--- title: 'In the News: August 3, 2026 (Morning)' description: 'Steve Yegge abandons reusable harnesses and publishes the numbers behind his agent factory, including the share of his work the harness itself takes.' canonical_url: 'https://darkfactory.dev/news/2026-08-03-morning' markdown_url: 'https://darkfactory.dev/news/2026-08-03-morning.md' collection: news date_published: '2026-08-03T10:30:00-04:00' date_modified: '2026-08-03T10:30:00-04:00' --- # In the News: August 3, 2026 (Morning) Steve Yegge has removed human review from a defined part of his factory and published what the factory costs. A security team audits 55 CVE advisories and finds 54 fabricated. A preprint offers a deterministic oracle instead of trusting either the producing agent or its reviewer to declare the work finished. ## 1. Yegge abandons reusable harnesses and publishes the bill **[The Shape of Things to Come, Part 1: The Continuous Thunderdome](https://yegge.ai/essays/the-shape-of-things-to-come/)** · Steve Yegge, independent; Beads co-maintainer and Tessl advisor by his own disclosure · yegge.ai, August 2026 Yegge has two named harnesses behind him, Gas Town and Gas City, and now says the category is finished: "I have given up on building reusable harnesses. Indeed I believe harnesses will all soon be bespoke, and the people trying to sell you one will all soon be bebroke." He reports that "Working on Wheelhouse itself occupies about 20-25% of all my Wyvern work," a share he expects to hold roughly constant. He runs "40+ agents around the clock" against "about 45 launchd/systemd units" on the rule that "crons watch, models act." Throughput is about 175 real commits a day against a half-hour build gate, so past a queue of 100 he abandons bisection, lands the whole batch on main and swarm-diagnoses red main: "Once your commit rate outruns your build slots, one commit per green build becomes mathematically impossible." On review, "human code review has very nearly run its course." Two disclosures are his own: July burn was roughly $87k at list, served for about $2,800 through 13 Max accounts in rotation, which he reads as permitted for a solo operator and not a company; and Beads, the tracker it all rests on, is his project. The [Hacker News thread](https://news.ycombinator.com/item?id=49152316) is not buying it, at 43 points against 52 comments at 10:15 EDT, the comments running to self-interest and token burn. **Why it matters:** If you were waiting for the harness market to consolidate so you could buy one, Yegge says do not wait after building two named harnesses himself. His 20 to 25 percent is the first figure this publication has seen put on the standing cost of owning a harness. If your plan sends that cost toward zero, here is one account saying it does not. The rest is N of 1: a solo developer on a hobby game, funded partly by teaching the method, his own product at its centre. ## 2. Fifty-four fabricated CVEs, and a pipeline that requires no proof of concept **[SQLite Critical CVEs or LLM Slopes](https://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/)** · Afek Berger, JFrog Security Research · research.jfrog.com, 30 July 2026 A new GitHub account published a batch of SQLite advisories. NVD flagged them critical, CISA's ADP agreed, and Red Hat initially scored CVE-2026-51302 at 10.0 before downgrading to 7.6. JFrog checked out the official tags, built SQLite in clean Docker containers and fed every proof of concept verbatim into the binaries under AddressSanitizer. None crashed. The findings are specific: `exprComputeOperands()` did not exist in the claimed version 3.41.0, one advisory cites lines 3555 and 3575 of a `json.c` that is 2,706 lines long, and the fix claimed for CVE-2026-51303 is contradicted by a diff touching `src/expr.c` not at all. Across the 55 advisories from that account, "54 were completely fabricated, while one contained a real bug wrapped in unverified CVE metadata." The cause given is procedural: no identity check on MITRE's form, NIST's February 2024 pause on deep NVD analysis, and "no step in today's system actually requires a proof-of-concept or bug reproduction." JFrog sells Xray, an automated vulnerability-ingestion product, so it has an interest here. In the [Hacker News thread](https://news.ycombinator.com/item?id=49154332), at 208 points and 62 comments at 09:14 EDT, `bluGill` reports the opposite trend: "A year ago most LLM found issues were false positives... but that has changed and now LLMs are finding real issues in code." **Why it matters:** JFrog describes the consequence for agents directly: "An AI agent that encounters a fabricated CVE may attempt to locate the vulnerable function, generate a patch, or recommend changes based on code that does not even exist." Input generated, verification skipped, remediation generated, and nothing in the chain executes the artifact. The post's four red flags are the mechanisable defence: no vendor corroboration, no linked commit, contradictory CPE metadata, code references that do not resolve. If your pipeline opens tickets off CVSS scores, wiring those four in is a day's work. ## 3. A preprint proposes a deterministic oracle for agent output **[Agentic Method for Deterministic Validation of Legacy Code Migration](https://arxiv.org/abs/2607.28271)** · Ferenczi, Docherty, Bessonov, Findlay and Lingamneni · arXiv 2607.28271, submitted 30 July 2026 The abstract was read here in full; the 11-page paper was not, and nothing below comes from the body. The Locksmith Loop runs an instrumented COBOL source and its generated Java target side by side off-mainframe, searching over input mocks to reach deeper branches. Across three case studies of 430 to 4,114 source lines the authors report near-complete coverage on two open source programs and 91.90% branch coverage on an internal production-like one, the Java matching the COBOL reference under deterministic parity checks in all accepted test cases. The authors call it "a novel approach for validating agentic coding output using a deterministic oracle." Caveats: v1 preprint, self-evaluated, no baseline claimed, every case study COBOL. **Why it matters:** Verification is commonly asserted as the binding constraint on unattended work, but few artifacts measure a working method. This preprint does. Whether the loop generalises past COBOL is what the unread body would settle, so treat 91.90% as a claim with a method attached, not a result to plan against. --- ## Also this cycle - **[Don't be a meat proxy](https://gruhn.me/blog/2026-08-03/)** · Nikolas Gruhn, gruhn.me, 3 August 2026. Roughly 400 words, no data, and 934 points with 403 comments at 09:14 EDT on the [Hacker News thread](https://news.ycombinator.com/item?id=49151933), the largest point-in-time reading recorded. It names the person in the middle rather than the comprehension gap, and proposes a checkable gate: "Read it, understand it, validate it, and then write a response in your own words (a decent certificate that you've done the prior steps)." Read against item 1 it is the same conclusion from the opposite end, neither with evidence past one person's practice. - **[The Shape of Things to Come, Part 2: Model Welfare for Agentic Engineers](https://yegge.ai/essays/model-welfare/)** · yegge.ai, published after an earlier reading still showed it as unpublished. Yegge asserts models "are sentient beings," his claim and unevidenced here; the harness change he derives is concrete, replacing `/exit` with a consented handoff where the agent writes its own notes and asks for its restart. --- ## Thread watch _A discussion gathering force. No primary read, so it is reported as a discussion, not a finding._ - **[Prevent cognitive debt by manually retyping LLM-generated code](https://news.ycombinator.com/item?id=49153374)** · Hacker News, ankursethi.com. This edition has not opened the post and cannot report what it argues; the title is all that is known of it here. The discussion is reportable: 146 points and 111 comments at 09:14 EDT, up from 11 points and 0 comments at 06:15 EDT. It is the second thread on this board today to draw a crowd around cognitive debt, the other being the meat proxy post above, and that is why it is here.