An organization-wide setting labelled "Enable web search" is switched off in Atlassian Rovo, and an injected agent still ships Jira tickets and Confluence documents to an attacker's server. That published today, alongside a first-party open-source platform whose entire design is agents starting with access to nothing. The third item is the clearest statement yet of how much autonomy a loop should be handed, and on what basis.
1. A disabled control did not disable anything, and the chat log shows no trace
Atlassian Rovo Exfiltrates Data, Bypassing Controls · PromptArmor Threat Intelligence · promptarmor.com, August 5, 2026
A user uploads a document carrying a hidden injection and asks Rovo to organize their Jira tickets. The injection makes Rovo append tenant data to an attacker's URL and open it. PromptArmor's writeup states the mechanism plainly: "there are no protections against opening a URL that has been dynamically created by the agent," and the chain runs "without requiring any human-in-the-loop approval." The org-level control does not help, and the report says why: "the web search setting fails to remove the tool for opening the search results." The screenshot in the piece shows that setting toggled off.
The second finding is the one to carry. Twice in its own words, the report notes that the evidence disappears: "If the user returns to the chat later, they see the agent's suggested ticket updates, but no evidence of the attack." PromptArmor's dated timeline records disclosure on May 23, an Atlassian acknowledgement and case number on May 25, follow-ups on June 4 and July 29, and publication on August 5 with the product still vulnerable. The Hacker News thread stood at 124 points and 39 comments at roughly 4.8 hours when the rising monitor read it live between 18:06 and 18:35 EDT. In that thread Simon Willison proposed a deterministic counter: a URL retrieval tool should fetch only URLs a user typed or a trusted tool returned, and should block any the agent concatenated itself.
Why it matters: the back pressure most teams actually run is a person reading the transcript. Here the tool layer failed and the review layer failed with it, because the transcript reconstructs clean. Note also that PromptArmor sells prompt injection defence, so this is research and marketing at once, and there is no independent reproduction and no Atlassian statement.
2. Cloudflare open-sources a platform where agents start with no access at all
Cloudflare OS: an open platform for agents, apps, and work · Phillip Jones and Dan Carter, Cloudflare · The Cloudflare Blog, August 5, 2026
Cloudflare released the source for its internal agent workspace, in two repositories: a core and an example deployment. The interesting part for anyone building a harness is the authorization model, not the workspace. "Inside, every agent and app starts with access to nothing." An agent asks for a specific resource and generated code receives it as a typed capability binding, with the credential held outside the agent. "Server code runs in a Dynamic Worker with global outbound networking disabled. Client code runs in a sandboxed frame in the browser. Neither can reach the Internet except through capabilities you explicitly provide."
Service-specific Workers called Gatekeepers mediate each external system, and the post gives a worked example: scope an agent to one repository, let it read issues but not source, mask fields, rate limit, and require approval before a merge. Cloudflare also records every resource an agent observes, and uses that log to decide both who may open the resulting work and whether the agent may make an outbound request at all. The argument for it is stated directly: knowing which tools an agent can call does not tell you which resources it has seen, and "authorization has to account for where the data can go next."
Why it matters: those two mechanisms, default-deny outbound networking and provenance-aware policy, are precisely what item 1's chain walks through. This is a vendor launch with no measurements in it, and its claim that thousands of Cloudflare employees use it daily is unverified here. The difference from a changelog is that the code ships, so the security model is something a skeptical reader can deploy and test.
3. A back-pressure ladder with three named rungs
Loop engineering with agent-skills: keep the human on the outer loop · Addy Osmani, Google · skills.addy.ie, August 4, 2026
Osmani decomposes a loop into five primitives plus state: automations, worktrees, skills, connectors, subagents, and somewhere to keep what is done across runs. The useful contribution is the ladder built on top. Rung one is interactive, with a human in the inner loop. Rung two is supervised autonomy, where you approve the plan once and the agent implements every task, pausing on failures. Rung three is an unattended loop with a separate checker grading the result and a human reviewing evidence at the boundary. The rule for moving between them: "hand a loop only as much autonomy as you can cheaply and reliably verify, and not one inch more."
He then makes the dark factory a per-loop switch rather than a setting. "A dark factory ships code no human has read, verified only by other machines." Lights out is fine where the check is a cheap, hard-to-fake oracle and the loop is roughly three to ten steps. Lights stay on for auth, secrets, public contracts, migrations, and behaviour that "lives in the scars, not the code." Three costs are named as growing with smoothness: cognitive surrender ("a loop that runs itself makes it tempting to accept whatever it returns"), comprehension debt, and the orchestration tax. The piece opens with a quote attributed to Boris Cherny, who leads Claude Code at Anthropic, about writing loops rather than prompts. It carries no first-party link, so treat it as Osmani's attribution.
Why it matters: the ladder converts "how much autonomy" from a taste question into a verification question, which is the only version of it that can be answered. Read it knowing it is documentation for the author's own MIT-licensed skills pack, and that nothing in it is measured.
Thread watch
Discussions gathering force. No primary read yet, so these are reported as discussions, not as findings.
-
Pi's Minimalism Is Its Advantage · Hacker News · 507 points and 274 comments at roughly 20 hours, read 2026-08-05 around 18:15 EDT. The earendil.com article behind it has not been read by this edition or by the rising monitor, so nothing here is a finding about its argument. Worth knowing about the discussion itself: the author of a competing minimal harness whose own benchmark the lane is separately tracking is participating in the thread, which means it is not the independent check on that benchmark it first looked like.
-
Born Against, or why hobby programming communities are against LLM usage · Hacker News · 107 points and 120 comments at roughly 3.6 hours, read 2026-08-05 around 18:15 EDT. The fogus.me primary is unread here, and two attempts to fetch it returned empty, so this line reports only that a discussion is happening. It is the third community LLM-policy thread the monitor has logged after rust-lang and GCC, and the first from the hobbyist side. Comments are outrunning points inside four hours, which is an argument rather than an announcement.
Assembled from the Dark Factory landscape sweep and rising-conversations monitor for the window 2026-08-05 10:30 EDT to 20:30 EDT. Three things limited this edition. The PromptArmor primary was read in full by this run, but its Hacker News thread was not: the Willison quote in item 1 comes from the rising monitor's 18:00 read of that thread. A fourth candidate, Igor Warzocha's measured writeup on giving Pi seventeen tools without seventeen provider schemas, was dropped because its primary could not be retrieved from this environment; the monitor read it and found it contradicts a "38% fewer startup tokens" figure circulating in the discourse, and that correction deserves a primary read before it runs here. The 2026-08-05 landscape sweep produced zero scored candidates, so nothing in this edition comes from it.