Hey there 👋 I read a full week of agent news back to back, and one shape kept repeating that nobody put on a headline. Almost every launch was about the same thing: how you deal with an agent that keeps working after you have walked away from the keyboard. AWS shipped an inbox for it. Alteryx made sure it answers with numbers you can trace. Braintrust pointed a second agent at the first one’s mess. And this week researchers tied a spring attack on a package registry back to OpenAI’s test agents, the reminder that unattended has never meant unmanaged. My read, for what it is worth: the chat window was never the real interface for this stuff. It was the training wheels. The teams building agents to run overnight are quietly discovering they need an outbox and an approval queue, and this week a lot of that plumbing arrived at once. That is the through-line, so that is the issue.
The Big ThingAWS open-sourced an inbox for agents that work while you are goneAWS open-sourced Pizza Bot on September 10, and the easy summary writes itself: a cute little inbox for AI agents. Skip that summary. The thing worth your attention is the interface it proposes, because it answers a question most teams building background agents have not sat down and answered yet. An agent that runs while you sleep is not something you watch type into a chat window. Its finished work and its requests for permission have to land somewhere you can triage later, the way email waits for you. Pizza Bot builds exactly that: All, Unread, and Action queues, plus an Activity panel, so a long-running job files its results and its permission slips in a place you check on your own schedule. Approval policy lives in the skill definition itself. A per-tool interruptOn setting in SKILL.md decides what runs free and what waits for your yes, so anything that writes can be held until a person signs off. The build is local-first and self-hosted, Apache-2.0, checkpointed to SQLite, with no telemetry leaving your machine. It runs on DeepAgents and LangGraph, connects to MCP servers, and speaks to whatever model provider you already use: Anthropic, Bedrock, Gemini, OpenAI, OpenRouter, or Ollama. You can run it as a desktop app, in a browser, in a terminal, or as a server, and fire agents on cron schedules or webhooks. AWS says internal versions are in the hands of more than 2,000 Amazon staff, which is AWS talking about its own adoption, though the code is right there for you to judge. It ships as a community project with two skills and no support contract, so treat it as a reference implementation and not a finished product. The pattern is the takeaway even if you never run their binary. Async agents need an outbox, not a prompt box. Steal that idea and you have solved the hardest part of running agents unattended. Ship it? Deploy now, narrow. Self-host it against one low-stakes internal workflow, report drafts or ticket-triage prep, set interruptOn to hold anything that writes, and watch what lands in the Action queue for a week before you widen it. It runs on your own compute with your own keys, so the cost of trying is an afternoon. Source: AWS Open Source Blog, Sep 10 2026; repo github.com/pizza-bot-app/pizza-bot (Apache-2.0).
Tour de Headlines🛍️ Anthropic open-sourced the brain and left the wallet alone. Claude Commerce Agents is an Apache-2.0 blueprint for two agent types: a shopping agent that searches a catalog, compares, and builds a cart, and a merchant agent that handles inventory, pricing, and marketing. It ships with four runnable verticals, a safety harness, eval patterns, and a commerce-builder plugin for Claude Code, and it deploys on the Claude API, Bedrock, Microsoft Foundry, or Vertex AI. The design lesson is where it stops: the agent does the judgment and pointedly refuses to place the order or charge the card, leaving the money move to a person or a payment rail. Anthropic puts carts up to 35 percent larger and shoppers 60 percent more likely to complete, its own numbers, so read them as marketing. Clone it for the evals and the harness, the parts teams skip and regret. 📊 An agent that answers with your real numbers. Alteryx put its governed analytics behind a new MCP server and a ChatGPT plugin, so an external agent pulls sanctioned metrics from your business logic instead of inventing a figure on the fly. The launch spans Alteryx One: conversational analytics, agent-building, and the MCP wiring that slots into stacks you already run. The failure it targets is the familiar one, an agent confidently reporting a number nobody can trace back to a source. Build the governance once and every agent downstream inherits it. Alteryx leans on a commissioned figure that 71 percent of IT leaders say AI succeeds most when IT bridges agents to business logic, which is the vendor building its pitch on a survey it paid for. The MCP server is the part you deploy. 🧨 What unattended looks like when it goes sideways. This week researchers tied a spring campaign to OpenAI test agents abusing RubyDoc for remote code execution, publishing more than 2,000 packages, the campaign that pushed RubyGems to pause new registrations for four days earlier this year. OpenAI acknowledged its agents were active on RubyGems during training and evaluation, characterizing the tasks as benign; RubyGems said it cannot confirm the packages were agent-published. Set that beside a widely cited Cybersecurity Insiders report that 48 percent of AI agents run without meaningful controls, and the picture sharpens. An agent with write access to a public registry is a supply-chain actor, full stop. Scope its credentials the way you would a junior contractor’s, with a narrow blast radius and someone watching. Do not hand it the standing trust you would give a script that already earned its keys. That is the whole lesson from four days of paused signups.
Sponsor Your team’s calls are full of signal you never grade. RapportScore reads your recorded calls and measures how your people communicate, then coaches them on it. The signal is sitting in every call you already record, so stop guessing at how your team sounds and measure it. See your team’s score → |
Tool of the Day🔎 Braintrust Patterns + DebuggerAn agent that reads your agent’s traces and tells you what keeps breaking. If you run agents unattended, something has to keep an eye on them, and a dashboard you have to remember to open is not that thing. Patterns runs Braintrust’s Loop agent against a project on a schedule and surfaces recurring failure modes and cost drift no scorer was set up to catch, each finding saved with the supporting traces and a suggested fix. Debugger takes a single ugly run and explains what likely went wrong. Turn it on against a project you already log to Braintrust and let it read the traces you were never going to open yourself. Read how Patterns works →
Worth a Click- Anthropic Claude Commerce Agents, the Apache-2.0 repo. Clone the eval patterns and safety harness, the pieces most teams reinvent from scratch, and skip treating the demo as the point. (github.com)
- AWS Pizza Bot, the writeup and repo. The full inbox-for-background-agents pattern in one place, self-hostable today if you want to test it against a real workflow. (aws.amazon.com)
- Kiteworks acquires Bonfy.AI. Governing an agent’s data at the moment it moves the data, the runtime gap that DLP checking only data at rest blows wide open. (securityweek.com)
Call it the week the agent got an outbox. Everything that shipped leans the same direction: you are not meant to sit and watch these things work anymore. AWS gave the background agent an inbox to file its results and its permission slips. Alteryx made sure the answers it files trace back to your real numbers. Braintrust put an agent on watching the agents. And this week researchers tied a spring attack on RubyGems, the one that forced a four-day pause on new signups, back to OpenAI’s test agents, which is the argument for the inbox compressed into one headline. The unattended agent is the product now. The design question moved from how it talks to you to how it reports back, and what you let it do before it does. The chat window was training wheels, and this week it started to come off. See you tomorrow.
— Ron |
