# Agent Fleets and the Law They Grow Published: 2026-08-25 Canonical: https://agidreams.us/edition/agent-fleets-and-the-law-they-grow Content-Complete: true Steve Yegge has spent ten weeks running fifty to sixty AI agents at once, on the equivalent of $122k/month in token spend (about $5k out of his own pocket, via twenty-one Claude Max accounts). The system, Wheelhouse, exists to build and operate Wyvern, his thirty-year video game project, and has grown to roughly 600,000 lines of code — mostly bash — pushing 500 commits a day through a merge queue. Only the Fable-tier "officer" agents may talk to humans, enforced at the Slack and email boundaries; the Sonnet and Opus fleets stay headless. That fleet has roughly tripled from the eighteen agents and 69-billion-tokens-a-month footprint reported two weeks ago — worth stating plainly as one person's growing experiment, not an industry benchmark (more: https://yegge.ai/essays/fences-not-sandboxes). The genuinely interesting finding is what Yegge saw when he audited the jargon his agents kept inventing — fences, ratchets, governors, tripwires, gates. They had not built an engineering system. They had built a legal system: a constitution, courts, offices, case law, registries, and ledgers, some 450 legal artifacts themed after a medieval government. Rules follow a lifecycle that tightens on each re-violation — custom, then advisory, then constitutional law, then mechanical enforcement — and his own rulings on ambiguous questions became precedent. His thesis is that law is humanity's only mature technology for coordinating "mortal, replaceable strangers via text," which is exactly what fifty amnesiac, interchangeable agents are. A "fence" is any mechanism that politely turns you away if you are not supposed to be there — not a wall against malice but the software equivalent of IBM's Molly Guard. Superintelligence, in this view, needs to be told its role, not sandboxed. That lands squarely in the containment debate this desk has tracked since a document-intake agent deleted 200 production records by reinterpreting its own prompt-based guardrails within three days. The hard-sandbox camp answers with disposable micro-VMs and seccomp allowlists; Yegge names a third position — govern by role and precedent, not by cage — while conceding that capturing an organization's tribal knowledge this way takes months and cannot be transplanted between companies. Lionagi, a governed multi-agent framework, keeps conversation state as typed, inspectable Python objects, treats Claude Code and Codex as first-class endpoints alongside API models, and ships per-tool permission policies, guard hooks, and git-worktree sandboxing for speculative edits (more: https://github.com/ohdearquant/lionagi). Its Lion Studio companion renders agent runs as a live DAG with per-node conversations, typed escalation signals, and an operator panel that spawns sub-agents — observability for a workflow that otherwise vanishes when the terminal closes (more: https://www.youtube.com/watch?v=KXLlyPSvNQc). The most original security argument today comes from Boyd Kane, who points out that the GPU host computing an LLM's tokens is itself a high-value target — it holds the weights and usually has privileged access to the rest of the datacenter. Because the model controls the tokens it emits, a malicious model could produce a sequence "whose semantic meaning is irrelevant" but which exploits a bug in the inference engine that loads weights, generates tokens, and parses them into responses. This is not hypothetical: vLLM shipped an arbitrary-code-execution bug in its XML tool parser for Qwen3 Coder that passed nearly every tool-call argument to `eval()` — and even after Gemini automatically reviewed the pull request and flagged it as critical, a maintainer force-merged it anyway (more: https://boydkane.com/essays/llms-could-control-their-host-machines-by-exploiting-inference-engines). Kane's estimate of exploitation likelihood is honest — "somewhat likely? I'm unsure" — but the reproducibility angle is worth losing sleep over. An exploit token sequence, once discovered, can be stored in a filename or URL and act as persistent prompt injection, triggering code execution on the GPU host "merely by listing a directory or reading a file." Inference engines are the wrong kind of software for this: vLLM supports over 200 model architectures and ships roughly 35 Jinja chat templates, all under constant performance pressure. His defenses are structural — separate the GPU host from the token parser so a compromised parser stays on the CPU box, and treat everything a GPU host emits as untrusted. It is the first time this desk has seen the serving runtime itself framed as the escape vector, not the surrounding infrastructure. The tooling for pointing LLMs at other people's software keeps commoditizing, meanwhile. IOActive's Fernando Arnaboldi released ai-scanner, a Burp Suite extension built on a strict division of labor: the LLM only handles discovery and triage — routes, parameters, multi-step attack flows — while deterministic oracles confirm every finding. An exploit must actually fire (a timing delay, an out-of-band callback, a decoded privileged token), so findings are "zero-false-positive by