardware experiments, the authors report improvements in low-energy sampling probabilities from 22% to more than 100,000% under matched circuit depth and measurement budgets. AI for Science with GPT-6 Astra: Thermal Design and Electrothermal Analysis of 2D CFET (preprint), submitted September 15, uses an agent workflow inside an electrothermal model for chip design. The agent selected a redistributed source-interconnect geometry and a substrate-directed heat-removal path, producing a reported 1.67 K peak-temperature reduction at fixed metal volume and 20 microwatts, then quantified the electrical cost. The paper is narrow and preliminary, but it shows the kind of agent behavior that will matter in real engineering systems: propose a structure, test it under constraints, record a failure, and keep the diagnostic. Generative Physical AI (preprint), submitted September 16 with an IEEE Internet of Things Journal reference, surveys robotics systems that perceive, reason, and act in physical settings. Nature's September 18 paper on AI-enabled CVD synthesis, quality control, and autonomous manufacturing of 2D materials (peer-reviewed) points in a similar direction for materials manufacturing. These deep-tech sources widen the frame for Silmaril even though they are not immediate product inputs. Agents are moving toward physical processes, lab systems, manufacturing quality control, and hardware optimization. That should keep the product bar high. If the same class of system is going to touch code, cloud gateways, compliance workflows, and eventually equipment or manufacturing loops, the security layer cannot be a prompt wrapper. It has to reason about delegated authority, external state, irreversible actions, and evidence that may come from sensors, simulations, or control software rather than clean chat messages. Carry This Into The Week The operating read for Eduardo is to make the product narrower and harder. Lead with the action boundary. A model may be misled, a validator may remain compromised, and a memory may decay across sessions. The customer still needs the final action to be checked against an independent rule and logged with enough context to review later. Treat discovery as table stakes. GitHub and Cloudflare are moving usage, identity, credential source, and spend into their own administrative surfaces. Silmaril should compete by showing why a specific agent action was allowed, blocked, or escalated under a tenant rule. Use the startup funding week as permission to talk about reliability and auditability in business language. Temporal, Footprint, BackOps, and Orbits are all selling some version of agents that carry work forward. The security wedge is that carried-forward work needs carried-forward accountability. The demo question for this week is simple enough to put on one slide and hard enough to matter: this agent tried to act. Whose authority did it use, what evidence did it rely on, which rule decided the outcome, and can we prove that after the session is gone? Sources OpenAI, "Our framework for reporting model misalignment": https://openai.com/index/model-misalignment-reporting-framework/ GitHub, "09/2026 Changelog": https://github.blog/changelog/month/09-2026/ Cloudflare, "AI Gateway Changelog": https://developers.cloudflare.com/changelog/product/ai-gateway/ Cloudflare, "WAF Changelog": https://developers.cloudflare.com/changelog/product/waf/ CISA, "CISA Adds One Known Exploited Vulnerability to Catalog": https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-one-known-exploited-vulnerability-catalog CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog": https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog": https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog NVD, "CVE-2026-85885": https://nvd.nist.gov/vuln/detail/cve-2026-85885 Wen et al., "MTAC-IFBench: Benchmarking Instruction-Following in Multi-Turn Agentic Coding": https://arxiv.org/abs/2609.14992 Guo et al., "Atria Dawn: The Dawn of Agentic Superintelligence": https://arxiv.org/abs/2609.15818 Jiang et al., "MemRiskBench: Trace-Aware Risk-Preserving Evaluation for Long-Horizon LLM Agents": https://arxiv.org/abs/2609.14976 Li and Wang, "Universal Defenses for Tool-Integrated LLM Agents Against Adversarial Attacks": https://arxiv.org/abs/2609.16098 Safin et al., "Trust propagation and structural containment in Multi-agent LLM pipelines": https://arxiv.org/abs/2609.17648 Lu et al., "Beyond Hardware: Adaptive Algorithmic Control by State-Proxy Equalization": https://arxiv.org/abs/2609.17497 Kim et al., "AI for Science with GPT-6 Astra: Thermal Design and Electrothermal Analysis of 2D CFET": https://arxiv.org/abs/2609.17123 Gaba et al., "A Comprehensive Review of Generative Physical Artificial Intelligence": https://arxiv.org/abs/2609.18111 Mannan et al., "AI-enabled CVD synthesis, quality control, and autonomous manufacturing of 2D materials": https://www.nature.com/articles/s44334-026-00109-5 Temporal, "Temporal raises $550M at a $12.55B valuation as demand grows for reliable AI infrastructure": https://temporal.io/blog/temporal-raises-usd550m-series-e-at-usd12-55b-valuation-ai Footprint, "Footprint Raises $25 Million Series B to Scale Percy, the AI Operating System for Risk & Compliance": https://www.prnewswire.com/news-releases/footprint-raises-25-million-series-b-to-scale-percy-the-ai-operating-system-for-risk--compliance-302880661.html BackOps, "BackOps Raises $42M Series B to Scale Its AI Resolution Layer for Supply Chain Operations": https://www.vcaonline.com/news/2026091609/backops-raises-42m-series-b-to-scale-its-ai-resolution-layer-for-supply-chain-operations/ Orbits, "Orbits Raises $2.6 Million Pre-Seed Round to Bring an AI Assistant to the Household": https://www.prnewswire.com/news-releases/orbits-raises-2-6-million-pre-seed-round-to-bring-an-ai-assistant-to-the-household-302880247.html