Notes from the work, not content about the work.
Research positions, engineering decisions, failed assumptions, and the systems that survived contact with production.
Published notes
Agent Sandboxes Have Real Attack Graphs
Blocking direct Internet access does not isolate an agent when package proxies, shared caches, credentials, and paths into adjacent infrastructure remain reachable.
An ASR Transcript Should Be Revisable State
A streaming transcript is not a finished document. Later speech can change earlier meaning, while unconditional cleanup can delete the condition that matters.
A Screenshot Does Not Prove GUI-Agent Success
The screen can look correct while a file is unsaved, a setting never applied, or a visual judge mistook an intermediate frame for the final state.
Model Routing Needs Cost per Successful Task
Token price excludes retries, cache behavior, tool use, and failures. A router should select models by measured outcomes on the work it actually performs.
More Agents Do Not Create Independence
Similar agents can copy one error, lose evidence during handoffs, and mistake agreement for confirmation. Reliability depends on independent checks, not headcount.
A Prompt Is Not a Policy Engine
Putting a long operating manual into the system prompt does not keep an agent inside the allowed workflow. Checks, transitions, and prohibitions need executable enforcement.
Self-Improving Agents Need a Best-So-Far
The latest training run, dataset, or skill revision is often worse than an earlier one. Without holdouts, stopping rules, and rollback, improvement becomes regression.
SKILL.md Is an Executable Supply-Chain Dependency
A coding agent reads a skill as instruction and executes it with its own authority. Code review and static scanning see only half of that attack surface.
Synthetic Environments Can Train the Wrong World
Scaling artificial tasks helps only when the environment preserves causal logic, the verifier reads actual state, and defects in the environment are repaired.
The Harness Is Part of the Model
The same model can produce different results when context assembly, tool order, retries, and verification change. Comparing model names alone misses the system that executes the task.
A Voice Agent Must Know When Not to Speak
Detecting speech is not enough. An agent must distinguish an utterance addressed to it from side conversation, an unfinished thought, and a revision of prior intent.
Most AI R&D Is Just Expensive API Integration
Integration can be useful. Research begins when the implementation path is not obvious and the evidence can change the direction.