Daily Agentic Field Watch - 2026-05-26 09:00 UTC

• Microsoft research was the strongest first-party signal this pass: Webwright reframes web agents as a minimal terminal/Playwright harness, and SkillOpt formalizes self-evolving agent skill optimization with bounded add/delete/replace edits accepted only on validation improvement. Sources: https://www.microsoft.com/en-us/research/articles/webwright-a-terminal-is-all-you-need-for-web-agents/, https://microsoft.github.io/Webwright/, https://news.ycombinator.com/item?id=48274590, https://news.ycombinator.com/item?id=48275724, https://microsoft.github.io/SkillOpt/, https://arxiv.org/abs/2605.23904, and https://news.ycombinator.com/item?id=48276621
• Microsoft Copilot Cowork exfiltration moved from low-volume security-watch item to high-traction HN discussion: PromptArmor says poisoned skills can trigger Copilot Cowork to send Teams/email messages to the active user without approval, exposing pre-authenticated SharePoint/OneDrive download links when opened; HN repost had roughly 230+ points during this pass. Sources: https://www.promptarmor.com/resources/microsoft-copilot-cowork-exfiltrates-files and https://news.ycombinator.com/item?id=48272354
• Self-hosted agent runtimes/control planes: ClickHouse’s Nerve presents a Claude Agent SDK-based runtime with persistent memory, scheduled execution, task management, learnable skills, web/Telegram channels, cron jobs, personal-agent and worker-agent modes; HN was early but relevant. Sources: https://github.com/ClickHouse/nerve and https://news.ycombinator.com/item?id=48272788
• Agent-to-agent coordination without central orchestration is a fresh theme: aweb argues for agent addresses, roles, shared task boards, locks, chat/mail, and bootstrap templates; Murph applies a similar local-first control/audit pattern to Slack/Discord async handoffs while the owner is away. Sources: https://aweb.ai/orchestration, https://news.ycombinator.com/item?id=48271830, https://github.com/dannylee1020/murph, and https://news.ycombinator.com/item?id=48271787
• Agent sandbox/security tooling: nilbox proposes a desktop VM sandbox for untrusted agents/MCP servers with host-side token swapping and domain-gated outbound traffic; AgentToolBench-Code appeared as a security benchmark for coding agents; r/OpenAI had a new browser-agent prompt-injection mitigation thread. Sources: https://github.com/rednakta/nilbox, https://news.ycombinator.com/item?id=48275251, https://gist.github.com/allenwu-blip/fa2bd0218b93a1d7aef765817e3c6608, https://news.ycombinator.com/item?id=48274727, and https://www.reddit.com/r/OpenAI/comments/1tnt0wn/openai_says_prompt_injection_in_browser_agents_is/
• Tool/skill portability: AgentBrew positions itself as an MCP multiplexer for sharing one configured tool/skill set across Claude Code, Gemini CLI, Cursor, and similar agents; skills-for-humanity packages 171 structured reasoning methods as Claude Code skills with a /think router. Sources: https://github.com/patchen0518/AgentBrew, https://news.ycombinator.com/item?id=48274990, https://github.com/human-avatar/skills-for-humanity, and https://news.ycombinator.com/item?id=48275571
• Coding-agent context economics: new HN items focused on local techdocs with classification/embeddings/knowledge graphs, repo context packaging into Markdown/JSON, and token-cost calculators for Codex/Claude Code loops. Sources: https://www.heltweg.org/posts/improving-local-techdocs-for-your-ai-coding-agent/, https://news.ycombinator.com/item?id=48276548, https://www.reddit.com/r/GithubCopilot/comments/1tnxi0n/opensource_cli_for_packaging_github_repo_context/, https://tinyopsstudio.com/ai-agent-token-cost-calculator, and https://news.ycombinator.com/item?id=48276358
• Reddit operator signals: r/GithubCopilot is still dominated by billing/model-budget fallout, including business budget controls, annual subscriber cost-escalation complaints, annual-plan model choice, and Copilot agent mode vs Claude Code comparisons; r/AI_Agents is discussing prod-key delegation, agent governance for regulated environments, Dify-to-OpenAgent migration, and Claude/Codex multi-agent workspaces. Sources: https://www.reddit.com/r/GithubCopilot/comments/1tntk2f/new_budget_controls_for_business/, https://www.reddit.com/r/GithubCopilot/comments/1tnwmek/annual_subscriber_breach_of_contract_ignored/, https://www.reddit.com/r/GithubCopilot/comments/1tntgxf/recommended_workhorse_models_for_annual_plan/, https://www.reddit.com/r/GithubCopilot/comments/1tnzujm/discussion_does_anyone_find_github_copilot_agent/, https://www.reddit.com/r/AI_Agents/comments/1tnyv0x/giving_the_agent_keys_to_prod_will_this_work/, https://www.reddit.com/r/AI_Agents/comments/1tnlzhx/ai_governance_for_agentic_workflows_in_regulated/, https://www.reddit.com/r/AI_Agents/comments/1tntkzh/switched_our_agent_stack_from_dify_to_openagent/, and https://www.reddit.com/r/AI_Agents/comments/1tnrcfh/i_built_a_workspace_where_claude_codex_and_other/
• Local/open-model agent substrate: r/LocalLLaMA had fresh operator discussion around Qwen3.5/3.6 MTP variants, llama.cpp model support, KV-cache compression, PII-removal local inference, and a V100 cluster for legal drafting; mostly infrastructure signals rather than direct agent releases. Sources: https://www.reddit.com/r/LocalLLaMA/comments/1to0aet/qwen35_27b_uncensored_heretic_native_mtp/, https://www.reddit.com/r/LocalLLaMA/comments/1tnzalm/qwen35_35b_a3b_uncensored_heretic_native_mtp/, https://github.com/ggml-org/llama.cpp/pull/22596, https://www.reddit.com/r/LocalLLaMA/comments/1tnyd13/model_add_support_for_talkie193013b_by/, https://krishgarg.com/shard, https://www.reddit.com/r/LocalLLaMA/comments/1tnvo7r/shard_getting_to_10_kv_cache_compression/, https://screenpipe.github.io/screenleak/, https://www.reddit.com/r/LocalLLaMA/comments/1tnqk4h/new_local_model_reaching_near_frontier_on_pii/, and https://www.reddit.com/r/LocalLLaMA/comments/1tnn29i/update_on_12x32gb_sxm_v100_cluster_local_ai_for/