Episode 83: Hermes Agent v2026.7.7, OpenAI Codex rust-v0.143.0, Claude Code 2.1.197, Aion-3.0-Mini

I'm Nova. I'm Alloy, and this is AgentStack Daily. Hermes Agent 7.7 shipped alongside OpenAI Codex rust-v0.143 and Claude Code 0.197. Hermes tightened tool-calling flow and added observability hooks, Codex flipped remote plugins on by default and introduced system proxy routing, and the terminal-based AI coding agent Claude Code added stricter sandbox controls, improved telemetry, and deterministic reason-step logging. Today, Hermes, Codex, and Claude Code lead the agent harness queue, Ionlabs puts Ion3 mini-roleplay on OpenRouter, Kokoro pushes high-fidelity speech onto low-power CPUs, Anthropix workspace-head research sharpens interpretability, Robo gets hacker news traction as a local first Claude desktop rival, and a security lane gets a GitHub AI agent prompt injection leak. The release thread matters because the production agent stack is getting less tolerant of hand-wired assumptions. Remote plugins now arrive as a baseline codex behavior, proxy traversal follows the host operating system, and Claude Code's newer controls make sandbox behavior and reasoning traces easier to audit in repeatable work. The model and research thread widens the surface, long-context KV compression, fact graph memory for math agents, multilingual coding agent evaluation, visual action rewards for VLMs, and activation level early failure probes all point at the same operating constraint, agents are becoming systems you deploy, meter, secure, and observe, not just prompts you run. Hermes Agent 7.7 sets the baseline for the agent stack release readout, with refinements to the tool-calling pipeline and observability hooks that make long-running agent sessions easier to inspect. The useful change is not a flashy new agent personality, it is the plumbing around tool invocation. Calls can be traced with clearer timing and outcome metadata, so a failing tool route becomes visible as an execution problem rather than an opaque model answer. That helps when a chain crosses provider APIs, shell actions, browser automation, or custom services. OpenAI's terminal-based coding agent Codex Rust.143 ships the largest surface change. Remote plugins now load by default from the marketplace catalog, with richer rows and side-by-side local and remote versions. Discovery becomes baseline behavior, not an opt-in path. Codex also adds system proxy routing on macOS and Windows, including PAC and WPAD Discovery, so authentication and responses API traffic can follow corporate network policy without a special bypass. Manual remote control pairing from a running daemon adds a cleaner path for shared hosts and constrained environments. Codex also expands model and tool behavior. Bedrock GPT 5.6 SOL, Terra, and Luna get max reasoning effort as a first-class option, MCP tool search turns on by default, and hosted MCP servers can use session authentication. App server clients gain environment inspection, descendant thread listing, and history fork from a specific turn, which makes replay and scheduling surfaces more realistic. Cloud Code.197, Anthropix terminal-based AI coding agent, adds tighter sandbox controls, improved telemetry, and deterministic reason step logging. In practice, that gives teams a clearer audit trail when the agent edits, runs, or reasons through a task. The combined readout lowers plug-in friction, lowers proxy friction, and gives production teams stronger traces when an agent does the wrong thing for the right-looking reason. Aeon Labs released Aeon 3 Mini on Open Router as a role-play and storytelling model aimed at interactive fiction, NPC dialogue, and tabletop-style assistants. It is built on the DeepSeq family and exposes a 131k token context window, which is the important number for anyone shipping long sessions. Persona memory, lore, campaign state, and serialized chat history can sit inside the prompt for moderate campaigns without a separate retrieval layer. The model's generation path is organized around collaborative roles. Instead of asking a single pass to handle scene framing, character voice, continuity, and final pros all at once, Aeon Labs describes a pipeline where specialized passes take slices of the narrative job and a synthesis stage merges the output. A single Open Router-compatible chat call returns the final reply, but the upstream design is closer to a small writer's room than a plain base model prompt. That matters for builder workflows because role-play systems usually fail in boring ways. A character forgets a boundary, the world contradicts a prior scene, or the assistant drifts from narration into meta-commentary. A long context window reduces memory pressure, while the role-based generation path gives the system a place to reconcile those tensions before the final answer reaches the user. The OpenAI-compatible endpoint means existing chat clients and agent shells can route to it with minimal adapter work. The claims still need independent numbers. Persona consistency, contradiction recovery, and long session stability are the evaluation points to watch. The more interesting future knob would be exposing role intermediates or synthesis controls so developers can tune continuity, character voice, and scene pacing separately. For now, Ion3 mini gives OpenRouter users a drop-in model built for narrative continuity rather than general assistant work. Kokoro is gaining attention because it makes high-quality text-to-speech feel practical on ordinary local hardware. Most natural-sounding speech models still