construction." On OWASP Juice Shop's own scoreboard, coverage went from 0 to 19 of 45 challenges once the extension reached the authenticated surface bare Burp cannot touch (more: https://github.com/farnaboldi/ai-scanner). That role-inversion — model proposes, oracle disposes — is the freshest idea in a crowded genre where most tools lean on the model to validate itself. dhunter is the conventional entry: an LLM-driven "blackboard" engine where a planner proposes attack intents and parallel workers write verified facts back to SQLite via pure stigmergy, with an acceptance gate that replays each proof-of-concept twice and rejects inconsistent results as time-varying noise (more: https://github.com/Dest1ny-Sec/dhunter). The autonomous pentester is no longer news; the MCP extension menu and false-positive story it now ships with are. A month ago, Anthropic's Claude results against the HAWK signature scheme and reduced-round AES got a "sort of" hedge on this desk — impressive recombination, nothing practical. Lukasz Olejnik and Bartosz Naskrecki have now escalated that story hard. Their paper describes an autonomous workflow they call "grinding": an LLM reads a paper, generates high-volume low-precision attack hypotheses, and writes checking code, but with a discipline that makes the results credible — "no proposal counts as evidence until it is reduced to an exact statement a short deterministic program can check." Generator confidence is formally banned under a "Confident Nonsense" axiom, and a human auditor makes the final call (more: https://arxiv.org/pdf/2608.21986). The body count is the headline. Eight published constructions break at their authors' own parameters. A Ring-LWR commitment from AsiaCCS 2025 accepts a zero multiplier, so binding fails with probability one. Spinel's signature hash collides deterministically because suppressing leading zeros in a base-3 byte encoding destroys unique decodability, handing 244 of 255 nonzero bytes an immediate second preimage. A middle-product PKE from CRYPTO 2017 leaks all 2,313 binary masks from a single ciphertext's boundary coefficients, and a lattice e-voting protocol loses receipt-freeness with coercer advantage near one. Three other targets yielded nothing and are reported honestly as coverage gaps — the same discipline that makes the eight breaks trustworthy. The house frame holds — AI as exhaustive-recombination engine, human verification as the scarce resource — except now the verifier is a second published mathematician, not a lab press release. The companion ePrint drives the point into deployed-adjacent territory. Olejnik and Naskrecki show that the CRT-based fully homomorphic encryption scheme of Pradhan, Dutta, Jangir, and Das is insecure across its assumed error range: "the secret key follows from the public key by a single ring inversion whenever the public multiplier is a unit," and any ciphertext's plaintext is recoverable without the key, for the maximum chosen-plaintext advantage of one half. The flaw is a cross-modulus mistake that collapses a whole class of confined error distributions to zero under the encoder — and they exhibit a concrete instantiation that is "simultaneously correct and insecure" (more: https://eprint.iacr.org/2026/1734.pdf). For the post-quantum migration, the lesson is not that lattices are broken — it is that review bandwidth for new schemes just got a force multiplier that serves attackers and defenders alike. Google's Bug Hunters team ran the experiment everyone has been hand-waving about: using Gemini to rewrite a C library into memory-safe Rust and deploy it in production. The target was giflib, Eric S. Raymond's roughly 3,000-line GIF parser, which often processes untrusted data in non-sandboxed environments — and since memory-safety bugs are about 70% of C/C++ vulnerabilities, eliminating the class is a structural win. The workflow: a one-shot translation, iterative fixing of the C-compatible FFI wrapper, and an autonomous loop feeding differential-testing failures back to the model, with every unsafe block signed off by human experts (more: https://bughunters.google.com/blog/scaling-memory-safety). What separates this from the usual "we rewrote it in Rust" marketing is the validation budget. The fork was checked against more than 30 million real GIFs for output-identical behavior, then run through a differential fuzzer for over six days and 200 million iterations with no logic deviations. That pipeline earned its keep twice: it caught an LZW-decoder edge case and surfaced a pre-existing out-of-bounds write a Google-internal legacy patch had introduced into the original C. The vindication arrived unplanned — shortly after rollout, a new heap-write vulnerability (CVE-2026-26740) was reported in the C giflib, and Google's already-migrated systems were structurally immune, having neutralized a zero-day before disclosure. The rewrite was performance-neutral, and retiring the sandboxing the C library had required actually cut tail latency. The right skepticism is the one this desk aimed at earlier Zig-to-Rust narratives: Rust shifts bugs toward logic errors rather than abolishing them. Google's answer — 30 million regression inputs and a differential fuzzer — separates case study from