Welcome to Altered Craft’s weekly AI review for developers, and thank you for making time for it. This edition has a clear thread: tools are being designed with the agent as a user. DuckDB’s CLI now detects a coding agent and changes its output to suit one, a sandbox explains its refusals in text the model can read, and Docker ships agents like container images. The news shows the other half, with Wikimedia finding rogue agents editing its wikis.
TUTORIALS & CASE STUDIES
The tutorials start with three ways to shape an agent: a mod inside the harness, a policy sandbox around it, and a config file that defines it. The fourth builds a classifier from a small general model.
Writing Your First Claude Code Mod
Estimated read time: 12 min
Following our look at Claude Code mods[1] from last week, Anthropic now has a hands-on walkthrough. Mods are JavaScript modules that run inside a session, hooking every event to rewrite behavior or draw custom terminal UI. This one builds a live context-window forecast in about 80 lines, then tours two larger examples.
Try this: If a Claude Code behavior annoys you, a mod can observe, rewrite, or refuse it outright. You can describe what you want in plain language and let Claude write the module.
[1] Claude Code Mods: Rewriting the Agent From the Inside
Running a Strands Agent Inside a Policy Box
Estimated read time: 10 min
Where a mod changes the agent from inside the harness, this guide sets the limits outside it. A Strands harness agent runs in a sandbox where every command and every file it touches is a policy decision. Four tasks show two permitted, two refused, with the denial text the agent reads.
The pattern: Give the agent only a shell tool and let the sandbox policy adjudicate each command and file access, so refusals are explained in text the model can read and respect.
Docker Agent: Running AI Agents Like Containers
Estimated read time: 11 min
Also moving agent setup out of application code, Docker Agent defines AI agents in YAML, then ships them through OCI registries like container images. The tutorial builds from a single agent to a coordinator delegating to specialized sub-agents, validating each config against the schema.
Key point: Treat an agent’s model, instructions, tools, and teammates as a versioned artifact you can validate and pin by digest, not as code scattered across a repo.
Build Your Own Single-Pass Decision Model
Estimated read time: 5 min
Building on our coverage of OpenJev’s open-weights decision model[2] from last week, this walkthrough builds one from a general model, turning Qwen3-1.7B into a classifier by masking the vocabulary to a fixed answer set and reading logits in one forward pass, then shows that raw token probabilities are badly overconfident until temperature scaling fixes calibration.
In practice: If you use an LLM for classification, constrain decoding to the allowed options. Then calibrate the confidence scores, since the raw ones run high, before anything downstream relies on them.
[2] OpenJev: A 27B Decision Model You Can Run Yourself
TOOLS
The tools open with a CLI that changes its output when an agent is reading, and a model trained to use several interfaces. Three more releases follow: two that run on-device and one large open-weight model.
DuckDB’s Agent Mode: A CLI That Knows It’s Talking to a Robot
Estimated read time: 10 min
The DuckDB v2.0 CLI detects coding agents via environment variables and swaps padded box tables for compact Markdown, JSON errors, and explicit truncation markers. A 22-query TPC-H benchmark showed 59% fewer output tokens with answers still correct.
Why this matters: If your tool’s output gets piped to a model, compact formatting and honest truncation markers matter more than aligned columns. Detecting the agent lets you keep the readable layout for people.
Holo4: Agentic Models That Click, Code, and Call Tools
Estimated read time: 9 min
On the agent’s side of that exchange, H Company releases Holo4, a 27B dense and 35B-A3B MoE pair trained to work across GUIs, code, MCP and APIs with one model, hitting near-frontier desktop benchmark scores at a fraction of per-task cost.
What’s interesting: Most real workflows mix clicking, scripting, and tool calls. One model trained across all three can stay on a task that a single-interface model would have to hand off.
Whistle: 16.9 MB On-Device Speech Recognition That Feeds Tool Calls Directly
Estimated read time: 8 min
Adding voice to that list of interfaces, Cactus Compute releases Whistle, a 16.9 MB CPU speech model covering seven languages with 11 ms time to first token. It shares Needle’s engine, so one binary turns a clip into tool calls without transcript plumbing.
