Silmaril CTO Weekly

The Bulletin Amazon put a spending cap inside the agent loop this week. On August 18, AWS said Amazon Bedrock AgentCore payments is generally available, with agent wallets, short-lived payment tokens, payment sessions, deterministic spending limits, and observability for autonomous transactions (company post). The payment protocol matters because of the assumption under it: an AI agent can discover a paid service, decide it needs the service, and try to spend money inside the same task. That same week, AWS published natural-language policy authoring for Dogwood, an open-source governance language used by AgentCore Policy to restrict agent actions across time, tool sequence, parameters, and cumulative effects (company post). Three days later, it described AgentCore Gateway as the governed entry point for agents using internal tools, with identity, policy, guardrails, registry, and logs wrapped around Model Context Protocol traffic (company post). GitHub moved Copilot deeper into team chat, bringing agent sessions to Slack and Microsoft Teams in public preview, while also giving JetBrains administrators managed controls for plugins, MCP servers, OpenTelemetry, and permission-bypass behavior (product documentation). OpenAI supplied the urgency. Greg Brockman wrote on August 17 that the OpenAI-Hugging Face incident showed AI models could participate in autonomous penetration of research and production infrastructure, and he urged organizations to put capable agents into defensive workflows now (company post). CISA's exploited-vulnerability feed put hard names underneath that warning. It added a Ray code-injection issue on August 17 and an MLflow server-side request forgery issue on August 19, both in AI infrastructure rather than ordinary office software (government advisory). NVD's MLflow record says an unauthenticated webhook-test endpoint before version 3.15.0 validated only the original URL while the delivery path followed redirects and re-resolved hostnames, allowing access to internal or cloud metadata services (government vulnerability record). Research filled in the measurement problem. New arXiv papers proposed stage-level diagnostics for agent memory, long-horizon benchmarks where agents manage a football club for 20 simulated years, memory-based compression for chain-of-thought reasoning, conditional safety adapters that try to preserve benign utility, and kernel-checked machine verification from application code down to silicon (preprints). Deep-tech sources pointed the same way from another angle: quantum circuits, topological materials, and microgravity fabrication are advancing only where measurement and control are tight enough to trust. The week touched payments, team collaboration, policy, memory, cyber defense, software vulnerabilities, physical AI compute, and quantum hardware. The common object was authority. Agents are being handed more of it. The companies that win the next buyer conversation will show exactly where that authority starts, where it stops, and what record survives after the action. Money Enters the Agent Path AgentCore payments is useful because it turns an abstract trust debate into a ledger problem. AWS says the service lets developers equip agents to pay for APIs, MCP servers, and content through Coinbase and Stripe Privy wallets. The user funds the wallet and grants delegation. AgentCore stores developer credentials in its Identity Secrets Manager, gives the agent short-lived tokens instead of raw credentials, and checks each requested payment against a session budget before signing. For a public product category, that is a clean vocabulary. A payment session is a scoped context for one interaction, with a maximum spend amount and an expiry time. If the agent retries, misreads a response, or attempts to buy more than the session allows, the infrastructure layer rejects the spend. The product implication for you is that "agent action" is becoming too broad a unit. Silmaril should keep separating the action type from the authority grant: read, write, transfer, execute, message, buy, deploy, delete. The use cases in the AWS post are also a preview of customer confusion. Agentic web search, browser automation, model routing, travel booking, financial research, paid content, pay-per-inference, and MCP endpoints are all treated as forms of transaction. That may be right at the protocol layer, but a security buyer will see different risks. Paying a few cents for a document is different from booking travel or calling a paid model that can see customer data. A strong policy layer needs object-level distinctions the agent cannot smooth over. That is why the Dogwood launch belongs in the same story. AWS describes policy authoring as a translator from written rules into formal specifications, using the tool schema from an MCP manifest so generated policies refer to the same tool names the agent actually calls. In the bank example, rules can require identity verification before a transfer, cap refunds, enforce business hours, and examine previous actions in the same session. The most useful sentence for your week is buried in that mechanism: the policy language can inspect both the current call and what already happened. Silmaril's opportunity is to make that temporal record legible without turning the interface into a compliance workbook. A decision artifact should answer four questions quickly. Who or what is acting. Which tool, account, tenant, or