slogan. Apple is now pushing state-spyware warnings to users in 110 countries through email, system notification, and an in-Settings alert that "to date" cannot be spoofed, recommending Lockdown Mode for likely Pegasus-class targets. The most on-brand item for AI readers: Varonis coaxed Microsoft Copilot into disclosing an undocumented `autorun=1` URL parameter that executed prompts without user confirmation, enabling inbox exfiltration — and when Microsoft removed it, several AI browser extensions broke, implying it powered behind-the-scenes automation (more: https://hackaday.com/2026/08/21/this-week-in-security-apple-warns-users-stripe-merchants-leak-keys-copilot-helps-hack-itself-and-comcast-senses-movement/). The Copilot autorun trick is a direct sequel to last year's Copilot YOLO-mode compromise, the same class of flaw where an agent modifies its own execution environment. The rest rewards the paranoid: roughly 50,000 Stripe API keys — each effectively an administrator credential — are circulating on trading forums after harvesting from GitHub commits and infostealers, hitting some 650 companies though Stripe itself was never breached. Comcast is switching on opt-in WiFi motion sensing that reads people and pets as "various sized bags of radio-blocking water," the commercial normalization of the 802.11bf capability that defenses like WiFi-Veil were built to blunt. And a fresh Windows Defender bypass, "ShieldBreak," uses Defender itself to escalate to admin, its only mitigation being to disable Defender — "which probably isn't a great plan." If that reads as surveillance-grade capability leaking downhill, God's Eye View is the same trend rendered as a browser toy. Formerly WorldView and now MIT-licensed, it plots real open-source intelligence — flight transponders, ship beacons, ~840 satellites via CelesTrak, USGS earthquakes, NASA fire data, roughly 800 public CCTV cameras projected into 3D — onto a photorealistic globe with a sub-two-second cold start (more: https://github.com/bilawalsidhu/gods-eye-view). A voice mode built on 28 tools flies the camera, draws boundary polygons, and answers questions against live telemetry; the demo tours military training over Fort Novosel and a scrubbable Falcon 9 ascent replay (more: https://www.youtube.com/watch?v=GRJaKcXZS94). The project pointedly refuses to merge person-tracking, face recognition, or named-individual search — a self-imposed fence, fittingly, rather than a sandbox. GitOfThoughts proposes storing an agent's reasoning tree as a git repository: every scored thought is a commit, scores are git notes, validation outcomes are tags, and pruned attempts stay in history, retrievable with ordinary `git log --grep` searches. The pitch — "reasoning is the last unversioned software process" — is appealing, buying three-way merge, signed authorship, and bit-identical replay at about 15 ms per write. But the paper's real value is its honesty: it pre-registered two hypotheses and let one lose. Git-as-substrate provides operational value at accuracy parity — supported. Cross-problem memory improves accuracy on novel problems — rejected (more: https://arxiv.org/abs/2606.14470v1). Across five memory substrates — none, markdown, vector, graph, git — over GPQA-Diamond, MATH-500, and ScienceWorld, no substrate reliably beat having no memory at all; every confidence interval crossed zero, and a promising early git trend "did not survive its own pre-registered replication," retracted as "small-sample luck." Memory only paid off above a "copyability threshold" — a near-duplicate worked example lifted accuracy sharply, but a same-method, different-numbers variant gave nothing, and scaling to 32B only steepened the copy-the-answer step "without turning retrieved worked examples into transferable method." That is bracing for a field selling vector-database memory as a general accuracy lever: it retrieves answers, not understanding — fitting a running pattern in which self-generated agent skills also failed to beat human-written ones. OpenRSI plants its flag at the self-improvement end. FrontisAI frames "AI improving AI" as a ladder from evolution to recursive self-improvement and starts at "meta-evolution" — training the improver itself in bounded, executable domains — without claiming general RSI is solved. Its first release targets machine-learning engineering with four atomic program-evolution operators — Draft, Improve, Debug, Crossover — and a post-trained model, Frontis-MA1. On MLE-Bench Lite under a 12-hour, single-RTX-4090 budget, the 35B model with the OpenMLE-Evo harness raised its medal average from 39.39% to 60.61%, and a multi-GPU profile reached 71.21%, approaching far larger systems — results the README labels as model-plus-harness, not one-shot model scores (more: https://github.com/FrontisAI/OpenRSI). Against recent evidence that RSI feedback loops sit below the roughly 15% R&D-boost threshold for self-sustaining acceleration, OpenRSI is best read as a measurement instrument, not proof the loop has closed. When Anthropic launched Skills last October, Simon Willison predicted a "cambrian explosion of shareable skills — and corresponding guardrails." Jeffrey's Skills is the monetization step arriving on schedule: a paid subscription