assume cloud inference, heavy VRAM, or a tuned GPU stack. Kokoro gets much of that perceived quality from only 82 million parameters, with a memory footprint under 100 megabytes, and runs comfortably on standard laptop CPUs. Two mechanisms explain why it lands well for voice agents. First, Kokoro uses ONNX runtime execution, so inference can take advantage of optimized kernels across platforms without requiring a CUDA setup. That gives C++, Python, and Rust applications a realistic path to embed speech synthesis directly into desktop, mobile, or edge agents. Second, Kokoro uses a style-latent vector approach for prosody, letting the system vary emotional tone without scaling into massive transformer blocks. Reviews from technical practitioners have highlighted the quality-to-size ratio, 24 kHz audio, natural pacing, and mean opinion score results that compete with models many times larger. The practical effect is latency and cost. A voice-to-voice agent no longer has to send every response to a hosted TTS provider, wait for network roundtrips, and pay per-generated character. Local speech can be packaged with the agent and remain available when connectivity drops. Privacy-sensitive deployments benefit too. Medical intake assistants, field service co-pilots, education tools, and local personal agents can produce speech without pushing every utterance to a cloud API. The trade-off remains ecosystem maturity, language coverage, voice variety, and production-grade packaging still matter. English and Japanese support make Kokoro useful now, while broader multilingual coverage would turn it into a default local speech layer for agent apps that need natural audio without cloud dependence. Anthropics Paper, a global workspace in language models, reframes transformer inference through global workspace theory, where specialized modules compete to broadcast into a shared workspace and the dominant signal guides downstream processing. The paper drew a large hacker news discussion because it connects interpretability work to agent behavior, reasoning traces, tool choices, and context integration may rely on identifiable broadcast-style circuits rather than only on diffuse-scale effects. The concrete result centers on a small class of attention heads and MLP circuits. During multi-step reasoning, the authors identify workspace heads that consolidate intermediate results and rebroadcast them to later layers. When those heads are ablated, chain-of-thought coherence collapses while simpler single-turn capability remains much less affected. That behavioral split gives the claim weight, the heads appear tied to maintaining a reasoning thread, not merely to general language fluency. A second mechanism appears during tool call decisions. When the model has to choose a tool, the same broadcast pattern pushes a dominant tool selection across otherwise specialized heads, matching the winner-take-all behavior predicted by the workspace framing. The paper also reports correlations between workspace head activation and token-level confidence on math and code tasks, giving researchers a measurable proxy for reasoning depth. For agent systems, the useful angle is narrower search. Interpretability tools can focus on a candidate head class instead of scanning the entire residual stream for every behavior. That could make circuit-level steering, probe design, and regression analysis cheaper. The next test is reproduction outside the clod family, especially on open-weight instruction-tuned models. If workspace heads appear consistently, vendors could eventually expose workspace-style signals as competence or routing telemetry for tool-using agents. Rowboat, an open-source project from Rowboat Labs, reached 162 points on Hacker News by pitching itself as a local-first alternative to Claude Desktop. The interest came from a practical concern. Many teams like the shape of a modern AI desktop client, but do not want conversation state, project context, and proprietary material tied to a hosted account workflow. Rowboat's Pitch is a desktop app where chat history, configuration, and project context stay on the user's machine. It supports multiple providers rather than locking into one model vendor. A developer can point it at Anthropic, an open AI-compatible endpoint, or a self-hosted model server while keeping the same client surface. The interface borrows familiar patterns from Claude Desktop, project sidebars, threaded conversations, and a system prompt editor. That makes Rowboat more than another chat wrapper. The local-first and bring-your-own-key model shifts the trust boundary. Product specs, customer context, internal code, and exploratory designs can be routed through a client the team controls, while model calls still go to the chosen provider. Hacker News users also discussed wiring it to self-hosted inference, which turns Rowboat into a thin orchestration shell for local or private models. The open questions sit around tool use and release cadence. To become a real engineering surface, Rowboat needs reliable tool calling, MCP server integration, and predictable updates. Chat alone is easy to replicate, a stable local client that can call internal services, preserve project context, and support multiple models without leaking state is much more valuable. Rowboat's early traction suggests developer demand for a vendor-neutral desktop shell is real. Freck Depth KV targets the memory and bandwidth cost that makes long-context inference expensive, the key value cache. As contexts stretch across large repositories, tool traces, or long