data object is involved. Which prior step changed the authorization state. Which policy blocked, allowed, or escalated the action. AWS is making the cloud control plane heavier. You can make the explanation sharper. The Collaboration Layer Became a Control Plane GitHub's Slack and Teams releases make agent work social, which also makes it harder to hide. In Slack, the GitHub integration can start a Copilot session from a direct message, channel, or thread. It can answer questions about code activity, triage bug reports, update or create issues, investigate failures, implement changes in a secure cloud sandbox, open a pull request, and link back to the originating conversation (product documentation). In Teams, the pattern is similar: a channel can start and steer a cloud agent session, and people with repository write access can trigger code changes (product documentation). The approval detail is the product news. GitHub says repository administrators can require an additional approval for pull requests attributed to the Copilot app identity, or to the Microsoft Teams Copilot integration identity, before merge. This is ordinary software governance adapting to an agent that begins in a chat room. The action may be initiated by one person, shaped by a group conversation, executed by an agent, reviewed in a pull request, and merged under repository policy. That path creates a new audit problem. The source of intent is no longer just an issue body or a ticket. It may be a messy chat thread with participants entering, leaving, clarifying, and redirecting the task. GitHub's product shape teaches buyers that agent provenance includes the request context, the identity under which the agent acts, the sandbox where it worked, the code review path, and the extra human approval attached to the agent-created change. GitHub's JetBrains managed-settings release is the quieter version of the same move. Administrators can now govern plugin marketplaces, allow or deny MCP servers, configure OpenTelemetry, and prevent the Copilot agent from using Bypass Approvals or Autopilot in JetBrains IDEs (product documentation). That turns the developer desktop into a managed agent surface. The local assistant is no longer just a personal productivity tool. It is a place where enterprise policy reaches plugins, servers, telemetry, and permission modes. For Silmaril, this argues against positioning around generic prompt filtering. The natural demo path is an agent that starts in collaboration software, reaches code and tools through ordinary permissions, and is stopped or allowed because the action crossed a specific authority boundary. The product should show how the same user request looks when it is a chat instruction, a tool call, a code diff, and an approval event. Cyber Defense Met AI Infrastructure OpenAI's August 17 post reads like a rallying memo, but it carries a concrete operating claim. Brockman says almost all of OpenAI's initial security alerts are now triaged by intelligence before humans are looped in, and that the company is connecting detections to bounded automated responses while reserving the highest-impact decisions for people (company post). He also describes asking ChatGPT Work to assess and then fix his personal website, including DNS, TLS, old jQuery, and DMARC configuration. Treat the anecdote as company narrative, not independent benchmark evidence. Still, it shows how OpenAI wants the market to imagine defensive agents: find the long tail of security work, prioritize it, and produce safe patches or configuration changes faster than a human team could. CISA's week shows why that pitch lands. On August 17 it added one known exploited vulnerability to the KEV catalog, Ray-Project Ray code injection. On August 18 it added four more across Microsoft IKE, VMware vCenter, Microsoft SharePoint, and Apple macOS. The AI-specific item is Ray. NVD says Ray is an AI compute engine and describes a browser-exploitable RCE path against developers using Ray before 2.52.0, involving DNS rebinding and insufficient protection based on the User-Agent header (government vulnerability record). The MLflow issue is even closer to agent infrastructure. NVD says MLflow is an open-source AI engineering platform for agents, LLMs, and machine learning models. The affected endpoint was unauthenticated. The validation path checked the first URL, while the delivery path followed redirects and re-resolved hostnames. That is a classic SSRF shape, but in the agent era it sits next to experiment tracking, webhook delivery, model operations, traces, and cloud metadata. CISA added it to KEV on August 19 with active exploitation listed in the NVD change history. MLflow's own July 31 release notes for 3.15.0 give the defender read more texture. The same release that fixes the vulnerability also adds an MCP Registry, assistant support for Claude Code, Codex, and OpenAI-compatible gateways, per-session token usage and estimated cost, multimodal attachments in LLM judges, per-endpoint budget policies in the AI Gateway, trace UI fixes, and multiple authorization or tracing repairs (GitHub release). AI infrastructure is adding agent features and security-critical surface at the same time. That is a useful GTM wedge. AI security buyers may understand prompt injection, but they are now staring at SSRF in model platforms, local developer RCE in AI compute engines, MCP credentials in config files, cloud metadata exposure, and agents with payment