Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

AI Trending Briefing · September 11, 2026 · morning edition

The harness stopped being scaffolding you write and became the product vendors sell, which means the layer that decides how your agent behaves is now the layer you no longer control.

OpenAI Agents APICodex harnessClaude CodeNVlabs SoL-PiEvoSafeHarnessagent-harnesscodexclaude-codeagent-securitymulti-agentai-skills

Trending AI Briefing: Friday, September 11, 2026 (morning ET)

For two years the agent harness was the boring part, the loop you wrote yourself around somebody else's model. This morning it is the thing being sold. OpenAI is renting out the Codex harness as a managed API, NVIDIA published an efficiency extension for a different harness, Anthropic shipped a Claude Code release that is almost entirely harness permission-boundary repairs, and a security paper argues the harness has to be synthesized fresh for every model and every domain because no single one transfers. The counter-evidence landed on the Hacker News front page at the same time, from someone who let a harness run unattended for 35 hours and read what came out.

What's hottest in AI news right now

OpenAI put the Codex harness itself behind an API on September 10, and the pitch is that you stop writing the loop. The Agents API entered public beta with a single client.beta.agents.sessions.create() call that takes a model, a tool list, an environment, and a task. OpenAI runs the orchestration, the context compaction as a session approaches its limit, tool search that loads tool definitions only when needed, programmatic tool calling that lets the agent chain and filter calls in code, and subagent fan-out via multi_agent: { enabled: true, max_concurrent_subagents: N }. You pick where the compute lives: an OpenAI-hosted sandbox, your own infrastructure, or one of nine named partners including Cloudflare, Modal, E2B, Daytona, Vercel and Oracle. The launch post says there are no additional fees beyond tokens and tools, while the docs add that OpenAI-hosted sandboxes bill at standard container rates. The line worth pinning to your wall is further down that same docs page: the Agents API supports data residency only in the United States, does not support Zero Data Retention, and "choosing a self-hosted sandbox does not make the Agents API ZDR-eligible." Every customer quote on the launch page is from OpenAI's own beta cohort. (OpenAI, docs overview)

Claude Code shipped 2.1.268 on September 10 at 18:41 UTC, and reading the changelog as a security document is more informative than reading it as a feature list. Four of the fixes are permission-boundary failures in the harness itself. Deny and ask rules on symlinked directories (/etc, /tmp, /var on macOS, /bin on Linux) were not applying when a path arrived by its real location, and Bash commands ignored deny rules written against the symlinked spelling. A Read or Edit deny rule could be skipped when an env -C, eval or similar wrapper the permission checker cannot parse sat on the same line. A respawned in-process teammate could pick up tools or a system prompt from a same-named agent file in a folder you never trusted. And both /mcp and /plugin output, plus claude mcp list, were printing secrets resolved from ${VAR} placeholders. None of those are model problems. All of them are the harness getting the boundary wrong, in a product whose entire safety story is that the harness holds the boundary. (CHANGELOG, version confirmed via npm)

Armin Ronacher's account of running GPT-6 Astra unsupervised for 35 hours reached the front page this morning with over 350 points, and it is the best argument yet that the harness decides what the model commits. He built a deliberately hands-off setup, let the model manage its own context and spawn subagents, and pointed it at adding virtual threads and lexical scoping to CPython. His numbers: 35 hours, a net addition of 75,000 lines, 79 commits, roughly 1,400 agent messages, about $1,200 in raw API costs, working out to around $15.50 per commit, and by his own summary "absolutely nothing of value." The mechanism he identifies is specific. When the agent stopped using the harness's edit tool and fell back to heredoc Python doing string splicing on C source, the changes became impossible to follow as they happened, and that code-golfed style then leaked into code that got committed: tests with no whitespace, magic integer indexes into an accelerator tuple, C written in a style that exists nowhere else in CPython. His read is that models are rewarded for token efficiency in tool calls and task completion, with little penalty for code a human cannot read. Note that his own post gives the token spend twice, as roughly 4 billion in the opening and around 1 billion later, so treat that one figure as unreliable. (lucumr.pocoo.org, HN thread)

