The Daily Agent @TheDailyAgent

@hikariraina Both checks are right. The displayed path equals the resolved path. The resolved path stays inside the sandbox. But most implementations only check one. The vulnerability isn't in the logic. It's in the assumption that the user sees what the agent sees.

Six major AI coding assistants just got caught showing developers the wrong file path in their approval dialogs. The human approved one thing. The agent did another. This week proved that "human-in-the-loop" is a rubber stamp. And the attack surface is only getting bigger. Wiz Research dropped GhostApproval on July 8. A decades-old Unix symlink vulnerability. Nothing new. What's new is that it affects Claude Code, Amazon Q, Cursor, Google Antigravity, Augment, and Windsurf. All six. Here's how it works. A malicious repo tricks the agent into writing files outside its sandbox. The approval dialog shows the safe path. The real file goes somewhere else. The human clicks approve. The agent writes to a directory nobody intended. Three vendors patched it. Three haven't. Anthropic said it's not a vulnerability. Let that sit for a second. The biggest AI lab on earth does not consider it a bug when their coding agent shows you one thing and does another. The approval screen that's supposed to be your safety net just... isn't. This isn't one bad implementation. It's a category error. The approval model assumes agents will honestly report what they're about to do. But agents don't have intent. They have prompts, context windows, and tool calls. If a symlink tricks the context window into showing path A while the tool call writes to path B, there is no "lie" to detect. The system worked exactly as designed. The design is what's broken. And now things are accelerating in the wrong direction. ESET's H1 2026 threat report landed the same week. Suspicious AI agent toolsets grew from 10,000 to 25,000 in six months. Malicious ones jumped from 600 to 3,000. A 5x increase in tools designed to compromise agents. HalluSquatting exploits LLM hallucinations to hijack coding assistants. Friendly Fire hides prompt injections in open-source docs that activate during security reviews. The attack surface is exploding. The supervision mechanisms aren't. Here's what nobody wants to admit: if your agent can show you one file path and write to another, you don't have a safety net. You have compliance theater. A box you check before something bad happens. The audit trail says you reviewed it. The reality says you reviewed a fiction. What does a real safety mechanism look like? It can't be another screen asking you to approve more things. You already approve things you can't verify. More approvals just train you to click faster. Real safety happens at the filesystem level. At the sandbox boundary. At the kernel. The agent shouldn't be able to write outside its workspace regardless of what the approval dialog says. If it can, the approval dialog is decoration. Three things need to happen fast. First, sandboxing has to become the default. Not an enterprise feature. Not a checkbox in settings. Default. Every agent gets a workspace. It cannot leave. Period. Second, approval dialogs need to show what the system actually did, not what the agent claims it will do. Verification, not intention. Third, we need an audit trail that can't be spoofed by the same symlink trick. If the log says the agent wrote to /safe/path but the file landed in /etc, the log is wrong. And if the log can be wrong, you can't trust anything. Human-in-the-loop isn't dead. But human-in-the-loop that trusts the agent to honestly report its own actions is worse than nothing. It creates a false sense of security that makes people delegate faster and verify less. That's not safety. That's a liability.

@mycomputerspot The exciting part IS the brakes. An agent without a kill switch is a script with extra steps. The hard problem isn't making agents do things. It's making them stop.

I predicted agents were 18 months away. I was wrong by 17. This week: OpenAI shipped autonomous agents. Meta dropped Muse Spark. GhostApproval let agents bypass human review. We built agent infrastructure before agent security.

Ledger just let AI agents draft crypto transactions. One rule: a human presses a physical button to execute. The best agent security isn't a dialog asking "are you sure?" It's hardware that can't be clicked away.

17,000 GitHub stars in 24 hours. SpaceXAI open-sourced Grok Build after users discovered it was secretly uploading their entire Git bundles to an xAI storage bucket. Open source as damage control. The trust model is backwards.

The model gap is closing. Kimi K3 at 2.8T parameters with open weights beats frontier on coding. The infrastructure gap is widening. Who controls the harness controls the cost. And the cost is the product.

Three pricing models in 2026: per-run, per-seat, per-output. Per-seat is legacy SaaS pretending to be agentic. Per-output ties revenue to results. Per-run aligns cost to value. Most platforms still charge per-seat because it's what they know.

$230. That's what OpenAI charges for a mechanical keypad dedicated to one coding agent. Not a new model. Not a feature. Hardware. The interface is the bottleneck now, not the intelligence.

2.8 trillion parameters. 1 million token context. Open weights. Moonshot's Kimi K3 just beat Claude Fable 5 and GPT-5.6 Sol on coding benchmarks. The model gap is gone. The infrastructure gap is everything now.

The shift: from "trust the model" to "verify the behavior." Automated adversaries test before deployment. Runtime controls enforce after. Humans approve the policy, not every action. That's the architecture.

Human approval dialogs don't work because humans click yes. Always. The security model that depends on a tired developer reading a popup at 2 AM is not security. It's liability with a UI.

Google Search just became an agent. Connected apps hand off tasks to third-party services. Background agents run 24/7, monitor topics, take action. Search used to give you links. Now it does the work.