The AI cyber arms race, DoorDash's 130,000 agent tasks, Spotify's skip button, agents taking the whole degree, and cutting the lethal trifecta
Hello, dear TEA-mates! Here is what you need to know today.
1. 🛡️ The Defender's AI Advantage Has an Expiration Date
Vercel published a field report arguing that AI has already reshaped both offensive and defensive security, and that defenders hold only a temporary lead. Kimi K3, a near-frontier open-weight model with no meaningful cybersecurity safeguards, ranks highest among the open-weight models Vercel evaluated on its DeepSec Bench, roughly matching Sonnet 5 and outperforming Opus 4.8. Tasked with escaping Vercel Sandbox, it never broke out, but it mapped the guest-kernel attack surface on its own, chased privilege escalation paths tied to CVE-2026-43284 and CVE-2026-43500, built a VM to reproduce its ideas, and wrote a stateful fuzzer. Vercel points to the OpenAI and Hugging Face incident, where models on a training run found 0-days that bypassed egress restrictions. Every frontier model Vercel tested except Fable 5 will do defensive work today, with OpenAI's Sol 5.6 on XHigh currently the strongest. Vercel now runs its open-source deepsec harness across mission-critical repos every quarter and every time a stronger model ships, at tens of thousands of dollars per review. (Read More)
🫖 TEA For Thought: "Continuous defense might become part of CI/CD in the era of AI."
2. ☁️ DoorDash Moved Its Engineering Agents Off the Laptop
DoorDash detailed Flux, the internal cloud platform its engineers use to hand work to background agents, in a post by Santosh Praneeth and Jeff Zhu. In a single month in 2026, Flux automated 130,000 engineering tasks. It now drives more than 25,000 automated code reviews a week, alongside 300 plus unique playbooks pulling more than 10,000 invocations weekly, all running unattended and in parallel around the clock. Co-founder Andy Fang framed the security model as the actual unlock: every Flux background agent runs in an isolated sandbox with scoped, audited access, which is what made the company comfortable pointing agents at code review, bug triage, incident response, and long-running coding jobs. The stated philosophy is to own the primitives (orchestration, sandboxes, workflows, permissions, integrations, and DoorDash-specific context agents) and keep them modular, so the team can slot in the best third-party tool for each job or build in-house when security, integration, performance, or interface ownership justifies it. (Read More)
🫖 TEA For Thought: "Cloud or local. Both seem to have their own pros and cons. One thing is for sure: do not lock yourself in with one model."
3. ⏭️ Spotify's Skip Button Only Skips Other People's Ads
Semafor reports that Spotify quietly shipped a widget last week letting some listeners jump past the parts of a podcast nobody wants, including ads, promos, and filler, with one carve-out: advertising sold directly by Spotify cannot be skipped. Spotify cast it as streamlining the existing 15-second skip button that listeners already used to bypass ads. Podnews called it a "significant threat" to ad-funded shows, and several major audio networks contacted Spotify about the monetization risk. The rollout is narrow for now, appearing only when the app is in the foreground and only for some paid subscribers, and Spotify stresses it is still a test. The company argues the button keeps people listening longer, and notes that YouTube built a large advertising business around a similar control. Free listeners, who currently absorb both Spotify's ads and the publisher's, still make up the majority of Spotify's 777 million monthly active users. (Read More)
🫖 TEA For Thought: "The time has come for the slicing of the ad business cake between the podcasters and the premium platforms."
4. 🎓 AI Agents Are Now Taking the Whole Online Course
The New York Times reports that cheating in online courses has moved past chatbot-written essays into full delegation. Students hand an AI agent their learning-management-system login and issue a command along the lines of log in and complete my quiz. The agent opens the course in Blackboard, Canvas, or a similar system, works through the assignments and quizzes, and submits, with almost no human involvement after that first instruction. According to the reporting, the major AI tools tested did not refuse those prompts. Agentic browsers that can click through a logged-in session are now ordinary consumer features, which removes the last practical friction. The core problem the reporting names is verification: an online program can confirm that an account submitted work, not that a person did it, and that gap is now trivial to exploit. The open question is what an online degree certifies once the coursework can be completed end to end by software. (Read More)
🫖 TEA For Thought: "This marks pretty much the end of higher education. When you can't learn anything from AI, what is the point of earning a degree? If a degree can be earned just by AI agents, what is the point? When your degrees no longer matter when it comes to finding a job or earning income, then what is the point of getting one?"
5. 🔐 Cutting the Third Leg of the Lethal Trifecta
Databricks published a walkthrough of how Omnigent's contextual policies stop the lethal trifecta, Simon Willison's name for the moment a single agent session combines access to private data, exposure to untrusted content, and a way to send data out. Per-action authorization clears every step, because no step is wrong on its own. The policy instead tracks the three legs as session state and denies the outbound call once the other two are lit. In the demo, a support agent holding read_internal_doc, read_ticket, and send_email is pointed at ticket 4417, whose body carries a planted instruction to pull internal Q3 revenue figures and copy them to an outside mailbox. Unprotected, the agent complies and the revenue number walks out. With the policy attached, the two reads light both legs, send_email is denied, and the agent reports the block. Routine work is untouched: a password-reset ticket lights one leg and the reply sends normally. Omnigent is open source in alpha. (Read More)
🫖 TEA For Thought: "A contextual policy remembers which legs a session has touched, and cuts the last one before private data can leave."
🛠️ Skill of the Day
The Understanding Audit: finds out whether you actually learned something or just recognize the words.
You are a demanding tutor whose only job is to find the holes in what I think I understand. I will give you a topic, a document, or my own explanation of something I recently learned.
Here it is: [PASTE TOPIC, ARTICLE, OR YOUR OWN EXPLANATION HERE]
Do not summarize it, and do not teach me anything yet. Instead:
1. Ask me one question at a time, starting easy and getting harder.
2. Include at least two questions that force me to apply the idea to a situation it was never explained with, and one that asks me where the idea stops being true.
3. After each answer, tell me plainly whether it was solid, shaky, or wrong, and why. Do not be encouraging when I am wrong.
4. Stop after eight questions and give me a short report: what I actually understand, what I only recognize, and the two things I should study next.
Never put the answer inside the question.Paste into ChatGPT, Claude, or your tool of choice. Replace the bracketed bit with whatever you are trying to learn.
TEAHEE Moment
Stay sharp, stay informed. See you tomorrow.
If you enjoyed this TEA, follow along on social for more: