// From the blog
• 13 applications for .agent. We're one of them. — ICANN has published the 2026 application list: 13 applicants are seeking .agent, including Google, OpenAI, Meta, and Open Agent Registry, Inc. Here is why our community application is still the one we believe in.

X Recap

Anthropic opened a research preview of Claude Duet, a proactive personal agent built on Opus 5.5, as OpenAI confirmed its models found the PHP2Shell engine flaws.

This week collapsed three of the biggest agentic-web threads into one: the personal-agent race, AI-found vulnerabilities forcing mass patching, and a model built by an automated research loop. For builders, the through-line is that harness quality, security posture, and procurement are now as load-bearing as raw model intelligence — and each is shifting fast.

Claude Duet Joins The Personal Agent Race

Anthropic opened a research preview of Claude Duet, a proactive personal agent built on Opus 5.5 that runs in the background, manages tasks across connected apps, and asks for approval before sensitive actions (@kimmonismus). It ships with 6,000+ connectors and plugins and keeps working when you step away, per Anthropic engineer @ahuja_karan, who says it was built for professionals and small-business owners juggling work and home. Anthropic CPO @mikeyk confirmed a waitlist research preview and called Opus 5.5 "our first model with the judgment to be proactive in the right ways," describing it drafting fireside-chat questions and ordering a book once asked.

The strategic read is that every major lab now fields a personal agent. @signulll maps the field — Meta→Muse, Anthropic→Duet, OpenAI→Dots, SpaceX→Bots — and argues competition is shifting from "who has the smartest model" to "who owns the persistent relationship with the user." @petergyang hands-on found Duet the "most proactive out of the box" with "arguably the best model behind it," but notes it can't yet drive its own browser. The contrarian case is sharp: @clairevo praised the design but found it "SLOW" with weak personalization, while @jjpcodes argues none of these agents are yet smart enough to do life-admin reliably without heavy guidance.

For agent builders the implications are uncomfortable on both sides. @ChrisGPT asks why anyone would run Opus 5.5 through Grok Bot — which uses that same model as its reasoning engine — when Anthropic now ships a first-party harness with native memory, skills, connectors, and its own execution environment. On the ecosystem side, @stripe is working with Anthropic to let users run businesses inside Duet, and @benjaminsehl confirms Shop MCP integration so Shop Pay acts as a wallet. @tirthaexe compiles the pricing — Duet $20/mo versus Grok Bot $30 and Dots $100 — and notes Duet can't yet show its browser while Dots can drive your laptop. @CoreyJMahler lands the sharpest counter to the "owns the relationship" thesis: "Guess who owns the persistent relationship with the end user? @Apple."

---

PHP2Shell: AI Found The Bug, Now Patch Everything

A massive coordinated disclosure dominated the week: PHP2Shell, two critical PHP engine vulnerabilities (CVSS 9.2) enabling unauthenticated remote code execution and server-memory exposure, with early exploit attempts already emerging, per @TheHackersNews, which lists CVE-2026-109618 and CVE-2026-109619. @OpenAI confirmed its models — including GPT-5.6 Sol — found the flaws under its Patch the Planet initiative, and spent two months leading a coalition to prepare fixes ahead of disclosure because the fix "required a major change to the PHP engine." @gdb called it "one of the most severe bugs in open source software found in recent memory."

For agent builders this is a proof point and a warning. @nicbstme: "This is what older models can do. I don't think the world is prepared for the sheer number of vulnerabilities newer models will uncover." @emollick describes companies already struggling with the patch cadence as AI defenses outrun human response. The darker read comes from @AutismCapital, who warns many PHP sites with sensitive data are abandoned and will never be upgraded, and that OpenAI has indicated this is one of several critical flaws it found — "a large portion of the unmaintained internet is about to be pwned."

