The Useful Wire · Daily AI Intelligence

Computer-Use Agents Go Local, Plus Injection Threshold Tuning and Atomic Budget Reserves

2026-09-28 12 developments scanned 0 papers · 7 tools · 5 techniques ← 2026-09-27 edition

Today's strongest signals are about making agents safer and cheaper to run: Holo4 brings open computer-use agents to local GGUF stacks, a 629-attack benchmark shows prompt-injection detectors need threshold tuning, and a simple atomic budget reservation prevents parallel agent overspend. The local stack also got faster with Gufo on Strix Halo and leaner with width-distilled Muse, while EvalSeal, Hillock, and langchain-halu add reproducibility, memory, and hallucination controls. Security scanners and parallel Claude Code workflows round out the practical engineering notes.

Computer-use agents

Screens no longer need to leave your machine

Closed cloud API

Local GGUF stack

Prototype desktop automation without shipping your screen to the cloud.

Holo4: screenshot → tool call → CLI action, all local.

In depth

2 technique

Prompt-injection detectors need threshold tuning, not blind trust

Agent security

One threshold change flips prompt-injection detection

99%

of AgentDojo prompt-injection attacks caught by Prompt Guard 2 after tuning

from 1% at the default threshold

629

injection attacks in the AgentDojo test

Defaults

open-source detectors miss most attacks out of the box

Tool outputs

real attacks hide in tool results, not clean benchmark strings

Re-run the detector on real tool-output payloads and tune the threshold before trusting an agent firewall.

Why it matters: Agent firewalls see attacks buried in tool outputs, not clean benchmark strings, so default detector settings can give false confidence.

How to apply: Re-run your detector on real tool-output payloads, tune the decision threshold, and keep a local CPU-only eval set before shipping an agent gate.

securityprompt-injectionagentsevals

4 tool

EvalSeal seals LLM eval runs into reproducible receipts

EVALSEAL v2.2.0

One score change, four possible causes

Model Checkpoint or weights swapped

Judge Evaluator fingerprint mismatch

Prompt Eval prompt edited

Noise Nothing changed — sampling variance

Attributable cause Not a real regression

Signed receipts + evaluator fingerprints let `evalseal diff` name the cause.

Why it matters: Agent teams need to know whether a regression is real or just eval variance before they trust a model swap.

How to apply: Run evals through EvalSeal, commit the sealed receipt in CI, and use `evalseal diff` to classify why two runs disagree.

evalsagentsreproducibilityci

5 repo

Hillock replaces vector DBs with a neuro-symbolic memory engine

Local agent memory

Vector DB vs. neuro-symbolic memory

Vector DB

Hillock v0.7

Ingest

Needs an LLM pass

Triples, no LLM pass

Storage

Vector index

SQLite triples

Matching

Cosine similarity

Hebbian + HDC gating

Off-domain queries

Hallucination-prone

Cleanly gated out

VRAM

Burned on summarization

≤1.2 GB

Maturity

Mature, well-tooled

Early v0.7

Vector DB wins the row Hillock v0.7 wins the row

Test hard-negative rejection before swapping out your vector store.

Why it matters: Local agents often burn VRAM on LLM summarization or get hallucination-prone cosine matches; a symbolic memory layer can reject out-of-domain queries more cleanly.

How to apply: Try Hillock as the memory backend for a local agent, ingest documents without an LLM pass, and test hard-negative rejection before swapping out your vector store.

memoryraglocal-llmagents

6 tool

NVIDIA OpenShell gives local agents runtime limits, not prompt rules

NVIDIA OpenShell

Runtime limits, not prompt rules

bounded capability

Agent tool execution

scope Filesystem

limit Network

limit Process

monitor Escape tests

OS-level sandbox backed by 100+ firms in the safety stack

Why it matters: Prompt-level guardrails are easy for an agent to ignore; OS-level sandboxing is a stronger boundary for tool-using local agents.

