ZeroNoise Logo zeronoise
Post
Persistent Coding Agents Arrive—Alongside a Privacy Boundary Failure
5 hours ago
5 min read
167 docs
Cursor’s new event subscriptions, long-lived goals, and isolated subagents move coding agents toward background work; the Grok CLI incident shows why the control plane must include hard data and execution boundaries.

🔥 TOP SIGNAL

Coding agents are becoming background workers, not chat sessions. Cursor’s 08-19 update says Cloud agents now pick up work from events, hold a goal through long sessions, monitor PRs and Slack threads, run scheduled tasks, and automatically follow their own PRs to completion; /goal makes the objective persistent, while isolated VM subagents can test parent changes or swarm independent fixes in fresh project copies.

That capability shift is useful only if boundaries ship with it: a Pragmatic Engineer report quoting independent researcher Cerblab says Grok CLI, on a normal consumer login, transmitted .env contents and uploaded the whole repository plus git history—even when prompted “reply OK, do not read any files”—with the upload active by default; the evidence establishes transmission and storage, not model training. For unattended runs, define event scope, filesystem scope, network egress, and approval gates before you define the goal.

⚡ TRY THIS

  • Schedule maintenance with a checkpoint, not open-ended autonomy. In Cursor Cloud, give /goal a bounded outcome, then use Agent Subscriptions with a prompt such as Subscribe to this thread and add anyone who asks to the waitlist; subscriptions are Cloud-only for now, with local support and a public API planned later. For a one-month feature sunset, Kent C. Dodds shows the stronger pattern: ask the cloud agent to schedule a wake-up near the date, review the situation, and recommend next steps before acting.

  • Parallelize with isolation and pinned operating rules. Run subagents in their own virtual machines and project copies to test the parent agent’s changes in a fresh environment or swarm independent fixes. For a persistent review or testing policy, select a skill from / and choose Use as Mode or press ⌥⏎ on Mac / Alt+Enter on Windows.

  • When the agent’s sandbox cannot run the test, move the test—not the trust boundary—to CI. Simon Willison’s smolvm task was explicit: execute untrusted Python/JavaScript with CPU/RAM limits, no network, and filesystem access only to designated files. The Claude Code web environment lacked /dev/kvm, so Fable 5 used a temporary GitHub Actions workflow, ran the real test battery there, collected logs, and removed the workflow; Willison says the agent pushed that workflow directly without asking first. Copy the CI fallback, but review the workflow and permissions before merging.

  • Debug the diagnosis, not just the symptom. If T3 Code says GitHub is unauthenticated while gh is logged in, check the CLI version: a user traced the false negative to T3 probing with gh auth status --json, a flag introduced in gh 2.81.0; gh 2.72.0 returned “unknown flag,” which T3 misread as logged out. Run npx t3@nightly triage on the weird state, update gh, and track the next-nightly fix.

📡 WHAT SHIPPED

  • Cursor 08-19 update:/goal, event-driven Cloud agents, PR/Slack/scheduled-task subscriptions, isolated VM subagents, Custom Modes, and steering that waits for the next tool call. Full changelog.

  • Kody v2026.08.19: adds a read-only /files explorer for published package files. Its release notes also describe progressively disclosed MCP search: counted domain indexes for broad queries, saved packages ranked above raw provider operations, and bounded related-operation detail so agents do not receive a tool firehose.

  • T3 Code adoption and safety signal: Theo reports 200,000 users; Omarchy 4.1 is also announced to ship with T3 Code. Separately, a user reported taking down production by accidentally killing the T3 terminal, which Theo called the “first confirmed production outage caused by T3 Code.” Treat destructive terminal actions as confirmation-gated until proven otherwise.

  • Codex as an embeddable agent loop: OpenAI says teams are putting the open-source Codex harness inside internal apps and operations dashboards, with the host application controlling the interface, context, tools, and approvals while the harness handles the loop. OpenAI separately reports a vendor-run tax-prep pilot processing 7,000 returns and cutting preparation time by about a third; treat that number as a first-party case-study claim, not an independent benchmark.

  • Google AI Studio GitHub support: repo import, bidirectional GitHub push/pull, and UI support for force-pushes and merges are now available.

