Computer-Use Agents Go Local, Plus Injection Threshold Tuning and Atomic Budget Reserves

Today's findings

1. #1 Holo4 brings open computer-use agents to local GGUF stackstool

   H Company's Holo4-27B VLM and hai-agents harness let local agents read screenshots, call tools, and execute CLI actions.

   Computer-use agents

   Screens no longer need to leave your machine

   Closed cloud API

   vs

   Local GGUF stack

   Prototype desktop automation without shipping your screen to the cloud.

   Holo4: screenshot → tool call → CLI action, all local.

   Why it matters: Computer-use agents are moving from closed APIs to open weights, so teams can prototype desktop automation without sending screens to a cloud vendor.

   How to apply: Pull the Holo4 GGUF, run it with the hai-agents harness, and wire a sandboxed CLI/tool loop for screenshot-to-action tasks.

   agentscomputer-uselocal-llmgguf

   Read more: Holo4: powering generalist computer-use agents · Holo4

2. #2 Prompt-injection detectors need threshold tuning, not blind trusttechnique

   A 629-attack AgentDojo test found open-source detectors miss most injections at default thresholds, but one threshold change took Prompt Guard 2 from 1% to 99%.

   Agent security

   One threshold change flips prompt-injection detection

   99%

   of AgentDojo prompt-injection attacks caught by Prompt Guard 2 after tuning

   from 1% at the default threshold

   629

   injection attacks in the AgentDojo test

   Defaults

   open-source detectors miss most attacks out of the box

   Tool outputs

   real attacks hide in tool results, not clean benchmark strings

   Re-run the detector on real tool-output payloads and tune the threshold before trusting an agent firewall.

   Why it matters: Agent firewalls see attacks buried in tool outputs, not clean benchmark strings, so default detector settings can give false confidence.

   How to apply: Re-run your detector on real tool-output payloads, tune the decision threshold, and keep a local CPU-only eval set before shipping an agent gate.

   securityprompt-injectionagentsevals

   Read more: I tested 10 open-source prompt injection detectors on 629 real agent attacks. Meta's Prompt Guard 2 caught 1% out of the box, and 99% after changing one number.

3. #3 Reserve agent budget instead of reading it before parallel callstechnique

   A simple read-then-call budget check lets parallel tool calls overspend; an atomic reserve-and-commit update fixes the race.

   Why it matters: Long-running agents fan out calls, and a $5 cap can silently become $5.40 or worse when every branch sees stale spend.

   How to apply: Replace read-check-write with a conditional SQL update that reserves estimated cost before the call and reconciles actual cost after.

   agentscost-controlparallelismtooling

   Read more: Why a simple budget check lets parallel agent calls blow past the cap

4. #4 EvalSeal seals LLM eval runs into reproducible receiptstool

   EvalSeal v2.2.0 adds drift classification, evaluator fingerprints, and signed ledgers so score changes can be traced to model, judge, prompt, or noise.

   EVALSEAL v2.2.0

   One score change, four possible causes

   Model Checkpoint or weights swapped

   Judge Evaluator fingerprint mismatch

   Prompt Eval prompt edited

   Noise Nothing changed — sampling variance

   Attributable cause Not a real regression

   Signed receipts + evaluator fingerprints let `evalseal diff` name the cause.

   Why it matters: Agent teams need to know whether a regression is real or just eval variance before they trust a model swap.

   How to apply: Run evals through EvalSeal, commit the sealed receipt in CI, and use `evalseal diff` to classify why two runs disagree.

   evalsagentsreproducibilityci

   Read more: I built EvalSeal v2.2.0: reproducibility receipts for LLM and agent evals · I built EvalSeal v2.2.0: reproducibility receipts for LLM and agent evals

5. #5 Hillock replaces vector DBs with a neuro-symbolic memory enginerepo

   Hillock v0.7 extracts subject-predicate-object triples with lightweight encoders, stores them in SQLite, and uses Hebbian links plus HDC gating under 1.2GB VRAM.