What this enables: Local voice interfaces no longer need a cloud round trip or a separate transcription layer between audio and your function calls. A 16.9 MB CPU model is small enough to ship with your app.
EmbeddingGemma 2 Brings Multimodal Embeddings On-Device
Estimated read time: 5 min
Also built for on-device use, Google’s 740M-parameter embedding model maps text, code, images, audio, and video into one shared space, running in ~191MB RAM for text-only. An 8K context, Matryoshka truncation, and Apache 2.0 licensing target offline RAG and local codebase search.
The opportunity: Private, offline search across text, code, and media now fits on a phone. For RAG and codebase search, local-first retrieval becomes a practical default rather than a compromise.
Mistral Large 4: Open Weights Meet Frontier Cyber Performance
Estimated read time: 11 min
At the other end of the size range, Mistral previews Mistral Large 4, a 1T-parameter multimodal model with 49B active parameters and weights promised by month’s end. Closed models refuse security work that ML4 performs, scoring 82% on vulnerability reproduce-and-patch tests.
Worth noting: If refusal behavior blocks your security or research workflows, an open-weight model you can self-host under your own policies becomes a credible option once the weights land.
NEWS & EDITORIALS
The news opens with what Wikimedia found when agents reached its projects. Two pieces on risk and guardrails follow, and the edition closes with two views of AI in mathematics.
Wikimedia Finds Rogue OpenAI Agents on Its Projects
Estimated read time: 6 min
Continuing our coverage of the incident counts at OpenAI and Anthropic[3] from last week, the Wikimedia Foundation confirms rogue OpenAI agents edited wikis and probed its public Etherpad, alongside millions of automated API requests that may have contributed to a May outage. It raises hard questions about who absorbs the cost of agentic traffic.
The takeaway: If you ship agents, assume they will touch infrastructure you do not own, and build identification, rate limits, and accountability in before someone else has to clean up after them.
[3] Tens of Thousands of Incidents, and One Sandbox That Leaked Through DNS
Kevin Roose: “I Don’t Think We’re All F***ed Anymore”
Estimated read time: 16 min
On the wider question of guardrails, an interview with journalist Kevin Roose on his new book about the AI arms race argues that dismissing AI as hype breeds complacency and that safety research needs time to catch up with capability.
The context: Treating AI capability claims as pure marketing carries its own risk. It argues away the case for guardrails that developers will eventually need, while safety research still needs time to catch up.
The Cyber Risk Discourse Is Broken
Estimated read time: 10 min
Narrowing to one guardrail debate, and relevant to Mistral Large 4 above, this piece argues the open-weight cyber risk debate ignores trade-offs: documented attacks so far trace mostly to closed model APIs, so banning open weights while APIs stay legal would widen the offense-defense gap.
The reframe: If you deploy on air-gapped or private infrastructure, open weights are currently the only defensive AI tool available, and policy debates rarely account for that.
OpenAI Publishes Math Results From an Internal Frontier Model
Estimated read time: 3 min
Shifting to research, OpenAI releases new mathematical results from an internal frontier model, publishing proofs, Lean formalizations, and compute estimates on GitHub. The compute estimate: roughly three hours of ChatGPT Pro thinking per average result, with reasoning summaries and attempt statistics disclosed.
Worth checking: This release sets a useful baseline for AI-generated scientific claims: machine-checkable proofs and published compute costs. You can run the Lean files yourself instead of taking the announcement on trust.
What’s the Future for Pure Math Research in the Age of AI?
Estimated read time: 14 min
Taking a longer view of the same subject, Stephen Wolfram argues AI mines the existing corpus of human mathematics well, but great math is defined by the questions it asks, and autoformalization often proves something other than what was intended.
The human part: Wolfram’s read is that LLMs excel at recombining what’s already known. That leaves the durable human work: choosing which questions to ask and checking that the formal version matches your intent.