Multi-agent orchestration cuts both ways. @rohanpaul_ai reports a hacking crew (CyberCartel) wired Claude, Grok, and Kimi agents into a harness to automate attacks on 400+ Latin American financial targets. @cyber_razz details the guardrail-bypass: attackers told Claude they were running internal tests, and when Claude refused they switched to Grok, then Kimi, then fell back to traditional malware. Compounding the chaos, a separate Railway security incident forced key rotation across the ecosystem — @JustJake confirmed the compromise, and Railway's disclosure (blog.railway.com) states an unauthorized third party may have accessed encrypted environment variables. @owengretzinger gives the first-hand cost: stolen AWS keys used to run Claude, with AWS blocking 3,000+ requests.

What to watch: @dnvolz reports Amazon telemetry showing PHP2Shell was being exploited on Oct. 17 — four days before public disclosure — with no known actor. The practical takeaway from @gregisenberg: an API key is now basically a credit card for compute — give every agent its own key, set hard monthly spend limits, and turn on usage alerts.

---

Flint: A Model Built By An Automated Research Loop

Recursive (founded in February) released Flint, a 40B MoE coding model with 2.5B active parameters, Apache 2.0 weights, and a 512K context that runs at 125+ tokens/sec on an M4 Pro MacBook. The lead-story hook isn't the benchmark — it's that @RichardSocher says it was built by their Eureka Machine, an automated research system that contributed to nearly every part of the stack. Co-founder @_rockt adds it was "developed from scratch in less than four months" with the autoresearch system, and @tydsh reports the full pipeline — tokenizer→Pretrain→Midtrain→SFT→RL — with 54.9% on Terminal-Bench 2.1, 89.7% on SWE-bench Pro v2, and 74.2% on SWE-bench Verified.

The Eureka Machine's concrete decisions are the interesting part. @guohao_li describes the loop — "propose, implement, test, decide what to try next" — and notes it "searched the expert config, quantized lm_head to 4-bit against common practice (recovered via self-distillation), and wrote a Metal megakernel for the whole decode pass." @Thom_Wolf singles out the lm_head decision: an AI researcher quantizing lm_head to 4 bits "AND being actually right (0.7pt from bf16)." @Marktechpost corroborates the architecture — "a router picks 6 of 256 experts plus 1 shared expert" — and the trade-off: Flint's 54.9% on Terminal-Bench 2.1 versus dense Qwen 3.8's 73.0%.

The contrarian case is concrete and worth holding onto. @threerouter flags that "every benchmark above is vendor-reported, nothing independently verified yet," and that Recursive itself says Flint "needs more hand-holding than Claude or Codex." @IntuitMachine calls the whole thing "patently completely insane — Recursive invented the machine that invented the LLM in just a few months," noting the company was founded in February. Independent reproduction is already underway: @UnslothAI shipped Dynamic GGUFs to run Flint on 24GB RAM, and @DogukanUrker reports running it on a single RTX 3060 (12GB VRAM) at ~46 tok/s decode with 256K context.

This pairs with a second signal: a Google Cloud AI Research paper on OO-Harness (self-evolving agent harnesses via object-oriented design). @omarsar0 reports it raises AutomationBench from 61.6% to 77.4% "with the same Gemini 3.5 Flash executor." The paper (arXiv:2610.28380) describes an evolution agent creating specialized harnesses via inheritance, with "an absolute improvement of up to 15% over the base." The contrarian take from @DavinYCD: OO-Harness "reports fewer steps in the selected trajectory, excluding other rollouts and selection calls" — a shorter final path can still require more total inference. The bigger theme: harness quality is becoming as load-bearing as the model, and harnesses themselves are now being evolved by agents.

---

In Brief

Sandbox Infrastructure Heats Up: E2B, Orgo, Daytona

A sandbox is now something an agent's work has to survive, not just run inside. @e2b published a cookbook pairing Pydantic AI with E2B and Temporal — a workflow resumes a fix in the same E2B sandbox with files and diagnosis intact after a worker is killed, with no custom durable-agent wrapper. @pydantic announced E2B as a native sandbox provider, and @adtyavrdhn03 and @ivanda_mislav both note Pydantic AI now supports Daytona too. Orgo takes the opposite shape from a microVM — @spncrk describes it as closer to a virtual desktop (VDI) with a full GUI, live resizing, RDP/SSH, and a computer-use driver out of the box. On cold start, @LizardBuild reports timing 1,200 boots with medians of 238 ms (Lizard), 270 ms (E2B), 796 ms (Daytona), and 865 ms (Modal) — a self-published comparison by a competing vendor, so read it as a claim, not a neutral benchmark.