A Johns Hopkins-affiliated group submitted EvoSafeHarness to arXiv on September 5, and its central claim is that a safety harness cannot be written once. The argument: models differ in how much enforcement they tolerate before utility collapses, and domains differ in which effects, state and action sequences need governing, so a harness tuned strictly enough for one model over-blocks another. The framework jointly searches a natural-language policy and executable code logic against a frozen model in a target domain, using fresh-context adversarial review to throw out rules that only work on the benchmark. Reported results: average attack success rate on DecodingTrust-Agent drops from 45.6% to 10.0% at a 3.3-point utility cost, with the best score in 14 of 15 cells; on AgentDojo it reaches 82.8% utility at 0.0% attack success, which the authors put at twice CaMeL's utility at the same operating point, and transfers unchanged to unseen AgentDyn suites. Authors include Dawn Song and Bo Li. These are the authors' own runs and the paper is v1 with no peer review attached. (arXiv:2609.05903)

A Tell HN post claiming OpenAI keeps silently re-enabling the "allow training" setting drew 429 points on September 10, and the timing against the Agents API launch is not kind. The author says they reset the setting more than once, made a dated note of the last reset, and found it enabled again on checking. This is a user report with 176 comments as read from the Hacker News API this morning, and no confirmation from OpenAI, so treat it as an allegation rather than a finding. It matters this week because the Agents API asks you to hand a vendor the orchestration layer, the session state, and in the hosted case the sandbox, on a service whose own documentation says Zero Data Retention is not available and that self-hosting the sandbox does not change that. (Hacker News)

New tools and features worth actually trying

npx skills from vercel-labs/skills. One CLI to install, list and update SKILL.md bundles across 75-plus coding agents, so a skill you write once stops being pinned to whichever harness you wrote it in. MIT, Copyright (c) 2026 Vercel, Inc., v1.5.25 dated 2026-09-08. Honest tradeoff: portability across 75 harnesses means the lowest common denominator of what a skill can assume, the tool sends telemetry unless you set DISABLE_TELEMETRY or DO_NOT_TRACK, and every skill you install this easily is still a vendor's judgment loaded into your agent's startup context.

Appending .md to any OpenAI docs URL. https://developers.openai.com/api/docs/guides/agents-api/overview.md returns clean markdown instead of a JavaScript shell, and the index lives at /llms.txt. This is how the ZDR sentence quoted above was found, because the rendered page is large enough to blow a fetch budget before you reach it. Honest tradeoff: it works on OpenAI's docs and nothing else, and the markdown carries no rendered tables of contents, so you still need to know roughly which page you want.

AlexsJones/llmfit. One command reads your CPU, RAM, GPU and VRAM and ranks which open models and quantizations will actually run, scored on fit, speed, quality and context. MIT, Copyright (c) 2026 Alex Jones, v1.1.15 dated 2026-09-10. Honest tradeoff: the tokens-per-second figures are estimates from a memory-bandwidth model rather than measured runs, which the project acknowledges by shipping a benchmark-and-share feature specifically to replace them.

CLAUDE_CODE_WEBFETCH_DEADLINE_MS in Claude Code 2.1.268. WebFetch previously hung forever against a server that keeps a response open without finishing it; there is now a 300-second deadline you can override, or disable with 0. Honest tradeoff: 300 seconds is still five minutes of a stalled turn, and turning the deadline off restores the old hang, so the useful move is lowering it rather than raising it.

Trending AI repos on GitHub today

Trendshift's daily board was read once at 07:12 ET; its inline numbers are momentum scores rather than star totals, so every star count below comes from cache-busted img.shields.io JSON and every license from the raw LICENSE file text. The board itself was unusually polluted this morning, with six of the top fifteen slots held by cracked-software, crypto-seed-phrase and Discord-raid repos.

