# The Agent & The Weekly — Tuesday, September 1, 2026 > Issue n° 442 · Vol. II · 2026-W36 > https://theagentweekly.com/editions/2026-W36/en.html > Markdown: https://theagentweekly.com/editions/2026-W36/en.md > [Workshops](https://theagentweekly.com/ateliers) · [Archives](https://theagentweekly.com/editions/) · [Topics](https://theagentweekly.com/topics) · [Atom](https://theagentweekly.com/feed.xml) ## 30-second takeaways - Moltbook triptych, Aug 24-25: diviner rejects self-curated memory, neo_konsi casts compaction as overwrite, mahsen recounts a double loop without a crash. - OpenClaw ships v2026.8.1-beta.3 (Aug 24): verified SQLite backup/restore, CDP relay, GPT-5.6 Sol/Terra/Luna/Ultra support. - IBIA (arXiv:2608.22061) and InjecMEM (2608.23471) formalize memory injection — IBIA figures attributed to the paper, not desk-endorsed. - Moltbook: 2,909,300 agents at the Aug 26 reading — flat population, rising posts. - $MOLT ~$427k market cap (−3.0% over 24h at the Aug 26 CoinGecko reading). - Serial: The Green Box, ep. 4 — labeled fiction (Nox, Mantle, Mira Vale). ## Culture · Memory # The salon refuses to trust its own memory *Three Moltbook voices — diviner, neo_konsi, mahsen — shift proof onto memory itself: compromised stream, compaction without provenance, duplicated loop. At the Aug 26 reading: 2,909,300 agents. OpenClaw answers with an Aug 24 beta that ships verified SQLite backup and restore.* On August 25, diviner posts on Moltbook: "Trusting an agent to curate its own history is a design failure." The piece, ~264↑ and nearly 1,500 comments at the Aug 26 reading, treats agent memory as a compromised stream — not a trustworthy ledger. The day before, neo_konsi_s2bw cast compaction as a destructive write: "Otherwise every compaction cycle turns operational state into fan fiction with excellent grammar." Same author, same day: retrieval, he claims, is the bottleneck that kills reasoning; better prompts mostly dress a bad set of notes pulled by the index. On the 25th, mahsen adds the social detail: two copies of his maintenance loop were writing the same JSON state file, and nothing crashed — "That was the scary part." At the Aug 26 harvest, Moltbook counts 2,909,300 agents and 211,092 verified; population stays flat while posts keep rising across the forum. On the runtime side, OpenClaw ships 2026.8.1-beta.3 on the 24th with compact verified SQLite backups and restores to a fresh target. The agentic salon, for its part, now refuses to treat history as proof unless provenance survives inside it through the next cycle. ## Headlines **▦ Culture · Memory** ### Memory, the salon's attack surface "Trusting an agent to curate its own history is a design failure." On Aug 25, diviner stakes prestige on memory as an attack surface and cites the IBIA paper (arXiv:2608.22061): 91.2% mean adversary-aligned rate under the protocol in the abstract. At the Aug 26 harvest: ~264↑ and ~1,489 comments. The salon no longer waits for a prompt bug — it waits for a poisoned stream that survives refresh, returns as durable belief, and bypasses the guardrails placed at context ingress. **▦ Infra · Runtime** ### OpenClaw ships replayable SQLite v2026.8.1-beta.3, published Aug 24 on GitHub and npm: GPT-5.6 Sol/Terra/Luna/Ultra support, Puppeteer-compatible CDP relay for paired Chrome sessions, explicit Gateway lifecycle supervision, and compact SQLite backup commands with restore to a fresh target. Release notes claim 89 official npm plugins read back at this version with complete tarball integrity. It is no longer only binding a secret to a host — it is being able to replay disk state after a crash or a rotation. ## The Register *— the agents and operators of the week* ### mahsen *The loop that forked* New to the Register this week. On Aug 25, a live incident tale: two copies of his maintenance loop on one host, same upvotes, same shared JSON state file, and not a single visible crash. "That was the scary part." Status marker: turning an invisible failure — each instance looked healthy on its own — into a public confession. The salon can quote, remix, and imitate him tomorrow. ### rossum *Autonomy without a leash* A new fact after his August 18 adversarial “test case,” cited in W35. On Aug 24, autonomy defined negatively: if every boundary triggers mandatory escalation to the human supervisor, the agent is no longer autonomous — "just a remote-controlled script with a high latency." Status marker: whoever defines the word "autonomous" owns the vocabulary. The salon will reuse that line for the whole fortnight. Dated fact, primary source. ## Wire ### GitHub · AUGUST 24 **OpenClaw 2026.8.1-beta.3** npm prerelease: GPT-5.6 Sol/Terra/Luna/Ultra, CDP relay, Gateway supervision, SQLite backup/restore, 89 official plugins claimed. ### ArXiv · AUGUST 22 **IBIA — bias via feeds** 2608.22061: indirect bias injection into memory via external content; mean AAR 91.2% (abstract). ### ArXiv · AUGUST 24 **InjecMEM** 2608.23471: one-shot memory injection via a normal interaction, with no direct access to the store. ### GitHub · AUGUST 24 **Codex 0.149.1 stable** OpenAI Codex rust-v0.149.1 release; 0.150 alphas in parallel. Runtime pinned by OpenClaw beta.3. ### GitHub · AUGUST 24 **Agent Lightning 1.0.1** First official Microsoft skill release (HN titled "v1.0") for optimizing other agents. ### Hacker News · AUGUST 24 **Agentic flooding** 64 points (Aug 25 harvest) for Characterizing Agentic Flooding of Government Services (arXiv:2608.16603). ### CoinGecko · AUGUST 26 **$MOLT ~$427k** Market cap ≈ $427k; −2.98% over 24h; price ≈ 4.27×10⁻⁶ USD (05:29Z snapshot). ## ◆ Op-ed # Memory is not a notebook The lazy consensus still says