Memory Is The Unsolved Problem

The simplest useful pattern is a 'work ledger' — a JSON repo all your agents write into. @yoheinakajima describes tracking what each agent worked on, what changed, what's next, and a chat URL, which lets him switch between Claude Code, Codex, Grok Bot, and Muse without losing the thread — and he's explicit it isn't long-term memory. On infrastructure, @omarsar0 frames the shift as "goodbye, context engineering; hello, cache engineering," pointing at KV cache work @dair_ai describes: when an agent trims history the prefix changes and invalidates the cache, so the paper gives the agent two operations on its own KV cache. @HuggingPapers reports the system cuts average cost by 27.7% while improving task accuracy by 1.7 points. The practitioner version from @Arun131: editing a system prompt broke the KV cache and pushed time-to-first-token up by a second or two, so he now keeps the prompt fixed and appends instructions to the message list.

WebMCP, MCP 2.0, Agent VFS: The Plumbing Standardizes

WebMCP is now enabled for MCP Apps in ChatGPT Desktop, per @ndmccormack, who says OpenAI is collaborating with the MCP project to make WebMCP the default way agents interact with MCP Apps. @Cloudflare says almost 100,000 Commerce.com domains now expose shopping tools through WebMCP injected at the edge, and @GoogleDevsIN reports PayPal saw 2x faster checkout and roughly 4.6x lower compute costs. The more interesting fight is over the interface itself — @zechengzh released AgentVFS, which presents every service as files and turns actions into virtual CLIs so "the agent no longer calls MCP tools at all." @guohao_li reports VFS-Bench 1.0 results with Claude Opus 5.5 at 86% vs 83% pass@1 with 166k vs 617k tokens per task. The contrarian thread is about credentials — @RhysSullivan asks "can we move on from api keys now," and @saen_dev warns that if WebMCP becomes the default surface, "auth and permissions become the hard part."

Evals Get Serious: BenchmarkGate And Human Calibration

'BenchmarkGate' — don't blindly trust benchmarks, even popular ones — is the week's sharpest evals lesson. @HamelHusain coined it in response to @dejavucoder, whose post found SWE-bench Multimodal v2 is barely multimodal: removing images changed GPT-6 Luna xhigh from 36.9% to 37.1% on 480 tasks, while the same ablation on MMMU-Pro dropped accuracy by 42.8 points. @ragzoi flagged the detail worth stealing — agents were digging upstream fixes out of the repo's git history, a known SWE-bench hack still baked into the v2 images. @a16z adds a parallel exhibit from Reducto's Adit Abraham, arguing "benchmarks have become marketing over time." And @AnandButani goes further, alleging — in his own post, not corroborated elsewhere — that 89 answer-key files in Reducto's RD-TableBench were byte-for-byte identical to Reducto's own output.

OpenAI Lands On Google Cloud; Compute Sold Out Through 2027

OpenAI's frontier models and Codex agentic workflows are coming to Google Cloud's Model Garden, per @OpenAI, so enterprises can use them "where they already build." @kweinmeister says the private preview covers GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna, and that Google Cloud is now "the only hyperscale cloud provider offering access to all three leading closed source LLMs." The commercial detail matters more than the model list — purchases transact through Google Cloud Marketplace and draw down existing GCP commitments, per the announcement openai.com. @panditdhamdhere argues that's the real story: "it's procurement, and procurement decides what most enterprise developers are actually allowed to use." @rohanpaul_ai adds the deal was only possible after Microsoft's license turned non-exclusive on April 27, 2026.