   Local agent memory

   Vector DB vs. neuro-symbolic memory

   vs

   Vector DB

   Hillock v0.7

   Ingest

   Needs an LLM pass

   Triples, no LLM pass

   Storage

   Vector index

   SQLite triples

   Matching

   Cosine similarity

   Hebbian + HDC gating

   Off-domain queries

   Hallucination-prone

   Cleanly gated out

   VRAM

   Burned on summarization

   ≤1.2 GB

   Maturity

   Mature, well-tooled

   Early v0.7

   Vector DB wins the row Hillock v0.7 wins the row

   Test hard-negative rejection before swapping out your vector store.

   Why it matters: Local agents often burn VRAM on LLM summarization or get hallucination-prone cosine matches; a symbolic memory layer can reject out-of-domain queries more cleanly.

   How to apply: Try Hillock as the memory backend for a local agent, ingest documents without an LLM pass, and test hard-negative rejection before swapping out your vector store.

   memoryraglocal-llmagents

   Read more: Hillock v0.7: A neuro-symbolic memory engine to replace vector DBs on consumer GPUs (<1.2GB VRAM) · Replacing Vector DBs and LLM Extraction passes with SQLite, Hebbian links, and HDC Gating (Hillock v0.7) · A lightweight, neuro-symbolic approach to long-term memory for local agents

6. #6 NVIDIA OpenShell gives local agents runtime limits, not prompt rulestool

   OpenShell is an open-source sandbox that enforces real runtime constraints for local and open agents, with over 100 firms joining the safety stack.

   NVIDIA OpenShell

   Runtime limits, not prompt rules

   bounded capability

   Agent tool execution

   scope Filesystem

   limit Network

   limit Process

   monitor Escape tests

   OS-level sandbox backed by 100+ firms in the safety stack

   Why it matters: Prompt-level guardrails are easy for an agent to ignore; OS-level sandboxing is a stronger boundary for tool-using local agents.

   How to apply: Wrap agent tool execution in OpenShell, define filesystem/network/process limits, and test escape attempts before production.

   agentssandboxsecuritylocal-llm

   Read more: NVIDIA shipped OpenShell, an open source sandbox that gives local and open agents real runtime limits instead of prompt rules. Over 100 firms joined the safety stack. OpenAI did not.

7. #7 Qwen3-VL 8B on a MacBook is a serious messy-document extractortechnique

   A local Qwen3-VL 8B Q4_K_M run on an M5 24GB beat a frontier model on tax forms but failed on Indian date formats, showing where local VLMs are ready and where they need guards.

   Why it matters: Document-heavy teams can cut cloud OCR/VLM costs for many forms, but locale-specific fields still need validation.

   How to apply: Benchmark Qwen3-VL 8B via Ollama on your own PDFs, add regex/date-format validators, and route only low-confidence fields to a larger model.

   vlmlocal-llmollamadocument-ai

   Read more: Qwen3-VL 8B on a MacBook vs Opus 5.5 / Sonnet 5 / GPT-5.6 on 137 messy documents: beat GPT-5.6 on tax forms, lost badly on Indian date formats · Qwen3-VL 8B on a MacBook vs Opus 5.5 / Sonnet 5 / GPT-5.6 on 137 messy documents: beat GPT-5.6 on tax forms, lost badly on Indian date formats · Qwen3-VL 8B on a laptop vs Opus 5.5 / Sonnet 5 / GPT-5.6 on 137 messy documents: beat GPT-5.6 on tax forms, lost badly on Indian date formats[R]

8. #8 Gufo speeds Qwen3.8 Flash Next on Strix Halotool

   A Strix Halo user reports Gufo inference hitting 1239 tok/s prefill and 57 tok/s decode on Qwen3.8 Flash Next, roughly 2x the fastest llama.cpp fork at high context.

   Why it matters: High-context local inference is often prefill-bound; a faster engine can make long-document and agent workflows practical on AMD mini-PCs.

