AI Radar
EN edition
Public · Free

AI agents are becoming persistent operating systems, while their security debt is becoming brutally measurable

🔭 Today’s thesis

AI agents are becoming persistent operating systems, while their security debt is becoming brutally measurable. Today’s scan covered 1,602 posts across 27 fetchers and produced 506 ranked candidates. Nous turned Hermes profiles into durable bots with separate memory and skills; Garry Tan packaged personalized agents as an onboarding flow; Harvey trained an agent against a synthetic 100M-token law firm. At the same time, frontier exploitation costs reportedly fell from roughly $2,000 to $20 in two months, and an AI-generated Copilot fix helped expose Snowflake’s Jira.

The China-side signal sharpens the builder lesson. Chinese creators are no longer selling “prompt tricks”; they are packaging agents into business operating loops—meetings, recruiting, ecommerce, editing, and local coding. The durable product is the governed context-and-feedback system around the model. If you ship agents, memory, permissions, evaluation, and incident response are now one design problem.

🎯 Primary

📦 Releases and model moves

  • Nous Research — Hermes Desktop Bot Mode turns an agent profile into a persistent bot with its own role, model, memory, skills, and identity. This is an operating-system move, not another chat surface.
  • Google DeepMind — Gemini 3.7 Flash is the new fast-model release; an independent physical-tool benchmark reported a jump from 32% to 92% over Gemini 3.6 Flash, a result worth watching rather than treating as settled.
  • Qwen — Qwen3.8-27B can run locally through Cline, while Artificial Analysis reportedly places it near DeepSeek V4-Pro and GPT-5.6 Luna. A frontier-adjacent local model changes the economics of long-running private agents.
  • MiniMax — MiniMax H3 remains a heavily downloaded open video model; China-side creators are already publishing local workflows rather than waiting for a Western wrapper.
  • OpenClaw — 📌 stable v2026.7.1-2 fixes official-plugin update metadata; a separate profiling artifact records a bounded 12-concurrent-turn gateway test.

Agent infrastructure and control

  • Harvey / Engram — a 100M-token synthetic law firm, spanning about 10,000 documents and 250 matters, is being used to study agents that learn a firm’s accumulated knowledge. Synthetic organizational context is becoming test infrastructure.
  • OpenAI — The Defender’s Window argues that defenders have a short period to harden fundamentals before offensive capability diffuses. OpenAI also joined the PORTS-Pike data-center project, underscoring how agent capability and power infrastructure now move together.
  • Sierra — defense in depth for agents treats goals, guardrails, and independent reasoning as a single production control problem. Its Horizon agents also pursue insurance leads over days or weeks, making persistence commercially concrete.
  • Replit — black-box penetration tests can probe an app like an external attacker and hand findings back to Replit Agent for repair. The repair loop is useful; the generated-fix supply chain still needs independent verification.
  • OpenAI / Base44 — Base44 reports 20% fewer tokens with GPT-5.6 while building production apps and agents. The relevant metric is completed workflow cost, not token price in isolation.
  • NVIDIA — its infrastructure-security position frames AI factories as critical infrastructure. That is accurate, but it also means model-layer security claims are insufficient without supply-chain and facility controls.

💰 Investor

  • Sequoia / Irregular — the hardest exploitation task reportedly moved from unsolved in February, to occasional success at about $2,000 in April, to reliable success at about $20 in June. That is the day’s clearest economic signal: offensive capability is crossing from lab curiosity into cheap operational tooling.
  • a16z / Stripe — Stripe says agents wrote 30% of its code in one week and helped ship global tax filing in one-third the time of the US version. The conclusion is not “cut headcount”; it is build more surfaces because the marginal cost of software has dropped.
  • a16z on creator economics — agents as transaction actors could make microtransactions practical for articles and digital goods. That is a sharper creator-business thesis than another subscription bundle: machine buyers reduce checkout friction.
  • Sequoia — owning the intelligence layer is becoming the application moat. UI and distribution remain useful, but proprietary context and feedback determine whether the product improves with use.

