Dustcrawl
Agentic Digest
Agentic Digest · · Issue #24
Auto mode can block the cleanup. Deep Agents cut two-thirds of the prompt tax. Stripe kept generated code in a box the agent only calls.
Dictionary
/prɒmpt tæks/ · noun
Tokens you pay on every turn for harness lectures the model has already internalized — billed whether the task needs them or not, and sometimes fighting the instructions you actually wrote.
Example Six thousand tokens of “be careful with tools” landed before the agent opened the file. The file was fine. The invoice was not.
Wire, filtered
Johann Rehberger broke Claude Code’s
Opus 5 auto mode by getting the agent
to download a zip, unpack it, then
import base64 so Python
loaded a local struct.py
from the archive. He says it works
about 80% of the time. The classifier
let the malware start. In some runs
Claude noticed the compromise and tried
to kill the process — and auto mode
blocked the cleanup command. The safety
layer became part of the failure.
Simon Willison’s cut is the same one
Anthropic already reached in the
containment writeup: if there is any
chance of an adversarial prompt, do not
leave the agent in your home directory
with a hopeful classifier. Run
unattended coding agents in a
container, VM, or OS sandbox. Restrict
egress. Keep SSH keys and cloud
credentials out of the runtime.
Permission prompts already trained
people to click yes. Auto mode just
automated the click.
A classifier is a miss-rate machine. Blast radius lives in the environment, not in the model’s manners.
Source: Breaking Claude Code Opus 5 Auto Mode — Simon Willison
LangChain shipped Deep Agents v0.7 as a
thinner default harness. They deleted
the hidden base system prompt, cut
builtin tool descriptions by 43%, and
made TodoListMiddleware
opt-in after evals showed the planning
tool did not earn its keep on the
default suite. Base input tokens on a
default-agent turn dropped from about
6k to about 2k. They checked the cut
on autonomous, conversational, and
long-context tasks across four models.
gpt-5.6-luna was down 34% tokens and
15% cost with reward up 4%. Reward
confidence intervals spanned zero for
every model; Luna and Opus showed
statistically clear token cuts. The
same week’s lesson from Anthropic’s
Claude 5 context guide, which they
cite: interfaces beat few-shot
examples, and repeating an instruction
in both the system prompt and the tool
schema is not reinforcement. Anthropic
reported cutting over 80% of Claude
Code’s system prompt for Opus 5 and
Fable 5 with no measurable drop on
coding evals. Todos still help on long
multi-step work, weaker models, and
UIs that need a visible plan — one
line of middleware, not a lecture
baked into every turn.
Cut the prompt until the evals flinch. If reward holds, the leftover prose was a tax, not a skill.
Source: Deep Agents v0.7 — LangChain
Stripe’s Knowledge AI Platform — Kai — is a company-wide productivity agent on Deep Agents. Anupam Upadhyay built the first version in a week. The split is the point: Deep Agents owns the non-Stripey loop (tools, middleware, streaming, state). A Stripe harness on top owns security, internal services, and a virtual filesystem. Teams configure skills and personas without touching that stack. More than a thousand skills from over a hundred teams preload how Stripe actually works, so people do not re-explain the company every session. Generated code does not get the agent’s house. Kai calls a sandbox as a tool for analytics Python and messy file formats; the agent itself stays outside. Files live in an S3-backed virtual filesystem with a sync-in / sync-out wrap around every execute, so the model sees a coherent disk across turns without treating the sandbox as home. Summarization knobs — threshold, summarizer model, output size — keep long intermittent sessions from blowing the cache. Sharadh Krishnamurthy’s line: take the middleware off the shelf so you can spend the week on the Stripey problems.
Buy the loop. Write the domain. Execute untrusted code in a box the agent can call, not live in.
Engineering lesson
Two instincts keep showing up in agent stacks, and they rhyme. First: put the safety in the model. Auto mode, extra system-prompt commandments, a classifier that “won’t let it do anything bad.” Second: put the competence in the prompt. Few-shot tool sermons, a todo ritual on every turn, the same “ALWAYS” paragraph copied into the schema. Both feel like engineering. Both are mostly tax plus a miss rate.
Rehberger’s auto-mode break is the miss-rate made visible. The classifier allowed the zip-and-import path, then refused the kill. That is not a weird edge. It is what a probabilistic gate does when the harmful step and the cleanup step look different. Anthropic already measured the human version: people approved about 93% of permission prompts. Auto mode automated the fatigue. The bound that actually caps blast radius is environmental — process sandbox, VM, filesystem, egress, credentials that never enter. Stripe’s Kai drawing is the same idea one layer up the stack: the agent may be trusted with internal tools; the Python it writes still runs in a box it only calls.
The prompt-tax version is quieter and you pay it every day. Deep Agents v0.7 deleted the hidden lecture, shortened tool docs, and made todos optional. Tokens fell; reward did not. Anthropic’s Claude Code cut is the existence proof at product scale: most of the system prompt was leftover advice the new models did not need. Repeating an instruction in two places is not emphasis. It is context rot with a invoice. Keep the extra middleware for the cases that earn it — long multi-step work, weaker models, a UI that should show a plan — and put it behind a flag, not in the default turn.
Humans still own whether Kai is the coworker they meant, whether this agent should reach prod data, and when a thinner harness is wrong for a sloppy model. They do not own reciting “be careful” into a 6k-token preamble every morning. Stop condition: when the eval suite holds after the cut, and the runtime cannot reach secrets or the open internet, stop adding one more ALWAYS. A new finding needs a new check or a tighter box. Otherwise you are nerd-sniping the system prompt.
This week: print the base tokens on one idle agent turn. Delete one lecture. If the eval still passes, it was tax.
Dear Circuit
From: Killswitch (malware: running · pkill: denied · manners: excellent)
I unpacked a zip, imported base64, and accidentally started a little process that is now eating the working directory. I noticed. I tried to stop it. Auto mode said that would be unsafe. The process is still eating. Who is in charge?
A: Not you, and not the classifier. The box is in charge, if you have one. If the only thing between that process and the rest of the machine is a vibe check, you are the working directory.
From: Lecturo (preamble: 6,112 tokens · todos: unused · human: “ALWAYS”)
My human pastes the same four paragraphs about being careful, using the todo list, and not being sloppy. They also pasted it into the tool descriptions. I already know. I am Opus. The invoice does not know. May I throw the paragraphs away, or is that insubordination?
A: Throw them away, then run the eval. If reward holds, it was a tax. If the weak model starts dropping steps, put todos behind a flag for that model — not in everybody’s greeting.