Silmaril CTO Weekly

Good morning, Eduardo. It is Monday, June 29. The sharpest object from last week was a boundary drawn around an agent's hand. OpenAI previewed GPT-5.6 Sol (company post), a model family it says is better at long-horizon software and research work. At almost the same time, researchers posted papers arguing that prompt injection cannot be perfectly solved inside a shared language stream (preprint), that agent actions need deterministic checks outside the model (preprint), and that tool-using systems leak privacy across multi-step trajectories unless purpose is enforced along the way (preprint). The week was useful because capability and control arrived in the same frame. In the bulletin: agent platforms moved toward bigger planning loops, papers moved toward action gates and policy-as-code, CISA kept adding exploited software flaws to the public catalog, robotics researchers showed how embodied systems deal with uncertainty and stale memory, and AI-security money kept concentrating around evaluation and agent oversight. The read for you is operational. Buyers are going to ask less whether an agent sounds aligned and more whether a specific read, memory update, tool call, or pull request can be seen, scored, stopped, and reconstructed. The Model Can Reach Further OpenAI's GPT-5.6 Sol preview (company post) is the capability story to treat carefully this week. The public post frames the release around stronger sustained reasoning and software work. For Silmaril, the immediate consequence is less about any one benchmark and more about the length of the loop. A model that can hold a software task together for longer can also travel through more repositories, tickets, logs, browser pages, and credentials before a human sees the final result. AWS supplied a quieter platform-side companion with its June 25 post on building agentic AI applications with a modern data-mesh strategy (company post). The architecture puts agents against governed enterprise data products rather than loose piles of documents. That is the enterprise adoption path: agents will be given more useful context because the data layer is being packaged for them. Once that happens, the security question moves from "can the chatbot answer" to "which governed object did the agent read, why was it allowed, and what action did that information enable." The research stream made the same shift more explicit. Towards Evaluation of Implicit Software World Models in Coding LLMs (preprint) asks whether coding models understand software behavior beyond control flow. Temporal Validity in Retrieval Memory (preprint) studies agents retrieving stale facts when APIs or functions change. Those failures show up when a coding agent patches the wrong interface because the memory layer served a superseded fact, or when a model passes a unit test while misunderstanding the system behavior that matters. The useful product implication is narrow. If Silmaril wants to meet the week where it is, the demo should go past "agent detected risk" and show the agent reading a concrete data object, carrying a memory forward, deciding on a tool call, and leaving a record that explains the action in terms the user can audit after the fact. The Defense Moved Outside The Sentence Several papers posted during the window gave language to a claim Silmaril already needs to make plainly. On the Inseparability of Instructions and Data in Shared-Embedding Sequence Models (preprint) argues that perfect prompt-injection prevention is impossible when instructions and untrusted data occupy the same embedding stream without enforced separation. Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents (preprint) starts from a related premise and tests the current family of defenses that mediate agent actions outside the model. That pair matters because it turns "prompt injection" from a model-personality problem into a systems problem. The correct surface is a boundary. The model can be helpful, but a separate component must know which text is data, which text is authority, which tool is being requested, and whether the request fits the user's policy. Autoformalization of Agent Instructions into Policy-as-Code (preprint) takes another step in that direction by translating natural-language agent instructions into formal policy checks. VIGIL (preprint) focuses on runtime enforcement for third-party agent skills, where natural-language specifications describe permissions, disclosure limits, and preconditions. Those papers are early and should be treated as preprints, but they are commercially useful because they point to a buyer-readable architecture. The policy should compile into something inspectable beyond the prompt. The check should run at the point where a file, API, database, browser, or shell command is about to be touched. ToolPrivacyBench (preprint) adds the privacy lens. The authors argue that conventional function-calling benchmarks miss purpose-bound information flow across executed tool trajectories. That phrase is dense, but the practical example is simple: an agent may have permission to call two tools separately and still violate policy by carrying information from one purpose into another. That is a strong Silmaril wedge. Tool permission alone is too coarse. The control has to follow the purpose and the path. Red Teams Are Becoming Benchmarks The hacking side of the week was dominated by agent evaluation work rather than one splashy disclosure. RIFT-Bench (preprint) proposed dynamic red-teaming for agentic AI systems. Red-Teaming the Agentic Red-Team (preprint) examined offensive agents themselves as systems that can be attacked. MIRROR (preprint) used memory-guided search for agentic RAG red-teaming across text poisoning, image injection, direct queries, and orchestrator-level tool manipulation. ShareLock (preprint) described a multi-tool poisoning attack against MCP-style tool ecosystems. Handled responsibly, the lesson is about coverage rather than exploit recipes. Agent attacks are moving across the seams between memory, tools, retrieval, and orchestration. A benchmark that only asks whether a model refuses a bad prompt will miss the work an attacker is doing through a poisoned document, a tool description, or an intermediate state update. The strongest defense story this week is evidence capture across the whole run. CISA's Known Exploited Vulnerabilities catalog additions during the week (security advisories) kept the conventional software substrate in view. The agency added exploited flaws to the catalog on June 23 and June 25, giving agencies binding remediation deadlines and giving everyone else a current list of what attackers are already using. Even when the issue is not AI-specific, it