Ephemeris
Today's issue is about the boundary — where agent code runs, what it can reach from there, and who gets handed the key.
Eighteen sources read · five filed copy
The microVM holds. The wire out of it doesn't.
A microVM keeps untrusted code off the host and off the neighbours. On its own it does nothing about that code exfiltrating data, probing internal services, or spending whatever credentials it finds inside the environment. Vercel's argument is that a sandbox has two boundaries, and most people ship one.
networkPolicy: { allow: { "ai-gateway.vercel.sh": [{ transform: [{ headers: { Authorization: `Bearer ${AI_GATEWAY_TOKEN}` }}], }] } }
The token stays on the host and gets injected at the boundary. The guest never sees it.
Java gets the agent loop, and it looks like the annotations you already write.
The Copilot SDK for Java lets a server-side application open agent sessions, register its own tools, send prompts and stream structured events back. It is framework-agnostic and takes your own key against OpenAI, Azure or Anthropic.
The tool contract is a pair of annotations. Mark a method @CopilotTool, mark its arguments @CopilotToolParam, and the SDK generates the JSON Schema, parses the arguments and dispatches the call. If you have written a JAX-RS endpoint, you have written this.
The loop itself is one line: session.sendAndWait(prompt).get() carries reasoning and tool calling to completion. For a UI that has to stay responsive, session.on(event -> {…}) streams events as they land, with pattern matching for the types you care about.
What it needs. SDK 1.0.7-preview.1, JDK 17 or 25 — take 25 if you want virtual threads — Maven 3.9+, and Copilot CLI 1.0.71 or later. The sample runs on Open Liberty 26.0.0.5 against Jakarta EE 11, on CompletableFuture and lambdas throughout.
One binding now sits in front of every model you call.
Workers AI and AI Gateway stop being two products. A single env.AI.run() routes through the gateway whichever provider you name, a new /ai/ REST endpoint covers both, and fresh accounts get a default gateway — so full request and response logs, per-model token counts and cost attribution arrive before anyone opens a dashboard. Gateway credits now spend on Workers AI too, which makes one wallet across OpenAI, Anthropic and Cloudflare's own models. Model-first routing by capability and classifier-driven smart routing are the next two on the list.
worker · one call, any provider
await env.AI.run( '@cf/zai-org/glm-5.2', { messages }, { gateway: { id: 'default' } } )
The offensive-security model ships with an approvals door attached.
GPT-5.6-Cyber is a cybersecurity-specific model for authorized vulnerability research, exploit validation and security testing, and it is reachable through Daybreak Red rather than the general API. A second post the same morning extends the same frontier cyber models to approved Daybreak partners, so they can run governed security services for their own customers. For anyone building in this space, the access tier is the part worth reading.
Four layers, eight steps, and step five is the one people skip.
A refreshed guide to wiring a personal knowledge base to an agent. The vault is plain Markdown in a Johnny Decimal tree, the behaviour lives in a global rules file plus per-folder READMEs, and twelve role personas do the reading. Step five is semantic search over the vault — BM25 and embeddings fused with RRF — and it is what decides whether any of the other seven steps ever retrieves anything.
Four layers
- Storage
- Markdown files in a numbered folder tree, backed up to a private repo. No proprietary database.
- Rules
- One global instructions file of five to ten lines, plus a local README per folder.
- Roles
- Twelve personas — accountant, lawyer, mentor, therapist — each with a narrow mandate.
- Interfaces
- Chat, a Telegram bot, dashboards, and MCP connectors out to Notion, Gmail, Calendar, Figma.
That's today.
Issue 110, Tuesday 11 August 2026. Five picks out of eighteen sources read this morning, held to one rule: something a senior engineer or founder could act on inside a week. Nothing older than thirty days, nothing that has run here before.
Filed today — Vercel · GitHub · Cloudflare · OpenAI · @TochkiNadAI
Also read — The Batch · The Zvi · Import AI · Jeff Bullas · Anthropic · Sentry · PostHog · Fly.io · Next.js · @seeallochnaya · @denissexy · @rvnikita_blog · @ProductsAndStartups
Rubric — adoptable AI tools, creative software, dev tools and agentic coding, privacy and security where the signal is high, research with a practical kernel.
Two strong pieces missed the thirty-day cap today: Anthropic on containing Claude across products, and Fly.io on agents that break their own sandbox.