Silmaril CTO Weekly

Good morning, Eduardo. It is Monday, June 8. A benchmark released Friday put frontier systems through the small, fussy parts of research work and found the best setup still topped out at 68.3 percent. That felt like the cleanest read on the week. The stack kept getting more capable, but the new evidence kept dragging the conversation back to judgment, budgets, and control. In the bulletin: research groups are starting to score agents on whether they catch subtle mistakes instead of whether they can merely finish a workflow. Robotics and autonomous-driving teams are showing that context only matters if you can afford to carry it at speed. Security vendors have moved closer to the moment of action, with new products for approvals, tool-level policy, and coordinated response. And the public advisories from Android and Chrome were a reminder that real systems still break in ordinary ways, even while the market talks about autonomous ones. Where the agent slips The most useful research paper of the week for you was AARRI-Bench, the first release in the Act As a Real Researcher benchmark series (preprint). The premise is simple and sharp. Instead of asking whether an agent can complete a broad task, the benchmark asks whether it behaves like a careful junior researcher when the work gets granular and a little annoying. The best configuration in their run, Mini-SWE-Agent with Claude Opus 4.7, reached 68.3 percent. The misses were not exotic. They were the sort of subtle details that experienced people notice early and scaffolds tend to skate past. That matters for Silmaril because the commercial market keeps rewarding agent wrappers that look fluent at macro tasks. The paper argues that the next bottleneck is professional judgment. I think that frame fits this week. A customer does not care whether an agent can string together steps in a clean demo. They care whether it notices the one quiet inconsistency that turns a harmless action into a bad one. MemDreamer landed the same week from the multimodal side, and it points at the same operating truth by a different route (preprint). The authors handle hours-long video by splitting perception from reasoning, building a hierarchical graph memory, then letting the reasoning model retrieve only the small part of the record it needs. They report a 12.5 point accuracy gain while keeping the reasoning window down to 2 percent of the full context. That is a strong result, but the more interesting part for you is architectural. The system improves because memory becomes explicit and navigable rather than because someone simply paid for a bigger window. If I were tightening product priorities from these two papers, I would keep one question on the table all week. Where in your stack does carefulness live? If the answer is still “inside the model,” the evidence is getting worse for that hope. If the answer is “in the retrieval path, the approval path, and the replayable record,” the week was supportive. Budget is back in the room A lot of this week’s deep-tech work carried the same subtext. Useful autonomy still has to fit through hard physical bottlenecks. RhinoVLA, a technical report from HuixiAI, is a robotics paper about token pressure disguised as a deployment paper (preprint). The authors argue that visual and context tokens dominate latency for edge robotic manipulation, then co-design a model and hardware stack to bring end-to-end inference to 11.69 hertz on their edge SoC. The report is full of robotics specifics, but the business lesson is wider. Teams are leaving the phase where “agentic” means generous cloud budgets and forgiving latency. They are trying to make embodied systems behave within fixed clocks, memory ceilings, and heterogeneous hardware. COMPACT-VA pushes the same constraint in autonomous driving (preprint). Instead of carrying full temporal context, it compresses history in a way aligned to planning intent. The result in their closed-loop evaluation was a 3.3 times speedup, 2.7 times memory reduction, and better behavior on the scenarios where historical context actually decides the action. The detail worth noticing is the choice of objective. They are not optimizing for prettier representations. They are optimizing for whether the system still stops, yields, or proceeds correctly after compression. That same turn toward bounded systems showed up in Microsoft’s June release notes for Agentic Retrieval in Foundry Local (product documentation). The product now requires a bring-your-own model endpoint, reduces the local GPU requirement from four to two, exposes an Agents Runtime API with threads, messages, runs, and streaming, and adds explicit timeouts across inference, vector-database queries, and database operations. Read literally, this is a release note. Read as market evidence, it says something more important. Even Microsoft’s local agent stack is being pulled toward narrower resource envelopes and clearer failure behavior. For you, this is a good week to keep performance discipline tied directly to the security story. If an agent product cannot tell a customer how it degrades under pressure, which operations time out, what state persists, and how it resumes safely, the