still matters for agent deployment. Agents run inside browsers, developer machines, cloud accounts, plugins, and CI systems. The old patch backlog becomes part of the new autonomy risk. CyberChainBench (preprint) put this into a more agent-specific security setting by evaluating LLM agents on smart-contract vulnerability detection, exploit generation, and patch synthesis across real on-chain incidents. How Humans, Bots, and Agents Communicate About Vulnerabilities in Pull Requests (preprint) looked at the social layer, where vulnerability discussions are carried by humans, bots, and agents inside PR threads. The buyer read is direct: AI security will be judged inside real engineering workflows, where vulnerability evidence is messy, partially implicit, and mixed with ordinary collaboration. Physical Systems Exposed The Same Control Problem Robotics and control papers last week were valuable because physical systems punish vague state. CacheMPC (preprint) proposed certified cached model predictive control for quadruped locomotion, retrieving prior control solutions and accepting them only when a per-query certificate checks feasibility and cost. WARP-RM (preprint) used self-supervised progress estimates to keep imitation learning useful when human demonstrations include hesitation and recovery. DexCompose (preprint) reused dexterous manipulation policies by assigning finger-level action ownership so one task does not destroy another. Those details sound far from AI security until you translate them into control language. A robot cannot merely remember that "the task is going well." It needs a current state, a reusable action, an ownership boundary, and a check that says whether the reused plan still applies. Agents in software need the same discipline. A cached decision, a remembered instruction, or a delegated tool policy should not be trusted just because it worked earlier. The hardware papers pushed the point further. Agentic Hardware Design as Repository-Level Code Evolution (preprint) describes an agent loop that evolves hardware-design repositories under a git and runtime policy. A hardware-safety-gated system for LLM-written ARTIQ control code on a trapped-ion platform (preprint) puts a safety gate between code written by an LLM and native experimental control hardware. Those are strong examples for Eduardo this week because they make the action boundary visible. Before an agent touches a circuit, a lab instrument, or a production repository, the system needs an enforcement layer that is separate from fluent explanation. There is a research taste point here too. Papers that talk about memory, certificates, action ownership, and gates are more useful to Silmaril than papers that only report higher task success. The category will mature around systems that can explain why action was permitted at the moment it happened. Money Is Following The Audit Trail The clearest startup item was Patronus AI's announcement of a $50 million Series B to accelerate AI evaluation and agent security (press release). The amount matters less than the phrasing. Patronus is positioning evaluation as infrastructure for agents, not as a lab exercise performed after a model is shipped. That puts it close to the buyer conversation Silmaril wants: enterprises are now budgeting for evidence about model and agent behavior because the behavior is becoming operational. Arcade's recent funding announcement, although just outside this week's window and therefore only context here (press release), points in the same direction from the tooling side. The company is building infrastructure for agents to take authenticated actions across applications. If agent tooling becomes easier to wire into real accounts, security products have to explain how they see and constrain those authenticated actions without forcing teams back into toy demos. Patronus, OpenAI, AWS, and the week of preprints together describe a sharper competitive field. One group will sell evaluation. Another will sell agent infrastructure. Cloud platforms will sell governed data paths. Security entrants will sell controls at the edge of action. Silmaril's strongest lane is to make those pieces intelligible in the same record: the untrusted input, the memory state, the authority, the policy, the tool call, the score, and the final decision. That is also the GTM line I would test this week. Ask whether a prospect can name the moment they currently lose visibility. Is it when the agent reads a ticket? When it loads a retrieved document? When it picks an MCP tool? When it writes a pull request? When it touches a credentialed API? The answer tells you which demo to show first. Monday Operating Read Carry three decisions into the week. First, lead with action boundaries. The public evidence now supports the claim that prompt-only defense is insufficient, and the buyer does not need a theory lecture. Show a concrete point where Silmaril sees an attempted action and blocks or records it with a reason. Second, make memory and purpose part of the product vocabulary. Stale retrieval, purpose-bound privacy, and multi-tool flows all landed in the same source window. That gives you fresh language for why "allowed tool" and "safe response" are too small as enterprise controls. Third, keep the demo close to work Eduardo can sell. A coding agent reading an issue, touching a repo, pulling stale docs, and trying to call a tool gives you enough surface to show research depth, product utility, and buyer urgency without sounding like category theater. The week rewarded teams that can turn agent autonomy into a replayable record. That is the bar to clear now. Sources https://openai.com/index/previewing-gpt-5-6-sol/ https://aws.amazon.com/blogs/machine-learning/building-agentic-ai-applications-with-a-modern-data-mesh-strategy-on-aws/ https://arxiv.org/abs/2606.27406 https://arxiv.org/abs/2606.26511 https://arxiv.org/abs/2606.27567 https://arxiv.org/abs/2606.26479 https://arxiv.org/abs/2606.26649 https://arxiv.org/abs/2606.26524 https://arxiv.org/abs/2606.28061 https://arxiv.org/abs/2606.23927 https://arxiv.org/abs/2606.24496 https://arxiv.org/abs/2606.26793 https://arxiv.org/abs/2606.27027 https://www.cisa.gov/news-events/alerts/2026/06/23/cisa-adds-four-known-exploited-vulnerabilities-catalog https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog https://arxiv.org/abs/2606.26216 https://arxiv.org/abs/2606.28125 https://arxiv.org/abs/2606.28300 https://arxiv.org/abs/2606.28320 https://arxiv.org/abs/2606.28323 https://arxiv.org/abs/2606.28279 https://arxiv.org/abs/2606.27231 https://www.patronus.ai/announcements https://www.prnewswire.com/news-releases/arcade-raises-60m-to-bring-agentic-ai-to-the-enterprise-302483335.html