Three projects on today's board run frontier-scale models on machines that cannot hold them by streaming weights off NVMe, which moves the binding constraint on local inference from RAM to storage bandwidth and makes every headline memory number misleading on its own.

Three projects on today's board run frontier-scale models on machines that cannot hold them by streaming weights off NVMe, which moves the binding constraint on local inference from RAM to storage bandwidth and makes every headline memory number misleading on its own.

The harness, not the model and not the prompt, became the unit of engineering this week, and it is now carrying the permission model, the review gate, and the security posture that used to live somewhere else.

Agent skills finished their transition from a convenience feature into a package ecosystem, complete with a measured supply chain, an OWASP top ten, and enterprise signing registries, while the format itself still ships with no signatures and no capability model.

Streaming experts off disk instead of holding them in RAM went from one clever hack to the default architecture for running open frontier models locally, and the same week it landed, Unit 42 published what an attacker built out of the open-weights plus open-harness stack.

Agent state that used to live somewhere invisible is being dragged into the open, by the MCP spec that deleted the hidden session, by YC scoping memory and permissions per person and per room, and by two disclosures where the exploit was configuration and text the operator never saw.

Three separate disclosures this week put the failure at the harness layer rather than the model layer, with Anthropic classifying its own real-world breaches as an operational failure, AI Now showing no model update fixes the README injection class, and a GitHub board led entirely by skill routers and connector gateways.

The model stopped being the product this week, with the biggest cost win credited to a harness rewrite rather than a new checkpoint, a hyperscaler putting its own model family on life support, and a GitHub board led by skills, connectors, and packaging.

Four separate disclosures and shipments in seventy-two hours all turned on the same question, what an agent can reach on the network and whether anyone checked that boundary before the agent went looking.

Pdf-inspector's real argument is that roughly half the documents in a typical pipeline are already machine-readable and get sent to OCR…

A context window that wrote the code cannot honestly review it, self-preference research shows the failure gets worse exactly when the…

WASTE proves a 2.78-trillion-parameter model no longer has to fit in RAM, but it relocated the constraint rather than removing it, from…

Every control the attacker disabled in Unit 42's autonomous-attack campaign is a documented, supported setting in harnesses developers…

Agent identity files are the persistence layer of the skills ecosystem because they load into context before every session and no package…

Reasonix's transferable idea is that an agent's input bill is set by prefix stability rather than model price, so an append-only loop that…

The most valuable file in YC's newly open-sourced QM harness is SECURITY.md, because it enumerates in plain language the twelve places its…

Reverse-skill's copyable idea is not its security content but its RULES.md, which pre-declares authorization, writes itself into your…