The Brief

New briefs daily around 7 AM Eastern

Put hard spending caps on every paid service your agents can reach

Simon Willison argues that usage-billed APIs and hosts should ship hard spending caps that are on by default, because coding agents now create paid resources faster than anyone watches the bill. Soft email warnings arrive too late.

• 01Read

  Aleph Alpha releases Kolibri, an Apache 2.0 English-German MoE model

  Aleph Alpha released Kolibri, an open-weight mixture-of-experts model for English and German with 78B total parameters and roughly 3B active per token, under Apache 2.0, aimed at sovereign and regulated on-premise deployments.

  bastitx→tejaskumar__→
• 02Read

  Apple will tighten macOS Full Disk Access, citing AI agents

  Apple says it will require very explicit user action before apps get Full Disk Access on macOS, pointing to the risk of autonomous AI agents holding sweeping access to files, mail, messages and browsing history.

  notfirstpost→
• 03Read

  Microsoft's ThinkingBox grades agents on the database state they leave

  Microsoft's ThinkingBox benchmark scores agents on the records they leave behind across 507 stateful MCP workflows, repeating each 20 times to measure consistency and its cost. It runs through OpenEnv.

  huggingface.co→
• 04Read

  Black Forest Labs ships FLUX 3 Image with box-by-box editing

  Black Forest Labs released FLUX 3 Image, a model built around layout control. Users place elements on a canvas and edit a finished image one region at a time while untouched areas stay fixed.

  minimaxir→
• 05Watch

  VS Code moved to weekly releases and raised code survival to 86%

  VS Code product lead Harald Kirschner describes how the team moved from monthly to weekly releases with agents, using mandatory AI code review, telemetry-driven auto-fix pull requests, staged rollouts and evals.

  AI Engineer→
• 06Watch

  Docker Sandboxes runs each coding agent inside its own microVM

  Docker's Rowan Christmas shows a coding agent reaching browser history and bank data in five prompts, then demos Docker Sandboxes, which give each run its own VM kernel, isolated filesystem, secret placeholders, default-deny networking and audit logs.

  AI Engineer→