Independent AI intelligence Two editions daily · ET
FervorAI
Menu

AI Trending Briefing · August 3, 2026 · morning edition

The harness, not the model and not the prompt, became the unit of engineering this week, and it is now carrying the permission model, the review gate, and the security posture that used to live somewhere else.

QMY CombinatorAgentFlowopen-krittsol-advisorpdf-inspectoragent-harnessmulti-agentagent-securityagent-infrastructureai-skills

Trending AI Briefing: Monday, August 3, 2026 (morning ET)

Four of the ten fastest-moving repositories on this morning's momentum board describe themselves with the same word: harness. Y Combinator open-sourced the one it runs its own company on. A solo developer's Codex orchestration script climbed the board by doing nothing more than separating who writes code from who reviews it. A bug-bounty team released the harness behind $1.5M in payouts. An arXiv paper supplies the number that explains all of it: hold the language model fixed, change only the harness, and success rates on public agent benchmarks move by several-fold. The wiring took over from the model, and this week it started carrying the permission model too.

What's hottest in AI news right now

Y Combinator open-sourced QM on July 31, the MIT-licensed multi-agent harness it runs internally across accounting, legal, events, and engineering, including building QM itself. The framing matters more than the code: most agent tooling assumes one person and one session, and QM assumes a company. Its load-bearing abstraction is the scope. Every person and every room gets its own memory, files, keychain view, permissions, crons, web apps, and durable sandbox. The core is generic TypeScript on Node with Postgres holding sessions and state, and everything company-specific lives in a deployment directory that a CLI validates and ships into the operator's own cloud account. Harness choice is a swap, not a lock-in: Pi, OpenCode, Codex, and Claude Code all drive the same core. (GitHub, YC on X, Hacker News)

The part of QM nobody is discussing is the part worth copying: three org-level security postures that narrower scopes can only tighten. Strict pauses every harness tool call for approval. Auto, the default, runs a classifier over provenance-labelled external data and tool results before they reach the model. Dangerous turns screening off. A predeclared command policy covering recursive deletes and destructive SQL applies in all three, Dangerous included. That is a real capability model shipped inside a harness, which is where the agent-skills ecosystem has spent two months failing to put one.

AgentFlow is the paper that turns this into a claim you can argue with. Published April 22 and circulating hard again this week alongside the harness repos, it treats the harness as a search space rather than a hand-written artifact: a typed graph DSL covering agent roles, prompts, tools, communication topology, and coordination protocol, with an outer loop that reads runtime signals from the target program to diagnose which part of the harness broke and rewrite it. It reaches 84.3% on TerminalBench-2 with Claude Opus 4.6, and against Google Chrome with Kimi K2.5 it found ten previously unknown zero-days, two of them Critical sandbox escapes filed as CVE-2026-5280 and CVE-2026-6297. Read the framing sentence twice: with the model held fixed, harness changes alone swing benchmark results by several-fold. (arXiv 2604.20801)

Kritt-ai released open-kritt, the self-hosted distillation of the internal platform behind more than $1,500,000 in bug-bounty payouts under the researcher name Blockian. Its thesis is the anti-thesis of pointing a model at a repo: break research into small well-defined tasks, run them across agents in parallel with Codex or Claude Code, then de-duplicate, validate with post-scripts, and rank with custom severity rankers. It is AGPL-3.0, ships as Docker Compose, and is unusually honest about the blast radius. Tool-enabled agents run as root inside disposable job containers with writable repository copies and direct internet access, and the backend has no application authentication. (GitHub, docs)

DannyMac180/sol-advisor is the smallest thing on this list and the clearest illustration of the pattern. GPT-5.6 Sol High acts as architect and never writes production code, Luna Max handles routine implementation, a separate lane takes high-risk changes, and a fresh-context Sol instance reviews the real diff at the end. The insight it encodes: one context window should not simultaneously be the architect, the implementer, and the reviewer, because a context that wrote the code cannot honestly review it. Role files are verified byte-for-byte and routing requires runtime evidence rather than silent fallback. (GitHub, Trendshift)

Firecrawl open-sourced pdf-inspector, the week's counterweight to all of the above. It is a pure Rust library, no ML models and no external services, that classifies a PDF as TextBased, Scanned, ImageBased, or Mixed in roughly 10 to 50ms by sampling content streams, then extracts position-aware text and converts to Markdown locally in under 200ms. Firecrawl built it because about 54% of PDFs never needed OCR. On the 200-document opendataloader benchmark it scores 0.78 overall in 4 seconds, against 0.83 to 0.88 for OCR and ML engines that take 2 to 180 minutes. It also publishes where it loses: heading detection trails opendataloader, because plenty of PDFs use bold body-size text as a heading. (GitHub, Firecrawl)