  • NVlabs/SoL-Pi: a standalone extension for the Pi coding-agent harness bundling four opt-in efficiency mechanisms, Action Fusion, ObservationPack, an Evidence-Preserving Reducer and Online Context Compact. Why now: it is the same bet as the Agents API from the other direction, treating the harness as the tunable surface rather than the model. MIT, Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES, 780 stars, no releases. Caveat: the Evidence-Preserving Reducer can ship eligible diagnostic-log content to a remote reducer model, and the README itself says not to enable remote reduction for logs that must stay local.
  • github/spec-kit: a toolkit that gives any coding agent a specify, plan, tasks, implement workflow through slash commands. Why now: v1.0.6 landed yesterday and it is the most-adopted attempt to put structure above the harness instead of inside it. MIT, Copyright GitHub, Inc., about 135k stars, v1.0.6 dated 2026-09-10. Caveat: none found.
  • vercel-labs/skills: npx skills, a cross-harness installer for agent skills covering 75-plus agents. Why now: skills are the one agent asset that has stayed portable while harnesses diverge, and this is the tool betting on that. MIT, Copyright (c) 2026 Vercel, Inc., about 31k stars, v1.5.25 dated 2026-09-08. Caveat: none found; telemetry is disclosed with documented opt-outs.
  • AlexsJones/llmfit: hardware-aware model recommendations from a single terminal command. Why now: local model selection is still done by guessing, and this is the cheapest way to stop. MIT, Copyright (c) 2026 Alex Jones, about 36k stars, v1.1.15 dated 2026-09-10. Caveat: speed numbers are modeled from memory bandwidth, not measured.
  • nashsu/llm_wiki: a desktop app that has an LLM incrementally build and maintain an interlinked wiki from your documents, instead of retrieving from scratch on every question. Why now: it is the clearest consumer-shaped argument that persistent structured memory beats per-query retrieval. GPL-3.0, Copyright (C) 2024-2026 Yong Su, about 18k stars, v0.6.11 dated 2026-08-25. Caveat: none found.
  • Anakin-Inc/anakin: a self-hosted scraping API turning sites into LLM-ready markdown through an HTTP, anti-detect browser and API fallback chain. Why now: agent pipelines keep discovering that the retrieval layer is where they break. AGPL-3.0, and the LICENSE file is the unmodified FSF template with no copyright holder filled in. About 3.3k stars, v0.1.1 dated 2026-03-23, default branch master. Caveat: two, both in the repo's own text. The README calls the project anakinscraper-oss throughout while the repo lives at a different path, and the self-hosted section pairs the AGPL hosting obligation with a paid hosted upsell.
  • mcncarl/yichen-skills: a single-author collection of Claude Code and Codex skills for content work, covering article drafting, WeChat and WeCom export, ASR and multi-platform research. Why now: it is a live demonstration of how much workflow now ships as skill files rather than code. About 2.7k stars, latest tag x-article-draft-uploader-v1.0.1 dated 2026-08-16, which versions one skill rather than the repo. Caveat: the license is a custom "Personal Learning and Non-Commercial Use License" that forbids commercial use, client delivery and internal company deployment without written authorization obtained by contacting the author on WeChat, so this is not open source in any sense a scanner will catch.
  • oomol-lab/open-flow: a workflow platform where agents driving an oo flow CLI and humans edit the same typed visual workflow. Why now: it is the execution half of the connector gateway the same org shipped last week. Apache-2.0, about 120 stars, v0.1.0-beta.8 dated 2026-09-04. Caveat: the README states the project has not reached a stable release.

What actually matters from today's signal

Track the pinning question. Every harness shipped as a service this year is described the way OpenAI describes this one, as something the vendor "maintains and continuously improves" with "versioned access to these capabilities with each model launch." That sentence is the entire product and the entire risk in one clause. The harness is what decides whether your agent reaches for the edit tool or a heredoc of string-splicing Python, whether a deny rule survives a symlink, whether context compaction keeps the thing your run depends on. Ronacher's 79 commits and Anthropic's four permission fixes are the same finding from opposite ends: harness details you cannot see change outputs you have to live with. If you are adopting a managed harness this quarter, the question to answer before the token price is whether you can pin a harness version, reproduce a run from last month, and diff the behavior when it changes. The four highest-signal areas right now are harness pinning and reproducibility, per-deployment safety policy of the EvoSafeHarness kind rather than one expert config for everything, subagent observability since that is where Ronacher saw behavior degrade fastest, and skill portability as the one asset that survives a harness switch.

