Wednesday, August 26, 2026
TL;DR
A single webpage visit can permanently poison a local AI agent through a DNS-rebinding flaw in NVIDIA's NemoClaw, disclosed as CVE-2026-65105, and OpenAI's Assistants API shuts down today with no data-export tool. Elsewhere: watermarking is shipping silently in consumer apps, harness engineering is moving in-house at companies like Ramp, and OpenAI published its first in-house inference-chip results.
Act on this
- Check every host running Ollama and bind it to 127.0.0.1. On non-loopback binds Ollama skips Host-header validation, which is what the rebinding attack exploits. Oasis Security #
- Migrate anything left on OpenAI's Assistants API. Endpoints stop serving today, the failure is a hard error, and Thread data has no export tool. Migration guide #
Signals
Harness engineering is moving in-house #
Up from the hobbyist end of this thread filed August 25. Gergely Orosz, August 25: Ramp built its own agent, Inspect, because engineers “wanted to run more than a few agents in parallel”; it now authors 75% of merged PRs. Two papers submitted August 24 and 25 freeze the base model, evolve only external memory and verification, and report +10 points on Terminal-Bench 2.0. Orosz
Watermarking is shipping silently, and it marks identity rather than content #
Sebastian Raschka, August 22, on Claude's text watermarking: “nothing else for the end user than fixing a random seed and making this sampling kind of deterministic.” Zvi Mowshowitz argued August 21 it costs nothing and should be adopted. Then August 25, Xusheng Li found Microsoft Paint and Photos encoding a server-issued GUID into locally generated images, chaining a user's generations together. Microsoft has not commented. Li
Developers are routing production traffic to an anonymous provider that retains their prompts #
Ox Alpha took 23.2 trillion OpenRouter tokens this week, first place by more than double the next model. Joseph W. Elstner, August 23, matched its tokenizer to Zhipu's released GLM-5 vocabulary across 95 probes at zero error, but cautioned this “establishes vocabulary identity, not ownership.” OpenRouter states the provider retains prompts and completions. Elstner
News
ACTOpenAI sets November 30 shutdowns for Agent Builder, the Reusable Prompts API and the Evals Platform #
it points builders at Promptfoo for evals and at moving prompt text into application code. Self-serve fine-tuning ends January 6. Deprecations
SHIPClaude Code 2.1.243 splits the prompt-cache TTL #
promptCacheTtl and subagentPromptCacheTtl let API-key users hold a one-hour cache on the main conversation while subagents stay at five minutes. modelPricing makes /cost use contracted rates. Changelog
SHIPOpenAI publishes first Jalapeño inference-chip results #
1.5 to 1.9 times more work per watt and 1.7 to 3.6 times lower end-to-end latency on SemiAnalysis's InferenceX. Internal deployment only, starting by year end. OpenAI
SHIPUnsloth v0.1.803-beta adds experimental auto-compaction #
it evicts whole oldest turns rather than summarizing, and keeps evicted content searchable through an archive. Also 170-plus fixes, including broken MLX runtimes on Mac. Release
The long view
Infrastructure and energy. A year ago every lab rented compute from a merchant market it did not control. On August 25 OpenAI published measured results for silicon it designed itself, next to a supplier list eight names long, and Dylan Patel told Dwarkesh Patel that OpenAI and Anthropic will hold most of the world's compute by 2028 because “every force is screeching towards centralization.”
Also noted
- Joseph Thacker used GPT-5.6 Daybreak Blue to find a NetHack buffer overflow, then took the leaderboard. Thacker #
- A 3-bit local Qwen3.8-27B scored within 0.3 points of Claude Opus 4.6 on BrainBench. Single source, self-judged. Report #
- An Intel Arc B70 32GB ran Qwen3.8-27B Q6_K at 28 to 32 tokens per second on 200,000-token context. Report #
- Nvidia's Jetson Orin Nano 2: 78 TOPS in 8GB, but no price and nothing shipping until 2027. Nvidia #