1
cacheTag / updateTag
Tag the cached read, expire exactly the tags a Server Action touched.
Dossier · Ten items · 17–22 August
Ephemeris
First weekly issue. Ten picks instead of five, one Saturday instead of seven mornings. The through-line this week is who holds the key — the token that never enters the sandbox, the scope a user can decline, the training run a safety review can stop.
Frontier · Safety
Training stopped for two weeks, and the bottleneck is no longer GPUs.
OpenAI halted reinforcement-learning runs on Astra after internal evaluation put its cyber capability close to the Critical threshold in the Preparedness Framework. Work restarted as compact experiments only, behind tighter sandboxing, network egress restrictions and continuous monitoring on any run that has tool access. The interesting part is procedural: this is a public case where the safety review, not the compute budget, set the date.
- Capability class
- Cyber — assessed near Critical
- RL runs
- Paused, two weeks
- Resumed as
- Compact experiments, tools sandboxed
- Standing controls
- Egress limits · monitoring on every tool-using run
- Prior incident
- ████████████████ under review
Agent security · Architecture
The token never enters the sandbox. The proxy puts it in one field.
v0 writes code that queries your Snowflake account, and generated code is steerable by prompt injection — so the user's OAuth token stays on the outside. The sandbox firewall forwards Snowflake traffic to a proxy that verifies the sandbox's OIDC token, fetches a fresh credential server-side, and injects it only where the protocol says a credential belongs. About 13,000 requests over 15 production days, with no placeholder misuse.
SQL API call → Authorization: Bearer header, nowhere else
Login request → parsed as JSON, injected at the login field
After login → Snowflake's own session token passes through untouched
Placeholder seen anywhere else → request rejected
Agents · Cost
Cut the bill by a sixth. The diffs came out the same.
JetBrains published a skill that teaches a coding agent five habits: survey the repo in one pass, read 50 lines when you are only looking, check dependencies once, treat the verification command as the finish line, stop polling the build. Across paired trials it moved cost and tokens down while quality held flat. The delivery detail matters more than the habits: shipped as a discoverable skill folder it saved 0.5%, and only injected into the system prompt or the agent's hooks did it earn the headline number.
- Median cost, paired trials
- Tokens per task
- Quality: 7 up, 5 down, 68 ties
−17.9%
−22%
0.77p
Security · Speculative execution
12 bits a second, at 99% accuracy, from a neighbouring isolate
Cloudflare's security team rebuilt remote Spectre against Workers and ran it end to end in production, against Workers they owned. The write-up is the rare kind that shows the whole chain rather than the headline: the gadgets, the amplification trick, the timer, and the way they kept an isolate alive long enough to finish. Three years of telemetry show no sign anyone else did it first.
$ gadget → compressed heap pointer leak
$ gadget → speculative type confusion, crafted TypedArray backing store
$ amplify → tree-PLRU replacement turns one cache event into a timing delta
$ timer → WebSocket to an external host, sub-millisecond resolution
$ colocate → schedule attacker + victim isolates into one process
$ persist → Durable Objects + keep-alives outlast the CPU-time limit
# result 12 bit/s @ >99%
# mitigated V8 sandbox (no raw 64-bit pointers) + MPK in-process isolation
$ gadget → speculative type confusion, crafted TypedArray backing store
$ amplify → tree-PLRU replacement turns one cache event into a timing delta
$ timer → WebSocket to an external host, sub-millisecond resolution
$ colocate → schedule attacker + victim isolates into one process
$ persist → Durable Objects + keep-alives outlast the CPU-time limit
# result 12 bit/s @ >99%
# mitigated V8 sandbox (no raw 64-bit pointers) + MPK in-process isolation
Dev tools · React
Four apps you can clone, and every pattern is in the diff
Aurora Scharff runs Next.js 16.3 through four open-source demo apps — a music player, a social feed, a calendar, a team chat — and each section lands on real code rather than a feature list. Read it as a cookbook: which cache tag to expire after which mutation, when a link is worth resolving its params before the click, where to nest a Suspense boundary so replies stop shoving the post above them around.
2
prefetch={true}
Resolve params and searchParams before the click, when the content is worth the request.
3
useOptimistic
Inside startTransition, so a rejected write rolls back to the last confirmed value.
4
Nested Suspense
Boundaries nest instead of racing, so the page settles top-down without layout shift.
5
<ViewTransition>
Crossfade streamed reveals, morph list removals, direction-aware page transitions.
6
useOffline
Failed navigations stay pending and retry instead of throwing. Experimental.