system is still closer to a lab rig than a control surface. Biology got less forgiving The most interesting biology papers last week were both about hard targets, which is where the useful signal usually is. AlloGen focuses on conformation-selective binder generation rather than binder affinity alone (preprint). That sounds narrow, but it gets to a real product distinction in AI biology. Plenty of systems can search for something that binds. Much fewer can search for something that binds the desired state and refuses the adjacent one. The authors report that their framework can identify binders that prefer the intended structural state and reject alternatives, and they back the computational result with experimental validation on calmodulin. ShallowBench makes a related move from the benchmarking side (preprint). It is built for shallow-pocket targets, the awkward territory where many generative drug-design models look weaker because the geometry is less accommodating. Their conclusion is sober: current state-of-the-art models show weaker predicted binding affinity on these low-concavity interfaces, and the field needs new architectures or loss functions for the hard cases. That is the kind of benchmark I trust more than a broad average. It makes the problem less flattering. Ingenix’s June 3 funding announcement sits neatly beside those papers (press release). The company raised a €13 million seed extension around what it calls a Biological Reasoning Engine and claimed that, in one oncology engagement, the system compressed work that had taken a partner biotech years into minutes. That is still a company claim, and it should be treated that way. Still, paired with AlloGen and ShallowBench, it suggests a market pattern worth watching. The capital is showing up around domain-specific reasoning on ugly biological search spaces instead of broad life-science copilot pitches. This is adjacent to Silmaril rather than central, but I would not ignore it. Biology keeps being an early market for AI systems that must combine long context, structured retrieval, and auditable decision paths. Those are close cousins of the control problems showing up in agent security. Policy moved into the execution path The commercial story last week centered on who is trying to own the control layer around agents. Cloudflare’s Agents SDK v0.14.0 shipped on June 2 with experimental Agent Skills, scheduled tasks, durable reasoning steps inside workflows, and a hardened chat-recovery path meant to survive deploys, evictions, and stalled model streams (product documentation). That is a meaningful shift in emphasis. The company is treating instructions, scheduling, recovery, and state continuity as first-class parts of the product rather than as scaffolding that customers are expected to bolt on themselves. Salt Security used the same week to launch Salt Code, which it describes as a way to enforce security policies inside AI coding assistants by discovering APIs, MCP servers, and agent integrations across repositories and cloud environments, then applying policy during code generation (press release). Noma launched Agent Access Control with explicit resource states of Approved, Requires Review, or Blocked, plus tool-level controls inside a single MCP server (press release). Netskope introduced AI Command Center to combine AI discovery, correlated risk intelligence, and an AI Risk AISecOps agent inside one platform (press release). Three different companies, three slightly different wedges, one clear market instinct. The buyer is no longer being pitched a content filter. The buyer is being pitched an operating plane that can discover agents, classify resources, constrain access, and route a response when something goes wrong. ZeroDrift’s $10 million seed round on June 2 sharpened that picture further (press release). The company calls itself a compliance firewall for AI and says the funding will accelerate deployments as enterprises try to govern AI communication at machine speed. The phrase is vendor language, but the demand behind it feels real. Regulated buyers are trying to compress the gap between policy writing and policy enforcement, especially when AI systems start speaking to customers or acting across business systems. The product implication for Silmaril is uncomfortable in a useful way. “Detection” will keep commoditizing. The harder surface, and likely the more durable one, is approval state plus action state plus evidence state. If a customer can see the resource, the policy, the tool invocation, and the reason the action was allowed or blocked, you are in the part of the market that is getting more expensive to displace. Ordinary bugs still decide real outcomes The security advisories last week were a useful corrective to all the agent theater. Google’s June Android Security Bulletin said the most severe issue was a critical vulnerability in the Framework component that could lead to remote escalation of privilege with no additional execution privileges and no user interaction (security advisory). Chrome’s June 2 stable desktop update fixed a stack of critical bugs, including use-after-free issues in Network, Chromecast, FileSystem, Cast, and graphics-related