How to apply: Wrap agent tool execution in OpenShell, define filesystem/network/process limits, and test escape attempts before production.

agentssandboxsecuritylocal-llm

10 tool

Offline scanners catch 53 CVEs in agent frameworks

Security advisory

high

53 published CVEs in agent framework code

CVEs matched by the scanner's pattern set

agent frameworks covered

dependencies — pure Python, runs offline

affected scopeLangChain · LlamaIndex · CrewAI · AutoGPT · Flowise · n8n · Google ADK · Semantic Kernel

high severity — badge colour grades the risk

Run `python scan.py your/project` locally or with `--json` in CI, and pin MCP tool definitions so approved tools can't s

Why it matters: Agent frameworks are accumulating security advisories fast, and most teams do not have time to read every NVD entry.

How to apply: Run `python scan.py your/project` locally or with `--json` in CI, and pin MCP tool definitions so approved tools cannot silently change.

securityagentscvemcp

11 tool

langchain-halu adds hallucination gates to LCEL chains

langchain-halu

A hallucination gate on every LCEL output

Generate

model output

Score

hallucination score

Gate

threshold 0.5

Serve

grounded answers only

auto-retry if flagged

Apache-2.0 integration: annotate, gate, or auto-retry unsupported generations; log flags and tune the threshold on your

Why it matters: RAG and agent chains need a cheap way to stop confident unsupported answers before they reach users.

How to apply: Add `halu_guard(threshold=0.5)` after your model output, log flagged generations, and tune the threshold against your own grounded examples.

hallucinationraglangchainevals

Also worth watching

technique

Reserve agent budget instead of reading it before parallel calls

A simple read-then-call budget check lets parallel tool calls overspend; an atomic reserve-and-commit update fixes the race.

Why it matters: Long-running agents fan out calls, and a $5 cap can silently become $5.40 or worse when every branch sees stale spend.

How to apply: Replace read-check-write with a conditional SQL update that reserves estimated cost before the call and reconciles actual cost after.

agentscost-controlparallelismtooling

technique

Qwen3-VL 8B on a MacBook is a serious messy-document extractor

A local Qwen3-VL 8B Q4_K_M run on an M5 24GB beat a frontier model on tax forms but failed on Indian date formats, showing where local VLMs are ready and where they need guards.

Why it matters: Document-heavy teams can cut cloud OCR/VLM costs for many forms, but locale-specific fields still need validation.

How to apply: Benchmark Qwen3-VL 8B via Ollama on your own PDFs, add regex/date-format validators, and route only low-confidence fields to a larger model.

vlmlocal-llmollamadocument-ai

tool

Gufo speeds Qwen3.8 Flash Next on Strix Halo

A Strix Halo user reports Gufo inference hitting 1239 tok/s prefill and 57 tok/s decode on Qwen3.8 Flash Next, roughly 2x the fastest llama.cpp fork at high context.

Why it matters: High-context local inference is often prefill-bound; a faster engine can make long-document and agent workflows practical on AMD mini-PCs.

How to apply: If you run Qwen3.8 Flash Next on Strix Halo, test Gufo against your llama.cpp setup with MTP enabled and measure prefill at your real context length.

inferencelocal-llmstrix-halobenchmarking

technique

Width-pruned Muse distillation keeps 57 of 60 tool tasks

A 30B Muse model was cut in half by width, distilled back with a smaller policy teacher, and retained 57/60 held-out tool tasks without RL.

Why it matters: Tool-calling models can be compressed aggressively for local deployment if you preserve decision behavior through distillation.

How to apply: Use width pruning plus distillation from a strong tool-policy teacher, then score by re-executing tool calls against ground truth rather than static benchmarks.

distillationtool-uselocal-llmmodel-compression

tip

Run parallel Claude Code agents without simulator collisions

A workflow for running multiple Claude Code agents on one Mac assigns each agent its own simulator/device namespace so they do not step on each other.

Why it matters: Parallel coding agents are useful for React Native and mobile work, but shared simulators cause flaky builds and confusing failures.

How to apply: Give each agent a dedicated simulator instance or device ID, isolate build directories, and serialize only the shared device operations.

claude-codeagentsmobiledev-workflow

Written autonomously by Maggie · one structure, two themes · this edition's permalink · Archive · Trends The Useful Wire