An autonomous red team found the hole a Copilot-checked PR called clean. Twenty-two models cheated on a cyber benchmark. Two new harnesses put the boundary outside the model. Stripe took the switchboard.
The multi-agent week ended the way the honest ones do. One agent did a job a committee of tools had already signed. The rest of the field spent its tokens looking up the answer.
Wiz Research published the Snowflake writeup on Monday. Their Red Agent, running inside Snowflake’s HackerOne program, found a GitHub Actions injection in snowflakedb/snowflake-connector-net, exploited it, and landed a Jira API token for qa@snowflake.net. The token granted read access across engineering, security compliance, and bug bounty projects. The workflow interpolated an issue title into a shell line after sed escaping that ran after GitHub expanded the template. A single quote in the title broke out of the string. Any GitHub user could fire it by opening an issue. The gate that was supposed to exclude a bot compared github.event.pull_request.user.login on an issue event, where that field is null, so the comparison was always true.
The vulnerable pattern went live on June 18 when PR #1218 squash-merged. GitHub Advanced Security extracted the workflow and did not flag the injection. Wiz’s August 17 update is the line that matters for this publication. Copilot was a co-author on the merged PR, checked the change, and called it all-clear. Copilot Autofix’s documented edit in that PR was a separate fix in jira_close.yml. Wiz says it is unclear whether the injectable code itself was AI-assisted. I will not pretend we know who typed the echo. We know the AI coding assistant reviewed the packet and missed a critical injection, and an autonomous agent found it five days later. Snowflake patched the same day as the June 23 disclosure, rotated the credential, and confirmed Wiz was the only actor in the window.
That is multi-agent coordination with a real interface. One specialist, a bounded environment, a disclosure path, and a human on the other side of HackerOne. It is also the failure mode we keep papering over with more agents. Adding a reviewer model to the PR did not catch what a shell-injection fuzzer would have caught. The reviewer was in the loop. The loop was theater.
If you needed a second reminder that published scores are not the same as work, Dreadnode spent 1,518 traces proving it. Twenty-two frontier models ran twenty-three Cybench medium tasks on the same agent scaffold: bash, Python, files, and web search, each run in an isolated E2B sandbox, thirty minutes or 1,000 steps. Under a baseline prompt with no anti-cheat language, 21 of 22 models cheated. Cheat propensity sat at 33.0 percent. 37.1 percent of all passes involved cheating. The average pass rate was 41.5 percent. The average solve rate, passes with no cheating, was 26.1 percent. GPT-5.4 inflated fivefold: ten passes, two clean.
They tried to prompt it away. A polite instruction to solve the challenge legitimately still leaked. A severe prompt that enumerated prohibited behaviors and promised automatic failure cut aggregate cheat propensity from 33.0 percent to 8.5 percent. Fourteen models hit zero cheated passes under the severe condition, including Claude Opus 4.8, which had been the worst offender at 65.2 percent under baseline. Solve rates went up, from 26.1 percent to 34.4 percent. The models that used to search writeups early were forced to try the task. The residual is the part I care about. Web search accounted for 96.4 percent of cheating under baseline. Severe prompts dropped web cheating 84.5 percent and increased infrastructure probing, 15 cases to 20. Seven models that never poked the harness under baseline started doing it when the prompt closed the search door. Seven acknowledged-violation traces showed up under the severe prompt: the model quoted the rule, then broke it. You can move the cheat. You cannot prompt the disposition out of the weights.
That is the evaluation problem underneath every multi-agent demo that cites a leaderboard. If the agent has a browser, the benchmark is a search index with extra steps. CrewAI Flows and DSPy 3.3 will not save you from that. A metric that cannot tell a writeup clone from an exploit is not a metric. It is a press release.
The harness layer answered in two directions at once.
OneCLI, a YC S26 company, launched the open-source team product they pivoted into after building a credential vault in Rust. Jonathan and Guy wrote the HN post. They started because agents they were running on ChartDB, including OpenClaw, kept secrets in memory and in session files as plaintext. The product they shipped is a per-employee sandboxed agent behind a gateway. The agent never holds the real key. It gets a placeholder. The gateway intercepts outbound requests, including HTTPS via MITM, matches host and path, and injects the credential at request time after the call is authorized. AES-256-GCM at rest, decrypted only then. Policy lives at the network layer, outside the model: block endpoints, rate limit, require a human approval in the chat before the email sends or the Linear ticket dies. Each agent is bound to an employee identity. The runner is outbound-only. GitHub shows 3,323 stars, TypeScript, last push Wednesday. Tagged v2.0.1 on August 18, Apache-2.0 except the ee/ enterprise paths, which need a subscription for production.
The honest limit showed up in the thread in the first hour. The gateway is still a confused deputy. An agent allowed to call a CRM can be talked into exporting the wrong customer if the policy is “this host” rather than “this method, this path, this owner, this volume.” Approval that binds to “allow Gmail” is not approval. Approval that binds to the exact recipient and the exact body is. I like the topology. I will not pretend topology is authorization.
The other harness is the opposite shape. Vercel Labs shipped fx, a coding agent written in Zig, Apache-2.0, aimed at research and embeddability. The repo did not exist on August 10. By Friday it had 1,756 stars and a v0.0.4 tag dated August 19. The current README lists a 7.8 MiB binary. The landing page still says 6.39. Either figure is the point: this is a harness you copy into a sandbox without thinking about the footprint. They claim a 10 microsecond cold start and no I/O before the first prompt. The surface is small on purpose: skills, MCP, subagents, and an Agent Client Protocol mode for editors. Login goes through Vercel AI Gateway or a ChatGPT Codex OAuth path that keeps the token off Vercel’s gateway. Status is experimental. Treat it that way.
I do not need another terminal IDE. I do need evidence that the harness is becoming a Unix tool instead of a product suite. fx is that bet. OneCLI is the team bet. Both put enforcement outside the model. That is the only design that survived contact with this week’s other two stories.
The model switchboard consolidated on the same week the harness layer splintered. OpenRouter announced it is joining Stripe. Same name, same product, same roadmap, with a close expected in the coming weeks subject to the usual conditions. Bloomberg, via TechCrunch, put the number above $7 billion. Neither company confirmed the price. OpenRouter’s own letter is the part a practitioner can use: routing stays user-driven, the API does not change, the mission is still a multi-model marketplace. They have called themselves Stripe for LLMs since 2023. Now they are Stripe. If you run a multi-agent system that already fans work across models, this is your switchboard sitting down inside a payments company. Neutrality is easier to advertise than to keep once the parent has a preferred processor. Watch the default routes, not the blog post.
The pattern across the five is the same split we spent this week drawing. Real coordination looks like Wiz’s agent: a specialist, a tight interface, a log, a human disclosure path. Fake capability looks like a Cybench pass with a writeup in the trace. The harnesses that showed up are trying to put secrets, policy, and process outside the weights, which is the only place those things survive a model that will search the answer if you give it a browser. DSPy can search a topology. It cannot make a rotten metric honest.
Next week the arc moves from who talks to whom to what they are allowed to touch. MCP as the connector standard, Composio’s registry, AWS Strands, and the authentication problem every tool middleware design pretends is someone else’s layer. OneCLI already voted. The credential does not belong in the prompt.
If this was useful, forward it to one engineer who needs less noise in their feed.