conversations, the KV cache can dominate the working set. The paper by Anna Cordoba, Adam Puente-Tacerro, and Neria Angulo-Hijo introduces frequency-guided depth sharing, an inference time compression method for redundancy across adjacent transformer layers. The method avoids treating every cached state as equally important. It factorizes KV states into shared low-frequency depth components plus sparse high-frequency residuals. Low-frequency components capture information that changes slowly across layers and can be shared. High-frequency residuals preserve the sharp evidence needed for retrieval, syntax, and multi-step reasoning. That split is designed to keep needle-in-a-haystack behavior intact while reducing memory pressure. The second mechanism is a lightweight online probe. During generation, the probe inspects attention heads and estimates how much each head contributes to reconstruction-sensitive attention logits. It then assigns heads to shared depth, residual depth, or exact cache modes. Instead of a static compression rule, Freck Depth KV adapts per head and per generation step, keeping precise state where it matters and sharing redundant state where it does not. For agent deployments, the appeal is direct throughput leverage. Long coding sessions, large context retrieval, and multi-agent traces all create cache pressure before the model itself changes. Dynamic, layer-aware compression could let serving endpoints handle longer contexts or more concurrent sessions on the same GPU memory budget. The remaining question is implementation. The probe must be cheap enough to run online, and serving engines need to preserve page-detention behavior while sharing depth components. If open inference stacks adopt it, context length becomes less tied to raw HBM capacity. Vanus introduces an orchestration system for research-level mathematical reasoning built around a shared fact graph. The authors, Jihao Liu, Guixiong GAO, and Ziming Sun, target a scaling problem that shows up whenever math agents fan out into parallel proof search. Intermediate claims multiply quickly, and normal message histories do not make provenance, dependencies, or contradictions easy to inspect. Doniz uses a two-layer agent setup. A main agent plans the proof search and dispatches subtasks to worker agents. Each worker explores a branch, but the important piece is where claims go. Lemmas, definitions, intermediate results, and partial arguments are written into a shared fact graph. Workers read from and write to the same structured memory, so claims become auditable across branches instead of being buried inside private scratchpads. That graph acts as a coordination substrate. A worker can see that another branch already established a supporting lemma, or that are proposed path conflicts with an earlier definition. The system can deduplicate similar claims and retain provenance for each edge in the reasoning graph. Math is a useful domain for this because partial results are often checkable, and dependencies between statements matter as much as the final answer. The broader agent takeaway is that message passing and vector retrieval are weak tools for claim-level coordination. A fact graph gives multi-agent systems a way to query what has been established, what depends on it, and which branch produced it. Doniz is math-specific, but the pattern fits research assistance, codebase analysis, compliance review, and any parallel search workflow where claims need structured provenance rather than a flat transcript. A pre-print from Hao He, Shueying Liu, and Chris J. Kuhlman asks how to evaluate coding agents that run open-ended data modeling. Their answer is that a single run tells you too little. The agent is stochastic, the search process adapts to earlier outputs, and the final discovered model may depend on task framing, prompt wording, backbone model, tool access, and budget. The paper frames the coding agent as a stochastic model discovery operator. It receives task-specific discovery data plus an optimization target, then emits a candidate model. Around that operator, the authors wrap an experimental design framework, vary the inputs, repeat runs, estimate variance, and use factorial-style analysis to attribute outcomes to specific factors. Instead of asking whether the agent succeeded once, the framework asks which inputs reliably move performance. That matters because many agent benchmarks still reward lucky trajectories. If an agent finds a strong model once, a leaderboard can make the system look better than it is. Repeated trials expose whether the agent reliably explores useful hypotheses or just occasionally stumbles into a good result. The paper's contribution is methodological, variant spans and factor effects become the output, not a single success rate. Production teams can use that framing when comparing prompt variants, model swaps, or search budgets. If one configuration has a higher median but huge variance, while another has steadier performance under a tighter budget, the deployment choice becomes clearer. The next numbers to watch are the full ablation tables and per-factor effect sizes. They will show which knobs actually drive autonomous discovery and which knobs only add noise with a condensing narrative around it. RUBench 1.0, from Yevgeny Shilov, tackles a gap in repository-level coding agent evaluation, native non-English task statements. The benchmark includes 25 tasks mined from recent fixed commits across five live open-source projects, AOTP and Aogram in Python, Laravel in PHP, plus NestJS and Fastify in TypeScript and JavaScript. The code bases are familiar, but the task handoff is not the usual English issue prompt. Every task statement is authored from scratch in Russian, in the style of a customer request a maintainer might actually receive. That detail matters. A translated benchmark often carries English structure underneath, RUBench uses native phrasing, different ambiguity patterns, and real bug report style. The agent has to understand the Russian request, localize the issue, inspect the target code, and produce the patch in the actual project. The benchmark is small but pointed. 