   How to apply: If you run Qwen3.8 Flash Next on Strix Halo, test Gufo against your llama.cpp setup with MTP enabled and measure prefill at your real context length.

   inferencelocal-llmstrix-halobenchmarking

   Read more: If you are running Qwen 3.8 Flash Next on Strix Halo, use this software for inference. It's so much faster than llama.cpp especially at high context.

9. #9 Width-pruned Muse distillation keeps 57 of 60 tool taskstechnique

   A 30B Muse model was cut in half by width, distilled back with a smaller policy teacher, and retained 57/60 held-out tool tasks without RL.

   Why it matters: Tool-calling models can be compressed aggressively for local deployment if you preserve decision behavior through distillation.

   How to apply: Use width pruning plus distillation from a strong tool-policy teacher, then score by re-executing tool calls against ground truth rather than static benchmarks.

   distillationtool-uselocal-llmmodel-compression

   Read more: Liked Muse, so I cut the 30B model in half by width, distilled it back, and it does 57 of 60 tool tasks its parent does 60 of · Liked Muse, so I cut the 30B model in half by width, distilled it back, and it does 57 of 60 tool tasks its parent does 60 of

10. #10 Offline scanners catch 53 CVEs in agent frameworkstool

    A zero-dependency Python scanner checks LangChain, LlamaIndex, CrewAI, AutoGPT, Flowise, n8n, Google ADK, and Semantic Kernel code for patterns behind 53 published CVEs.

    Security advisory

    high

    53 published CVEs in agent framework code

    53

    CVEs matched by the scanner's pattern set

    8

    agent frameworks covered

    0

    dependencies — pure Python, runs offline

    affected scopeLangChain · LlamaIndex · CrewAI · AutoGPT · Flowise · n8n · Google ADK · Semantic Kernel

    high severity — badge colour grades the risk

    Run `python scan.py your/project` locally or with `--json` in CI, and pin MCP tool definitions so approved tools can't s

    Why it matters: Agent frameworks are accumulating security advisories fast, and most teams do not have time to read every NVD entry.

    How to apply: Run `python scan.py your/project` locally or with `--json` in CI, and pin MCP tool definitions so approved tools cannot silently change.

    securityagentscvemcp

    Read more: I wrote free offline scanners for the code patterns behind 53 CVEs in LangChain, LlamaIndex, CrewAI and 6 other agent frameworks

11. #11 langchain-halu adds hallucination gates to LCEL chainstool

    An Apache-2.0 LangChain integration can annotate, gate, or auto-retry generations based on a hallucination score.

    langchain-halu

    A hallucination gate on every LCEL output

    1

    Generate

    model output

    2

    Score

    hallucination score

    3

    Gate

    threshold 0.5

    4

    Serve

    grounded answers only

    auto-retry if flagged

    Apache-2.0 integration: annotate, gate, or auto-retry unsupported generations; log flags and tune the threshold on your

    Why it matters: RAG and agent chains need a cheap way to stop confident unsupported answers before they reach users.

    How to apply: Add `halu_guard(threshold=0.5)` after your model output, log flagged generations, and tune the threshold against your own grounded examples.

    hallucinationraglangchainevals

    Read more: Made a small open-source LangChain integration to flag likely hallucinations (annotate / gate / retry) · Made a small open-source LangChain integration to flag likely hallucinations (annotate / gate / retry)

12. #12 Run parallel Claude Code agents without simulator collisionstip

    A workflow for running multiple Claude Code agents on one Mac assigns each agent its own simulator/device namespace so they do not step on each other.

    Why it matters: Parallel coding agents are useful for React Native and mobile work, but shared simulators cause flaky builds and confusing failures.

    How to apply: Give each agent a dedicated simulator instance or device ID, isolate build directories, and serialize only the shared device operations.

    claude-codeagentsmobiledev-workflow

    Read more: Running several Claude Code / Codex agents on one Mac's simulators without them stepping on each other's devices