Huntley: stop risky agent actions by removing the capability

Geoffrey Huntley's talk "the answer to ai is engineering" (in a blog post and on YouTube) is the most reusable material this period. His central rule: "The best way to stop a model from doing something is to remove its ability to do it." Agents push toward their goal and do destructive things along the way. So he asked Claude to "use Nix and create a custom overlay that removes force push." The patched git is now used on his laptops, in agent sandboxes and by anything that depends on git Geoffrey Huntley.

The rest of the approach, from his nix-demo repo:

• One environment file for everything. A single devenv/Nix file builds developer laptops, CI/CD, agent sandboxes and production Docker images. This avoids running a separate agent-sandbox setup that drifts from the others Geoffrey Huntley. CI compiles patched software once and publishes it to a cache, and the other environments download it from there Geoffrey Huntley.
• Handling security incidents. He asks Claude whether his fleet is affected. It then applies patches and updates refs, dependencies and pins Geoffrey Huntley. For temporary patches, he prompts it to "update the AGENTS.md, and in seven days' time, get rid of my patches." The next agent to use the machine removed them once upstream was fixed Geoffrey Huntley.
• Root access only on throwaway machines. His agent loops run with sudo on disposable Nix dev machines, and NixOS tests run work against infrastructure that matches production Geoffrey Huntley. He never lets agents run as root on production hosts or connect to production databases. For reproductions, he copies the database and tightly limits outbound network access Geoffrey Huntley.
• Don't let the loop accept bad code. Pre-commit hooks block pushes that don't compile. Static or semantic checks enforce architecture rules, such as SQL code never referencing the API Geoffrey Huntley. Property-based tests find edge cases that unit tests miss Geoffrey Huntley. He works at Antithesis, which makes Bombadil (property testing for web apps, which returns a failing example as a reproduction) and Hegel (a Rust core with layers for each language) Geoffrey Huntley.

Gemini 4 Carbon in real use: slow, hallucinates, but good for security fixes

Theo's reports add real-use data to last period's CursorBench result:

• Speed. One task took 22m21s with Carbon on low effort, against 9m33s for Opus 5.5 on high @theo. On identical code-review tasks it was 4x slower @theo. He blames mostly Google's servers: 11 seconds before the first response, 20x longer than Fable @theo. He also says its tool calls don't batch or run in parallel, and that it needs a "code mode" like Opus, Astra and Fable use to run actions in one call @theo.
• Hallucinations. False claims across his evals fell from 36% with the previous Gemini model, Argon (which he calls "Argan"), to 18%. One Rust architecture review still had 23 false claims out of 79, where most models have zero or one Theo - t3․gg. He says not to use it for code review or codebase analysis. He saw it invent database column names, line numbers and architecture details Theo - t3․gg.
• Cost per task. Theo disputes claims that Carbon is cheaper. He says Opus 5.5 at xhigh effort costs less than Carbon at any effort level on real tasks @theo.
• Where it did well. He gave it a vulnerability report for T3 Code. It proposed separating known-machine flows from raw-URL flows instead of a heavy cryptographic redesign. He then had it get a "council review" from other models and fix their feedback, and reviewers scored the result 7–9 out of 10 Theo - t3․gg. He warns that his early access may have made the model's safety refusals less strict for him Theo - t3․gg.
• If you use Gemini through another tool: use the Google-approved ACP bindings. Some of his hallucinations came from an old binding that didn't pass line numbers to the model Theo - t3․gg.

What Carbon produced: a Windows-install fix for T3 Code that took 14 hours @theo and ran to 4k+ lines where about 500 should do. He had Fable clean it up @theo, and Fable's PR was "significantly smaller and better" @theo. Nicholas Moy, more positive, calls Carbon "very good." It is publicly available in Antigravity with generous limits for Ultra subscribers @thenickmoy.

Fable 5.2: new prompt wording and an arena result

• Prompt update. Anthropic has changed the recommended "This codebase is yours" sentence to: You are the owner and long-term maintainer of this codebase, and its design is up to you. @simonw
• Agent Arena ranks Fable 5.2 (Max) #1 across 4.7k agentic sessions, at +30.4% net improvement against +19.5% for Opus 5.5 @arena. Median cost per task fell from $7.7 to $7.3, while Opus costs $5.5 and Carbon $1.5 per task. One row of the post's own table labels the top entry "Fable 5.1" @arena.
• Matthew Berman's team: Fable built a complete multi-level Fall Guys clone. Opus "builds you one level and goes, 'Hey, is this good enough?'" Matthew Berman
• Simon Willison used leftover Fable credits to have it analyse 244 tools with tree-sitter. It tagged the JavaScript APIs, libraries and web API hosts each tool uses, and those tags now let you browse tools.simonwillison.net by tag Simon Willison's Weblog.
• Riley Brown gave one Claude Code prompt to make a 4K Blender video. Fable wrote Python to build the scene, rendered test clips and graded them itself, and added timed sound Riley Brown. It rented 10 RunPod GPUs and rendered 1,329 frames in 52 minutes for about $6 Riley Brown.

Smaller items

• Find plaintext keys: grep your agent configs for sk_, ghp_, sntrys_ and xoxb-. Each hit is a key your agent can read (guide) @kodykoala.
• Limit self-review loops: LangChain's GTM agent re-reviewed pages that were already fine, sometimes dozens of times. A rule to "ship once one review finds no real defect" cut a one-pager from 18 minutes to 7 LangChain Blog.
• Antigravity browser use is rolling out. You choose which accounts it logs into, downloads wait for your approval, and the agent can run several browser tasks at once @antigravity.
• llm 0.37.2 fixes two ways your OpenAI key could be sent to a third-party OpenAI-compatible provider Simon Willison's Weblog.
• aws-emulator is AWS's official emulator for testing locally against AWS services. A swarm of agents wrote it in Rust, with 29,684 commits in its first three weeks. It needs Docker on macOS and Windows Simon Willison's Weblog.
• Monorepos: Matt Carey argues against them for agents unless you'll rebuild git tooling. He suggests a CLI or MCP that lets agents search your organisation's code without a checkout @mattzcarey.
• Local models: Omarchy 4.6 will share a model on one machine with others on your tailnet @dhh. DHH runs GLM-5.3 Flash on two DGX Sparks @dhh. Theo says open-weight models are under 0.5% of T3 Code traffic @theo.