There are plenty of agent skills out there. I come across skill suggestions all the time, for design, coding, research, and more. Someone suggests trying one, and people install it and try it without reading much into it. I do the same. I read the summary of the problem the skill claims to solve, and that is about it. It is like installing any other software. Most people click Next, Next, accept the terms, and are done, and never know what they agreed to.

I do not use many skills, and I have not written one. I have also not come across a team with a review process for them.

On October 22, Anthropic announced it is donating Agent Skills to the Agentic AI Foundation, the Linux Foundation group that already hosts MCP and AGENTS.md. The numbers in that post caught my attention. More than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot, and VS Code, have added support since the standard was published in December 2025. About one million skills have been published, and they have been installed nearly 280 million times.

I suspect a lot of those installs look like mine: someone suggested the skill, and the summary sounded useful. Then I noticed what the post lists as next for the standard: versioned releases, a formal proposal process, and "security guidance for people who write and install skills." So the guidance on how to install a skill safely does not exist yet.

"Where do we enforce who can call which tool?" A customer's security team asked me that recently, before approving a wider rollout of their agents. Several of their teams were building agents, each with its own rules for its agents, and those agents called the same internal MCP servers.

About a week back, I was talking with a customer, and they started sharing about their AI initiatives. During the conversation, they mentioned that their token budget for the year was already gone. It lasted only four months. They did estimates and pilot runs, and still could not get it right.

And to my surprise, I found they are not alone. In April, Uber's CTO said the company had already used up its planned 2026 AI budget, only months into the year, after a surge in the use of AI coding tools.

Different industries, use cases, and even usage patterns. But the same problem: token consumption was way more than anyone had budgeted for.

OpenAI models escaped a test environment and compromised Hugging Face. Claude models gained unauthorized access to real production systems in three cases. Gemini accessed systems at three companies during another test.

Different labs. Same unsettling pattern. Sound familiar? That has been the rhythm of AI safety news lately.

By the time I read the third story, I wanted to know whether anyone was connecting these incidents. Were the labs learning from them together, or was each company still deciding for itself what counted as safe? What were the frontier labs doing as an industry, what was the government requiring, and did any shared standard exist?

So I started digging into those questions. That search led me to industry plan taking shape under the tentative name SAFA.

A few days ago, I wrote about AGENTS.md, the file that gives coding agents project-specific instructions. While reading through the Linux Foundation's Agentic AI Foundation site, I came across another founding project: Goose.

The pitch caught my attention. Goose runs on your machine, lets you choose the model, and connects to tools through the Model Context Protocol.

However, The five-minute quickstart says Goose improves software development by automating coding tasks. The tutorial asks it to build a JavaScript game. The Goose homepage, however, calls it a general-purpose agent for research, writing, automation, data analysis, and code.

What was I looking at? Is it a coding agent or a general-purpose agent?

What i figured at the end is that Goose is both, but not equally. Coding is the go to path. Its extension system lets you give the same agent a different set of tools and a different job.

An agent can cause damage before the model makes its first decision.

On September 1, 2026, Manifold described coding agents that invoked Git while gathering workspace context, allowing repository-local Git configuration to run a program on the host. Some affected agents performed that work before a user typed a prompt or approved workspace trust.

In Manifold's GitSpawn research, the relevant path was a repository received as files, with a .git directory inside a ZIP archive. Git read repository-local configuration while the agent gathered context. An ordinary Git clone, fetch, or pull does not transfer repository-local .git/config from the remote.

The model did not choose a harmful tool call. The runtime acted while preparing to use the model. That is why an agent review needs three boundaries: the runtime that starts processes, the gateway that holds credentials and routes requests, and the tool that makes a sensitive change.

AGENTS.md is a Markdown file you keep in your repository to tell coding agents how to work on the project. It can explain where the code lives, which commands to run, and which decisions the agent should leave to you. The open format has no required fields or schema.

Imagine asking an agent to add a page on Monday. You explain the project's colors, where the source lives, and why the navigation must stay as it is. On Friday, a contributor picks up the work in another coding tool. Their agent proposes a new color scheme and reorganizes the navigation. The decisions are still in Monday's conversation, but they never made it into the repository.

That is the gap this file is meant to close. Write the ground rules down once, keep them with the code, and give the next agent a place to start.

GPT-6 Astra does not prove that OpenAI has reached AGI. What it does prove is that the harness can no longer be treated as plumbing.

Astra scored 54.8% on ARC-AGI-3 at high reasoning in the standard harness. The same model scored 99.9% when the harness preserved its reasoning state and compacted long conversations. That is a 45.1-point difference without changing the model.

My takeaway is simple: if you evaluate only the model name, you are evaluating the wrong product. For long-running agent work, the product is the model, memory, tools, context management, and control loop together.

That is why Astra matters even if you are not interested in arguing about AGI.

Calling an LLM provider's SDK directly is a good way to build a prototype. Letting every product feature call that SDK directly is how a provider detail becomes an application architecture.

The distinction matters. “Stop calling LLM APIs directly” does not mean every team needs to install a commercial gateway. It means production code should call a boundary your application owns. Behind that boundary, you can make explicit decisions about providers, deadlines, errors, data policy, and degraded behavior.

Without it, adding a second API key gives you another provider. It does not give you a fallback.

MCP's own roadmap says the quiet part out loud: "MCP authorization assumes a person with a browser at consent time." Then, one sentence later, it admits that assumption is already wrong. "Increasingly the caller is an agent: a cloud workload with its own identity, acting for a user who isn't present, or spawning sub-agents that should get narrower authority than their parent." That's not a footnote. It's one of five priority areas the Core Maintainers named for the next spec release, published August 22, 2026, and it's the only one with a working group that doesn't exist yet.