components, plus out-of-bounds flaws in ANGLE (security advisory). None of that is glamorous. All of it is the work that decides whether a production environment stays trustworthy. This matters for the market story because the control-plane vendors are selling into security organizations that already live under a patch-and-triage regime. If the agent layer adds more systems, more connectors, more long-lived credentials, and more automation without making patch response and rollback simpler, it will be treated as another exposure multiplier. The flashier the demo, the faster that question will come. There is also a quieter lesson in the release note from Microsoft Foundry Local. The page spends real space on timeouts, clearer error messages, and resource exhaustion protection. That is not accidental. The systems that survive contact with enterprises are the ones that make failure legible. Capital is rewarding workflow ownership Two funding announcements pushed the week’s commercial picture beyond pure security. AlphaSense announced a $350 million round at a $7.5 billion valuation and said it had surpassed $600 million in annual recurring revenue, while also introducing SuperAnalyst, an always-on agent for financial and strategic workflows (press release). You do not have to love the branding to take the market lesson seriously. Buyers will pay for an agent when it is attached to a narrow workflow with expensive information friction and a built-in standard for accuracy. A more sovereign version of that demand showed up in Innefu Labs’ June 5 Series B announcement (press release). The company, positioned around AI systems for defense, intelligence, and law-enforcement environments, said the new capital would support global expansion and deeper work on agentic AI, physical AI, and a sovereign stack for high-trust environments. Again, this is company framing. Still, it matches the pattern from Noma, Netskope, and ZeroDrift. The regulated edge of the market wants control, local context, and clear lines of authority. That is the GTM read I would carry into the week. The market is getting less patient with generic “AI platform” language. It is paying for systems that own a consequential workflow, prove control at the action boundary, and make the surrounding evidence easy to inspect. Operating close: the questions to keep active this week I would keep four things active. First, make judgment visible. AARRI-Bench and MemDreamer both suggest that reliability improves when the system’s retrieval and decision path are explicit enough to inspect, not when context is merely larger. Second, keep deployment budgets in the product story. RhinoVLA, COMPACT-VA, and Microsoft’s Foundry Local changes all point in the same direction. Real buyers care about bounded memory, bounded latency, and clear timeout behavior because those are the terms under which systems survive. Third, push the control layer all the way to the tool boundary. Salt, Noma, Netskope, and ZeroDrift are all circling access state, policy state, and coordinated response. If Silmaril can make those states legible with better provenance than the field, that is a stronger position than trying to win a race for the most generic notion of “guardrails.” Fourth, keep the patch muscle close to the AI story. Android and Chrome both showed last week that the old vulnerabilities still matter, and they will matter even more when agents sit on top of the same brittle substrate. That is the read for you this Monday. The field is getting more serious. It is also getting less forgiving. Sources https://arxiv.org/abs/2606.07462 https://arxiv.org/abs/2606.07512 https://arxiv.org/abs/2606.07383 https://arxiv.org/abs/2606.07464 https://arxiv.org/abs/2606.05474 https://arxiv.org/abs/2606.06717 https://developers.cloudflare.com/changelog/post/2026-06-02-agents-sdk-v0140/ https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/release-notes https://www.prnewswire.com/news-releases/salt-security-launches-salt-code-the-first-agentic-security-solution-to-enforce-security-policies-inside-ai-coding-assistants-302786506.html https://www.prnewswire.com/news-releases/noma-launches-agentic-access-control-to-govern-ai-agents-and-mcp-servers-across-the-enterprise-302788534.html https://www.globenewswire.com/news-release/2026/06/02/3305239/0/en/Netskope-Unveils-AI-Command-Center-Delivering-Comprehensive-AI-Discovery-and-Correlated-Risk-Intelligence-with-Fully-Coordinated-Agentic-Response.html https://www.globenewswire.com/news-release/2026/06/02/3305264/0/en/ZeroDrift-Raises-10M-Seed-Round-to-Build-the-Compliance-Firewall-for-AI.html https://source.android.com/docs/security/bulletin/2026/2026-06-01 https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html https://www.prnewswire.com/news-releases/ingenix-raises-13m-from-sofinnova-partners-led-syndicate-to-scale-modality-fusion-a-novel-architecture-for-drug-development-302789278.html https://www.globenewswire.com/news-release/2026/06/03/3305968/0/en/AlphaSense-Raises-350M-at-7-5B-Valuation-and-Surpasses-600M-in-Annual-Recurring-Revenue.html https://www.prnewswire.com/apac/news-releases/panthera-growth-partners-invests-usd-30-million-in-innefu-labs-series-b-round-302792309.html