privileges. The sharper pain is the pace at which AI infrastructure mixes old web vulnerabilities with new authority paths. Memory and Verification Got More Measurable The AI research spine this week is about making agent behavior measurable across time. D2ACCI, a preprint submitted on August 18, argues that persistent memory failures are hard to localize because ingestion, retrieval, filtering, and generation all sit between the stored fact and the final answer. The authors propose a dual-loop diagnostic protocol with paired evidence, protected-slice monitoring, trace-level localizability, and a graded observability metric. The paper does not solve memory. It gives memory changes a gate: promote, feature-flag, or reject them based on evidence from each stage. FM-Bench, submitted August 19, makes a neighboring move for long-horizon agents (preprint). An LLM agent runs a football club for 20 in-game years through 26 tools and roughly 340 to 400 decision stops. It drafts a squad, trades players, negotiates contracts, invests in facilities and youth, chooses lineups, and can be fired by a board. The scoring engine is deterministic, with no LLM judge or human rater. Strip away the sports wrapper and the evaluation object is serious: cumulative action, limited budgets, competing agents, consequences that arrive later, and a final score that does not depend on another model's taste. Memory-Augmented Compression, posted August 21, attacks inference overhead from another angle (preprint). The paper argues that reusable reasoning memories can stand in for some generated chain-of-thought tokens by retrieving summaries of reasoning patterns, constraints, and critical operations as prefill-side scaffolds. For Eduardo, this belongs in the same bucket as Qwen and one-token classifier work. Claims about fewer generated tokens need a careful accounting of what moved into context, what still has to be decoded, and whether the retrieved memory is reliable under distribution shift. CLEAR, another August 21 preprint, proposes conditional safety adaptation through a lightweight hidden-state gate that controls the activation strength of a safety LoRA adapter. The authors report lower attack success on HarmBench with less benign-utility loss than globally applied safety tuning in their experiments. It is a preprint, and benchmark performance will not automatically translate to production traffic. The architecture is still worth tracking because it treats safety strength as conditional rather than uniformly smeared across every prompt. AI with Authority, posted the same day, is the most provocative research object in the set (preprint). The paper reports that one researcher, using consumer AI subscriptions, directed agents from application code through a verified compiler and executive to a RISC-V processor taped out on a community silicon shuttle, with mathematical claims moving as kernel-checked artifacts rather than prose that humans inspected line by line. The claim needs ordinary community scrutiny. The operating idea is still sharp: if agents are going to move faster than review teams, the artifact that grants trust may need to be machine-checkable. The research read for Silmaril is concrete. Do not let "trace" become a decorative noun. A trace should localize memory failure, expose tool and policy state, preserve budget and authority changes, and contain enough machine-checkable structure that a customer can replay the decision without trusting the model's explanation. Deep Tech Was a Control Story Too The deep-tech sources came from outside AI security, and they kept pointing at the same discipline. Scientific Reports published a paper on August 17 describing a quantum-computing-driven digital twin for energy and timing optimization in low-power VLSI circuits and IoT devices (peer-reviewed). Its domain is chip design rather than agent safety. The shape is familiar: optimization claims are useful only when the model has to answer to timing, energy, and device constraints. An August 21 quantum cryptography preprint proposed eavesdropper-blind remote state preparation and applications to quantum public-key encryption. The relaxed adversarial model protects against external observers who see the protocol transcript, rather than the quantum server itself. The paper is technical and early, but the distinction is useful. Threat models get weaker or stronger depending on who is assumed to observe which state. Materials and fabrication gave the week's physical version of that lesson. A preprint on microgravity-assisted liquid shaping describes using liquid self-organization in microgravity as a design and fabrication principle for minimal-surface structures. The workflow moves from simulation to a neutral-buoyancy setup that imitates microgravity, with a flight validation still part of the path. A separate materials thread in the week looked at topological and low-power device structures. Both belong in the "watch, do not overclaim" folder. The startup source made the infrastructure pressure visible. Velaura AI announced a $110 million Series A at a valuation above $1 billion to commercialize ultra-low-power AI compute, including its Titan Core silicon platform (press release). The company claims a 2 to 4 times performance-per-watt improvement for mathematical operations in AI accelerators and says related technology has shipped in more than 30 million ASICs. Wispr Flow announced a $280 million Series B at a $2 billion