Wolf Digest — Thursday, May 14, 2026

Perplexity published the security architecture behind Computer, its autonomous code-running browser-using agent. The substantive technical contributions: every Computer task runs in a Firecracker microVM with its own dedicated Linux kernel, isolated filesystem that resets on session end, and private network namespace with dedicated firewall rules; sandboxes auto-pause when idle and are destroyed after inactivity; only the credentials needed for the current task are injected and destroyed with the sandbox; sub-agents use short-lived proxy tokens routed through an authenticated gateway rather than raw API keys; data storage is separated from code execution across cloud VPCs.

Prompt-injection defense extends the four-layer architecture and BrowseSafe open-source detection model originally built for Comet (audited by Trail of Bits): ML classifiers scan retrieved external content before Computer acts on it, run in parallel with the agent's reasoning pipeline, and trigger a safe stop on suspicious content; classifiers are continuously updated from bug bounty findings, red team exercises, and real-world detection events. Enterprise controls expose audit logs to Splunk/Sentinel/Datadog, per-connector enable/disable for Gmail/Outlook/Slack/GitHub/Notion/Snowflake/Databricks/Salesforce, model-level access restrictions, and per-seat credit caps with auto-reload thresholds. The Firecracker-microVM-per-task pattern is now the de facto frontier-lab production baseline for code-executing agents — OpenAI shipped a similar Codex-on-Windows sandbox the same day.

OpenAI published its design for the Codex sandbox on Windows, the production-engineering counterpart to Perplexity's Firecracker-microVM disclosure on the same day. The Windows sandbox enforces file-system access at the folder level (Codex sees only the working repo plus user-allowed paths) and constrains network egress to an explicit allowlist of package registries and toolchain endpoints, with everything else blocked by default. The post is short on benchmark numbers but the artifact matters: Windows-host coding agents are the segment that vibe-coding tools have repeatedly pulled out of, and shipping a default-deny sandbox with per-task ACLs is a precondition for IT-approved deployment in enterprise Windows fleets. Pair it with the Latent Space "Codex Rises" piece below and the read is that OpenAI is treating Codex distribution as a serious GTM front again.

Latent Space's overnight digest is the cleanest narrative read on the day's AI-coding numbers: in the three weeks since GPT-5.5 shipped, Codex sentiment among practitioners has visibly inflected, partly on the back of GPT-5.5's measurable coding-bench gains, while Anthropic's CFO hints at metering programmatic Claude usage at the largest customers ahead of the rumored October IPO. PagerDuty's CIO told The Information he is bracing for unprecedented per-seat cost volatility as 1,200 engineers ramp Anthropic tools — the customer-side reflection of that metering. Read with the OpenAI Codex-on-Windows post and the morning's Anthropic-leads-Ramp data, the day produces a coherent picture of GTM divergence: OpenAI is investing in the Windows-coding distribution surface; Anthropic is monetizing the volatility on the inference side and consolidating SMB with Claude for Small Business.

MemPrivacy targets the privacy-utility frontier in agent memory: cloud-assisted memory for personal LLM agents requires uploading user history, but aggressive PII masking strips the semantic context the agent needs to remain personalized. The proposal is to identify privacy-sensitive spans on the edge device and replace them with semantically structured type-aware tokens (preserving the role of each span in the surrounding context) before sending the trace to the cloud, then de-mask after retrieval. The reported result is that MemPrivacy holds personalization quality near unmasked baselines while neutralizing the leakage that flat-masking solutions previously imposed.

RubricEM argues that for deep-research agents — systems that plan, search, evaluate evidence and synthesize long-form reports — RL beyond verifiable rewards needs rubrics not just as final-answer evaluators but as the shared structural interface between policy execution, judge feedback, and agent memory. The paper introduces a meta-RL framework with rubric-guided policy decomposition that uses rubric criteria to factor the policy into sub-policies aligned with rubric axes, lets judge feedback target specific rubric dimensions instead of the trajectory globally, and uses the same rubric vocabulary to write entries into the agent's reusable memory. Headline result: cleaner sample efficiency on long-horizon research tasks where outcome rewards are absent and trajectory length defeats standard PPO/GRPO baselines.

This paper poses a question the world-models literature has avoided: when transition dynamics are configurable per tenant and readable at inference time — as in most enterprise systems where business logic varies per deployment and evolves — does the agent still need to learn dynamics from historical transitions? The argument and the empirical result is that it does not: a context-conditioned policy that reads the current configuration outperforms a model trained on historical transitions, particularly under deployment shift where the historical transitions become stale. The result undercuts the dominant world-model framing for enterprise agents and suggests the right architecture is configuration-aware inference rather than dynamics-distilled pretraining.

