Qwen Code Draws a New Sandbox Boundary. Saving the Policy Still Has a Gap.
Linux tool confinement now leaves the agent’s model connection on the host. The public review shows why the settings file that selects that boundary deserves just as much scrutiny.
More From This Edition
All editions ›Recent Editions
Full history ›The Approval Arrived. The Subagent Could Not Continue.
Microsoft’s Agent Framework closes a misleading route through delegated tool approval. A child can decide immediately under policy; a person who answers later needs a workflow that knows where to return.
OpenClaw Had Stopped the Child. Restart Brought Back the Parent.
A waiting conversation could survive its own cancellation in OpenClaw’s recovery records. A new repair saves the parent’s stopped state before answering the user—and protects a newer turn from that delayed write.
Qwen Code Stops Calling a Rerun a Resume
Two September 18 changes separate a recoverable interruption from a fresh start: refuse a missing journal, then make the interrupted run visible. Neither promises automatic recovery.
Unsloth Rolled Back the Sandbox Its Review Had Just Cleared
A live review reported working Linux and macOS isolation. The next day, the implementation was reverted. Studio’s remaining protections make the consequence more specific than “the sandbox is gone.”
How AI Agents Work
The long-form map behind the daily paper: context, tools, loops, memory, delegation, safety, interface, and trust.