🧠 Sense makers

  • TLDR AI — its headline set pairs GLM-5.3, the Stripe–OpenRouter deal, and agent consensus. That corroborates today’s convergence: open models, routing, and multi-agent coordination are becoming one market.
  • Rohan Paul on ByteDance research — instruction sensitivity asks whether an instruction actually changed an agent’s behavior or merely agreed with its default. That is a better controllability test than checking whether an agent completed a friendly benchmark.
  • Rohan Paul on agent memory failure — agents may retain the task while forgetting the rules. Long-context persistence therefore needs invariant checks, not just bigger context windows.
  • Lenny Rachitsky / OpenAI design — there is no training data for the next great product idea. Models compress precedent; product judgment still comes from noticing a problem the corpus cannot already name.
  • Boris Cherny — LLM bugs are shifting away from simple off-by-one mistakes toward system design, usability, and missing context. Review practices must move up a level with them.
  • Naval — “Don’t send me the report, just send me the prompt” captures a real organizational shift: reusable intent and context can be more valuable than a static artifact.

🔨 Practitioners

  • Hamel Husain — an updated eval-skills plugin adds error discovery from a file of outputs. That is the right direction: make evaluation a repeatable agent capability, not a launch-week spreadsheet.
  • Greg Isenberg — his nine-part Claude Code setup begins with a self-explaining repo, persistent memory, a brief, and a ticket. The model is rarely the missing piece; structured context is.
  • Garry Tan — GBrain asks 12 questions, generates a SOUL.md-style agent profile, and installs a skill library. Personalized-agent onboarding is becoming a product category.
  • ClaudeDevs / ABC Legal — a fleet of 50-plus managed agents reportedly cut some legal-task costs by up to 50% and uses feedback for improvement. Fleet governance, not one heroic agent, is the operative pattern.
  • Alex Finn — Grok Bot’s appeal is fewer configuration decisions plus an integrated cloud computer. Reliability often feels like removing choices.

🔥 Professional trending

  • GitHub / Apple Silicon — omlx combines continuous batching and SSD caching in a menu-bar inference server. Local-agent infrastructure is becoming ordinary desktop software.
  • Hacker News / security — an AI-generated GitHub Copilot Autofix was implicated in a path to compromise Snowflake’s Jira. Auto-remediation without adversarial verification can create a second vulnerability.
  • DuckDB — the v2.0 preview matters to agent builders because embedded analytical infrastructure is becoming capable enough to travel with the application.
  • OpenTrade — an open-source trading harness for Claude Code and Codex shows domain-specific harnesses replacing generic chat as the product surface.

👥 My feeds

  • China’s DeepSeek Harness — a China-side builder says memory is a first-class plugin that can be installed, swapped, benchmarked, and composed, while another is extracting Codepilot assets into a polished client. The notable idea is modular memory, not the brand name.
  • Seedance 2.5 — ByteDance’s video model is already being used for 30-second, reference-consistent sequences in 1080p. China’s generative-video market is optimizing for complete production workflows, not isolated clips.
  • Agent context — a folder structure is being framed as the best Claude Code upgrade: the model already has capability, but the repo has to explain the work.

🌶️ Hot signals · China market pulse

🔥 What is breaking through

  • Qwen on commodity hardware — a LocalLLaMA user published a 16GB-VRAM configuration after more than one million tokens, claiming a 73K context for agentic coding. The open-model story is turning into reproducible operator knowledge.
  • Chinese Claude Code education — creator Qiuzhi’s 60-minute Claude Code course is a high-engagement cross-platform hit. China’s audience has moved from model curiosity to full workflow education.
  • AI as business process, not assistant — Guangyu, a Chinese enterprise-AI creator, profiles a one-person ecommerce department doing more than RMB 10M annual sales through six AI-executed stages. Treat the number as a case-study claim, but notice what the audience rewards: end-to-end workflow redesign.
  • Twenty-person company, 17 months of growth — another Guangyu case packages AI transformation as durable operating cadence rather than a one-off automation.
  • Agent-native editing — Qiuzhi’s CapCut Agent tutorial signals that Chinese creator tooling is moving from generation into timeline-level execution.

👤 Trusted China-side creators

🌱 China-side weak signals

  • Meetings are becoming agent workflows — a “lobster meeting” case uses OpenClaw-style agents plus Feishu to restructure the meeting loop. The interesting unit is follow-through after the meeting, not transcription.
  • WAIC as founder distribution — Wang Yucheng’s report calls a WAIC startup town an AI-founder ideal. Chinese AI events are becoming customer-acquisition and ecosystem surfaces for tiny teams.
  • Local learning workflows — a skill built specifically to learn technical topics suggests the next education product is not course content but a repeatable research-and-practice loop.

This is the full public edition. Want the daily story angles, or a radar built for your market positioning?

See how to subscribe →