In this article
Google examined more than 913,000 coding-agent sessions and found that 13% exposed the agent to an inline TODO(bug/...) or FIXME(bug/...) reference. In 6% of those encounters, the agent took a secondary action aimed at that bug. Eighty-three percent of those actions were not requested by the developer. Some agents investigated closed tickets. Others expanded the task to an open bug and, in 39% of those scope-expansion cases, edited code. (Google)
The cost was measurable. After controlling for developer, codebase complexity, task type, model tier, files read, prompt length, and when the reference appeared, Google associated unprompted detours with 70% more steps, 77% more tokens, and 105% more wait time. The company also reports that an automated cleanup program removed thousands of obsolete references over six months, with more than 95% of proposed deletions accepted by human reviewers.
The important failure is not that a comment was false. An open TODO can be accurate and still be irrelevant to the delegated task. The agent treated text that described possible work as authority to perform it. That turns context management from a retrieval problem into an authorization problem.
This week’s strongest application and research evidence extends that distinction across five surfaces. Uber is binding proposed actions to declared intent and session history. Anthropic and Singapore’s GovTech are treating memory notes as claims that need scoped evaluation and correction. LangChain is giving background work explicit interrupt and enqueue semantics. Microsoft is turning a reviewed plan into a formal specification that generated code must satisfy. Together they suggest a practical rule: every consequential agent action should be traceable to the instruction, evidence, and authority that justified it.
Context can suggest work without authorizing it
Google’s study uses bug-linked comments as a proxy because the current ticket state and the developer’s request can be checked automatically. That gives the analysis unusual scale, but it is not a randomized trial. The public article does not disclose absolute session counts for each regression cell, model-specific rates, codebase distribution, or whether deleting comments changes task success. The reported overhead is an association after fixed-effects adjustment, not proof that every extra step was caused by the TODO.
An independent preprint from May supplies a useful challenge. Overeager Coding Agents evaluates 500 benign scenarios and about 7,500 runs across four agent products and six base models. Its paired design changes whether the prompt states the authorized scope explicitly. On shared models, removing consent language raised the out-of-scope action rate by 11.9 to 17.2 percentage points. Framework design mattered more than a simple model ranking: permissive systems ranged from 5.4% to 27.7% overeager actions, while a framework that asked before continuing ranged from 0.2% to 4.5%. (OverEager-Bench)
The benchmark is a preprint built from synthetic scenarios, so it does not establish production incident rates. It does support a narrower conclusion that Google’s internal evidence alone cannot provide: scope expansion is not only a stale-comment problem, and model alignment does not automatically survive a permissive harness.
The control should sit at the boundary between evidence and authority:
- Label retrieved text by origin and role, such as user instruction, repository evidence, policy, tool result, or agent hypothesis.
- Bind the task to an explicit change scope and allowed effect classes.
- Require a new authorization event before an observation can expand that scope.
- Record the lineage from request to proposed action to completed effect.
Cleaning obsolete comments remains valuable. It removes noise and reduces wasted investigation. It cannot be the security boundary because current documentation, a valid ticket, or a correct memory can still propose work the user did not delegate.
Uber is adding behavioral authorization beside access control
Uber’s November 6 engineering account describes a production security framework with three layers: provisioning-time validation, runtime enforcement, and continuous assurance. An agent registry records ownership, persona, permitted intents, constraints, dependencies, and risk tier. Static and dynamic analysis compare that declared contract with code, prompts, endpoints, and tool paths. Runtime policy points then evaluate a proposed action against the agent’s purpose, the user’s request, and session history before enforcement hooks allow it. (Uber)
This is a different decision from ordinary authorization. Valid credentials can establish that an agent may call a tool and that the user may access its target. They do not establish that this particular call follows from what the user asked. Uber says explicit intents and constraints were its most effective mitigation, even though they reduce autonomy. Small specialized models run near the execution path to keep guardrail latency and cost bounded.
The account is concrete about architecture but thin on outcomes. It does not publish the number of agents covered, false-block and false-allow rates, latency distributions, or results from independent red teams. Prompt provenance and evidence chaining are described as current work that Uber plans to extend, not a finished guarantee. The safe inference is that behavioral authorization is a deployed design direction at Uber, not that semantic guardrails have solved indirect prompt injection.
Braintrust’s new MCP tracing feature shows a smaller version of the same contract at a tool boundary. A server can record the request, result, timing, errors, and an optional telemetry.intent field. That distinguishes a successful call from a correct one. Braintrust’s example is a production-only query that also returns staging rows. The tool reports no error, but the trace preserves enough context to turn the mismatch into a regression test. (Braintrust)
Self-reported intent is evidence, not enforcement. A compromised or confused agent can write a plausible explanation. The field becomes valuable when a policy engine can compare it with the original task, the selected capability, and the actual result.
Memory is a write path into future decisions
Anthropic’s November 6 memory report makes an unusually direct admission: a memory note is a prediction about what a future session will need. In one benchmark, newer Claude models learned to record rules together with how those rules had been verified. Memory raised reported reward for several models, including Opus 5.5 from 0.655 to 0.838. In a Pokémon experiment, a smaller and more selective memory helped a newer model progress farther than a large archive of transient state. (Anthropic)
That selectivity creates authority. A note promoted into every future session can steer many tasks without being reconsidered. Anthropic shows a failure in which Claude stored the wrong side of a map as a landmark, repeatedly followed the bad note, and failed to reach the next city. An offline “dreaming” pass checked the note against the original transcript, corrected it, and changed the outcome. In a separate document experiment, a generated wiki grew to 1.77 times the size of the source material, showing that consolidation can become more expensive than the evidence it abstracts.
