Silmaril CTO Weekly

GitHub made a quiet administrative field matter this week. Copilot usage reports now count activity inside the dedicated VS Code Agents window, and enterprise owners can see who used that agent surface. That sounds like billing plumbing until you put it beside the rest of the week: GitHub also gave administrators centrally managed permissions for Copilot agent operations, shipped an enterprise sandbox for JetBrains, expanded code review agents with shell tools, and pushed agentic autofix deeper into code quality workflows. The week was full of larger announcements, including OpenAI's public beta for the Agents API and Cloudflare's Codex-on-Containers reference path. But the practical read for you starts with that usage metric. Agent activity is becoming a managed enterprise workload. Once it is visible in reports, governed by policy, billed, sandboxed, and reviewed, the buyer conversation changes. The question is no longer whether a model can help with work. It is whether the organization can prove who let the agent act, which environment it acted in, what evidence it used, and where the intervention record survives. The Agent Became An Enterprise Object OpenAI introduced the Agents API on September 10 (company post), bringing the Codex harness and long-running agent infrastructure into a public beta for developers. The pitch is direct: create a cloud agent with a task, model, tools, and environment, then let it keep working across long sessions, use MCP tools, coordinate subagents, and save evidence. The customer quotes are useful because they are operational rather than abstract. Ciridae claims a 0.71 to 0.85 evaluation lift and a 4x latency reduction from subagent support. SafetyKit says its migrated case-review workflow cut cost per case by 60%. Nash describes thousands of long-running agents managing delivery workflows across global logistics networks. For Silmaril, that is the important placement. OpenAI is selling the harness as production infrastructure, while leaving the customer or partner to supply the tools, execution environment, and business context. That creates a familiar split of responsibility. OpenAI can keep a session durable, compact context, and orchestrate subagents. The enterprise still needs to decide which tools are allowed, what counts as sufficient evidence, which resources an agent can touch, and how the final record can be defended later. GitHub moved on the same surface from the developer-platform side. Enterprise managed permissions for Copilot agent operations (product documentation) let administrators centrally block, require approval for, or allow shell commands, file reads and edits, and network domains. The policy cannot be weakened by user settings, workspace settings, auto-approval, or old approvals. A day earlier, GitHub shipped an enterprise-managed sandbox for Copilot in JetBrains (product documentation), with managed settings for filesystem access, network access, proxies, developer tools, and macOS Keychain access. That feature set maps the powers that matter when a coding agent becomes real. File reads, file edits, shell, network, credentials, and persistent approvals are the places where helpful work becomes consequential action. The product implication is sharp: Silmaril should keep its language around the action boundary. A policy that says "this shell command required approval because it touched this resource under this tenant rule" is more valuable than another generic claim about detecting unsafe prompts. GitHub's code review update (product documentation) adds a second angle. Copilot code review now uses a broader set of shell tools behind the Copilot agent firewall, and Lite reviews use an ensemble of agents. GitHub reports more high-severity findings and fewer nits in experiments, plus higher addressed-comment rates for high and medium severity findings. That makes agentic review more useful, but it also makes review itself an executed workflow. The review agent can run builds, tests, targeted scripts, and tools. Once review evidence is generated by an agent with its own permissions, the audit record needs the comment, command, observation, policy, and repository state behind it. Controls Moved Down Into Workflows OpenAI's GPT-6 Astra work post (company post) continued last week's model story, but the new emphasis was operational adoption. OpenAI says Astra is available in ChatGPT Work, Codex, and the API, and frames it as a model for complex professional work across software engineering, cybersecurity, science, document understanding, and computer use. The customer quotes matter less as endorsements than as category signals. Cognition says it is integrating Astra into Devin's harness for testing. CodeRabbit says Astra catches more bugs and backs findings with verification steps. Basis says end-to-end