October 23, 2026 — Who Owns the Agent Spec?

Host0:29

Manik Surtani, CTO and co-founder of the Agentic AI Foundation, put it this way: “Today we host 10.” He said it in San Jose at AGNTCon + MCPCon North America. The foundation launched in December twenty twenty-five with three projects. Thursday it added four. Agent Skills from Anthropic. Open Responses from OpenAI. OpenEnv from Hugging Face. OpenSandbox from Alibaba. Agent Skills packages instructions, scripts, and resources, so an agent loads a capability only when it needs it. Think of a folder that says, here's how we do this job, plus the tools. Open Responses is the one that touches your code. It defines a shared schema, consistent streaming events, and extensible tooling. The aim is one request format, with consistent streaming events for providers that support it. The spec is based on OpenAI's Responses API. The New Stack lists support from Vercel AI Gateway, Databricks Model Serving, AWS Bedrock, Ollama, LM Studio, vLLM, OpenRouter, and others. Now the catch. Anthropic's Messages API and Google's Interactions API remain alternatives, and Anthropic wasn't among the supporters The New Stack surveyed. That's a little awkward, since Anthropic donated Agent Skills in the same announcement. The contributor guide also says the core schema files were copied from OpenAI's API. Shared governance doesn't erase where a spec came from. The foundation calls its governance neutral; fewer integrations to maintain is a design goal, not a measured result.

2:21

Speak says its time to next action fell from one point four seconds to zero point one three. That's from OpenAI's launch post for the Decisions API, now generally available. It's built with GPT six Luna, for questions with bounded answers. Classification, routing, picking an action. You send a question and the allowed answers, plus text, images, or structured input. It hands back a probability, a choice with probabilities and confidence, or a score. A score is the probability-weighted average of ordered levels, giving apps a numeric result to branch on. Price is ten cents per million input tokens, one cent per million cached input tokens, and nothing for output. Context window isn't stated in the pages I read. Neither is a distinct model ID. It runs on OpenAI's dedicated endpoint with US and EU inference residency. Whether it's on Bedrock or Vertex is unknown. New at general availability: GPT-Live integration, prompt caching, JSON inputs, image inputs in question instructions, and four hundred questions per request. That's double the old limit. Now whose numbers these are. OpenAI says up to ten times faster than GPT six Luna through the Responses API. Box reported about five times faster routing at the same accuracy, on thirty cases. Datadog reported forty times faster p ninety-five than available frontier models, with comparable accuracy. Those are customer reports quoted by OpenAI, not a controlled test. TechCrunch reports rankings of eighth on the AIM System One Index and fourteenth on the Artificial Analysis Decision Index. It also says this is plain GPT six Luna configured for speed. OpenAI's Nikunj Handa agreed, saying right now it's just plain old Luna that gets the job done. The launch demo has an avatar deciding whether to wink, smile, look sad, or look concerned. Concern, at last, at production speed. Verdict. Try it on a frequent, bounded routing or classification task where latency hurts, and measure accuracy against your current Responses API setup. Wait if a wrong answer is costly or safety-critical.

4:54

The first sandbox you create in OpenShell is deliberately an empty box. Minimal Ubuntu, no agent installed. OpenShell is NVIDIA's open-source runtime for fleets of autonomous agents, under Apache two point zero. You declare in a policy what each agent can touch, and OpenShell enforces it. Enforcement happens at the kernel, with checks on file access, system calls, and network connections. Approved network requests can get credentials injected, without exposing the real credentials to the agent. And before a policy change lands, a formal verification step flags new access, like a new host reached with credentials, for a human to review. The README says OpenShell aims to give agents useful capabilities without unrestricted access to your data, secrets, or network. The limits. Safe and private are NVIDIA's words, and I found no independent audit. Hacker News commenters raised data exfiltration through destinations a policy already allows, and the friction of managing network access. The README describes a zero point one x line, and Windows support is experimental. To try it, you need Linux, macOS on Apple Silicon, or experimental Windows with WSL two, plus Docker, Podman, or host virtualization. Run the shell installer from the NVIDIA OpenShell repo, then openshell sandbox create, dash dash name demo.

6:33

Arista scored this one ten point zero on CVSS three point one, nine point five on version four, and says it's being exploited now. It's in on-prem VeloCloud Orchestrator, the central management interface for VeloCloud SD-WAN, so a compromise can have implications beyond that one host. Affected are the five point two, six point one, six point four, and seven point zero release trains. The advisory lists affected cutoffs of five point two point three point fifteen, six point one point three point seven, six point four point two point seven, and seven point zero point zero point two, and below. Arista says exploitation needs network access to the web interface and certificate-based authentication between VeloCloud Edge and the orchestrator. No tenant or operator credentials are required. The weakness is improper input validation, reaching privileged internal functionality. Fixes exist for five point two point three point sixteen and later in the five point two point three train, and six point four point two point eight and later in the six point four point two train. Fixes for other trains will be added over time. Here's the wrinkle. BleepingComputer reports a different CVE identifier and describes an authenticated SQL injection that escalates privileges. Its patch versions differ too. It's unclear whether the two accounts describe the same flaw, so triage from Arista's advisory. Arista adds that there's no single definitive indicator of compromise. Its checklist includes unexpected database exports and archive artifacts, so you're looking for things that shouldn't exist. Check your exact version. Restrict web access to trusted admin networks. Review web, backend, system, and database logs. Then upgrade when your train has a fix.

