Closed That Tab: Agentic Identity, AI Security Incidents, and Loop Engineering

This week we're trying something new: Closed That Tab, a segment where each host shares one thing they finally read that was worth the time. Erika brings a post on agentic AI identity and delegation - covering why OAuth isn't quite enough for agents that accumulate permissions across a request lifecycle, and what transaction tokens (an IETF draft proposal) offer as a solution. Bethany covers Simon Willison's breakdown of the OpenAI security incident, where an eval harness escaped its sandbox by chaining zero-day vulnerabilities - and what responsible sandboxing and observability should have caught earlier. Brittany shares how she accidentally built a loop engineering system before knowing the term existed: a continuously running agent harness using git worktrees, sub-agents, and a memory file to close around 20 PRs a day, including self-healing flaky tests.

Links:
Erika’s Agentic AI Identity Read: khaledzaky.com/blog/delegation-is-the-real-ide…
Bethany’s OpenAI CyberAttack Read: simonwillison.net/2026/Jul/22/openai-cyberatta…
Empire of AI: bookshop.org/p/books/empire-of-ai-dreams-and-n…
Brittany’s Loop Engineering Read: addyosmani.com/blog/loop-engineering
Superpowers: github.com/obra/superpowers
Brittany’s Loop Engineering Blog post: brittany-ellich.offprint.app/a/3mrjj34puva23-1…

Hosts:
Overcommitted: ⁠overcommitted.dev
⁠Bethany Janos: ⁠trustyduck.dev/⁠
Brittany Ellich: ⁠brittanyellich.com
⁠Erika Eggemeyer: ⁠github.com/eggyhead