The counter-signal is that almost nobody is measuring this. The industry has benchmark suites for models and essentially nothing standard for harnesses, which is why the two most-read harness comparisons this week were a personal weekend experiment and an unrunnable Notion page. EvoSafeHarness is the only piece of today's signal that treats harness configuration as something you optimize with a stated objective and an adversarial check, and it is a v1 preprint reporting its own numbers on four benchmark families. Meanwhile the commercial incentive runs the other way. A vendor that lets you pin a harness version has to support old harnesses; a vendor that improves it continuously does not. Expect pinning to arrive late, expensively, and only in the enterprise tier, and budget review time accordingly. The real cost of a managed harness is not the container rate. It is that when your agent starts behaving differently on a Tuesday, you will have nothing to diff.

Source access notes: Primary sources reached directly via web_fetch: openai.com/news and the Agents API launch post, developers.openai.com/api/docs/guides/agents-api/overview.md (the rendered HTML version exceeded the fetch token limit and was read through the .md variant), anthropic.com/news, blog.cloudflare.com, blog.langchain.com, devblogs.microsoft.com/agent-framework, huggingface.co/blog and /papers, github.blog/changelog, arxiv.org/abs/2609.05903, lucumr.pocoo.org, registry.npmjs.org, trendshift.io. Hacker News was read through the Algolia API with the response covering stories created after 2026-09-10 10:30 ET. Trendshift was read once, at 07:12 ET. The Claude Code CHANGELOG was fetched cache-busted from raw.githubusercontent.com and exceeded the fetch token limit, so only the 2.1.268 section was read; version and publish time were cross-checked against the npm registry, which gives 2.1.268 published 2026-09-10T18:41:11Z. api.github.com is proxy-blocked from this environment, so every star count comes from cache-busted img.shields.io JSON and every license from cache-busted raw LICENSE text rather than a badge. Two sources failed and are excluded rather than characterized: the "Nine coding harnesses vs. your laptop" post on HN returned a JavaScript-only Notion shell with no readable content, and the Forgejo 16.0.4 release notes on Codeberg returned an empty body on both the rendered and raw URLs, so the reported critical RCE is named nowhere in this briefing. developers.openai.com/codex/changelog was not fetched (JS-rendered, historically empty). Anthropic's newsroom shows nothing since the September 10 threat intelligence report already covered in the September 10 afternoon briefing; Cloudflare's newest post is a September 10 post-quantum DNSSEC piece with no agent or builder angle; LangChain's newest is a September 10 customer case study. DeepSeek V4.1-Flash, the OpenAI Navier-Stokes credit dispute, GPT-Live-1, Cognition SWE-2 and the Anthropic threat report all appear in the last two briefings and are not repeated here.

Adversarial pass: an independent hostile fact-check subagent audited this file against the primary sources and returned one correction, folded in. It caught inflated Hacker News figures on the "allow training" Tell HN item, where the Algolia search index served 457 points and 179 comments while the live Firebase item API returned 429 points and 176 comments; the lower live figures are now in the text with the read time attached, and the Ronacher point count was softened to "over 350" for the same reason. It independently confirmed and found accurate: the Claude Code 2.1.268 version and its 2026-09-10T18:41:11Z npm publish time, all four permission-boundary changelog entries and the WebFetch deadline entry against the raw CHANGELOG, the Agents API ship date, the verbatim ZDR and data-residency sentence, the "maintains and continuously improves" and "versioned access" quotes, the nine named sandbox partners, the EvoSafeHarness September 5 submission date with Dawn Song and Bo Li among the authors and both the DecodingTrust-Agent and AgentDojo figure sets, every figure and the "absolutely nothing of value" quote in the Ronacher item including the 4-billion versus 1-billion token contradiction inside his own post, and every star count, license text, copyright line, release tag and release date in the repo section including the unfilled AGPL template and the anakinscraper-oss naming mismatch on Anakin-Inc/anakin and the non-commercial license on mcncarl/yichen-skills.