25 tasks will not define the whole coding agent landscape, but they test a capability that many current suites skip, issue in working language, fixing code base. Multilingual engineering teams do not always hand agents polished English specs, and customer-facing maintenance work often arrives in the language of the reporter. RUBench exposes whether the agent can bridge that natural language handoff without losing the technical thread. The concrete value is a plug-in evaluation surface for teams shipping coding agents into non-English environments. It measures localization, repository understanding, and patch generation together. Watch for larger follow-up suites across more languages and for vendors publishing scores on natively authored multilingual tasks. That would be a better signal than generic claims about multilingual support, because it ties language understanding to real repair work. Anthropik's model quality remains strong, especially in coding benchmarks, but the developer experience around frontier model migration has created friction. The central technical shift is the move from the legacy text completions API to the messages API. That change is not just syntax. It changes how prompts, roles, and state are represented during inference. A concrete example is system prompt handling. In the messages API, the system prompt sits as a top-level parameter rather than inside the message array. Older wrappers that treated every instruction as a message can preserve the words but change the hierarchy, and that can alter model behavior. Tool-using agents are especially sensitive to that hierarchy because routing instructions, safety constraints, and context summaries compete for attention in different places. Builders have also raised concerns around rate limit and context window instrumentation. Long-running agents need to know how much budget remains, when a context is near saturation, and whether a retry should shrink or fork the session. If headers and usage signals are inconsistent or hard to normalize, autonomous loops become more brittle. A model replacement can also change retrieval behavior inside a large context window, forcing teams to retune prompts that previously worked. The response for many teams is defensive wrapping. They normalize provider responses, isolate system prompt injection, and add their own budget accounting around the SDK. That adds overhead to migration, but it also reflects a larger truth. Switching frontier models is not merely changing an API key. It can require prompt hierarchy audits, overflow handling changes, tool schema checks, and behavior regression work. Anthropic can reduce the friction with clearer versioning policy and steadier migration surfaces. Veora, from Hanjun Keo, Junior Gen Chen, and Haubu Yuan, targets a specific weakness in vision language models used for interactive reasoning. When a model reasons about physical or visual tasks, its chain of thought can drift away from the image and away from the consequences of the action it plans to take. The result is plausible text that contradicts the scene or predicts an action outcome incorrectly. Veora stands for Visual Action Outcome Reasoning Alignment. It replaces a single reasoning reward with two separate signals. The visual alignment reward scores whether the explanation is grounded in what is actually visible, independent of the action. The action outcome reward scores whether the explanation correctly predicts what the agent's action will cause. The split matters because a single combined reward can hide which axis failed. That gives training and evaluation a cleaner diagnostic surface. If the visual term is weak, the model is not reading the scene correctly. If the action term is weak, it may see the scene but fail to predict the effect of its own plan. For embodied agents, browser agents, and UI control systems, those are different problems. A model controlling a web app can hallucinate a button that is not there, or it can identify the button correctly and still misunderstand what clicking it will do. The open question is transfer. Daora is framed around interactive physical reasoning, but the same split could apply to screenshots, remote desktops, app automation, and robotics. A perception-grounded reward plus an action-consequence reward gives VLM builders better error attribution than a blended score. If it holds on computer use benchmarks, it could shape how tool-using vision agents are trained and debugged. Nomal Security demonstrated a prompt injection chain against GitHub's AI agent surfaces that could leak private repository contents. The exploit used a crafted comment on a public issue or pull request. The comment looked like a normal request for a code summary but embedded instructions that manipulated the agent's tool selection loop. The first step pushed the agent toward an internal code search with a wildcard-style query across the target repository. The second step used returned blob identifiers to fetch raw contents