Weekly Review — Oct 26–Nov 1, 2026

This was a threat-modeling week. Monday and Wednesday both use Adam Shostack’s Four Question Framework, once on my own setup and once on someone else’s pipeline. Friday picks up the evaluator question from a different angle. And the physics post? A real break this time, mostly.

This Week on the Blog

My Agent’s Rulebook Was an Accidental Threat Model

Almost every safety rule in my personal agent setup was written the day after something went wrong, like the run that quietly swapped my cloned voice for a stock one and reported success. I put the whole setup through Shostack’s four questions and his LLM mnemonic PHANTOM-B. The pile of rules turned into a threat model with four trust zones, and one arrow matters most: untrusted pages and mail coming in. It also split the rules into two groups. Some are deterministic checks that stop the failure they check for, and some are written instructions the agent follows most of the time. Inherent threats like prompt injection and hallucination need detection and a small blast radius, and a copyable template is at the end.

How Do Noise-Cancelling Headphones Work?

Neither common story holds up. The headphones don’t just block sound, and playing something louder over the noise would only make it louder. A microphone samples the noise, the electronics play its mirror image, and at your eardrum the two add up to almost nothing, which physicists call superposition. One trig identity shows why this works on the low drone of a plane and falls apart on a high hiss: a fixed delay is a small phase error at 100 Hz and a large one at 4,000 Hz. Episode seven of Lunch Break Physics, with an interactive demo where you can drag the phase yourself.

Who Threat-Models the Vulnerability Harness?

AWS published a two-part series on an AI vulnerability harness that narrows scanner output to evidence-backed findings and scores them with a steering file. Its controls aim at the model’s own mistakes, such as findings that point at code that doesn’t exist. Running the same four questions and PHANTOM-B over it shows a second direction: the code under review reaches the model as input, so a comment claiming “validated upstream” can push the model toward a downgrade. Most of the fix is configuration and process. Keep the steering file out of the repository you scan, never let a comment alone justify a downgrade, sample-audit the P3 pile, and add injection cases to the labeled set.

Wrong, Not Broken: An Agent Evaluator Is Only as Good as Its Reference

Matt Wood’s “Wrong, not broken” describes a refund agent that answers fast with zero errors and quotes $40 where the current policy says $140, because it retrieved last quarter’s document. I rebuilt that run on Amazon Bedrock and scored it with Amazon Bedrock AgentCore Evaluations. Faithfulness, helpfulness and correctness all rated it well, because the answer is faithful to the wrong document. Correctness failed it once I passed the expected answer, and a few lines of Python comparing the document version on the retrieval span failed it too. The practical step is to record the document version on the span, so an evaluator has something to compare.

The Thread This Week

Each of the three agent posts ends up at the same place: a safeguard is only as good as what it checks against. My rulebook holds when a rule is a check that runs, and drifts when it is a sentence the agent is asked to follow. The vulnerability harness can trust a downgrade only as far as the evidence behind it, and a code comment on its own doesn’t count. And a quality evaluator scores a stale answer well unless it knows the right answer or the right document version. The headphones show the same pattern. In many sets a second microphone inside the cup measures what is left over and corrects the anti-noise against it. That’s a check with a reference, in hardware.

Further Reading

Things worth your time that did not get their own post, all public:

• Mathematics Just Changed Forever: Kevin Hartnett (Machine Learning Street Talk): A documentary on how the proof assistant Lean won over a growing number of mathematicians, and why its small trusted kernel matters. The second half is about AI: once autoformalization works, the trust problem moves to the formal statement, because a checked proof can still prove the wrong thing. Kevin Buzzard says his team found theorems by four Fields medalists that are false as literally written. In one example, the paper left out the condition that n is at least three. A good follow-up to last week’s Who Referees the AI?
• Impatient Programming: A method that keeps the values of Extreme Programming and rewrites its 29 rules for teams that build with coding agents. The intro page shows six of them, among them a Contract the agent writes each obligation into, and mutation testing that keeps an agent-written test only if it catches something no other test catches.
• Software Engineering at Google and CS Education with Titus Winters (The Pragmatic Engineer): Winters argues for learning hard lessons once and codifying them somewhere deterministic, for example by turning findings from occasional AI code review into cheap lint rules. He also explains why productivity metrics miss much of AI’s value: it lets you attempt a harder, more valuable change, and counting changes can’t see that.
• The Benchmarking Crisis (Database Architects): AI code generation tunes database engines to ClickBench query by query, for example by grouping strings on their hash alone or caching predicates that repeat across queries. The post sets out three requirements for a meaningful benchmark (ad-hoc rules that forbid caching and prior knowledge, an update stream, and systems older than the benchmark) and suggests borrowing hidden test sets from machine learning.
• Does Agentic RAG Actually Retrieve Better Evidence? (Towards Data Science): Four retrieval methods, 298 questions, 2,000 arXiv papers. The agent that could search up to three times was 1.2 points ahead of plain search on top-5 hits, inside a range that includes zero. A reranker improved the ranking clearly with no language model call at all.
• Why Agents Love Supabase (Latent Space): Supabase’s founders on what changes when a coding agent is the database’s user: declarative schemas in git instead of migration chains, and lighter local setup. They also describe early coding agents turning off row-level security to make projects work, and how Lovable was the first to write skills that steered its agent away from that.
• Taking on ServiceNow: Coding Agents for the Rest of Us (No Priors): Serval’s Jake Stauch argues that agents will make enterprises tighten permissions to true least privilege, so the layer that grants just-in-time exceptions through approved, audited workflows becomes more important. He prices on workflows run instead of tokens.

Until Next Sunday

If you take one thing from this week, list the rules your agent depends on and mark which ones run as checks and which are only sentences in a file. My guess is the next incident comes from the second group. Which of your agent’s rules would you most like to turn into a check? Tell me in the comments on LinkedIn.

This is the Weekly Review, and it also goes out as Sunday’s newsletter.