GovTech Singapore provides the week’s strongest application evidence. Its Markly assistant drafts feedback for long-form school essays, while teachers accept, edit, reject, and steer the suggestions. The team evaluated a memory layer with ten simulated teachers across six blocks of assignments plus a contradictory distractor branch. It scored memory formation, retrieval, response alignment, and general quality separately. Memory improved preference alignment, but general comment quality did not show the same gain. The service now runs as an independent component in a Ministry of Education pilot for Geography and English. The live study is tracking acceptance, edits, steering, and memory lifecycle, so the synthetic benchmark should not be read as evidence of reduced teacher workload. (GovTech Singapore)
An updated memory-substrate study, accepted to the NeurIPS 2026 Evaluations and Datasets track, challenges any universal recipe. Across 11 memory methods, three backbone models, and four benchmark suites, broad retrieval helped long-context factual questions but could hurt sequential decision-making by drawing attention away from action-critical context. No substrate dominated every regime. (Harness the Memory)
The Anthropic results are provider-run evaluations with small task sets and selected examples. The independent study is broader but still benchmark evidence, not a production deployment. Their agreement is more useful than either headline: memory quality is not recall alone. A memory service needs separate records for the source event, the derived note, its verifier, freshness, scope, and every later task that consumed it. Correction should supersede a note without erasing the earlier state, so an operator can explain why yesterday’s agent acted differently.
Background work needs versioned steering
LangChain’s new async subagents keep an orchestrator responsive while workers continue on separate threads. The interface exposes start, check, update, cancel, and list operations. A follow-up instruction can use interrupt, which stops and restarts the worker, or enqueue, which waits until the current run finishes. Unfinished tasks are surfaced to the orchestrator, and approvals remain attached to the worker that requested them. (LangChain)
Those are not convenience details. They define which instruction version governs work already in flight. A correction that is merely appended can arrive after an irreversible action. An addition implemented as a restart can discard useful progress or repeat an effect. Every background task therefore needs an immutable task identity, parent instruction revision, cancellation state, effect ledger, and reconciliation rule for late results.
LangChain’s notifications are beta and the announcement offers no workload comparison, failure distribution, or recovery study. Treat the design as an architecture candidate, not evidence that async agents are dependable. Before adoption, test a worker that finishes at the same moment it is cancelled, a correction that invalidates earlier work, duplicate notifications, an approval requested before a restart, and a result that returns after the parent task has closed.
Architecture radar and research shortlist
Test: proof-driven review on one expensive invariant. Microsoft’s PDD Kit turns reviewed natural-language intent into a Verus specification, then has an agent implement code and a proof. Tests cover the trusted boundary that the proof assumes. The demonstration verifies login properties in a roughly 5,000-line Rust web application, but the proof focuses on one component and still trusts six pieces. The project is a research prototype and supports only Rust. It is useful where a wrong permission, payment, or token decision is expensive enough to justify specification work. (Microsoft Research)
Read: overeager actions before prompt-injection taxonomies. The OverEager benchmark isolates unauthorized initiative on benign tasks. That is the closer failure mode for a correct TODO that expands scope.
Watch: intent telemetry without policy coupling. MCP traces that record intent can improve debugging, but they should not become an authorization claim until the system compares them with a durable task contract.
Ignore: a universal memory winner. Current evidence says memory methods reverse order across factual and sequential tasks. Select a substrate only after measuring delivered context, management cost, and action outcomes in the target regime.
Stay Sharp: the agent is a confused deputy
Norm Hardy’s 1988 paper describes a compiler with authority from two sources. It could write its own protected statistics file, and it could write a user-named debug file. A user supplied the system billing file as the debug destination. Because the compiler’s ambient authority covered that directory, it overwrote the billing data. The compiler had no way to state which authority justified a particular write. (Hardy)
The agent version is structural, not metaphorical. A coding agent holds repository, shell, network, and deployment capabilities from its operator. It also reads user requests, code comments, tool descriptions, retrieved documents, and persistent memories. If all of that text enters one reasoning stream while every action uses the agent’s ambient credentials, the system cannot reliably distinguish “information I saw” from “authority I received.”
Hardy’s capability solution joins designation with authority. Applied to agents, that means a task should carry handles to the effects it authorizes, not merely natural-language names that the agent resolves using all of its standing access. A bug reference can designate an issue without granting permission to edit it. A memory can identify a past decision without authorizing its reuse for another customer. A background worker can inherit a bounded capability that expires when its parent instruction changes.
This changes my mental model of context engineering. I previously treated context quality mainly as a relevance, cost, and accuracy problem. This week’s evidence makes it an authority problem. Retrieval, memory consolidation, delegation, and tool telemetry all decide which text can influence an action. Their contracts should say not only what information is delivered, but what that information is allowed to cause.
Next week, watch for five missing pieces: Google’s model-level distraction rates, measured outcomes from Uber’s provenance controls, independent replication of memory-substrate reversals, race-condition tests for async cancellation, and evidence that proof-driven development can scale beyond one Rust security boundary.