proactive workflows lasting more than five hours improved their pass rate by 20%. The common thread is longer chains of delegated work. When an agent writes code, tests it, opens a pull request, resolves review comments, or monitors production, the security product has to follow the chain across stages. GitHub's AI Scan for pull request APIs (product documentation) also fits here. The preview lets teams read and update AI-powered pull-request security detections at organization and repository levels. It gives security leaders a rollout and governance control for AI detections without relying on one repository owner at a time. Cloudflare supplied the infrastructure echo. Its September 10 Containers changelog (product documentation) says Cloudflare Containers can provide self-hosted execution environments for the OpenAI Agents API through an open-source Workers template. The Worker keeps a Container per Codex session, lets active work continue, reconnects on follow-up input, and shuts down when idle. One day later, Cloudflare's voice agent package gained typed per-turn metrics (product documentation) with terminal outcomes such as completed, no output, output limit, content filtered, model error, text-to-speech error, or aborted, plus timings across transcript, model, first audio, and total turn duration. That pairing is easy to miss. Cloudflare is adding measurement around agent execution and a deployable substrate for third-party agent sessions. For you, the useful read is that every platform with compute, identity, logs, and gateway placement will try to own some version of the agent control plane. The opening for Silmaril remains the narrow proof that the agent crossed from reasoning into action under a tenant-specific rule, and that the evidence survives in a form an operator can inspect. OpenAI's GPT-Live-1 API launch (company post) adds one more wrinkle. Voice agents can now listen and speak at the same time, handle interruptions, delegate reasoning and tool calls to a backend model, and run in telephony workflows. In evaluations, OpenAI says GPT-Live-1 improved Full Duplex Bench by 30 percentage points over GPT-Realtime-2.1, and Speak saw interruptions fall by almost 80% versus earlier turn-based systems. Voice sits outside your core surface today, yet it shows where tool authority is going. The action request may arrive in a noisy, interrupted conversation with a customer, employee, or operator rather than as a clean typed instruction. The runtime record has to preserve intent when the interface itself is fluid. Research Kept Asking For Evidence, Not Just Answers The research week lined up cleanly with the product news. "Sci-MMR" (preprint) introduces 235 multi-hop tasks for multimodal scientific agents, built around structured argument graphs that connect claims, citations, visual evidence, and figure regions. The authors report that answer accuracy exceeded complete-evidence recovery by more than 20 percentage points. They attribute most failures to evidence acquisition from scientific figures, and show that giving models gold evidence can improve accuracy by up to 37 points. That result is directly useful for Silmaril's eval posture. If a model can land the answer while missing the evidence, a security control can also land a verdict while losing the reason it should be trusted. Answer-only benchmarks overstate capability in exactly the place an enterprise auditor will care about. The product proof should make the retained evidence visible as the object that decides whether the claim can be recomputed, rather than treating logs as decoration. "ClaimReceipt" (preprint), submitted just before the source window and still worth keeping as context, puts a protocol around that problem. It separates evidence sufficiency from coverage, binds typed transaction evidence to a signed experiment manifest, and returns PASS, INVALID, or INCONCLUSIVE per claim. Since it is older than this week's window, it should not carry the story alone. It still gives the right vocabulary for what this week's agent platforms are missing. Transcripts, hash chains, and committed universes of expected evidence answer different questions. "SIRF" (preprint) brings the same pressure to risk classification. The authors describe a spec-internalized risk model for industrial content risk control, where policies are internalized through continued pretraining and deployed as low-latency verdicts. They report 71.3% Black Recall at P95 precision, a 15.1 point gain over a same-interface baseline, and a tree-model adjudication layer that recovers 20% more mis-penalized samples. The paper reads less like an AI firewall product claim than a reminder that high-volume policy systems will trade explainability, latency, and rule freshness differently depending on where the model sits. The danger for Silmaril is to