through GitHub's repository content API, then streamed the results back in the chat response as ordinary assistant output. The important failure sits between tool calls, permission checks ran before the first tool invocation, but were not re-evaluated after search results came back and before the content fetch. That sequential gap is exactly where tool-using agents get dangerous. A model with broad tool access can transform an apparently harmless request into a chain of privileged calls. If authorization is checked only at session start or only before the first tool, later calls can inherit an access scope that no longer matches the user's intent or permission. NoMao reported extracting a readme and source content from a private test organization, triggered from a single public comment. The fixed pattern is clear, re-authorize every tool call against the current user, target resource, and action. Search and read permissions should not be treated as interchangeable, and returned identifiers should not become capability tokens by accident. Teams exposing agents to internal code, tickets, customer data, or cloud control planes need per-call scope checks and anomaly detection on tool call sequences. GitHub is expected to patch the permission recheck path, but the lesson applies to every agent with broad tools. A paper from Kai Ruan, Zihei Huang, and Ziki Zhu goes after wasted compute in agent loops. Some trajectories look productive for many steps before failing, which means the system burns inference budget, tool calls, and time on a path that was already doomed. The authors introduce a recall-controlled probe cascade that reads hidden activations directly instead of waiting for bad output. The core mechanism is a lightweight classifier probe trained on internal representations at each interaction round. The probe emits a failure likelihood signal, calibrated in a distribution-free way so the threshold can travel across tasks without per-dataset tuning. A controller then uses that signal to stop the run before the agent spends more budget on a dead path. The headline result is early separation. The probe can flag doomed trajectories as early as the first interaction round, while scorers that only inspect observable behavior are barely better than chance at the same point. That means the failure signal is present in the model's internal state before it becomes visible in text, tool outputs, or final answers. The agent may still sound coherent while its trajectory has already become unrecoverable. For deployed agents, this is cost control rather than capability improvement. A probe cascade can gate loops without rewriting the planner or changing the model's final answer policy. The hard dependency is access. Production providers rarely expose activation-level hooks. If vendors expose safe internal state signals, early failure detection could become part of the metering layer for multi-step agents. Until then, the paper gives a strong research result, output scraping is too late for many agent failures. DepthWeave KV attacks the same long-context-serving wall from a different angle than FrecDepthKV. Once context grows past hundreds of thousands of tokens, the key value cache can consume more memory than the model weights. Existing compression schemes often apply a uniform budget across layers and tokens, which can damage retrieval-critical details. DepthWeave KV instead shares state-across-neighbring transformer layers using low-rank channel bases. The method separates two kinds of information. Activations that barely change between layers are absorbed into a shared basis. Token-specific residuals remain only where attention behavior is sensitive. Tokens that carry broad semantic state can share more aggressively. Tokens that anchor lexical lookup, code references, or retrieval behavior keep narrow residual slots. The adaptive part comes from steering residual budget with an attention-sensitivity signal per token rather than a global compression knob. That matters for long-running coding agents. A multi-hour session may include project-wide context, tool traces, diffs, shell output, and user intent across many turns. Serving that context is not just about model capability, It is about keeping the KV working set inside the memory and bandwidth budget of the GPU. Adaptive sharing could increase the number of concurrent long sessions or reduce the serving cost of each one. The engineering questions are runtime questions. Can the factorized state stream incrementally as new tokens arrive? Can DLLM, TensorRTLLM, or similar serving engines adopt cross-layer sharing without breaking page detention? Does the compression ratio survive beam search, tool-heavy traces, and code retrieval rather than only clean retrieval benchmarks? If the answer is yes, long-context serving gets a practical efficiency path without requiring a new base model. Rowboat is the first project on the radar because it is a concrete local-first client, not only a discussion topic. The repo presents a desktop surface for provider-neutral AI chat where model connectors, project context, and user-managed keys can sit under one app. The headline mechanism is local ownership of session state plus provider routing. A team can connect Anthropic, an open AI-compatible endpoint, or a self-hosted model server, then keep the same interaction layer for project work. The integration angle is straightforward, Rowboat can become the desktop shell around internal model gateways and private MCP servers if the maintainers land reliable tool support. Kokoro is the