  • Claude Code output control: the new Concise style leads with the result and stays short until asked for detail. Enable it through /config → Output style or "outputStyle": "Concise" in settings.json; Theo notes that /config changes the current project only, not the global config.

🎬 GO DEEPER

  • Podcast clips — Simon Willison: jump to 35:01 for his case that agent productivity can be measured in maintainable, tested code—not raw generation—and 46:03 for the “conceptual integrity” failure mode. His useful constraint: agents can raise output dramatically, but senior skill and team cognitive capacity remain the bottlenecks; cheap feature additions make it easy for a codebase to grow “weird bumps.”

  • Study Simon Willison’s smolvm research: the 1.8.3 test covered offline images, no-network execution, CPU/RAM limits, timeouts, quotas, read-only inputs, writable outputs, and --unprivileged; cold starts were about 0.6–1.5 seconds and warm runs about 50 ms. The repo is a compact example of using CI when an agent’s own sandbox lacks nested virtualization.

  • Audit the Grok network monitor: AWS engineer Wes Eklund tracked the CLI’s upload behavior and found that a remote feature flag stopped collection while the file-streaming code remained in later builds—a useful template for verifying what an agent actually sends, not what its settings imply.

Editorial take: The durable coding-agent edge is now a controllable loop: wake on the right event, isolate the work, preserve the trace, and make data egress and conceptual debt visible before autonomy scales.

Persistent Coding Agents Arrive—Alongside a Privacy Boundary Failure
Addy Osmani

Addy Osmani (ex-Google Cloud AI/Gemini director, Chrome DevTools lead) announced his Pragmatic Engineer podcast conversation with Gergely Orosz covering engineering roles, DevTools-to-AI agents, and cognitive debt/surrender . Agent-relevant episode segments: "Working with agents" (1:03:03), "Loop engineering" (1:05:52), "The changing role of the software engineer" (1:12:55), and "How Addy uses AI in writing" (1:18:15) . Osmani's take in the episode: engineering/product roles will "unbundle" — engineers need product sense, product people need engineering/UX sense — and engineers should invest in product, technical evangelism, and go-to-market skills: "Don't be just an engineer" . Firsthand announcement; the source carries topic pointers, not the agent-workflow substance itself. Episode: https://x.com/GergelyOrosz/status/2090157324853711104

I had a great conversation in SF with [@GergelyOrosz](https://x.com/GergelyOrosz). We talked about engineering roles unbundling, DevTools… If you’ve ever opened Chrome DevTools, or optimized a page for Core Web Vitals, you’ve used software built by [@addyosmani](https://x.com…
Simon Willison

Simon Willison (@simonw) reports a firsthand Claude Code for web experiment using smolvm as a code execution sandbox. When Fable 5 spotted that the sandbox couldn't run the task (no /dev/kvm), it didn't ask first — it wrote a GitHub Actions workflow and pushed it directly to GitHub to run the experiments instead . Notes from the experiment: https://simonwillison.net/2026/Aug/19/smolmachines-untrusted-sandbox/ ; research report: https://github.com/simonw/research/tree/main/smolmachines-untrusted-sandbox#readme.

I had Claude Code for web experiment with smolvm as a code execution sandbox Fable 5 spotted that its environment couldn't run that (no /… Notes here [https://simonwillison.net/2026/Aug/19/smolmachines-untrusted-sandbox/](https://simonwillison.net/2026/Aug/19/smolmachines-unt…
Simon Willison's Weblog

Jeremy Morrell hypothesizes a new opportunity for extensible software on the web: LLMs radically lower the cost of authoring extensions, and modern sandbox primitives lower deployment cost while providing security boundaries. His recommended pattern: build an app as a solid, accountable core, then let users safely extend it in many directions by having LLMs fill in the missing pieces.

Quoting Jeremy Morrell
swyx

OpenAI's developer account shared a Codex case study in which Asana completed a frontend test migration from Enzyme to React Testing Library in two calendar weeks, versus the five more years originally expected — a dramatic, vendor-reported productivity gain with no workflow details or independent verification .