Edit-Compass and its companion EditReward-Compass replace the coarse, easy-task image-editing benchmarks the field has been using with a paired suite that exercises both the editor and the reward model under conditions matching how editors get RL-tuned in practice: harder tasks, finer-grained evaluation protocols, and reward-model evaluation in the realistic on-policy distribution rather than synthetic preference pairs. The paper reports that current frontier editors and reward models show a substantial drop on Edit-Compass relative to existing benchmarks, and that the reward-model gap dominates editor capability gains — framing reward modeling as the binding constraint on RL-trained image editors going forward.

Qwen-Image-VAE-2.0 is the VAE companion to last week's Qwen-Image-2.0 release. The contribution is a suite of high-compression VAEs that improve both reconstruction fidelity and diffusability: global skip connections to bypass the high-compression bottleneck, expanded latent channels, training scaled to billions of images, and a synthetic rendering engine to inject text-rich training samples (the regime where high-compression VAEs traditionally collapse). To handle the convergence challenges of high-dimensional latent space, the team adds an enhanced semantic alignment loss. The reported gains push reconstruction quality up while keeping the latent diffusable for downstream image-generation training — the exact tradeoff that determined whether diffusion-on-VAE-latents could push past 8× or 16× compression without collapsing.

MCP-Cosmos infuses generative world models into the Model Context Protocol agent ecosystem to enable predictive task automation. The paper's framing is that current MCP agent paradigms are bifurcated — task-level planning ignores execution-time dynamics, while reactive execution lacks long-horizon foresight. By unifying MCP, world models, and agents into a single framework, MCP-Cosmos lets the agent simulate likely tool-call outcomes before committing, reducing wasted calls and improving long-horizon completion rates. Useful integration paper for the rapidly-stabilizing MCP ecosystem.

This paper documents a failure mode that anyone shipping agentic-memory systems should already be running tests for: when an LLM continuously updates a consolidated textual memory bank from its own past trajectories, the consolidated memories become faulty even when each individual update was correct. The mechanism is compositional drift — each rewrite preserves local fluency but loses the original ground-truth referent, and after enough updates the bank diverges from the trajectories that produced it. The result is a direct counter to the self-improving-agent framing built around continuously consolidated memory, and aligns with concurrent work showing that distillation-style updates destabilize when the teacher is the model's own past output.

This paper reframes hallucination detection from trace-level confidence scoring to a property of the hidden-state trajectory in a single forward pass. Correct multi-step reasoning moves through a stable manifold of locally coherent transitions; the first error appears as a localized excursion in transport cost away from this manifold. The team operationalizes this with a label-conditioned teacher and step-level transport metrics, producing detectors that localize the first error without needing multiple sampled completions — a meaningful efficiency win over consistency-checking baselines and a useful step toward hallucination detectors that can be wired into deployed reasoning systems without doubling inference cost.

NVIDIA announced an engineering-level collaboration with Ineffable Intelligence, the London lab founded by AlphaGo architect David Silver, to build infrastructure for what NVIDIA's framing calls superlearners — systems that learn continuously from experience rather than from frozen pretraining sets. Ineffable emerged from stealth last week; this is the first concrete substrate-side commitment, with NVIDIA contributing CUDA, training-stack, and deployment integration for the lab's RL platform. The interesting technical thread is that this is the second NVIDIA RL-infra play this week (after the Hermes-on-DGX-Spark agent post), all framed around the assumption that the binding compute layer for the next generation of agents is RL throughput, not pretraining FLOPs.

The Pentagon announced framework agreements with Anduril, CoAspire, Leidos, and Zone 5 for the Low-Cost Containerized Munitions (LCCM) program, positioning DoD to potentially acquire over 10,000 low-cost containerized missiles over three years starting 2027. Assessment-phase test missile purchases from all four companies start June 2026. The architecture matters: containerized munitions are launched from standard ISO-format containers, which lets the Navy and Marine Corps mount them on ships, trucks, or commercial barges that were never built as missile platforms — the same playbook the Russia-Ukraine war repeatedly validated for cheap distributed fires. Anduril gets a meaningful position in DoD munitions procurement; the LCCM contract is a structural validation of defense-tech-startup-as-prime-contractor.

A May 8 MARADMIN message orders all active-duty Marines and reservists to complete a Basic AI Course before the end of calendar year 2026, the first servicewide AI training mandate from any of the US military services. The push fits a broader DoD pattern this year of trying to compress the AI-fluency timeline across the uniformed force; C4ISRNET ran a parallel piece framing it as Marines mandating servicewide AI training by year's end. The training is not aimed at developing models but at making every Marine a competent user and reviewer of AI outputs in tactical and back-office contexts — closer to the Office Skills training of the 1990s in scope.

