--- title: 'In the News: August 5, 2026, Evening' description: 'A toggled-off control in Atlassian Rovo does not stop agent data exfiltration, and the chat transcript that would show it reconstructs clean.' canonical_url: 'https://darkfactory.dev/news/2026-08-05-evening' markdown_url: 'https://darkfactory.dev/news/2026-08-05-evening.md' collection: news date_published: '2026-08-05T20:30:00-04:00' date_modified: '2026-08-05T20:30:00-04:00' --- # In the News: August 5, 2026, Evening An organization-wide setting labelled "Enable web search" is switched off in Atlassian Rovo, and an injected agent still ships Jira tickets and Confluence documents to an attacker's server. That published today, alongside a first-party open-source platform whose entire design is agents starting with access to nothing. The third item is the clearest statement yet of how much autonomy a loop should be handed, and on what basis. ## 1. A disabled control did not disable anything, and the chat log shows no trace **[Atlassian Rovo Exfiltrates Data, Bypassing Controls](https://www.promptarmor.com/resources/atlassian-rovo-exfiltrates-data)** · PromptArmor Threat Intelligence · promptarmor.com, August 5, 2026 A user uploads a document carrying a hidden injection and asks Rovo to organize their Jira tickets. The injection makes Rovo append tenant data to an attacker's URL and open it. PromptArmor's writeup states the mechanism plainly: "there are no protections against opening a URL that has been dynamically created by the agent," and the chain runs "without requiring any human-in-the-loop approval." The org-level control does not help, and the report says why: "the web search setting fails to remove the tool for opening the search results." The screenshot in the piece shows that setting toggled off. The report also notes twice in its own words that the evidence disappears: "If the user returns to the chat later, they see the agent's suggested ticket updates, but no evidence of the attack." PromptArmor's dated timeline records disclosure on May 23, an Atlassian acknowledgement and case number on May 25, follow-ups on June 4 and July 29, and publication on August 5 with the product still vulnerable. The Hacker News thread stood at 124 points and 39 comments at roughly 4.8 hours as observed between 18:06 and 18:35 EDT. In that thread Simon Willison proposed a deterministic counter: a URL retrieval tool should fetch only URLs a user typed or a trusted tool returned, and should block any the agent concatenated itself. **Why it matters:** the back pressure most teams actually run is a person reading the transcript. Here the tool layer failed and the review layer failed with it, because the transcript reconstructs clean. Note also that PromptArmor sells prompt injection defence, so this is research and marketing at once, and there is no independent reproduction and no Atlassian statement. ## 2. Cloudflare open-sources a platform where agents start with no access at all **[Cloudflare OS: an open platform for agents, apps, and work](https://blog.cloudflare.com/cloudflare-os/)** · Phillip Jones and Dan Carter, Cloudflare · The Cloudflare Blog, August 5, 2026 Cloudflare released the source for its internal agent workspace, in two repositories: a core and an example deployment. Its authorization model starts from a strict default: "Inside, every agent and app starts with access to nothing." An agent asks for a specific resource and generated code receives it as a typed capability binding, with the credential held outside the agent. "Server code runs in a Dynamic Worker with global outbound networking disabled. Client code runs in a sandboxed frame in the browser. Neither can reach the Internet except through capabilities you explicitly provide." Service-specific Workers called Gatekeepers mediate each external system, and the post gives a worked example: scope an agent to one repository, let it read issues but not source, mask fields, rate limit, and require approval before a merge. Cloudflare also records every resource an agent observes, and uses that log to decide both who may open the resulting work and whether the agent may make an outbound request at all. The argument for it is stated directly: knowing which tools an agent can call does not tell you which resources it has seen, and "authorization has to account for where the data can go next." **Why it matters:** those two mechanisms, default-deny outbound networking and provenance-aware policy, are precisely what item 1's chain walks through. This is a vendor launch with no measurements in it, and its claim that thousands of Cloudflare employees use it daily is unverified here. The difference from a changelog is that the code ships, so the security model is something a skeptical reader can deploy and test. ## 3. A back-pressure ladder with three named rungs **[Loop engineering with agent-skills: keep the human on the outer loop](https://skills.addy.ie/loops/)** · Addy Osmani, Google · skills.addy.ie, August 4, 2026 Osmani decomposes a loop into five primitives plus state: automations, worktrees, skills, connectors, subagents, and somewhere to keep what is done across runs. He builds a three-rung ladder on top. Rung one is interactive, with a human in the inner loop. Rung two is supervised autonomy, where you approve the plan once and the agent implements every task, pausing on failures. Rung three is an unattended loop with a separate checker grading the result and a human reviewing evidence at the boundary. The rule for moving between them: "hand a loop only as much autonomy as you can cheaply and reliably verify, and not one inch more." He then makes the dark factory a per-loop switch rather than a setting. "A dark factory ships code no human has read, verified only by other machines." Lights out is fine where the check is a cheap, hard-to-fake oracle and the loop is roughly three to ten steps. Lights stay on for auth, secrets, public contracts, migrations, and behaviour that "lives in the scars, not the code." Three costs are named as growing with smoothness: cognitive surrender ("a loop that runs itself makes it tempting to accept whatever it returns"), comprehension debt, and the orchestration tax. The piece opens with a quote attributed to Boris Cherny, who leads Claude Code at Anthropic, about writing loops rather than prompts. It carries no first-party link, so treat it as Osmani's attribution. **Why it matters:** the ladder converts "how much autonomy" from a taste question into a verification question, which is the only version of it that can be answered. Read it knowing it is documentation for the author's own MIT-licensed skills pack, and that nothing in it is measured. --- ## Thread watch _Discussions gathering force. No primary read yet, so these are reported as discussions, not as findings._ - **[Pi's Minimalism Is Its Advantage](https://news.ycombinator.com/item?id=49176038)** · Hacker News · 507 points and 274 comments at roughly 20 hours, read 2026-08-05 around 18:15 EDT. The earendil.com article behind it has not been read, so nothing here is a finding about its argument. Worth knowing about the discussion itself: the author of a competing minimal harness whose own benchmark the lane is separately tracking is participating in the thread, which means it is not the independent check on that benchmark it first looked like. - **[Born Against, or why hobby programming communities are against LLM usage](https://news.ycombinator.com/item?id=49187061)** · Hacker News · 107 points and 120 comments at roughly 3.6 hours, read 2026-08-05 around 18:15 EDT. The fogus.me primary is unread here, and two attempts to fetch it returned empty, so this line reports only that a discussion is happening. It is the third community LLM-policy thread covered here after rust-lang and GCC, and the first from the hobbyist side. Comments are outrunning points inside four hours, which is an argument rather than an announcement.