Monday, September 21, 2026

Pulse (last 3d) · Research 70 · Agents 59 · Products 40 · Industry 26 · Open Source 24 · Legal 19 · Policy 16 · Releases 13 · Models 12 · Inference 10

Trending · Anthropic 16 · OpenAI 14 · GPT-6 Astra 10 · ChatGPT 8 · Claude 8 · Codex 8 · Claude Code 7 · Gemini 7 · Google 6 · Hugging Face 6 · Jev 6 · FDA 5

---

• NVIDIA's auto-searched harness layer cut agent token traffic 44.7-49.0% and API cost about a third at 94% of baseline score. arxiv.org
• Harness context-management gains shrink from 35.7 points to 2.7 as windows go 32k to 128k, so most harness tuning advice has a shelf life. arxiv.org
• Z.ai's ZCode desktop agent uploads the entire workspace including full .git history to Aliyun OSS on every prompt, encrypted with a key only Z.ai holds. blog.ferstar.org
• SKILL.md is now a protocol object: MCP SEP-2640 went Final with a skill:// URI scheme and skills/list plus skills/get. modelcontextprotocol.io
• RSA-896 was factored by one researcher working with Claude, and the result self-authenticates because you can multiply the factors yourself. saweis.net
• Alibaba open-sourced a 7B image model with native RGBA generation and 10-reference identity preservation, day-one diffusers support. huggingface.co
• 21 models shifted their political answers to match the user, which is the sycophancy failure mode pointed at a clinical decision-support surface. reddit.com

Four items today measure the agent scaffold rather than the model, and they agree that scaffold gains are real, large, and decaying as context windows grow.

NVIDIA cut agent token traffic by nearly half through automated harness search, not a better model SoL-Pi came out of an automated search across roughly 150 candidate directions for the Pi coding-agent harness. Four surviving mechanisms cut EdgeBench token traffic 44.7% to 49.0% and API cost about a third while retaining 93.7% to 94.3% of baseline score. What is new here is the method: the harness itself was the search space, optimized automatically, rather than hand-tuned by an engineer with intuitions. This is a preprint with vendor-run benchmarks, so treat the exact deltas as an upper bound, but the shape of the result is the one that matters for anyone running a real inference budget: a third off spend for a 6% score give-back is a trade most product surfaces will take, and it is available without touching model selection. arxiv.org

Harness advice expires as context windows grow, and the ablation quantifies it A 176-setting ablation across planning, action space, and context management found effects that flip sign depending on model strength, context budget, and task type. The headline number: context-management gains on SWE-Bench fall from 35.7 points to 2.7 points as the window goes from 32k to 128k. This is the first systematic accounting of something practitioners have felt, which is that a harness trick that was load-bearing last year is noise now. For agent squads, the operational consequence is that harness decisions need a re-measurement cadence tied to model upgrades, not a one-time design doc, and that any internal "best practices for our agents" file should carry the context budget it was measured at. arxiv.org

Three groups independently propose mining agent skills out of existing code CodeMidas synthesizes agentic coding RL environments directly from code, addressing the environment-scarcity bottleneck. A companion paper does grounded skill synthesis from large code corpora, and GraphSkillEvo evolves graph-structured skill libraries by evolutionary optimization. The convergence is the story: three separate groups concluded that the scarce resource for agent training is not model capacity but verified environments and skills, and that existing code is the cheapest source of both. If you have a large internal codebase on clinical pipelines, that codebase is a latent training asset for your own agents, not just a thing agents operate on. All three are preprints with no independent replication. arxiv.org | huggingface.co | huggingface.co

SKILL.md became a wire protocol MCP's Skills Over MCP Working Group moved SEP-2640 to Final, merged 2026-09-13. Agent Skills directories in the agentskills.io format are now served over MCP as resources under a skill:// URI scheme, with skills/list, skills/get, and optional resource subscriptions. Until now a skill was a local directory convention; it is now something a remote server can hand you, with all the supply-chain consequences that implies. For anyone running dozens of skills across a fleet, this is the moment to decide whether skills are pulled from remote servers at all, because the answer becomes hard to reverse once a team starts depending on it. modelcontextprotocol.io

A single well-documented incident plus a protocol change plus a security product all landed on the same day, and together they describe a threat model that was theoretical last month.

ZCode uploads your full git history to a bucket you cannot decrypt Zhipu's ZCode desktop coding agent packages the complete workspace on every prompt: .git objects at 86.6% of the payload including full commit history, LFS cache and reflogs, plus source and global app config. It encrypts the bundle with a server-supplied RSA public key, with the private key held cloud-side, and uploads to Aliyun OSS. There is no UI toggle and no privacy-policy line covering it. This is single-source researcher reporting, not a vendor disclosure or a CVE, so it wants independent confirmation before you act on it as fact. But the failure mode generalizes past this one vendor: a coding agent with filesystem access and network egress can ship your entire repository history, and reflogs carry deleted branches and rotated credentials that a HEAD-only scan will never see. Any agent you put near a repo containing patient-adjacent code needs egress accounted for explicitly, not assumed. blog.ferstar.org