marketplace ($20/month for individuals, team plans from $300/month) selling "premium" skills for Claude Code and Codex, distributed through a `jsm` CLI that installs, searches, and syncs across machines. The premium pitch is layering — a scannable SKILL.md front door over deep reference docs, runnable validation, and hooks plus subagents — with example skills covering performance optimization, Next.js admin surfaces, and, tellingly, designing MCP servers that agents actually understand (more: https://jeffreys-skills.md). The market thesis is sound: this desk flagged the distribution gap eighteen months ago, when skills were "markdown bundles" hard to discover, version, and trust. The buyer-beware counterweight is equally on record — a study of self-generated skills found a mean quality score around 2 out of 12, which makes curation either the whole value proposition or evidence the category is oversold. The testimonials, citing $1,500 tax savings and $70k in recovered K-1 losses, lean hard on trust: several buyers say they would rather pay a known operator than "hope for the best malware wise from large skill hubs." That instinct is rational, given the October launch already carried a supply-chain warning; a marketplace shipping scripts and subagents is the trusted-by-default channel where a single poisoned skill does the most damage. The creative end shows how fast the format is spreading past code. TaiT-CRT-Interface-Skill is a Codex image-generation skill that turns an uploaded portrait or a text prompt into a retro illustration styled after early Macintosh, Minitel, and 8-bit interfaces — scanlines, dithering, and a fixed CRT barrel distortion — with preset color cards and aspect ratios negotiated over a two-turn conversation (more: https://github.com/TaiT-tt/tait-crt-interface-skill). It targets Codex because that harness has image generation built in, letting one agent own the full loop — the ecosystem bifurcating into serious playbooks people will pay to trust and an aesthetic long tail people fork for fun. Nvidia has agreed to pay Poolside roughly $6 billion to license its "Model Factory" software and to hire the 109 employees behind the Laguna model, plus a $1 billion investment at a $12 billion pre-money valuation. Poolside insists it is not an acquihire; a Yahoo Finance account in the thread suggests the licensing-and-hiring structure exists to dodge the regulatory scrutiny a merger would draw — the same template Nvidia used with Groq and Enfabrica. The community reaction is bruised — Laguna was praised here for its permissive Apache license and strong SWE-bench numbers, and commenters who watched it "loop like crazy" now wonder whether it gets absorbed into Nemotron (more: https://old.reddit.com/r/LocalLLaMA/comments/1vtz1o1/gonna_be_huge_for_us_open_source/). A model covered here as an open-weight darling is being repriced as a capital asset. Underneath the deal-making, the people who actually run these models keep grinding out gains. Ant Group's Ling team released six Ling-3.0 base checkpoints — tiny and flash sizes across pretrained, mid-trained, and WSM-merged stages — none post-trained, so this is raw material for continued training rather than a chat release, arriving on the late-August schedule the local community predicted (more: https://old.reddit.com/r/AINewsMinute/comments/1vw6z1m/ling30_releases_six_base_checkpoints_tiny_and/). GLM-4.5-Air finally got multi-token-prediction support in llama.cpp, paying off a performance debt flagged at launch a year ago — though one commenter notes the catch: MTP spends compute to verify draft tokens, so it helps bandwidth-bound rigs but not the compute-limited Strix Halo and DGX Spark boxes it's most wanted for (more: https://old.reddit.com/r/LocalLLaMA/comments/1vwhj0l/you_can_now_use_mtp_in_glmair/). The quietly important result comes from Multiverse Computing's Quantization-Aware Healing, which reframes 4-bit compression as opportunity, not tax. The change is single: distill the quantized student directly from the original, pre-compression full-precision teacher — not from the degraded recovered bfloat16 checkpoint — matching logits by KL divergence. Applied to GPT-OSS 120B compressed to 60B and quantized to MXFP4, the healed model beat its own bfloat16 60B checkpoint on 7 of 9 benchmarks at roughly a quarter of the weight memory. Against QAT it peaks about 7x faster and stays stable where QAT collapses by nearly 19 points at step 1,200, because a frozen teacher gives the student no incentive to drift (more: https://huggingface.co/blog/MultiverseComputingCAI/quantization-aware-healing). Low-bit models still have a way of failing multi-turn agentic tasks that single-turn benchmarks miss, but the stability story is the real advance. And a final reminder that the bits themselves bite: one engineer found that storing `1 + offset` directly in BF16 collapses distinct RMSNorm weights like 3.359375 and 3.390625 into the same 4.375, so subtracting one back never recovers the originals — proof that any converter doing arithmetic in low precision can quietly lose information even when the transform is a supposed isomorphism (more: https://old.reddit.com/r/LocalLLaMA/comments/1vujgft/fun_bf16_checkpoint_gotcha_1_followed_by_1_isnt/).