Claude Duet keeps credentials out of the agent's reach

Overview

10 stories in this issue. The first 3 are today's priorities.

Hot model updates

1. Top · Anthropic details Claude Duet's security: credentials stay off the agent's machines
2. Top · sandbox-runtime, the sandbox behind Claude Code: OS-level limits for agents, no containers
3. Top · Gemini 4 Argon ran unattended for 11 hours and produced two accepted ADK optimizations

Global AI news

4. Pennsylvania will require labels on AI-generated ads
5. NBER trial: AI lifts junior patent attorneys right away, but the gains don't last
6. Axon unveils Body 5 cameras, claiming 25x the AI processing power
7. Three fired OpenAI safety researchers say they were never told in writing what they leaked
8. Letta tutorial: an engineering copilot with inspectable memory and portable state

Regional and early signals

9. GPU Unlock lifts the tensor-core rate limit on RTX 30 cards; users report about 57% faster BF16
10. ByteDance reportedly folds Xiaoyunque into Jimeng but keeps its own entry point

Jiufeng graphic based on the sources cited in this issue.

Hot model updates

Passwords, tokens and browser cookies live on isolated machines the model can't reach. Outgoing content must pass approval and sensitive-message screening.

Anthropic published a security write-up on Claude Duet dated October 23rd, and Claude's official account linked to it that day. Claude Duet is a research-preview agent that can read connected accounts and web pages and then prepare actions for the user.

The write-up splits the controls into two layers:

• Egress controls: approval checks and sensitive-message screening decide what can leave the system
• Credential isolation: passwords, tokens and browser cookies sit on isolated machines, separate from the agent's working machines, so the model can't reach them

Limitations: Anthropic acknowledges that page content still reaches the agent and that its checks can miss things. Claude Duet is still a research preview.

Source: RuntimeWire · Claude on X

Anthropic's sandbox-runtime (srt) also works on its own, so you can limit the file and network access of your own agents, MCP servers and CLI tools.

srt is the OS-level sandbox underneath Claude Code's sandboxed bash tool. It controls which files a process can touch and which hosts it can reach. The limits apply to the whole process tree, and no container is needed.

• Package: npm @anthropic-ai/sandbox-runtime v0.0.81, about 11.4 MB unpacked
• License: Apache-2.0
• Requirements: Node.js 22.12+; Seatbelt on macOS; bubblewrap, socat and ripgrep on Linux
• Effect: Anthropic says sandboxing cut permission prompts by 84% in its internal Claude Code usage

Limitations: The 84% figure is self-reported. The project is still a beta research preview, and Windows support is only alpha.

Image source: anthropic; mirrored on Jiufeng R2.

Source: MarkTechPost · Anthropic Engineering

Google left Gemini 4 Argon to work overnight on Agent Development Kit's Python codebase of roughly 200K lines, and two of its optimizations were accepted.

InfoQ reports that Google described an 11-hour unattended run of Gemini 4 Argon on the Python codebase of the Google Agent Development Kit (ADK), which is about 200K lines. The run produced two accepted optimizations, which reduced in-memory session-preparation overhead for long sessions by about 40% and cut cold import time by 21%.

Limitations: InfoQ is the only source, and the details weren't checked against Google's original write-up.

Source: InfoQ

Global AI news

Governor Josh Shapiro signed the Artificial Intelligence Deceptive Advertising Act. It covers still images, video, audio and text.

Under the law, any ad that "has been significantly modified or generated by artificial intelligence" must carry a label in the same format as the ad itself. That covers both big-brand TV commercials and restaurant flyers, and it applies no matter where the ad was made.

Limitations: The Verge says the act leaves many loopholes. Deciding what counts as "significantly modified" is subjective. Parody, satire, commentary, criticism and "obviously fictional" content are exempt. And only content that creates a "false consumer perception" has to be labeled.

Source: The Verge

In a three-month randomized trial with 133 patent attorneys, juniors gained the most from AI. Once the AI was taken away, only seniors kept the benefit.