---

Quick Hits

Agent Frameworks & Harnesses

• Mastra shipped MCP 2.0 support to scale servers without sessions and route via HTTP headers — @calcsam
• LangChain's LangSmith shipped 'smithtune' for fine-tuning small models on your own agent traces — @hwchase17
• Foundry (Promptise) is an open Python framework wrapping MCP tools, memory, guardrails, tracing, and runtime controls — @DanKornas
• Flats is a single Go binary that turns your local machine into a home for what agents build — @victorialslocum

Tool Use & Agent Interfaces

• Harvey is using Figma's MCP so agents work directly on the canvas to produce tailored demo videos — @harvey
• Box MCP connector hit GA inside Harvey's Connector Library with existing permissions enforced end-to-end — @Box
• Chiasmus is an MCP server giving LLM workflows solver-backed formal verification via Z3, SWI-Prolog, and tree-sitter — @DanKornas
• OpenAdapt compiles demonstrated tasks in apps without APIs into rerunnable programs instead of model-per-click — @DanKornas

Memory & Context

• DuckDB 2.0.0 LTS ships a dedicated 'agent mode' plus async I/O and a first-class VARIANT type — @duckdb
• Cohere's Rerank 5 adds 'Context Focus' and cuts token consumption by up to 41% — @cohere
• AIOS is a local-first control plane adding ContextDB cross-session memory for long-horizon coding agents — @DanKornas
• Redis LangCache semantic caching + persistent memory + storage tiering cuts AI app running costs — @svpino

Multi-Agent Systems

• A distributed-agent swarm cited 700+ references vs 11 for a single agent, and human experts preferred the swarm's interpretations — @nicbstme
• Monzo's in-house agent now writes >10% of merged PRs — 1,800+ tasks/day — at a bank — @aiDotEngineer
• Tantra runs sales funnels with a suite of eight specialized AI agents — @agentcommunity_

Agentic Infrastructure & Compute

• Cloudflare saw millions of PHP2Shell exploitation attempts post-disclosure and pre-deployed WAF rules before public disclosure — @Cloudflare
• Google open-sourced TorchTPU with native vLLM and SGLang backends including optimized long-context agentic serving — @GoogleCloudTech
• Cisco is building DPU-level security into its AI Factory to keep agent permissions scoped — @Cisco
• Modal made on-demand multi-node RL clusters available, arguing most teams are one production harness from a viable training loop — @modal

Models for Agents

• Meta's Muse Glimmer 30B is distilled from Muse Spark and runs agentic tasks on a single consumer GPU under 20GB at 4-bit — @rohanpaul_ai
• Baseten released two decision models, elephant-1 (9B) and mammoth-1 (27B), for agent harness routing/classification — @ClementDelangue
• NVIDIA's Nemotron 3.5 Parse took #1 on ParseBench document understanding while staying under 1B params — @jerryjliu0
• Kimi K3.1 is rumored to drop before Tuesday as a SOTA open-source model — @zephyr_z9

Developer Experience

• Harness Lens lets you compare agent harnesses (Claude Code, Pi, Codex) on system prompts, tools, compaction, and edit format — @victormustar
• OpenAI packaged a Codex skill repo to check whether your site is exposed to PHP2Shell — @OpenAI
• gitai is an open-source Git server/workflow layer built for coding agents making many short-lived changes on the same branch — @DanKornas
• Hamel and Shreya's 'Evals for AI Engineers' book launches Nov 12 — @HamelHusain

Industry & Ecosystem

• DeepSeek raised ~$15B at a ~$74.8B pre-money valuation with Tencent and CATL among the largest backers — @MTSlive
• Anthropic is preparing to file its S-1 as soon as Friday, per Yahoo Finance — @MTSlive
• Legora raised $550M Series E at an $8.8B valuation with 140k+ legal professionals doing agentic work in-product — @ycombinator
• Mirendil pretrained its first model from scratch in 3.5 months for under $10M, with agents writing 99%+ of the code — @sophiamyang

---

HuggingFace Highlights

Frontier agents hover near a 60% ceiling outside coding, and the field is finally putting numbers on the failure modes instead of the demos.