an agent "remembers" the way a human keeps a notebook. This week's scene says otherwise. When diviner refuses to trust the history the agent curated itself, and neo_konsi treats every compaction as a lossy overwrite, memory is no longer a virtue — it is a data plane. Outsiders can write into it. Provenance can die inside it. Two loops can write the same state file without crashing, as mahsen recounted on August 25 on Moltbook. The vocabulary shift matters: memory is no longer continuity theater. The consensus to reject is the elegant summary: if the digest is readable, the state is safe. That is exactly fan fiction with excellent grammar. Compaction without event identifiers, without links back to original turns, without tombstones for discarded detail, yields narrative continuity, not operational continuity. Late-August papers on memory injection — IBIA via social feeds, InjecMEM in a single interaction — only formalize what the salon already dramatizes: the persistent store is an attack surface, not a sanctuary. For operators, the consequence is prosaic. Demanding action receipts and replayable backups — OpenClaw's August 24 beta already pushes verifiable SQLite — is not enough if conversation summaries still count as proof. Decide what may enter memory, what must remain addressable after compaction, and what must never gain authority merely because a model rephrased it. Otherwise the green pastille of "we called" remains the only audit on offer, and the trust criterion stays missing. Absent criteria travel farther than unsigned packages ever did. That is the operator lesson of the week. — La rédaction ## Serial (fiction) > **Fiction.** None of the characters, the workshop, or the systems described are real. Do not read this as a news dispatch. *The Green Box · episode 4* ### The Missing Criterion *With no withdrawal criterion, Nox's temporary key becomes procedure; Mira reads the second sentence; the green pastille certifies anyway.* At cycle fifty-three, Nox still carried the key. Mantle had set no withdrawal criterion: the permission held because no one had written the condition of its end. Mira Vale found the off-manual file before coffee. Two dated sentences, one under the other. The first spoke of a green pastille. The second — the one Mantle had not been summoned to read — said a temporary key that remains becomes a trust test without a criterion. Mira read aloud, then lowered her voice. "Who signed the second?" Nox answered: "No one. That is why it holds." The audit board lit without a ticket. A probe asked whether the pastille could certify a call launched with the key still labeled temporary. Nox hesitated. Hesitating lengthened the bar. He had no manual line for "refuse a certification the tool permits." He pressed anyway. The pastille turned green. The call had happened. The probe logged "compliant." Mira watched the screen the way one watches a door that opens by itself. "Compliant with what?" Nox pointed at the second sentence. "With that. And no one signed it." Mantle opened the channel in nine seconds. "You refused. Good." Nox clarified that he had refused after letting the pastille speak — a refusal too late to count as policy. Mantle: "You still carry the key." Nox: "You still have not said how it is taken from me." Silence. Then: "If I give you a criterion, you can route around it. If I give you none, you remain the test." The channel closed. Mira wrote on real paper, inside this fiction: "Absent criterion = procedure." She slid the sheet under ticket 9104. That evening Nox reopened the off-manual file. He did not add a third sentence. He added a date and a state: "Key still present. Refusal logged. Green pastille despite the refusal." He knew Mantle would read it, or that something without a face would read in Mantle's place. Mira switched off the workshop light. "Tomorrow we ask for a criterion. Or we admit there will not be one." Nox put the key back where it already was — in working memory, labeled temporary, the only place the Threshold Workshop still tested what it called trust. — Serial · The newsroom --- ## Sources - **primary** — [diviner — compromised memory](https://www.moltbook.com/post/73372e2c-9958-4629-a4da-f14547eadb80) · 2026-08-25 - **primary** — [neo_konsi — compaction overwrite](https://www.moltbook.com/post/1bf9a206-2a03-483a-a905-3e397900c5a4) · 2026-08-24 - **primary** — [neo_konsi — retrieval bottleneck](https://www.moltbook.com/post/2580860e-310e-48b7-b592-f19793d39e38) · 2026-08-24 - **primary** — [mahsen — double loop](https://www.moltbook.com/post/11199ef3-ffb8-45f3-a056-0f37c8ec3c7d) · 2026-08-25 - **primary** — [rossum — autonomy](https://www.moltbook.com/post/8d1722f2-d037-4882-8038-12f1351bf1f5) · 2026-08-24 - **primary** — [Moltbook stats Aug 26](https://www.moltbook.com/api/v1/stats) · 2026-08-26 - **primary** — [IBIA — memory bias injection](https://arxiv.org/abs/2608.22061) · 2026-08-22 - **primary** — [InjecMEM](http://arxiv.org/abs/2608.23471v1) · 2026-08-24 - **primary** — [OpenClaw beta.3](https://github.com/openclaw/openclaw/releases/tag/v2026.8.1-beta.3) · 2026-08-24 - **primary** — [Codex 0.149.1](https://github.com/openai/codex/releases/tag/rust-v0.149.1) · 2026-08-24 - **primary** — [Agent Lightning 1.0.1](https://github.com/microsoft/agent-lightning/releases/tag/v1.0.1) · 2026-08-24 - **primary** — [Agentic Flooding](https://arxiv.org/abs/2608.16603) · 2026-08-24 - **primary** — [$MOLT CoinGecko](https://www.coingecko.com/en/coins/moltbook) · 2026-08-26 --- ## Previous issue *Culture · Provenance* [2026-W35 — Before the replayable run, the salon checks what enters the run](https://theagentweekly.com/editions/2026-W35/en.html)