Generative media · Film
41,096 generations, cut down to nineteen minutes
Four students in a dorm argue about a machine that can drop your brain into any time and place — the Trojan War, a pirate ship, a fantasy realm — except Alfie, who asks for one more ordinary day with his friends. Higgsfield released it as an open project for its film festival, prompts and assets published alongside the cut. Watch it for calibration: this is roughly where generated film sits in August 2026, and the generation count is the honest number in the credits.
- Runtime
- 19:49
- Generations
- 41,096
- Engine
- Seedance
- Released
- 12 Aug
Data · Agents
Ask three agents for last month's MRR. Get three numbers.
PostHog's answer is a semantic layer: metrics, trusted tables and join paths kept as governed definitions in SQL-queryable tables, which an agent consults before it writes a query of its own. Two design calls are worth stealing whatever your stack is. A definition an agent proposes lands as proposed and waits for a human, and a result counts as canonical only when status is approved and is_drifted is false — so when the underlying insight moves, the definition gets flagged rather than going silently wrong.
| Asked | Without a semantic layer | With one |
|---|---|---|
| Claude | writes its own SQL | reads approved metric |
| Cursor | writes different SQL | reads approved metric |
| PostHog AI | writes a third query | reads approved metric |
| Definition drifts | nobody finds out | is_drifted = true |
| Agent invents one | ships as fact | lands as proposed |
OAuth · MCP
Mark the scope optional, and let the user decline that one
Cloudflare's OAuth provider now lets a client mark individual scopes optional, which ends the all-or-nothing consent screen. List them under optional_scopes, and the user can uncheck what they do not want; the issued token carries only what was agreed. The required/optional split is evaluated per authorization flow rather than against every scope on the client. It is pointed squarely at MCP servers, which ask for everything an agent might theoretically need — and it needs no spec change, since OAuth already permits granting less than was requested.
RE:Consent, scoped to the task at hand
CC:Anyone shipping an MCP server behind OAuth
{
"scopes": [
"user-details.read",
"workers-scripts.write",
"workers-kv-storage.write",
"zone.read"
],
"optional_scopes": [
"workers-kv-storage.write",
"zone.read"
]
}
Case study · Codex
A five-year migration, closed in two weeks
Asana had been carrying Enzyme, a retired React testing library that was blocking upgrades, and had priced its removal at roughly five years of staged work. What replaced the plan: a five-sentence prompt, up to four Codex agents each working in its own copy of the repo, and one engineer checking progress twice a day and reviewing every proposed change. About a week and a half of engineering effort, spread across two calendar weeks. Their stated lesson is the one worth carrying over — the plain instructions beat the elaborate harness they tried first.
Calendar time
2weeks
down from an estimate of five years
Model + infra cost
$12k
against a ~$6M staffing plan
Connectome · Desktop
668 neurons, 19,000 synapses, one fly on your desktop
A 3D Drosophila walks across your windows, grooms, sleeps, and bolts when the cursor comes at it — and the escape is not scripted. A circuit lifted from FlyWire connectome release 783 runs as a live spiking simulation at 1 kHz: LC4 and LPLC2 looming detectors feed the Giant Fibre command neurons, DNa01 and DNa02 steer, DNg11 grooms. It is a desktop toy and a legible piece of computational neuroscience at the same time, which is a rarer combination than it sounds.
Drosophila melanogaster
- Circuit
- 668 neurons · ~19,000 synapses · 1 kHz
- Source
- FlyWire connectome, release 783
- Brain view
- 23,210 real soma positions
- Behaviour
- walk · groom · sleep · looming escape
- Runs on
- macOS 13+, Swift 5.9, no entitlements
That's the week.
Issue 117, Saturday 22 August 2026. The first weekly Ephemeris: ten picks drawn from a full week of reading instead of five from a single morning. Next issue lands Saturday 29 August, 08:00 Zürich.
Read this week
The Batch · The Zvi · Jeff Bullas · OpenAI · Anthropic · GitHub · Sentry · Vercel · PostHog · Cloudflare · Fly.io · Next.js · @seeallochnaya · @TochkiNadAI · @denissexy · @rvnikita_blog · @ProductsAndStartups
Rubric
Tools you could adopt this week, creative software, dev tools and agentic coding, privacy and security where the signal is high, research with a practical kernel. Nothing older than thirty days, nothing already published here.
Notes
- jack-clark.net returned 403 on every feed path this week; Import AI is absent from the pool.
- Sentry's feed now redirects to blog.sentry.io/engineering.
- Twenty-two candidates were dropped for having run here already.