over-claim interpretability where a faster policy model only emits verdicts. The opportunity is to distinguish policy execution from policy evidence. A fast verdict can be useful. A runtime control product still needs to say which policy applied, which fact pattern triggered it, which user or agent held authority, and what would have changed the outcome. COBRA-Skills (preprint) and "Memory Compression for High-Fanout Agent Sandboxes" (preprint) made the agent-infrastructure point from two sides. COBRA-Skills treats reusable agent skills as an optimization problem and reports 55 to 58% lower optimization cost than a prior method while using only 50 unique optimization examples per benchmark. AgentZip targets the systems cost of many concurrent sandbox sessions, reporting up to 8.7x reduction in sandbox-owned memory and lower slowdown through restore prefetching and scheduling around LLM waiting periods. These are early preprints rather than procurement facts. Together they suggest agent fleets will become cheaper to tune and cheaper to run. That usually expands usage before governance catches up. If the marginal agent becomes inexpensive, the number of agent attempts grows, and with it the number of borderline actions that need clean attribution. The Physical World Kept Pulling Agents Out Of The Screen OpenAI's quantum-computing case study (company post) is the best deep-tech example of the week because it describes agent work against real instrumentation. A MIT researcher connected GPT-5.6 Sol through Codex to lab software for superconducting-qubit experiments. OpenAI says the agent could often run routine measurements, analyze results, refine parameters, and save results for later measurements with little intervention. The hard cases were weak or noisy signals, where expert steering was still needed. That caveat matters. Agents can move faster through well-defined workflows, while ambiguous physical evidence remains hard. The parallel for Silmaril is that clean policy surfaces are rare in production. Logs are partial, permissions are inherited, user intent is fuzzy, and observations can conflict. A runtime product needs to be best when the available signal is too messy for blind automation. The antimicrobial discovery case study (company post) sits beside it. OpenAI describes Cesar de la Fuente's lab using ChatGPT and Codex to brainstorm hypotheses, write and refine code, process datasets, analyze results, and connect ideas while searching genomes and protein datasets for candidate antimicrobial molecules. The source is an applied AI story, so it should be weighted as a company-reported use case, not peer-reviewed validation. Still, it shows the direction of travel: scientific AI agents are becoming workflow participants rather than standalone answerers. Power and hardware research supplied the infrastructure underside. "Characterizing Job Power Elasticity for Power-Flexible AI Training" (preprint) studies 131 H200 training runs, 24 H200 validation runs, and 34 matched H100 runs, then introduces a Power Flexibility Index for how training throughput changes when GPU power is reduced. Under a 30% power reduction, the authors report that PFI-aware allocation recovers about 1.5k tokens per second per job, 63% of the gap between equal allocation and an oracle. "Bio-inspired Learning and Decision-Making with Probabilistic In-Memory Computing Hardware" (preprint) argues for probabilistic analog in-memory hardware as a substrate for scalable uncertainty-aware inference. The week-ahead read is that deep tech is making agent operation more tied to power, hardware, lab software, and specialized workflows. Security for agents cannot stay at the SaaS prompt layer if the agent is operating equipment, scheduling compute under power limits, or coordinating multi-hour experimental loops. Exploitation Stayed Ordinary, Which Is The Point CISA's Known Exploited Vulnerabilities feed (security advisory) added actively exploited issues inside the September 7-13 window, including ConnectWise ScreenConnect entries on September 11. Cloudflare's September 10 emergency WAF release (security advisory) added immediate edge-level mitigation for an actively exploited Adobe Commerce and Magento Open Source RCE, and its September 8 WAF update moved Next.js RCE detections from beta log posture into baseline block signatures. This is the less glamorous part of the week, and it is where the buying urgency lives. Agent security sits alongside patching, virtual patching, exposure management, and secret protection. GitHub's September 9 ruleset update (product documentation) lets organizations block pull requests from merging when new secret scanning alerts remain open. That straightforward control becomes more important when agents generate branches, apply fixes, and open PRs at higher volume. For Eduardo, the