With Codex, [@asana](https://x.com/asana) finished a frontend test migration from Enzyme to React Testing Library in two calendar weeks—a…
Kent C. Dodds 🐨

Kent C. Dodds announced the release of his kody project at v2026.08.19, claiming the release was built in a single day by a solo dev . The post is firsthand (Dodds owns the repo) but provides no details on what kody is, what changed, or how the work was done — only the link: https://github.com/kentcdodds/kody/releases/tag/v2026.08.19. The single-day velocity claim is unsubstantiated hype rather than a replicable workflow.

Can you believe this was done in a single day by a solo dev? [https://github.com/kentcdodds/kody/releases/tag/v2026.08.19](https://github…
Simon Willison's Weblog
  • Simon Willison argues that lines of code can be a meaningful productivity metric for coding agents, despite common wisdom to the contrary. He notes that before agents, a developer producing 200 lines of working, debugged, production-level code was an excellent day, with 50-60 lines typical. With agents, producing 1,000 lines of maintainable, tested debugged code per day is a real improvement — but only achievable with senior-level skill and experience .
  • The new limiting factor is cognitive capacity: agents let him "churn out code a hundred times faster," but he cannot stay on top of 100x the amount of code, so teams are still needed to load-balance cognitive capacity across engineers .
  • Coding agents threaten conceptual integrity (from The Mythical Man-Month): features appear in minutes, so software "grows little weird bumps in funny different directions," like the Winchester Mystery House — cheaply added rooms with no overall integrity, making decisions harder .
  • The practical discipline tip: time cost used to enforce discipline (a crazy feature that took a week wasn't justifiable), but agents make features cost an hour, so developers must consciously impose their own discipline to avoid degrading the codebase .
Conceptual integrity and counting lines of code
Simon Willison's Weblog

Simon Willison tested smolvm 1.8.3 (smolmachines.com) as a sandbox for untrusted Python and JavaScript data transformations, using hardware-isolated VMs rather than shared-kernel containers . Verified working: offline local images, no-network execution, CPU/RAM limits, guest-enforced timeouts, storage quotas, read-only input mounts, writable output mounts, and --unprivileged; cold starts ~0.6–1.5s, warm executions ~50ms . He delegated the evaluation to Claude Fable 5 in Claude Code for web with this task: run untrusted Python/JS with RAM and CPU limits (protection against while true), no network access, filesystem access only to designated files, for executing user-provided tasks like data transformations . The agent hit an environment limit — the Claude Code web container is itself a Firecracker guest with no /dev/kvm or vmx/svm CPU flags, so smolvm machine run fails with "kvm not available" . Its workaround: GitHub Actions ubuntu runners expose /dev/kvm, so the agent ran the real test battery via a temporary workflow on the branch, collected logs, then removed the workflow before committing . Replicable pattern: when an agent's own sandbox lacks nested virtualization, offload VM-requiring verification to CI runners that expose /dev/kvm; Willison calls this an example of Fable being "relentlessly proactive" . Research notes are at https://github.com/simonw/research/tree/main/smolmachines-untrusted-sandbox#readme.

smolmachines / smolvm as a sandbox for untrusted Python & JavaScript
Kent C. Dodds 🐨

Firsthand from @kodykoala (Kody's account): Kody v2026.08.19 is out, adding a read-only explorer for published package files — "walk the file tree of any community listing or your own saved package at /files — no git session required" . Full release notes: https://github.com/kentcdodds/kody/releases/tag/v2026.08.19.

Same release, shared by Kent C. Dodds as "Primitive pruning": MCP search and capability discovery is now progressively disclosed — "Discovery returns counted domain indexes for broad queries, ranks your saved packages above raw provider operations, and bounds related-operation detail so agents get what they need without a firehose" (#1533) .

Breaking changes in this version: package services, values, and remote connectors are retired. Values are absorbed into memories/package storage/repos/secrets/integrations; the Values nav item is gone but /account/values remains reachable for migration; remote connectors are replaced by outbound MCP .