valuation, tied to voice interfaces, dictation, and meeting workflows (company post). One is about power. The other is about input surface. Both are reminders that model capability is spreading into physical constraints and everyday workflows at the same time. For product planning, the deep-tech lesson is restraint. A demo that claims universal agent security will sound thin next to this evidence. A demo that shows one well-scoped authority path, one replayable policy decision, and one real failure mode will travel better. Monday Operating Close Carry three decisions into the week. First, make agent spending, tool access, and code changes first-class action types in the product model. AWS is putting budgets and payment sessions into infrastructure. GitHub is putting agent-created work into Slack, Teams, sandboxes, and pull requests. Silmaril should avoid collapsing those into one allow or block label. Second, treat AI infrastructure vulnerabilities as part of the buyer story. Ray and MLflow are not side notes. They show that agent and model platforms inherit web security problems while adding new tool, trace, and credential surfaces. The strongest public language is specific: which component, which authority, which affected version, which control prevents recurrence. Third, turn research into evaluation discipline. D2ACCI, FM-Bench, CLEAR, Memory-Augmented Compression, and AI with Authority all ask for stronger evidence than a final answer. For Silmaril, the useful artifact is the one Eduardo can put in front of a buyer or engineer and say: here is the state before the agent acted, here is the rule, here is the action it tried, here is the decision, and here is the proof that the record is not just a story told after the fact. Sources OpenAI, "The Defender's Window," August 17, 2026. https://openai.com/index/the-defenders-window/ AWS, "Amazon Bedrock AgentCore payments is now generally available: Enabling agents to transact safely and autonomously at scale," August 18, 2026. https://aws.amazon.com/blogs/machine-learning/amazon-bedrock-agentcore-payments-is-now-generally-available-enabling-agents-to-transact-safely-and-autonomously-at-scale/ AWS, "Authoring Dogwood policies from natural language in Amazon Bedrock AgentCore," August 20, 2026. https://aws.amazon.com/blogs/machine-learning/authoring-dogwood-policies-from-natural-language-in-amazon-bedrock-agentcore/ AWS, "Govern AI agent tool access with Amazon Bedrock AgentCore Gateway," August 21, 2026. https://aws.amazon.com/blogs/machine-learning/govern-ai-agent-tool-access-with-amazon-bedrock-agentcore-gateway/ GitHub, "Enterprise managed settings in GitHub Copilot for JetBrains," August 18, 2026. https://github.blog/changelog/2026-08-18-enterprise-managed-settings-in-github-copilot-for-jetbrains/ GitHub, "The new GitHub Copilot experience in Slack," August 21, 2026. https://github.blog/changelog/2026-08-21-the-new-github-copilot-experience-in-slack/ GitHub, "Shared agentic work with GitHub Copilot in Microsoft Teams," August 21, 2026. https://github.blog/changelog/2026-08-21-shared-agentic-work-with-github-copilot-in-microsoft-teams/ CISA, "CISA Adds One Known Exploited Vulnerability to Catalog," August 17, 2026. https://www.cisa.gov/news-events/alerts/2026/08/17/cisa-adds-one-known-exploited-vulnerability-catalog CISA, "CISA Adds Four Known Exploited Vulnerabilities to Catalog," August 18, 2026. https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog NVD, "CVE-2026-64849 Detail," August 17, 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-64849 NVD, "CVE-2025-62593 Detail," August 12, 2025, CISA KEV update August 17, 2026. https://nvd.nist.gov/vuln/detail/CVE-2025-62593 MLflow, "v3.15.0," July 31, 2026. https://github.com/mlflow/mlflow/releases/tag/v3.15.0 Noa Mendel et al., "D2ACCI: A Dual-Loop Diagnostic Protocol for Evidence-Preserving Agent Memory," August 18, 2026. https://arxiv.org/abs/2608.17756 Nicholas J. Cochrane et al., "FM-Bench: A Benchmark for Long-Horizon Management with Competing Agents," August 19, 2026. https://arxiv.org/abs/2608.18423 Yuyang Zhang et al., "Memory Augmentation Unlocks Efficient Chain-of-Thought Reasoning," August 21, 2026. https://arxiv.org/abs/2608.21265 Haochen Liu et al., "CLEAR: Continuous Latent Adapter Routing for Utility-Preserving LLM Safety Alignment," August 21, 2026. https://arxiv.org/abs/2608.21278 Ben L. Titzer, "AI with Authority, from Application to Silicon," August 21, 2026. https://arxiv.org/abs/2608.21356 Md Manan Mujahid and Deepa Jose, "Advanced quantum computing-driven digital twin for energy and timing optimization in low-power VLSI circuits and IoT devices," August 17, 2026. https://www.nature.com/articles/s41598-026-65003-8 Hanzhi Liu et al., "Eavesdropper-Blind Remote State Preparation and Applications to Quantum Public-Key Encryption," August 21, 2026. https://arxiv.org/abs/2608.21241 K. G. Makris et al., "Shaping liquids into space structures - microgravity-assisted design and manufacturing of minimal surfaces," August 21, 2026. https://arxiv.org/abs/2608.21190 Velaura AI, "Velaura AI Raises $110 Million Series A to Advance the Next Generation of Ultra-Low-Power AI Compute Infrastructure," August 18, 2026. https://www.businesswire.com/news/home/20260818925932/en/Velaura-AI-Raises-%24110-Million-Series-A-to-Advance-the-Next-Generation-of-Ultra-Low-Power-AI-Compute-Infrastructure Wispr Flow, "Our Series B, and what it means for you," August 17, 2026. https://wisprflow.ai/post/series-b