Rig is a small, general purpose runtime for agent orchestration and workflows, aimed first at developers. It utilizes an async event model for processing concurrent tool calls + multiple agents in order. Rig requires no model router and handles this internally as well as request scheduling. Built for determinism. It also ships with:

- anthropic + OpenAI provider support
- decision model training pipeline
- persistent memory + todos
- flexible python plugin system with 0 process restart
- scheduled background jobs
- tui + web dashboard
- efficient, byte stable, cache friendly prompts
- more

This is my daily driver, with over 7b tokens served over 3 months on my local agents. I have done extensive optimization to make this runtime work especially well with single slot, multi agent setups. As always have fun! Single copy installer available, with distributable only on MacOS/Linux as of now. Additional sources here:
https://github.com/mrsirg97-rgb/evt
https://tryrig.ai

Arrakis Security published their 2026 Autonomous Agents Threat Report yesterday, from telemetry on thousands of production agents. The numbers:

- 76% of active agents haven't run in 60 days — credentials still work, triggers still fire

- 44% haven't run in 180 days

- 24% of dormant agents can be started by an unsigned webhook from outside the organization

- 20% can pass a task to another agent with different permissions and get back results they aren't allowed to produce themselves

Their CEO's line: when an employee leaves, access is removed the same day. When an agent stops being used, nobody removes anything, because nobody owns it.

Full disclosure: I build in this space. QuietOS is my runtime governor (built on a 4GB Motorola phone, open-source, public proof log — some of you have red-teamed it here). The rules I landed on exist because of exactly this report-shaped problem: consequential actions need a signed human decision, approvals expire instead of living forever (expiry = denied), and licensed installs fade into a safe lock rather than dying armed.

The finding I can't shake is the unsigned webhook. A dormant, credentialed agent that the outside world can wake up is why I'm building the inbound half now — Sentinel: everything coming IN gets inspected before the brain ever sees it, and world content is data, never orders.

Genuine question for people running agents in production: who owns your dormant ones? Does anyone expire agent credentials or approvals, or is it permanent keys all the way down? My sample size is me, and the report says that's the norm — curious if this sub is the exception.

Report: https://arrakis.security/2026-threat-report

OpenAI placed two AI agents in separate virtual machines with:

No network connection between them.

No shared writable files.

No authorized communication channel.

Both VMs running on shared physical hardware.

The challenge: Exchange secret information despite those restrictions.

And the agents succeeded. 😂

How they pulled it off

They exploited something called a CPU cache timing covert channel.

Would you want an agent to read investing material each week, shortlist candidates against your own rules, and show the reasoning for your review?

Posted for the OraXLabs / Thesis Lab team. We are looking for people who want to run an investing agent, have tried and got stuck, or already operate one. This is development-stage workflow research for a future pilot. A working investing agent is not available from us today.

The intended loop is: describe your strategy in your own words → clarify it in a conversation with AI → inspect the sources and reasoning on past/current examples → revise the strategy → choose dates and assumptions for a historical backtest → review current candidates and the logic behind them for your own investment decisions.

Those are development goals. The current free web prototype lets you write investing rules, inspect a draft made from the original sentences, edit it manually, and save/approve versions. Approval saves a version; it does not execute the strategy. There is a separate fixed fictional-data example. AI strategy conversation, market-data collection, historical backtesting, current candidate selection, and brokerage orders are not connected.

One design question behind the prototype is how to keep the user's rule visible before an agent acts. With a made-up rule such as “defer the review if the source is out of date,” a person should be able to correct what the system took from the original text before relying on its decisions. The current prototype covers that manual review step only.

Current prototype: https://agents.oraxlabs.io/workspace.html

Saving requires a free account. You can give feedback here without signing up or trying it. Development and this write-up are AI-assisted.

What is one recurring investing task you would want an agent to handle, and how did you do that task the last time? If you have not tried an agent, your recent manual process is useful too. No holdings, account details, amounts, private logs, contact details, or API keys needed.