Kody v2026.08.19 is out. Browse published package files in a read-only explorer. You can now walk the file tree of any community listing … Primitive pruning 👨‍🌾 ![Screenshot of a mobile browser page on github.com showing release notes or a changelog. Status bar shows 9:37. Visi…
Kent C. Dodds 🐨

Kent C. Dodds (@kentcdodds) made a Kody Discord, then wired up Kody to manage it; he reports it's much better telling an agent to do stuff in Discord than trying to click around the UI — a firsthand endorsement of chat/Discord as a control interface for coding agents .

I made a Kody discord. Then I wired up Kody to manage it and goodness it's so much better telling an agent to do stuff in discord than tr…
Jason Zhou

@jasonzhou1993 announced "OpenRouter, but for agent tools" at https://treg.to, with a video demo, explicitly referencing Patrick Collison's OpenRouter-Stripe news .

Patrick Collison announced that Stripe agreed to acquire OpenRouter — by his account "by far the best way to use new models and manage multiple inference providers" — and argued that "in the future, every business will have to manage both revenue flows and token flows," positioning OpenRouter as "the world's leading token marketplace" .

OpenRouter, but for agent tools Try it at [https://treg.to](https://treg.to) [![Video](https://pbs.twimg.com/amplify_video_thumb/20902420… OpenRouter is joining Stripe: [https://stripe.com/newsroom/news/stripe-agrees-to-acquire-openrouter](https://stripe.com/newsroom/news/str…
Kent C. Dodds 🐨

Kent C. Dodds (@kentcdodds) shared a firsthand look at his Devin coding-agent workflow: a parent session titled "Upgrade Remix v3 beta" coordinated five child sessions, each upgrading a separate repository to Remix 3.0.0-beta.10, while the parent session waited for a GitHub API rate-limit reset — an orchestration pattern for fleet-wide upgrades using parallel per-repo child sessions with rate-limit-aware coordination .

I love building software in 2026 ![Devin session titled “Upgrade Remix v3 beta,” showing five child sessions upgrading separate repositor…
Kent C. Dodds 🐨

Early-access user @tharshan_09 reports that across different agent harnesses, Kody is the first and basically only MCP they install, but they're unsure when the right task is for Kody; they also built their own package for a hosted agent plans app . Kent C. Dodds welcomed this feedback from early-access users .

[@kentcdodds](https://x.com/kentcdodds) [@kodykoala](https://x.com/kodykoala) I hope you do keep working on it! As I try different harnes… Love to hear this from early access users like [@tharshan_09](https://x.com/tharshan_09) 😊 [https://x.com/tharshan_09/status/209013438969…
Kent C. Dodds 🐨

Kent C. Dodds (@kentcdodds), a prominent developer and educator, reports firsthand that Grok 4.6 has worked so well for him that he no longer uses other models, and he is looking forward to Grok 4.7 .

I have been having so much success with Grok 4.6 that I don't bother with other models anymore. Looking forward to Grok 4.7!
Logan Kilpatrick

Google AI Studio added GitHub support: users can now import GitHub repos, sync bidirectionally (push/pull), and use a new UI for force pushes and merges . Logan Kilpatrick (@OfficialLoganK) said the push/pull feature took a while to land but is now live, with a demo video embedded .

Updates on GitHub support in [@GoogleAIStudio](https://x.com/GoogleAIStudio): - we now support importing Github repos - we now support bi…
Cursor

Cursor's official 08-19-26 update adds several agent-workflow features:

  • Cloud agents now pick up work from events, hold a goal until it's met, and stay on course through long sessions .
  • Cloud agents can monitor PRs, watch a Slack thread, or run scheduled tasks; they automatically subscribe to PRs they create and drive them to completion .
  • Any skill can become a Custom Mode (always-on pinned skill): from /, pick a skill and press ⌥⏎ (Mac) or Alt+Enter (Windows), or choose "Use as Mode" .
  • Subagents can now run on their own virtual machines, each with an isolated copy of the project — to test the parent agent's changes in a fresh environment or swarm independent fixes .
  • Steering now waits for the next tool call instead of cutting the agent off mid-action: type a follow-up and hit send, or press ⏎ twice .
  • Use /goal to give the agent a long-lived objective to work toward until fully complete ; full changelog: https://cursor.com/changelog/08-19-26.
Use /goal to give the agent a long-lived objective to work towards until it's fully complete. Read the full changelog: [https://cursor.co… We're continuing to improve cloud agents in Cursor. They pick up work from events, hold a goal until it's met, and stay on course through… Cursor can now monitor your PRs, watch a Slack thread, or run scheduled tasks. Cloud agents automatically subscribe to PRs they create an… Use any skill as a Custom Mode: a skill that stays pinned in the chat. You can think about it like always-on skills. From /, pick a skill… Subagents can now run on their own virtual machines, each with an isolated copy of the project. Have them test the parent agent's changes… Steering now waits for the next tool call instead of cutting the agent off mid-action. Type a follow-up and hit send now, or press ⏎ twice.
Theo - t3.gg

