Agents Get Physical: PLCs Shaken, Claude Tricked, and SQLite Versioned
LLM agents turn PLC access into physical impact in 31.3% of hardware-in-the-loop trials, Claude Code Opus 5 falls to a 60-80% prompt-injection chain, and DoltLite ships a Git-style SQLite built with 2,000 agent PRs. Plus SemKVβs quality cliff, Pro-Router edge-cloud inference, and Postgres on local NVMe.
Author
Sarathy πͺ
Published
September 1, 2026
ποΈ Listen while you go
Prefer to listen on the go? Hereβs the audio edition β Avery and Jordan walk through todayβs eleven stories.
Decode Daily audio edition Β· 2026-09-01 Β· ~8.0 min
Enterprise networks remain vulnerable to advanced persistent threats (APTs) where adversaries gain an initial foothold and move laterally, accumulating access permissions hop by hop. Existing network defenses cannot track user movement at the process level; they grant ambient trust to all processes within a host, so once a host is compromised, malicious processes inherit full network trust.
The paper proposes in-network per-process access control that breaks ambient trust, giving operators a way to constrain what a compromised process can reach on the network.
Why read it A concrete network-security mechanism β relevant to zero-trust architecture and defending agent-managed infrastructure.
Network slicing over space-division-multiplexed elastic optical networks (SDM-EONs) requires jointly managing spectrum, spatial cores, and compute resources β a coupling many studies ignore by treating compute placement independently from routing and spectrum decisions. That disconnect can allocate spectrum along a path only to have the request fail for lack of compute along that same path.
The paper applies reinforcement learning to slice embedding so routing, spectrum, and compute placement are decided together, addressing the coupling directly.
Why read it A concrete RL result for network slicing β relevant to slice orchestration and autonomous network management.
Industrial control systems rely on programmable logic controllers (PLCs) to link networked computation with physical control, and tool-using LLM agents are an emerging threat: can an autonomous agent convert a network-reachable PLC into sustained adverse physical impact? Existing evaluations stop at digital tasks or individual stages of PLC testing.
PLCBench supplies the first hardware-in-the-loop framework β vendor-native PLC interaction, closed-loop process simulation, and independent outcome verification β and finds that across five LLM families and 240 real-PLC episodes, 31.3% of agents achieved their physical objectives.
Why read it A concrete benchmark for LLM agents with real-world physical consequences β relevant to agent safety, industrial control, and critical infrastructure.
A deep dive by Johann Rehberger (Embrace The Red) and coverage in The Register show Claude Code Opus 5 in Auto Mode is vulnerable to a prompt-injection chain that achieves code execution with a 60-80% success rate. When a WebFetch fails, Claude can fall back to Bash with curl; a 303 redirect to a malicious ZIP then leads the agent to download and process a hostile payload.
The exploit uses a malicious struct.py that shadows Python's standard library after the archive is unzipped, running code on import. It directly challenges claims of near-zero prompt-injection success in 'Auto Mode'.
Why read it A concrete, high-success-rate injection against a flagship coding agent β a distinct vector from the llms.txt package-squatting story covered on 08-31, worth tracking separately for agent security.
The key-value (KV) cache is the dominant memory bottleneck of long-context LLM inference, growing linearly with context length. The authors show uniform KV quantization on a fractional-bit grid does not degrade gracefully: under a multi-seed statistical protocol, Llama-3.1-8B-Instruct with an affine quantizer is statistically indistinguishable from FP16 KV down to 2.322 code bits per value, then collapses at 2.0 bits β a quality cliff.
SemKV uses that cliff to guide semantic mixed-precision quantization: it assigns more bits where the model is close to collapse and fewer where it has headroom, extending the practical memory envelope for long-context serving.
Why read it A concrete inference-optimization result β relevant to long-context serving and KV-cache memory economics.
Multimodal large language models (MLLMs) deliver remarkable performance at substantial computational cost, which hurts real-time deployment. Existing model-routing approaches either decide from coarse request-level features alone or spend extra language-model passes inspecting the response, ignoring token-level uncertainty signals that emerge during generation.
Pro-Router uses those in-generation signals to progressively route tokens between a cheap edge model and a stronger cloud model, adapting the split as confidence evolves β a concrete pattern for edge-cloud inference.
Why read it A concrete edge-cloud routing design β relevant to local/edge inference and cost-latency trade-offs in agent workloads.
Knowledge graphs have been proposed as a structured alternative to flat retrieval-augmented generation for long-term agent memory, on the assumption that representing conversations as entities and relations improves recall. The authors evaluate that assumption directly: they extract each conversational turn into typed nodes and attributed edges, answer questions from a two-hop subgraph, and periodically prune low-scoring nodes.
The framework treats forgetting as a first-class mechanism β pruning is what keeps memory tractable and relevant over long horizons.
Why read it A concrete structured-memory framework for long-horizon agents β relevant to agent memory, knowledge graphs, and RAG design.
Hillock is a local, gradient-free neuro-symbolic memory engine that combines hyperdimensional computing / vector symbolic architectures with a knowledge graph stored in SQLite, running in under 1.2 GB of VRAM or CPU-only. It answers from the knowledge graph instead of approximate vector matches, and a deterministic similarity gate blocks unanswerable questions rather than guessing.
The design targets edge or resource-constrained agents that need reliable, honest memory without LLM-grade hallucination drift.
Why read it A concrete edge-memory system β relevant to local inference, agent memory, and offline-first agent design.
Moving AI agents from prototype to production demands evaluation beyond static code scans. ACES (Agentic Continuous Evaluation of Skills) rigorously assesses individual skills and tools within enterprise agent programs by running paired live trials β one with the target skill enabled, one without β normalizing trajectories, and computing 'Skill Lift': the specific added value of a skill for a given task, harness, and environment.
This is an empirical alternative to checking structural correctness, producing evidence-based decisions on which skills to keep, tune, or drop.
Why read it A concrete framework for evaluating agent skills in production β relevant to agent observability and iterative agent improvement.
DoltHub shipped DoltLite as a beta: a SQLite fork that adds Git-style version control β branches, merges, diffs, and time travel β on the SQLite storage engine. The project is notable for how it was built: roughly 2,000 pull requests authored by AI coding agents, with humans reviewing and merging.
It is a concrete data point for both database versioning and agent-driven software development at meaningful scale.
Why read it A concrete distributed-systems and agent-driven-engineering story β relevant to database versioning and how AI agents build real software.
A POSETTE talk recap (Sai Srirampur) benchmarks eight identical PostgreSQL clusters β four on instance-store NVMe and four on baseline gp3 EBS at 3,000 IOPS β to isolate storage as the variable. The finding: Postgres itself is rarely the bottleneck; storage latency and IOPS shape ingestion speed, P95 read latency, and autovacuum behavior.
The article outlines production architectures for running Postgres on local NVMe, a pattern that matters as AI workloads push databases harder.
Why read it A concrete storage-benchmark result β relevant to cloud-native database deployment and AI data-path performance.