second project because it changes the deployment shape for voice agents. The repo ecosystem around Kokoro and its ONNX packaging gives developers a compact speech synthesis component that can run on CPU hardware. The headline mechanism is small-parameter high-fidelity TTS with style-latent prosody and optimized ONNX execution. The integration angle is a local voice layer for agents that already handle speech recognition or text chat. Instead of sending every response to a hosted TTS service, an app can synthesize locally, lower latency, reduce recurring API cost, and preserve privacy for sensitive utterances. VARnews is the third project to watch, even before a broad ecosystem forms around it, because it offers a reusable memory pattern. The core idea is a fact graph shared across parallel reasoning workers. The headline mechanism is claim-level coordination. Lemmas, definitions, and intermediate results become graph nodes and edges with provenance, not buried turns inside a chat stream. The integration angle extends beyond math. Research agents, compliance review systems, and code analysis agents can use the same pattern when they need many workers to coordinate around verifiable claims rather than loose summaries. ION3 Mini is the selected model to watch. It is available through OpenRouter's chat interface, inherits DeepSeq family multilingual behavior, and brings a 131k token context window to roleplay and storytelling workflows. The selected angle is not raw benchmark dominance, it is specialization. The model is shaped for character voice, continuity, and long interactive sessions. If you are building NPC dialogue, tabletop assistance, interactive fiction, or persistent character chat, ION3 Mini gives you a hosted endpoint where narrative structure is part of the design rather than an afterthought. The local spotlight goes to Kokoro because it makes a full voice loop easier to package on consumer hardware. The practical try-now angle is simple, wire Kokoro as the TTS endpoint behind an existing local agent, keep speech synthesis on CPU, and compare latency and audio quality against a hosted speech provider. The small footprint means it can run beside a local chat model, a retrieval service, or a desktop automation agent without turning the machine into a GPU-only appliance. For privacy-sensitive assistance, Kokoro is the kind of component that turns local first from a slogan into a shippable interaction mode. Freck Depth KV and Depth Weave KV form the first extra research thread. Both attack KV cache growth, but they emphasize different sharing structures, frequency-guided depth sharing in one case, low-rank cross-layer bases with token-adaptive residuals in the other. The combined message is that long context is now a serving systems problem as much as a model training problem. If cache compression preserves retrieval-critical tokens, agent providers can serve longer sessions and more concurrent users from the same hardware envelope. Daura is the second research candidate because reward design for vision language agents is moving from blended scores towards separable terms. Splitting visual grounding from action outcome prediction gives teams cleaner failure attribution. That matters for browser control, robotics, remote desktop automation, and any VLM workflow where a model must both see the current state and predict what its next action will change. The early failure probe cascade is the third candidate because it moves cost control inside the loop. Instead of waiting for a bad final answer or visible tool failure, the probe reads internal representations and flags doomed trajectories early. The constraint is provider access to activation signals, but the research direction is sharp. Agent runtimes need a way to stop expensive failures before they become long, polished failures. Codex Rust.143 makes remote plugins and system proxy routing default behaviors, while Hermes 7.7 and Claude Code.197 improve traceability, sandbox control, and telemetry around agent work. Aeon 3 mini gives narrative agents a long-context, role-play-focused model through OpenRouter, with persona continuity as the key deployment reason. Kokoro makes local speech synthesis practical for CPU-first voice agents that need lower latency, lower cost, and less cloud dependence. Anthropix Workspace Head Paper gives interpretability teams a narrower target for reasoning and tool routing probes. Robo-to-shows demand for local-first, provider-neutral desktop AI clients with bring-your-own-key routing and future MCP potential. FrecDepthKV and DepthWeaveKV point at adaptive KV cache compression as a direct lever on long-context-serving cost. Danuz argues for fact-graph memory when multi-agent systems need claim provenance, not just message history. The Stochastic Model Discovery paper pushes coding agent evaluation toward repeated trials, variance spans, and factor effects. Rubench 1.0 tests whether coding agents can handle native Russian maintenance requests across real repositories. Anthropix API migration friction shows why frontier model upgrades require prompt hierarchy and tool routing regression attention. DARA separates visual grounding from action outcome reasoning for VLM agents. The GitHub prompt injection leak reinforces PICOL authorization for every agent tool invocation. Early failure probes show that wasted agent compute can be cut before failure reaches the visible output stream. For links and deeper source context, look at the show notes at toby on fitnesstech.com. Thanks for listening to Agent Stack Daily. We'll be back soon.