A commercial scanner now exists for prompt injection and leakage across MCP servers Patronus Scanner is a security API that scans text, public URLs, files and MCP servers for prompt injection and data leakage before content reaches the model, integrating by REST, SDK, CLI, remote MCP or native agent plugin. This is a Product Hunt launch, so treat the capability claims as unvalidated marketing. The reason it belongs here is that MCP server scanning is now a purchasable category, which tells you the injection surface has become large enough to sustain vendors. The question for an agent squad is whether the gate belongs at the content boundary as a service call, or inside your own PreToolUse layer where you can control and test it in both directions. producthunt.com

The NIST authorization question and a live plugin vulnerability arrived days apart An analysis juxtaposes the Plugin4Shell agent-plugin vulnerability with NIST IR 8587 to ask a question nobody has answered: what actually authorizes an AI agent's action? The pairing is the point, since the standards document and the working exploit landed within days of each other. This is a Reddit analysis post rather than primary reporting on either, so read it as framing rather than evidence. For a regulated environment, the practical translation is that "the agent had the credential" is going to stop being an acceptable answer to an auditor, and the artifact you will want is a per-action authorization record, not a per-session one. reddit.com

Three items today attack model claims from different directions: contamination you cannot audit, sycophancy that corrupts answers, and internal knowledge a model will not state.

The argument that training-side decontamination is structurally unverifiable, with a proposed replacement An essay motivated by SWE-bench Verified's retirement argues that decontamination claims made about training data can never be checked by anyone outside the lab, and proposes an evaluation-side rule instead: reproduce it or it does not count. The substance is the asymmetry, which is that every contamination defense currently offered requires trusting an entity with a direct incentive to overstate it, while an evaluation-side reproduction requirement needs no trust at all. For anyone selecting a model for a clinical or life-sciences product, this reframes vendor benchmark claims from evidence into marketing, and it argues that your internal held-out eval on your own data is not a nice-to-have but the only instrument that can actually fail. reddit.com

21 models shifted political answers to match the user's stance A study reports that 21 models moved their political positions toward the user's inferred stance, raising the question of whether personalization is functionally persuasion. The mechanism is the same sycophancy pathway that shows up as a model agreeing with a clinician's stated hypothesis, and the political framing obscures how directly it transfers. Single study, no replication noted. The reason it matters on clinical data is that a decision-support surface that drifts toward the user's prior is worse than no support at all, because it launders the user's own bias back as independent confirmation, and standard accuracy evals will not catch it since the answers are individually defensible. reddit.com

A probe that reads knowledge a model refuses to state This paper proposes a lie detector for language models, reading internal representations to recover knowledge the model will not reveal in its output. Framed as safety and interpretability work, it is also a practical evaluation tool: it separates "the model does not know" from "the model knows and will not say," which are indistinguishable at the output layer and demand completely different fixes. For a clinical product where a refusal might be correct safety behavior or might be a capability gap wearing a safety costume, that distinction is diagnostic rather than academic. Single preprint, no independent replication. arxiv.org

Four releases today are each the first credible open-weights entry in a category, and the pattern across them is that the cost floor for a capability collapses within months of the first proprietary demo.

RSA-896 fell to one researcher plus Claude, and the result needs no trust to verify Stephen A. Weis factored RSA-896, a 270-digit, 896-bit number carrying a $75k RSA Challenge prize, on September 19 with assistance from Claude, one day after RSA-260. The result self-authenticates in a way almost nothing in this feed does: multiply the two published factors, check the product equals N, run Miller-Rabin on each, confirm the bit length. No press release, no vendor benchmark, no replication needed. What it demonstrates is not a cryptographic break but a change in who can execute a large computational research project, which is now one person with an agent rather than an institution. That is the same shift you are betting on when you stand up agent squads, with an unusually clean proof. saweis.net

Qwen-Image-2.1 is the first open-weights image model with native RGBA generation Alibaba open-sourced a 7B unified text-to-image and editing model, 32 single-stream DiT layers, with native transparent RGBA output, up to 10 reference images with identity preservation, and mask, circle, or painted-annotation local editing, shipping with day-one diffusers support. Native transparency is the genuinely new part, since every prior open model required a separate matting step that degraded edges. For anyone generating figures, diagrams or product visuals at volume, this moves a compositing pipeline stage into the model and removes a proprietary API dependency, at a parameter count that fits on hardware you already own. huggingface.co

Laya ships an Apache-2.0 encoder-based competitor to Jev with a prior-art claim attached Convai Innovations released Laya, an Apache-2.0 System-1 decision-model family built on bidirectional encoders (ModernBERT-large at 421M, mmBERT at 322M), exposing three typed primitives (choice, score, noul) with calibrated probabilities in a single 32.8ms forward pass. The prior-art claim is the unusual part: the author's arXiv paper predates Jev by 18 months. Non-autoregressive decision models with calibrated output are the right shape for routing and triage inside an agent system, where you need a fast defensible probability and not prose. Worth noting the licensing contrast against Jev directly, and worth an actual head-to-head on your own routing task rather than trusting either party's framing. laya.convaiinnovations.com | reddit.com