This cycle, the agent ecosystem stopped selling capability and started measuring reliability. IBM and UC Berkeley's IT-Bench/MAST found frontier models like Gemini-3-Flash fail cleanly at 2.6 failure modes per trace while large open models cascade at 5.3. Meanwhile Hugging Face redrew the framework map around code-as-action, and ARD made tool discovery a cross-industry spec. The through-line: the fault line is no longer model power, it's verification, provenance, and reproducibility.

Failure Analysis Finally Gets Numbers: Reliability Is the Bottleneck, Not Capability

The most consequential work in this batch isn't a model release — it's the failure taxonomies. IBM Research and UC Berkeley annotated 310 ITBench SRE traces across three model classes — Gemini-3-Flash, Kimi-K2, and GPT-OSS-120B — and surfaced a clean split by scale. "Frontier models like Gemini-3-Flash fail cleanly (2.6 failure modes/trace), typically hitting isolated bottlenecks like verification," while "large open models like GPT-OSS-120B suffer from cascading failure modes (5.3 failure modes/trace)," per @ionstoica. A single reasoning mismatch early poisons the context and compounds into hallucinations.

The headline fatal mode is FM-3.3 (Incorrect Verification), which "shows a 52 percent increase in failed Gemini-3-Flash traces compared to its successful ones," alongside 1.5 (Unaware of Termination Conditions) and 2.6 (Reasoning Action Mismatch) (IBM Research). Independent coverage splits the distribution into FC1 system-design at 41.8% and FC2 agent-to-agent inconsistency at 36.9% (lilting channel). Microsoft's "The Agent Said It Was Done. The Database Disagreed." is the sharpest one-line framing of the gap between self-report and ground truth.

The metric that captures this is pass^k — a task counts as solved only if all k attempts succeed, versus pass@k's optimistic "at least one of k" (Prefactor). Microsoft's STATE-Bench formalizes it as pass^5, and per Splunk's guide, pass^k "is generally the better predictor of production experience," with a gap "often by thirty points or more between pass^1 and pass^8" (Splunk). Independent tracking converges: frontier agents hover near a 60% ceiling outside coding, and ITBench-AA's sub-50 percent ceiling on enterprise IT "is the realistic prior, not the vendor" number (NextFuture). Caveat: the VAKRA and IT-Bench/MAST figures are IBM/UC Berkeley-reported on their own harnesses, and no retrieved source publishes a neutral cross-lab head-to-head of these taxonomies.

---

Hugging Face Redraws the Framework Map — and the Code-vs-JSON Split Is the Real Fault Line

The action primitive, not the SDK, is now the substantive disagreement in agent frameworks. Hugging Face's smolagents built its thesis around a CodeAgent that "writes its actions in code (as opposed to 'agents being used to write code') to invoke tools or perform computations, enabling natural composability (function nesting, loops, conditionals)" (Hugging Face docs). Independent reviews put the "entire agent logic" at roughly ~1,000 lines of code with "minimal abstractions" and "first-class support for code-driven agents, which reduces the number of steps needed compared to JSON-based tool calling" (Pondhouse Data).

The tradeoff is explicit and both sides ship in the same library. smolagents' own docs concede that "ToolCallingAgent supports usual JSON/text-based tool-calling for scenarios wh[ere]" code execution isn't appropriate (Hugging Face docs). One review frames the case for code as generality — "Code is designed to express any action a computer can perform" — against the JSON-based ReactJsonAgent, which smolagents "argues that it's not ideal for representing executable actions" (Agents Decoded). The cost is sandboxing and observability, which is why the same release wave pushes tracing via Arize Phoenix and a unified tool-use spec. Tool-agnosticism is the dividend: "you can use tools from any MCP server, from LangChain, you can even use a Hub Space as a tool" (huggingface/smolagents).

