Agent systems are being boxed in by context, tool, cost, and safety controls

Context Sculpting tests a two-model harness where a stronger outer model can rewrite the working context of a weaker task agent. The setup is useful because long agent runs often carry stale files, failed paths, tool noise, and distractor evidence.

The results support feasibility, with clear cost limits. In the first demo, all 8 runs passed verification and the harness made no rewrites. In the noisier second demo, the outer agent made 14 context rewrites across 2 harnessed runs. The coding repair example passed in both forms: the control run used 7 turns, 42.7 seconds, and about $0.015; the harnessed run used 12 turns, 566.9 seconds, about $1.06, and hit a max-turn guardrail. The result is a concrete warning: context editing can work, and policy choice can make it expensive fast.

The Model Context Protocol (MCP) is showing up as a practical boundary for agent tools. clawdcursor exposes desktop control through one MCP entry, using accessibility metadata before OCR or screenshots. Its compact surface has 6 tool groups, while a 94-tool granular surface remains available for compatibility and debugging. Every call passes through a safety check, and destructive actions require confirmation.

Aquifer addresses a different operating problem: bursty tool traffic. Agents submit jobs through MCP or HTTP, Aquifer stores them in SQLite, and per-upstream workers dispatch requests at configured rates. Example limits include OpenAI at 10 requests per second with 3 concurrent requests and Stripe at 20 requests per second with 5 concurrent requests. These are engineering controls, with no reported throughput or task-completion benchmark in the excerpts.

Cost control is now part of coding-agent product design. Cursor cut Teams annual seat pricing by 20% to $32 per user per month, added a $120 Premium tier, split first-party Composer usage from third-party model allowance, and added spend alerts, dashboards, budgets, model access controls, and agent permission settings. The listed model prices explain the pressure: Composer 2.5 is priced at $0.50 per million input tokens and $2.50 per million output tokens, while Claude Opus 4.7 and 4.8 are listed at about 10 times those rates.

The maintenance concern appears in Code Is Cheap(er). The essay argues that generated code can arrive faster than reviewers can understand it, so teams should keep LLM changes small and treat simplification as an engineering duty. It offers no measurement, but it matches the operational theme: cheap generation still creates review, ownership, and budget work.

The safety item argues for hard boundaries around actions where recovery would come too late. Observational Governance Infrastructure (IGO) uses four layers: the first three monitor recoverable failures, and the fourth contains actions that must remain unreachable. Its Cognitive Performance Index (CPI) formula lowers the score when temporal confidence variance rises, with scores above 80 labeled stable and scores below 50 labeled critical volatility.

The reported evidence includes measurements across 4 institutions and audits of 4 global LLMs. CPI reportedly ranged from about 22 to 55, near or below the critical threshold. The paper also reports a recorded stress test with Claude Opus 4.8, but the strongest cited result is architectural: detection is used for recoverable errors, while containment is reserved for ruin-risk actions.