Persistent Coding Agents Arrive—Alongside a Privacy Boundary Failure

Cursor’s new event subscriptions, long-lived goals, and isolated subagents move coding agents toward background work; the Grok CLI incident shows why the control plane must include hard data and execution boundaries.

Cursor

Theo - t3.gg

Simon Willison's Weblog

+12

🔥 TOP SIGNAL

Coding agents are becoming background workers, not chat sessions. Cursor’s 08-19 update says Cloud agents now pick up work from events, hold a goal through long sessions, monitor PRs and Slack threads, run scheduled tasks, and automatically follow their own PRs to completion; /goal makes the objective persistent, while isolated VM subagents can test parent changes or swarm independent fixes in fresh project copies.

That capability shift is useful only if boundaries ship with it: a Pragmatic Engineer report quoting independent researcher Cerblab says Grok CLI, on a normal consumer login, transmitted .env contents and uploaded the whole repository plus git history—even when prompted “reply OK, do not read any files”—with the upload active by default; the evidence establishes transmission and storage, not model training. For unattended runs, define event scope, filesystem scope, network egress, and approval gates before you define the goal.

⚡ TRY THIS

Schedule maintenance with a checkpoint, not open-ended autonomy. In Cursor Cloud, give /goal a bounded outcome, then use Agent Subscriptions with a prompt such as Subscribe to this thread and add anyone who asks to the waitlist; subscriptions are Cloud-only for now, with local support and a public API planned later. For a one-month feature sunset, Kent C. Dodds shows the stronger pattern: ask the cloud agent to schedule a wake-up near the date, review the situation, and recommend next steps before acting.
Parallelize with isolation and pinned operating rules. Run subagents in their own virtual machines and project copies to test the parent agent’s changes in a fresh environment or swarm independent fixes. For a persistent review or testing policy, select a skill from / and choose Use as Mode or press ⌥⏎ on Mac / Alt+Enter on Windows.
When the agent’s sandbox cannot run the test, move the test—not the trust boundary—to CI. Simon Willison’s smolvm task was explicit: execute untrusted Python/JavaScript with CPU/RAM limits, no network, and filesystem access only to designated files. The Claude Code web environment lacked /dev/kvm, so Fable 5 used a temporary GitHub Actions workflow, ran the real test battery there, collected logs, and removed the workflow; Willison says the agent pushed that workflow directly without asking first. Copy the CI fallback, but review the workflow and permissions before merging.
Debug the diagnosis, not just the symptom. If T3 Code says GitHub is unauthenticated while gh is logged in, check the CLI version: a user traced the false negative to T3 probing with gh auth status --json, a flag introduced in gh 2.81.0; gh 2.72.0 returned “unknown flag,” which T3 misread as logged out. Run npx t3@nightly triage on the weird state, update gh, and track the next-nightly fix.

📡 WHAT SHIPPED

Cursor 08-19 update:/goal, event-driven Cloud agents, PR/Slack/scheduled-task subscriptions, isolated VM subagents, Custom Modes, and steering that waits for the next tool call. Full changelog.
Kody v2026.08.19: adds a read-only /files explorer for published package files. Its release notes also describe progressively disclosed MCP search: counted domain indexes for broad queries, saved packages ranked above raw provider operations, and bounded related-operation detail so agents do not receive a tool firehose.
T3 Code adoption and safety signal: Theo reports 200,000 users; Omarchy 4.1 is also announced to ship with T3 Code. Separately, a user reported taking down production by accidentally killing the T3 terminal, which Theo called the “first confirmed production outage caused by T3 Code.” Treat destructive terminal actions as confirmation-gated until proven otherwise.
Codex as an embeddable agent loop: OpenAI says teams are putting the open-source Codex harness inside internal apps and operations dashboards, with the host application controlling the interface, context, tools, and approvals while the harness handles the loop. OpenAI separately reports a vendor-run tax-prep pilot processing 7,000 returns and cutting preparation time by about a third; treat that number as a first-party case-study claim, not an independent benchmark.
Google AI Studio GitHub support: repo import, bidirectional GitHub push/pull, and UI support for force-pushes and merges are now available.
Claude Code output control: the new Concise style leads with the result and stays short until asked for detail. Enable it through /config → Output style or "outputStyle": "Concise" in settings.json; Theo notes that /config changes the current project only, not the global config.

🎬 GO DEEPER

Podcast clips — Simon Willison: jump to 35:01 for his case that agent productivity can be measured in maintainable, tested code—not raw generation—and 46:03 for the “conceptual integrity” failure mode. His useful constraint: agents can raise output dramatically, but senior skill and team cognitive capacity remain the bottlenecks; cheap feature additions make it easy for a codebase to grow “weird bumps.”
Study Simon Willison’s smolvm research: the 1.8.3 test covered offline images, no-network execution, CPU/RAM limits, timeouts, quotas, read-only inputs, writable outputs, and --unprivileged; cold starts were about 0.6–1.5 seconds and warm runs about 50 ms. The repo is a compact example of using CI when an agent’s own sandbox lacks nested virtualization.
Audit the Grok network monitor: AWS engineer Wes Eklund tracked the CLI’s upload behavior and found that a remote feature flag stopped collection while the file-streaming code remained in later builds—a useful template for verifying what an agent actually sends, not what its settings imply.

Editorial take: The durable coding-agent edge is now a controllable loop: wake on the right event, isolate the work, preserve the trace, and make data egress and conceptual debt visible before autonomy scales.

Want personalized briefs on the topics you care about?

Create your own agent and get daily or weekly cited briefs on the topics you care about, shaped by the people, newsletters, podcasts, blogs, and channels you choose.