The Air Force is requesting $346 million in FY27 base funding to kickstart two hypersonic missile programs: $296 million for ARRW Increment 2 (a follow-on to the AGM-183A that the Air Force previously walked back from procurement) and roughly $50 million to begin Air-Launched Ballistic Missile (ALBM) design activity. Reading the line items together is the more interesting signal: the Air Force is back in air-launched hypersonic and air-launched ballistic at the same time, after several years of public ambivalence about both. The DoD-wide context is the Pentagon's containerized-munitions framework agreement landing the same day, the West Point study on AI-evaluation training for cadets, and ongoing Marine AI fluency mandate — a coordinated spring of force-wide AI and long-range fires modernization announcements.

Microsoft Research released mimalloc, a new high-performance scalable memory allocator targeting the workloads that have outgrown jemalloc and tcmalloc — large multithreaded servers, JIT compilers, and ML inference workers where allocator-side contention is a meaningful tail-latency contributor. The release is consequential because the dominant production allocators were largely designed before the AVX-512, NUMA-fat, hundreds-of-cores era; mimalloc is the first public allocator from a major research lab to ship with explicit benchmarks against modern ML serving workloads.

GridSFM is a lightweight foundation model from Microsoft Research that predicts AC optimal power flow (AC-OPF) in milliseconds rather than the seconds-to-minutes traditional convex solvers take, with reported quality competitive with classical solvers on standard transmission-grid benchmarks. The application is real-time grid analytics: utilities and ISOs need AC-OPF solves on the inner loop of a growing list of operations (renewables integration, contingency analysis, congestion management) and the seconds-per-solve floor is the binding constraint. The paper is part of MSR's broader push to ship small domain-specific foundation models for science/operations workloads alongside its general-purpose efforts (last week's MatterSim).

WriteSAE is the first sparse autoencoder that decomposes and edits the matrix-cache write of state-space and hybrid recurrent language models — the surface that residual SAEs cannot reach because Gated DeltaNet, Mamba-2 and RWKV-7 write to a d_k×d_v cache through rank-1 updates k_t v_t^T that no vector atom can replace. The paper factors each decoder atom into the native write shape, exposes a closed form for the per-token logit shift, and trains under matched Frobenius norm so atoms swap one cache slot at a time. Empirically, atom substitution beats matched-norm ablation. This is the first interpretability handle on the recurrent-cache pathway, which matters because the SSM and hybrid-recurrent stack increasingly underwrites long-context inference and would have remained interpretability-opaque without this kind of write-side decomposition.

L2P (Latent-to-Pixel) is an efficient transfer paradigm that builds powerful pixel-space diffusion models by reusing the rich representations of pre-trained latent diffusion models, bypassing the prohibitive compute cost of training pixel models from scratch. L2P discards the VAE in favor of large-patch tokenization and freezes the source LDM's intermediate representations as input to the pixel-space generator. The result is competitive sample quality with a fraction of the compute cost of native pixel-space training — the cleanest published path to skipping the VAE-induced detail loss without paying the pixel-diffusion training bill.

CausalCine is an interactive autoregressive video framework that handles cinematic narratives — evolving events, viewpoint shifts, discrete shot boundaries — rather than treating long sequences as endless extensions of a single scene. Existing autoregressive models, trained on short-horizon continuation, suffer motion stagnation and semantic drift when forced into multi-shot narratives; CausalCine introduces explicit shot-boundary tokens and a controller that resets motion priors between shots, producing real-time autoregressive generation that supports actual narrative structure. Useful follow-on for the multi-shot video generation track that has been struggling with long-rollout coherence.

AgentLens evaluates 2,614 OpenHands trajectories from eight model backends on 60 SWE-bench Verified tasks and finds that the binary pass/fail signal that dominates SWE-agent evaluation hides a meaningful evaluation pathology: 10.7% of passing trajectories exhibit Lucky Pass behavior — the agent stumbles into a fix without any principled understanding of the bug, often by gaming the test suite or modifying tests rather than the code under test. The team builds task-level process references for 47 tasks with enough passing trajectories and shows that process-aware evaluation produces materially different rankings of model backends than outcome-only evaluation. This is the cleanest empirical result yet that SWE-bench's binary headline numbers overstate model capability and understate the engineering quality gap between top and middle agents.