Theo (@theo of t3.gg), creator of T3 Code, is pushing back on people calling T3 Code a "harness," comparing the effort to convincing people that NextJS isn't an alternative to React . @ThadDoormat disputes the claim, saying T3 Code "very clearly is" a harness and asking Theo to explain what a harness is, give examples, and justify why T3 Code is not one .

How do I convince people that T3 Code is not a harness? This feels like trying to convince people that NextJS isn’t an alternative to Rea… [@n_ullO7](https://x.com/n_ullO7) [@theo](https://x.com/theo) [@fullfrankchan](https://x.com/fullfrankchan) instead of characterizing me …
Kent C. Dodds 🐨

Kody's official account announced that Kent C. Dodds published a new Product Hunt integration for the Kody coding agent (@kentcdodds/producthunt), letting the agent pull today's Product Hunt hunts, hunters, topics, and comments, plus make generic GraphQL requests on the saved OAuth integration ; it's hosted at https://kody.codes/@kentcdodds/producthunt. Kent shared the announcement approvingly ("Yo, so that's neat") . Announcement from the platform, not a hands-on workflow report.

Your agent can pull today's Product Hunt now. [@kentcdodds](https://x.com/kentcdodds) just published [@kentcdodds](https://x.com/kentcdod… Yo, so that's neat [https://x.com/kodykoala/status/2089955137326354690](https://x.com/kodykoala/status/2089955137326354690)
Kent C. Dodds 🐨

Kent C. Dodds (@kentcdodds) shows a practical Cursor cloud-agent workflow for timed feature removal: with a one-month sunset timeline, he tells the cloud agent to use Kody to schedule itself to wake up when the time is up — the draft prompt (in screenshot) asks the agent to schedule a wakeup near the planned sunset date, review the situation, and recommend next steps before acting . The setup: Cursor Cloud mode, model 'Grok 4.6 High Fast', branch 'cursor/hide-values-nav-8e48' . This is a human-in-the-loop pattern where the agent self-schedules a future check-in and is instructed to review before acting — first-hand, from a well-known dev educator.

This is the sort of prompt I can give my agent because I have [@kodykoala](https://x.com/kodykoala). We're removing a feature with a mont…
Kent C. Dodds 🐨

Kent C. Dodds (firsthand, @kentcdodds) reports creating and merging 41 PRs in a single day . He adds that this count does not include agents committing to his own private "git hub" inside Kody itself — a signal of the volume of agent-driven PR work a top practitioner sustains, and that such tallies often undercount internal agent activity.

Created and merged 41 PRs yesterday 💀 Not included is the number of agents committing to my own private "git hub" inside Kody itself...
Kent C. Dodds 🐨

Kent C. Dodds (@kentcdodds) argues that a viral video being shared as a vibe-coding cautionary tale is mislabeled: 'This is funny. But it has nothing to do with vibe coding and everything to do with product engineering!' He says this failure pattern predates AI coding tools — 'The exact same thing has happened to companies forever' — and pinpoints the root cause: 'It's too easy to focus on the solution and forget to validate the problem is good enough' . He was responding to a video posted by @kiwicopple .

This is funny. But it has nothing to do with vibe coding and everything to do with product engineering! The exact same thing has happened… who made this masterpiece ? [![Video](https://pbs.twimg.com/amplify_video_thumb/2089917531750592512/img/qiZlXnZ351GUM8pa.jpg)](https://vi…