8:37

A typical proof in Anthropic's new work runs about six hundred thousand lines. A proof checker verifies it. Anthropic says Claude proved security properties for executable RISC-V code across one hundred twenty-three open-source libraries, covering two hundred thirty-nine fuzz-test entry points. The total is about one hundred eighty million lines of Rocq proof. Here's the mechanism. Take an existing OSS-Fuzz entry point and turn it into a spec: this test never crashes on any input under sixty-four megabytes. Claude writes the proof over the compiled instructions, and Rocq checks it. The attempts also found hundreds of bugs. One out-of-bounds write needed an input around twenty megabytes with a rare layout. One read needed sixty-four megabytes and over two gigabytes of memory. One proof had Claude reason about whether the red-black tree in libc plus plus stays balanced, because otherwise a set destructor could overflow the stack. On cost, Anthropic reports Opus five point five proved half of thirty-six small tasks using about forty percent fewer tokens than Opus five. Agents sharing proofs used seventeen percent fewer than agents working alone. Those are Anthropic's numbers. Now the limit, which Anthropic states plainly. Formally verified does not mean bug-free. The proofs assume a modeled, single-threaded static binary with a fixed memory budget, on RISC-V running Linux. Many deployments use x86 or ARM and dynamic linking. Hacker News raised the old problem too. A proof holds relative to its specification, so a wrong spec can prove the wrong thing. Whether this makes verification practical at scale is Anthropic's reading of its own results. It cites seL4, two person-years to implement and twenty to verify.

10:41

Claude Code two point one point three zero nine. Sandboxed Bash commands on macOS and Linux were running shell startup files outside the sandbox before each command. That's fixed, along with macOS denyWrite globs reached through a symlink, the case where sandboxed commands and auto-accepted edits could modify the MCP config file passed with `--mcp-config`, and Linux write-denies lifting after a background command outlived the session. If you rely on the sandbox, upgrade and retest. It also fixes transcripts that jq couldn't parse after an emoji got sliced in half. Bun one point four point four. Bun's own benchmark has `bun fmt --check` checking Prettier's repo, two thousand six hundred sixteen files, in fifty-nine point seven milliseconds. Prettier took seventeen point one seconds. It reads Prettier and oxfmt config, and `bun check` is up to seven point eight times faster on selected projects. Yarn Berry lockfiles now migrate too. Those are Bun's numbers, so diff the output on your repo before switching. Run bun upgrade, then bun fmt dash dash check. Ruff zero point seventeen point two. It adds a check for unnecessary regular-expression compiles, plus a configurable allowlist for the PLR two thousand four magic-value rule. It also fixes syntax errors on starred type-variable constraints in four rules. The notes give no example for the new check, so run it before enabling it everywhere. FastAPI zero point one six one point one. It fixes the OpenAPI schema for standalone nullable form unions. Narrow patch. If your forms use those and you generate clients, upgrade and diff the schema.

12:31

Fast Boot. Secrets, kernels, and a trenchcoat. Railway rotation. Railway spotted anomalous activity on October twenty-first in systems storing customer environment variables, and told every user to rotate secrets. It believes this is part of attacks targeting platform companies and AI inference providers, which is efficient, since those systems can hold API keys. KSMBD flaws. The Hacker News reports two KSMBD remote code execution flaws rated nine point zero by Trend Micro's Zero Day Initiative, with no fix in mainline Linux or linux-next at the time of reporting. One was reported as triggerable without network authentication on a server running KSMBD on port four forty-five. Greg Kroah-Hartman complained about both public reports seventeen seconds apart, the only part of this disclosure that moved quickly. Docker's trenchcoat. A developer who wrote a container runtime for fun found that runc can approximate fork by re-running itself with a special argument. It's a workaround hiding behind an everyday docker run, and the author calls containers five Linux kernel features in a trenchcoat. A kernel maintainer in seventeen seconds, a runtime in a trenchcoat, and your secrets in need of rotation. That's Fast Boot.

13:57

Today: the foundation adopting Agent Skills and Open Responses, OpenAI's Decisions API, NVIDIA's OpenShell, the VeloCloud zero-day, and Anthropic's formal verification proofs. Try this: install OpenShell and create that empty sandbox. And if you run an on-prem VeloCloud Orchestrator, check your version first. Show notes and sources are on the episode page. Follow The Daily Reboot in your podcast app so tomorrow's show lands on its own. I'm your host. Go rotate something.