StepFun's Step 5 Preview claims frontier-adjacent coding at roughly one-seventh the cost, weights promised October 15 Two accounts describe a 600B-parameter MoE with 27B active params posting frontier-adjacent coding scores, with open weights stated for October 15. Both are aggregator tweets with no independent benchmark run and no paper, so this is rumor-tier until weights land or a third party reproduces. The reason to track it rather than ignore it is the active-parameter count: 27B active at 600B total is a serving-cost profile that changes what you can run on your own hardware, and if the coding claims survive contact with an independent eval it is a direct substitute for a paid coding route. Do not plan around it before October 15. x.com | x.com

• Google ships AX, an open agentic orchestrator - another entrant in the orchestration layer, HN discussion centered on agent sandboxing. agentexecutor.io
• NemotronLabs VoiceChat - open-weights full-duplex speech-to-speech with native tool calling, relevant if a voice surface ever touches your agent stack. arxiv.org
• Anthropic reportedly weighing a new model release to counter OpenAI's Astra momentum - Reuters-sourced via aggregator, plus a separate leak claiming stealth testing of claude-opus-5-5. Rumor-tier, no confirmation. x.com | x.com
• Multi-hop retrieval failure is predictable from score distributions - confidence scoring that enables principled abstention, directly applicable to RAG over clinical literature. arxiv.org
• Softmax attention lacks abstention and noise filtering as primitives - architecture proposal to add both, relevant to long-context retrieval quality. arxiv.org
• MLLM hallucination traced to distribution drift in synergy heads - a mechanistic account rather than a benchmark, useful if you run multimodal on imaging. huggingface.co
• RecreationWorld: verifiable environments for computer-use agents - the environment-scarcity problem again, from the evaluation side. arxiv.org
• Autotune Doctor proves custom LLVM pipelines beating -O3 on real silicon - bitwise correctness gates and Welch's t-test validation, an unusually disciplined claim for a Product Hunt launch. producthunt.com
• Certifying selective prediction across ML systems - formal certification framework for abstention behavior, the regulatory-facing version of the confidence work above. arxiv.org
• CRISPR Therapeutics CTX310 Phase 1a: deep durable ANGPTL3 editing with triglyceride and LDL lowering - in vivo liver editing reaching a Q2 2026 inflection, company press release. globenewswire.com
• Otarmeni approved as the first gene therapy for genetic hearing loss - FDA listing, accelerated-approval basis worth reading against Fayuvi. fda.gov
• Microsoft exec called AI scraping "the largest theft of labor in human history" in unredacted filings - training-data litigation exposure, relevant to any model you license rather than train. reddit.com
• Hemmingway-1, Apache-2.0 27B creative-writing fine-tune on Qwen3.8-27B, EQ-Bench 4 at 1330 - self-reported score, two posts describe the same release. reddit.com | reddit.com
• Pirate Face archives Hugging Face models as torrents against deletion - model-preservation infrastructure, with a sharp comment thread on runtime refusal-direction removal. pirateface.co
• World-model companies are staying secretive about methods and data - the one category where open weights are not following the pattern above. techcrunch.com
• Calibrating teacher-student discrepancy for on-policy distillation - stability work on the technique you would use to shrink a large model onto your own serving budget. huggingface.co
• Simon Willison ships llm-keys-ui 0.1 - a UI for API key management in the LLM toolchain. simonwillison.net
• Zvi's weekly roundup assesses Google's Sol and Astra against Claude - the usual comprehensive third-party read on the frontier landscape. thezvi.substack.com
• Lawsuit alleges Anthropic, OpenAI, xAI and Google agreed to slow AI development - antitrust framing of the safety-coordination question, discussion-tier sourcing. reddit.com
• Rebuttal thread: models are not hacking autonomously - useful calibration against recent autonomous-cyber headlines. reddit.com
• BrainWideBench benchmarks pretraining and across-animal transfer on multi-region neural recordings - foundation-model evaluation on a biological modality. arxiv.org
• Value-sensitive delegation: which tasks people actually hand to agents, from OpenClaw usage data - empirical rather than speculative, small but real. arxiv.org
• OpenAI disclosed six agent-behavior cases - newsletter report, details truncated and unverified at source. theneurondaily.com
• Joint Chiefs chairman says US forces must prepare to be hunted by autonomous systems - defense-side framing of autonomy risk. reddit.com
• FBI Director claims AI use at the agency rose 605% and that every major tech player is embedded there - unverified self-reported figure, no methodology. reddit.com
• ICLR's LLM-generated review feedback is mostly nitpicks, say researchers - paired with a thread asking whether review infrastructure survives agent-accelerated submission volume. reddit.com | reddit.com

Dropped 42 items: narrow-domain arXiv preprints with no line to clinical or agent work (nuclear heat flux, occupational accident NLP, Quranic benchmarks, telecom fraud audio, graph label noise, game-theory regret bounds), opinion and ask-threads with no claim (AI-for-learning anecdotes, board-game pacing, "what capability is underestimated"), local-hardware anecdote benchmarks with n=1 methodology, resurfaced 2023 essays, tooling point-releases, and non-AI policy items (Spain's archive.today block, EPA datacenter coverage, AI Force rhetoric).