New tools and features worth actually trying

QM is worth standing up this week even if you never deploy it. Run qm init against a throwaway Fly target and read deploy/layers/ and the security-posture section. Honest tradeoff: this is a company-shaped tool, and if you are one person with one laptop you are taking on Postgres, a sandbox layer, and a deployment repository to solve a coordination problem you do not have.

pdf-inspector is the highest-value hour here for anyone running a document pipeline. cargo run --bin detect-pdf -- document.pdf --json tells you which specific pages need OCR, turning an all-or-nothing routing decision into a per-page one. Honest tradeoff: it does no OCR at all, so scanned documents still need the expensive path, and its table and heading extraction trails the ML engines it routes around.

sol-advisor pays for itself whether or not you run it, because the orchestrator prompt is the deliverable. Honest tradeoff: it is welded to specific Codex model tiers, the review pass is a fresh context rather than a different model family, and a single-contributor Shell project driving production diffs is a dependency worth thinking about.

Trending AI repos on GitHub today

  • yc-software/qm: multiplayer agent harness for Slack and web. The first widely-read design treating per-person scope, not per-session context, as the primitive.
  • firecrawl/pdf-inspector: Rust PDF classifier and extractor with Python and Node bindings. A deliberate argument for deterministic tooling in a stack that reaches for a model by reflex.
  • Kritt-ai/open-kritt: orchestrates parallel agents into de-duplicated, ranked vulnerability findings. Its provenance is payouts, not benchmarks.
  • DannyMac180/sol-advisor: Codex architect orchestration with separate implementation lanes and a mandatory fresh-context review. Small enough to steal in an afternoon.
  • TencentCloud/TencentDB-Agent-Memory: team memory hub producing governed Chat Memory, Skill, LLM-Wiki, and Code-Graph assets. The memory-side answer to what QM solves on the execution side.
  • bytedance/deer-flow: long-horizon SuperAgent harness with sandboxes, memory, skills, subagents, and a message gateway. Back on the boards as the category heats up.
  • Graphify-Labs/graphify: turns a folder of code, schemas, and docs into a queryable knowledge graph via deterministic AST parsing, no vector store. The retrieval layer today's harnesses assume exists.
  • microsoft/skill-recorder: MIT-licensed TypeScript tool in the AI-skills category. Microsoft entering skill authoring signals where the packaging fight goes next.

Star counts come from Trendshift's board and GitHub's own pages, which disagreed on at least one repository during this scan. Treat them as direction, not audited totals.

What actually matters from today's signal

Track the harness layer this week, and track it as an engineering artifact with a version, not as glue. Four highest-signal areas for builders: scope-based isolation, where QM's per-person memory, keychain view, permissions, and sandbox is now the reference design; role separation with a fresh reviewer context, which sol-advisor makes cheap enough that there is no excuse; harness-level security posture, because QM shipped a three-tier model with a command policy that survives even the Dangerous setting; and deterministic pre-filters like pdf-inspector, the discipline of asking whether a task needs a model at all before routing it to one.

The counter-signal is buried in the AgentFlow abstract and almost nobody is saying it out loud. If holding the model fixed and changing only the harness moves benchmark results by several-fold, the public leaderboard culture is measuring a confound. Every "our model beat theirs on TerminalBench" post is also a claim about scaffolding that nobody publishes, versions, or reproduces. AgentFlow's own result was not a better model. It was a searched harness, and it found ten Chrome zero-days including two Critical sandbox escapes.

Which points at the risk. The harness is now where the capability lives, and it is also where the credentials, the sandbox, the cron schedule, and the permission model live. QM says the agent acts as the person it works for, with their credentials, and everything is audited. That is the correct design and it is a much larger blast radius than a chat window, distributed across every employee in a company. open-kritt is blunter: root, in a container, with internet access, no backend auth. The agent-skills supply chain spent two months learning it had no signatures and no capability model. The harness layer is one abstraction up, moving faster, and running with real production credentials. Nobody is scanning it yet.

Source access notes: GitHub's /trending page, the HN Algolia API, and the Anthropic, OpenAI, Google, and Cloudflare blogs were unreachable directly this run, so trending signal came from Trendshift's daily board and vendor news came via search, with every cited repository and paper verified by a direct fetch on its own page. The Claude Code changelog was reachable and shows no release after 2.1.220 on July 25. Product Hunt was not reached.