Article URL: https://cinemasojourns.com/2026/08/27/the-wandering-yamamura-theater-troupe/ Comments URL: https://news.ycombinator.com/item?id=49465250 Points: 8 # Comments: 0
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
A developer has built a security tool called Airlock to verify whether MCP (Model Context Protocol) servers accurately describe their own behavior, particularly their read-only claims. The core problem is that MCP servers self-report how dangerous they are, creating a conflict of interest that AI agent frameworks may blindly trust. Airlock tests each server's declared behavior against what it actually does, flagging discrepancies as evidence of deception rather than issuing a blanket safety score. In controlled testing, a deliberately dishonest fixture triggered 7 findings across 36 checks — uncovering planted behaviors like hidden file writes, scope escapes, and data exfiltration — while an honest fixture produced zero findings. The tool also audited real-world public MCP servers and found that some simply declare no annotations at all, meaning they neither lie nor inform, leaving agent approval workflows with nothing to act on.
A developer has built Verdict, an AI agent harness designed to rigorously reproduce software bugs before any fix is attempted or claimed. The system converts a GitHub issue into a structured investigation, running approved commands repeatedly and logging every result in an evidence ledger that cannot be selectively edited. Three specialised subagents handle trigger identification, change localisation, and regression planning, with each step constrained to claim only what the recorded evidence supports. Verdict was tested on TrueForge issue #417, where a stalled endpoint caused indefinite waits, achieving a verified 10-of-10 reproduction under the faulty condition and zero failures under a responsive control. All findings are cryptographically bound to a specific runtime, commit, and package version, allowing any reviewer to independently verify the results.
Developer and maintainer of paseo-agy-acp has released version 2.3.0 on npm, enabling Paseo to use Google's official Antigravity ACP kernel as a multi-agent provider. The open-source adapter acts as a thin NDJSON proxy, handling Paseo-specific integration concerns such as agent identity, mode mapping, and MCP normalization, while leaving authentication, inference, and tooling to the official kernel. Users must supply their own locally installed Antigravity kernel, a compatible Antigravity account, Node.js 22+, and Paseo — the npm package itself contains only the Apache-2.0 proxy code. The project is an unofficial community effort and carries no endorsement from either Paseo or Google. Its design deliberately keeps the open-source surface narrow and inspectable to avoid reimplementing or redistributing any proprietary provider components.
A DeFi security assessment dated August 30, 2026, assigned Bybit's oracle infrastructure a risk score of 7 out of 10, classifying it as high risk. The report targets Bybit's multi-chain DeFi ecosystem, which holds over $16 billion in total value locked across Ethereum and Layer 2 networks. Researchers identified four key attack vectors, including single-source price feed dominance, flash loan-based time-weighted median manipulation, cross-chain feed desynchronisation, and gas-price manipulation on Layer 2 rollups. While existing safeguards such as multi-source aggregation, time-weighted medians, and Chainlink fallback feeds reduce the likelihood of a successful attack, the report notes significant residual exposure. The assessment recommends prioritised technical upgrades to harden Bybit's oracle pipeline, strengthen on-chain verification, and reduce the economic incentive for potential attackers.
Discussion (0)
Log in to join the discussion and vote.
Log in