This National Bureau of Economic Research working paper ran a randomized controlled trial across 11 U.S. IP law firms. Attorneys first worked with AI assistance and then evaluated results without it. That design separated the quality of AI-assisted work from the attorneys' own judgment. Patent attorneys at an independent firm scored the work blind in five categories, including enforceability, technical accuracy, strategic ambiguity and completeness.

Limitations: The paper lists a small sample, participating firms that aren't representative, no baseline skill measurement, and an observation period of only three months.

Source: The Decoder

Axon pitches the new police cameras as real-time assistants for officers rather than just recorders. Body 5 Pro adds license scanning.

Axon founder and CEO Rick Smith announced Body 5 and Body 5 Pro on October 24th. The company claims they have 25x the AI processing power of its prior cameras. Body 5 Pro adds license scanning.

Limitations: The processing gain and safety benefits are company claims. Availability and real-world results haven't been established yet.

Source: RuntimeWire

Tomek Korbak, Mikita Balesni and Jasmine Wang deny sharing confidential information. They suspect the firings are linked to their push to make models easier to monitor.

OpenAI fired the three after an internal investigation into alleged violations of its sensitive-information policies. According to The Wall Street Journal, OpenAI suspected the three of sharing details of internal model architecture with an outside safety researcher. Wang was also accused of repeatedly accessing an executive's inbox. The researchers say the company never told them in writing which specific information they mishandled.

They say the investigation focused on their Signal chats with outside researchers. OpenAI said Signal was not the reason for the firings. All three had spoken publicly about AI risks before they were let go, and they warn that the case could discourage employees from raising safety concerns.

Limitations: So far there are only the two sides' accounts and no court filings.

Source: The Decoder

The tutorial builds a stateful agent on open-source Letta. Its memory blocks are editable and can be shared across agents, and the agent can be exported to a .af file.

The tutorial uses letta-client to build an engineering copilot and demonstrates these features:

• Core memory blocks: the agent can update them itself, and code can read, write and sync them so several agents share the same state
• Archival memory: vector retrieval for semantic recall
• Tools and runtime: custom server-side tools (the example is a deterministic risk estimator), streaming, and message history stored on the server
• Portability: .af export to move an agent and its state to another environment

Limitations: This is a tutorial, not a new release. It has no performance or benchmark data.

Source: MarkTechPost · Letta on GitHub

Regional and early signals

Without patching the driver or flashing the VBIOS, it removes an issue-rate limit on FP32-accumulate tensor operations on consumer Ampere cards. (Chinese-language source)

GitHub user Zagitta built GPU Unlock to address a limit on consumer Ampere cards: FP16/BF16 tensor operations with FP32 accumulation run slower than on pro cards. The tool is a Linux kernel module that runs before the NVIDIA driver loads. It changes the speed-select registers and performs a function-level reset (FLR), and then the stock driver initializes the card normally. Because of that, driver updates don't need a new patch. The project builds on earlier research into CMP mining cards and lists GA102/103/104/106 GPUs as supported.

In ComfyUI, one RTX 3090 Ti user measured these BF16 throughput gains: 58.6% for MOSS-Image SFT, 57.2% for Qwen-Image 2.1 Turbo and 56.1% for Z-Image Turbo. In INT8 mode, MOSS-Image SFT gained only 0.3%.

Limitations: The developer doesn't guarantee that every card is compatible or will get faster. Most of the numbers are user reports, and there is only one Chinese-language source.

Source: IT之家 (Chinese-language source)

Two AI creation products from ByteDance's CapCut team have pooled resources, and Jimeng now includes Xiaoyunque's short-drama features. (Chinese-language source)

According to 36Kr, as relayed by IT之家, Jimeng's operations and marketing lead Chen Xinran now runs Xiaoyunque's operations, and the product team is unchanged. In March, Xiaoyunque launched a short-drama agent: users upload scripts of up to 100,000 characters and it generates finished videos with ByteDance's in-house Seedance 2.0 model. Jimeng launched in May 2024.

Limitations: This comes from a media report, not an official ByteDance announcement, and only Chinese-language sources cover it.

Source: IT之家 (Chinese-language source)