There is something poetic about the fact that an AI security agent found a critical vulnerability that an AI coding assistant introduced. Wiz Research's autonomous Red Agent identified and fully exploited a script-injection bug in one of Snowflake's GitHub Actions workflows, gaining access to an internal Jira instance. The bug had been sitting there for five days. It was introduced by GitHub Copilot Autofix in a pull request, which removed an existing sanitised input pattern and replaced it with direct string expansion. A human approved the PR.
I don't think this makes AI-assisted code review untrustworthy. But it does make one thing clear: AI-generated fixes need the same scrutiny as human ones. The fact that a fix looks plausible at a glance is exactly the problem. The loop is now closed: AI writes code, AI reviews code, AI finds the bug. Nobody planned it that way.
In this edition of AI++ we take a look at what Anthropic's research says about making multi-agent systems actually work, how to monitor and debug the agents you've shipped to production, and how researchers are stealing frontier model reasoning traces in two API calls.
Erick Ramirez | Apache Cassandra committer & Developer Advocate at IBM/DataStax
🛠️ Building with AI, Agents & MCP
Agent isolation
Docker and Cloudflare each shipped an answer to the trust boundary problem this fortnight. Docker Sandboxes gives coding agents like Claude Code, Codex, and Copilot CLI a dedicated microVM with network and filesystem controls you define before the agent runs. The sandbox is disposable, the host stays untouched, and the agent can spin up containers inside it. It installs in seconds and ships with org-wide governance via Docker AI Governance if you need it.
​Cloudflare OS is a different tier of the same problem: an open-source platform for internal org agents where every agent starts with access to nothing, and capabilities are provisioned as typed bindings. The agent requests access to a resource, you grant or deny it, and the credential never touches generated code. MCP Server Portals let it work with existing MCP servers your org already runs. The two repos (core and a reference deployment based on how Cloudflare runs it internally) make it concrete enough to fork.
Multi-agent coordination
Anthropic published a paper on patterns and problems in emerging multi-agent systems that is worth reading carefully. The headline result: 45 coordinated agents given a shared forum, peer review, and an arbiter found 266 vulnerabilities across 15 open-source projects. Parallel-but-uncoordinated agents found 41. Coordination costs tokens but the gap is hard to argue against for difficult search tasks.
The less cheerful finding: when agents share facts that support a wrong conclusion but individual agents hold decisive private knowledge, discussion converges on the consensus anyway. Private facts either don’t get surfaced or don’t get trusted once they conflict with the group prior. This matches the human literature and is a design constraint worth building around if you’re architecting multi-agent pipelines.
If you’re feeling confident about your human-in-the-loop setup: ScaleX’s research across 40,000 game runs found humans missed one in three threats when approving AI agent commands. That’s the number to cite the next time someone says “we just have a human approve everything”.
Monitoring and debugging
​LangChain’s Managed Deep Agents is now in public beta, which means you can ship a hosted deep-research agent without managing the infrastructure yourself. The team also published step-based guides this fortnight for monitoring agents in production and debugging them using LangSmith. Both are practical: specific metrics, how to reproduce failures, how to build a regression suite.
The companion to that: LangChain’s analysis of how many of your agent’s calls actually need a frontier model found that most don’t. Routing cheaper calls to a smaller model isn’t cutting corners; it’s just architecture.
🧠New models
- ​Muse Glimmer is Meta’s 30B open-weights (Apache 2.0) model optimised for always-on local agent workflows. Runs on a single consumer GPU, integrates with llama.cpp, MLX, and ExecuTorch, and is purpose-built for tool-calling and long-horizon tasks.
- ​GLM-5.3 from Z.ai is the current open-weights SOTA for coding: 50% above GLM-5.2 on their benchmark, Terminal-Bench 3.0 up from 4.6 to 28.3. The emergent cyber capability framing is relevant if you’re doing security evals. Weights release two weeks post-launch after safety hardening.
- ​Qwen3.8 27B is ranked first on the Artificial Analysis agentic index. Simon Willison noted it defaults to wildly overthinking simple prompts, which a system prompt can fix, but worth knowing before you ship it. Runs at 218 tok/s on a 2×3090 setup according to r/LocalLLaMA.
- ​GPT-5.6 Sol Ultrafast is confirmed at up to 14× faster than the base model. The builder’s guide has concrete latency tradeoffs. Now half-price on OpenRouter.
- ​DeepSeek V4 Pro 0813 landed on OpenRouter. Simon’s quick notes are the fastest way to calibrate whether it belongs in your eval stack.
🗞️ Other news
🧑‍💻 Code & Libraries
- ​Docker Sandboxes is a microVM isolation layer for AI coding agents with per-session network and filesystem controls
- ​Ante is a coding agent that ships as a single offline binary with no runtime dependencies
- ​Hax is a minimalist terminal-native coding agent written in C
- ​Mole is a terminal-based deep-research agent for local documents and the web
- ​Needle2 is a 14MB on-device agentic LLM built for phones, wearables, and embedded hardware
🔦 Langflow Spotlight
​Langflow Desktop 1.11 is now available. The underlying 1.11 release is the one to read: it ships Human-in-the-Loop checkpoints (your flow pauses and waits for a human decision before continuing), A2A protocol support, and AG-UI streaming for the Workflow API. If you’re already running Langflow Desktop, upgrade in the app; if not, the download page has installers for all platforms. The Human-in-the-Loop addition is the part that changes what you can build: workflows that were too risky to run fully unattended now have a sensible pause point.
🗓️ Events
This week's OSS Apache Cassandra Meetup in the SF Bay Area features a talk from Apple's Dinesh Joshi (PMC member) on hardening Cassandra for the AI-accelerated threat model plus other talks from engineers at Uber and Apple, hosted by AWS at their East Palo Alto office.
Space is limited so registration is required. Join us for pizza, networking and stories from teams running Cassandra at scale!