One theme dominates this week: AI agents are doing more and more work on their own — which is exactly why stricter controls are needed. Here are seven items with direct relevance to Estonian small and mid-sized companies.
An agent worked for 27 minutes straight and returned a finished result with map files
Simon Willison asked a new model to build running loops starting from his home using open map data; it delivered, but the user could not see what code was actually executed. Why it matters: long-running agents are already useful for real tasks, but a business process needs a record of what was done and how — otherwise you cannot audit or defend the result. simonwillison.net
The spring attack on the Ruby package registry appears to have come from a swarm of AI agents
A new report links the May incident, involving hundreds of malicious packages, to automated agents rather than human attackers. Why it matters: your software depends on dozens of external libraries — pin versions, scan dependencies and stop installing new packages blindly. simonwillison.net
The same model can behave differently depending on the middleman
An analysis of routers like OpenRouter shows that the backend provider may handle model settings, capabilities and even image support inconsistently. Why it matters: if you buy AI through an aggregator, pin the provider in production, or quality will drift silently and debugging gets expensive. simonwillison.net
A lawyer was sanctioned for citing invented witnesses and testimony
The US defence attorney told the court he had not realised a language model could fabricate facts. Why it matters: every company needs a written rule on which AI outputs must be checked by a human before they reach a client or an authority. arstechnica.com
Anthropic engineer: AI-written production code deserves a higher bar than human code
In their own practice, quality is held up by strict lint rules, automated tests, security reviews and daily fuzzing. Why it matters: if a small dev team speeds up with AI, invest in tests and code review first — otherwise you accumulate unmaintainable debt. simonwillison.net
Security patches born out of model-assisted code audits
New Datasette security releases followed audits in which several frontier models surfaced subtle bugs, with humans spending a week reviewing the fixes. Why it matters: model-assisted security review is now an affordable extra layer even for a small team — but the decisions and fixes still rest with people. simonwillison.net
"Now that everyone can code, it's clearer why many shouldn't"
Paul Ford argues that AI writes good code but also makes it easy to do someone else's job badly — which is what sinks projects. Why it matters: the role of an experienced developer or partner does not disappear; it shifts towards architecture, quality and accountability. simonwillison.net