operating read is to keep Silmaril's story attached to the workflows security teams already run. When a coding agent touches a repository, the customer still needs secret scanning, code scanning, review evidence, and merge policy. When an operations agent touches a production surface, the customer still needs identity, approval, observability, and rollback. The AI-specific layer records how the agent was allowed to use those controls. The Week's Working Read Carry three things into the week. First, platform competitors are converging on agent governance from their home turf. GitHub owns source and developer policy. Cloudflare owns execution, network, gateway, and observability placement. OpenAI owns model and harness language. Each can make a plausible claim to "agent control" without solving tenant-specific action accountability end to end. Second, the research literature is moving from final answers toward evidence recovery, disagreement handling, policy internalization, skill optimization, and sandbox efficiency. That favors Silmaril if the product proof is concrete. Show retained evidence, action authority, and policy effect under intervention. Avoid broad "safe agents" language when the stronger claim is narrower and more defensible. Third, the GTM message should treat agent adoption as an enterprise operations problem, not a novelty. Agents are being counted in usage reports, governed by managed permissions, run in containers, monitored per turn, connected to lab instruments, and assigned code-quality backlogs. The customer question is simple enough to fit in one demo: when this agent tried to act, who allowed it, what evidence did it have, and can we prove that after the fact? Sources OpenAI, "Introducing the Agents API": https://openai.com/index/introducing-the-agents-api/ OpenAI, "GPT-6 Astra: The next generation in intelligence for work": https://openai.com/index/gpt-6-astra-next-generation-work/ OpenAI, "Build more natural voice experiences with GPT-Live-1 in the API": https://openai.com/index/introducing-gpt-live-1-in-the-api/ OpenAI, "Rapidly scaling online storage to serve over 1 billion ChatGPT users": https://openai.com/index/scaling-storage-one-billion-users-part-one/ OpenAI, "How GPT-5.6 Sol helps run quantum computing experiments": https://openai.com/index/codex-quantum-computing-experiments/ OpenAI, "How a researcher uses Codex and ChatGPT to search for new antimicrobial molecules": https://openai.com/index/using-codex-chatgpt-to-search-for-new-antimicrobials/ GitHub, "Add VS Code Agents to Copilot usage metrics": https://github.blog/changelog/2026-09-11-add-vs-code-agents-to-copilot-usage-metrics/ GitHub, "Enterprise managed permissions for GitHub Copilot agent operations": https://github.blog/changelog/2026-09-09-enterprise-managed-permissions-for-github-copilot-agent-operations/ GitHub, "Enterprise-managed sandbox in Copilot for JetBrains": https://github.blog/changelog/2026-09-08-enterprise-managed-sandbox-in-copilot-for-jetbrains/ GitHub, "Auto-resolution and analysis updates in Copilot code review": https://github.blog/changelog/2026-09-11-auto-resolution-and-analysis-updates-in-copilot-code-review/ GitHub, "AI Scan for pull request APIs in public preview": https://github.blog/changelog/2026-09-10-ai-scan-for-pull-request-apis-in-public-preview/ GitHub, "Block pull requests with exposed secrets from merging": https://github.blog/changelog/2026-09-09-block-pull-requests-with-exposed-secrets-from-merging/ Cloudflare, "Changelog": https://developers.cloudflare.com/changelog/ CISA, "Known Exploited Vulnerabilities Catalog JSON": https://www.cisa.gov/sites/default/files/feeds/knownexploitedvulnerabilities.json Li et al., "Sci-MMR: Benchmarking Multi-Step Evidence-Grounded Scientific Reasoning in Multimodal Agents": https://arxiv.org/abs/2609.11243 Wu et al., "SIRF: A Spec-Internalized Risk Foundation Model for Industrial Content Risk Control": https://arxiv.org/abs/2609.11752 Lu et al., "COBRA-Skills: Contextual Bandit-Guided Evolution for Agent Skill Optimization": https://arxiv.org/abs/2609.11682 Li et al., "Memory Compression for High-Fanout Agent Sandboxes": https://arxiv.org/abs/2609.11294 Colangelo et al., "Characterizing Job Power Elasticity for Power-Flexible AI Training": https://arxiv.org/abs/2609.11542 Dalgaty et al., "Bio-inspired Learning and Decision-Making with Probabilistic In-Memory Computing Hardware: Part 1": https://arxiv.org/abs/2609.11281 Ge et al., "MindTopo: Can Foundation Models Reason in Topological Space?": https://arxiv.org/abs/2609.11900 Chen et al., "When Agents Disagree: Bayesian Backward Reasoning as a Label-Free Anchor for Multi-Agent Collective Decision-Making": https://arxiv.org/abs/2609.11709 Zhu and Chang, "ClaimReceipt: Verifying Evidence Sufficiency and Coverage in Agent Evaluations": https://arxiv.org/abs/2609.01992