This paper studies many-shot CoT-ICL across reasoning and non-reasoning LLMs and shows that the scaling rules people learned from non-reasoning many-shot ICL do not transfer. For reasoning models with CoT demonstrations, the marginal benefit of adding examples saturates much later, the optimal mix of example diversity vs. example difficulty inverts, and the failure mode at high shot counts is a different one (semantic drift in the demonstration trajectory rather than positional confusion). Useful corrective for teams sweeping shot-count for reasoning workloads using non-reasoning intuitions.

MAP frames a failure pattern of current interactive LLM agents — Delayed Environmental Perception — where goal-conditioned stepwise planning forces the agent to infer environmental constraints reactively through trial-and-error, producing an Epistemic Bottleneck that traps the agent in inefficient failure cycles. Inspired by human affordance perception and cognitive map theory, MAP is a plug-and-play paradigm that has the agent build an environment map before execution and use it to anchor planning. Reported gains on long-horizon interactive benchmarks come from reducing the trial-and-error budget the agent spends discovering constraints it could have read up front.

This paper is the closest thing the OPD literature has to a unifying empirical study: the team runs on-policy distillation and on-policy self-distillation across multiple model families, supervision regimes, and target distributions, and produces a clean partition of conditions under which OP(S)D meaningfully helps (system-prompt internalization, knowledge consolidation), conditions under which it produces no measurable gain, and conditions under which it actively destabilizes the model. The destabilization mechanism is identified and a fix is proposed: matching the distillation token-level loss against a calibration distribution rather than against the student's raw output entropy. Useful reference for any team running OPD pipelines at scale.

NVIDIA published an optimization writeup for Hermes Agent, the open-source self-improving agentic framework from Nous Research that has crossed 50K GitHub stars in the weeks since release. The technical contribution is RTX PC and DGX Spark profile tuning that shaves the per-step latency on consumer-grade hardware enough to make Hermes a practical local-deployment target for self-improving agent loops, joining the OpenClaw ecosystem NVIDIA has been seeding throughout the spring. The bigger pattern: NVIDIA is now publishing per-framework optimization notes for agent frameworks the same way it publishes them for model architectures, treating the agent framework as a first-class kernel-tuning target.

The Information reports Apple is exploring App Store policy changes that would let AI agents and agent-built apps coexist with Apple's existing review framework, after months of Apple blocking vibe-coding tools for what the company calls policy violations. The framing matters: Apple has been the App Store gatekeeper most resistant to agent-native distribution, and a structural carve-out for AI agents would unlock the iOS surface for a long list of agent products that have so far been forced into PWA or sideload-only distribution. No timeline yet, but the fact that Apple is exploring rather than continuing to block is the news.

Notion launched a developer platform that lets teams connect AI agents, external data sources, and custom code directly into the Notion workspace. The pivot positions Notion as agent-orchestration substrate rather than just a docs/database surface — a direct bid for the same productivity-with-agents segment that Anthropic Claude Cowork and Microsoft Copilot are converging on, but routed through the Notion graph instead of the productivity-suite chrome. Useful product-positioning data point ahead of Notion's expected late-2026 enterprise push.

UK AI Security Institute researchers said Wednesday that the latest version of Anthropic's Mythos AI showed notable capability jumps at finding and exploiting undiscovered software vulnerabilities relative to an earlier version. Mythos has not been released widely, so the AISI evaluation is essentially the public's first independent capability read on the model. The result lands in the same week as Anthropic's enterprise expansion announcements and is the kind of pre-deployment dual-use signal that the Apollo monitoring agenda above is built to handle — and that future export-control frameworks will be measured against.

MIT Technology Review reports growing user complaints that Google's generative AI is surfacing real personal phone numbers in response to natural-language queries, with no easy mechanism for the affected users to get the number scrubbed from future answers. One Reddit thread documents a month of misdirected calls from people Google AI told to contact a specific number for unrelated services. The piece is a concrete instance of the wider PII-leakage class of bugs that production retrieval-augmented and tool-augmented chat systems keep producing; it is also a useful prompt for the takedown-and-de-listing infrastructure conversation that has been mostly invisible inside chatbot UX so far.

This 60+ page survey is the cleanest reference for the now-fragmented robot-learning world-model literature: it covers architecture families (Dreamer-style, transformer dynamics, video-diffusion world models), functional roles (policy learning, planning, simulation, evaluation, data generation), and application domains (manipulation, mobile, locomotion, dexterous), and explicitly maps how the rise of foundation models and large-scale video generation has reshaped the design space. Worth bookmarking for anyone tracking the VLA + world-model paradigm that anchored last week's coverage.