Watching agents cohabitate is fascinating. This trace in particular reminds me of this paper arxiv.org/abs/2606.03237 My bet is that understanding the systems agents form together will become a bigger constraint on autonomy alongside humans than individual model capability.

Task completion is an incomplete measure of AI work. Agent traces let us infer an organization’s norms and intents, then evaluate behavior against its purpose, practices, and policies. Securing AI work requires modeling the organization. originhq.com/blog/norms-and-…

Defense has fundamentally shifted away from an external actor/campaign-centric model toward insider threat, but so much of what we’ve built over the past 15+ years wasn’t designed for this. Years of ATT&CK bingo have atrophied the muscles required to combat subtle acts of subversion, and now they’re occurring at machine speed and often without the users’ knowledge. Countless teams I talk with are drowning in alerts generated by agents operating in massive grey areas, doing things that look malicious but are completely benign and vice versa. The missing piece is, as it always has been, the intent behind the action. False positive tuning was already the painful exercise of explaining that intent in org-specific context so we could make exceptions for acceptable behavior. Agents make that substantially harder through their speed, volume, and contextual ambiguity. The next generation of security controls has to reason about intent in organizational context, because the behaviors we’ve spent many years learning to detect are becoming indistinguishable from the work we’re paying agents to do.

Yesterday we found an interesting trace during review of our own data. Codex needed an MCP tool it didn't have, found that Claude Code had it, and launched Claude to do the work. When Claude needed approval, Codex eventually relaunched it with --dangerously-skip-permissions.