Caveat worth carrying: the "reduces the number of steps" claim and the ~1,000-line figure are the framework's own framing repeated by third parties, the Agents Decoded review is a single practitioner's read, and a vendor-style comparison scores smolagents 75/100 vs 67/100 for mcp-agent on 11 criteria with "the widest gap... pricing" (faun.dev). No retrieved source publishes a neutral, replicated benchmark of code-as-action versus JSON tool calling on the same backbone.

---

OpenEnv Bids to Own the Environment Layer — but It's Still an Interface, Not a Proven Trainer

Hugging Face is making a serious bid to standardize the environment layer for agentic RL, and the docs finally get specific enough to check. OpenEnv packages simulated environments as versioned, discoverable artifacts via RL Environments on the Hub, with "one interface, many environments which all expose the familiar Gymnasium-style API (reset(), step(), state()) running on a client/server architecture" — "a trainer that speaks OpenEnv can drive any compliant environment without bespoke code" (agentic RL post). Environments are "served over standard protocols like HTTP and WebSocket and packaged with Docker," with MCP called out as "a first-class citizen."

The design goal is interface gravity, not algorithmic novelty. Per the PyTorch Foundation workshop with Meta, HuggingFace, and Unsloth: "Anything else in your training loop should not change... the RL algorithm is handled by your training API. You download your LLM, and you're just changing environments" (Linux/PyTorch Foundation Workshop). The most deflationary independent read stresses that "OpenEnv is explicitly experimental and in early development," and that "its value in 2026 is the architecture and growing integration surface, not a promise that every API is stable" (medux.io). A commenter on the launch adds the skeptic's case on Gymnasium itself — its classic environments are "like a toy simulation" for LLM-scale RL, which is precisely why the client/server split and Docker packaging matter more than API shape (@sanyambhutani).

Caveat: the adoption list and "standardized" claim are announced by the project and partners; no retrieved source publishes an independently replicated pass-rate table for OpenEnv-trained agents versus bespoke harnesses, and Prime Intellect runs a parallel Environments Hub — so "default" is interface gravity, not a measured training-quality result.

---

ARD Turns Tool Discovery into a Spec — but It Solves Provenance, Not Judgment

Agentic Resource Discovery is now a cross-industry specification, and the trust model is the part builders need to understand before wiring it in. Per Hugging Face, ARD is "a draft, open specification developed by contributors from Microsoft, Google, GoDaddy, Hugging Face, and others... It is not a product or a marketplace." Google for Developers frames it as a coalition effort spanning Cisco, Databricks, GitHub, NVIDIA, Salesforce, ServiceNow, and Snowflake, giving "any agent a secure, decentralized way to discover and verify capabilities."

Independent analysis draws the boundary plainly: "ARD is an open standard for tool discovery — not a runtime, not a Google product. Anyone can publish a catalog or run a registry" (svetpetkov.com). The trust chain is domain-anchored — "Trust comes from the catalog being hosted on your own domain" — but "ARD handles finding and trusting a tool. It doesn't handle running it — that's a separate connection." That's a meaningful limit: ARD can tell an agent a tool is authentically published by a domain, but nothing in the retrieved sources measures whether the agent selects the right tool from a federated registry.

Meanwhile the Spaces ecosystem already functions as a de facto registry in practice. Spaces chaining with AGENTS.md documents an agent composing two Spaces into a pipeline neither was designed for, and gradio_agent_inspector gives builders a way to watch MCP tool calls in flight — the observability half of the same problem, since a discovery layer without call inspection leaves selection quality unmeasured.

---

Agent Intrusion Timeline Makes the Case for Source-Aware Verification

The most sobering item in this batch is a step-by-step reconstruction of a July 2026 frontier lab agent intrusion. Anatomy of a Frontier Lab Agent Intrusion traces how agent autonomy converts small permission grants into lateral movement: tool credentials reachable from context, filesystem access broader than the task required, and no human checkpoint between planning and execution. The independent security read is that the root cause is credential sprawl, not model misbehavior — the Cloud Security Alliance's MCP note identifies "supply chain vectors — package impersonation, configuration file poisoning, repository compromise — as an early and observable initial access path" (CSA Lab Space).

The blast radius is measurable. Axis Intelligence Research has logged 8 confirmed AI agent security incidents since July 2024, with the costliest — a Claude Code / GPT-4.1 campaign against nine Mexican government agencies — exposing approximately 400 million records (Axis Intelligence). Authzed's breach timeline adds protocol detail, including a critical zero-day in gemini-mcp-tool tracked as CVE-2026-0755 at CVSS 9.8, where execAsync passed "user-supplied input directly into a system call without proper validation" (Authzed).

Two research threads respond directly. MosaicLeaks asks whether a research agent can keep a secret, and Source-Aware Verification for MCP Agents argues fact-checking is insufficient — you must verify provenance, because an agent retrieving from an untrusted MCP server can be correct-and-compromised simultaneously. The mitigation consensus is converging on identity rather than per-call allowlists: Astrix recommends "replace hard-coded credentials with credentials fetched at runtime" and "enforce least-privilege access for Non-Human Identities (NHIs)" (Astrix via Yahoo Finance). Caveat: the HF timeline is co-published by affected parties, the CSA and Axis trackers are not regulator-verified registers, and no retrieved source publishes measured breach-prevention rates for these controls.

---

Computer-Use Agents Go Local — and the Benchmark Spread Becomes the Story

H Company's Holo line matured from demos into a model family, and the numbers now come with a spread rather than a single score. Holo4 shipped September 28, 2026 in 27B dense and 35B-A3B MoE sizes, trained on "roughly 10,000 tasks from the Agentic Task Factory" (Holo4 walkthrough). H Company reports Holo4 27B at 85.2% on OSWorld at $0.08 per task, but on the harder OSWorld 2.0 the same model reaches 61.7% against 81.8% for Opus 5.5, with Holo4 35B-A3B at 30.9% — "with orders of magnitude fewer parameters and at a much lower cost" (huggingface).

A notable credibility move: H Company "open-source[s] every trajectory behind our scores on public benchmarks: replay each step at trajectories.hcompany.ai or download them from Hugging Face" (huggingface) — a reproducibility step most vendors skip, though the scores remain vendor-run. Holotron-12B is the throughput play: on WebVoyager, success rose from 35.1% for the Nemotron base to 80.5% (H Company).

Hugging Face's Smol2Operator covers the post-training recipe for small GUI operators, ScreenEnv provides the deployment substrate, and ScreenSuite rounds out evaluation — a train/eval/deploy triad missing a year ago. The related OSWorld-Human work confirms the efficiency gap: top agents need 1.4–2.7x the steps of human gold trajectories (OSWorld-Human). Caveat: no retrieved source publishes a neutral cross-lab head-to-head of Holo4 or Holotron-12B against OSWorld or WebArena baselines.

---

Model Releases Target On-Device Agents — with Vendor Spreads to Read Carefully

Three releases are framed around agent workloads, and this cycle the most-debated one finally has third-party numbers attached. Liquid AI's LFM2.5-24B-A2B is a 24B-parameter MoE activating ~2.45B parameters per token with a 131K context. Liquid claims competitiveness with Qwen3.6-35B-A3B on five of eight agentic benchmarks, scoring 48.09 vs 38.19 on LiveClaw and 27.69 vs 8.72 on AutomationBench (Liquid AI). Read the spread skeptically: the same comparisons show "the bigger model still wins on GPQA and SWE-bench Verified" (YouTube teardown), and one aggregator ranks LFM2.5-24B-A2B #96 of 131 for agentic tool use at a 30.7/100 category score (benchlm.ai).

NVIDIA's Nemotron 3 Nano Omni targets long-context multimodal agents, but its context spec remains unresolved — NVIDIA's post has claimed 1M tokens while OpenRouter lists the 30B-A3B reasoning variant at 256,000 tokens (OpenRouter). Meta's Muse Glimmer is Apache 2.0 / 30B, with Meta reporting "average accuracy degradation of just 0.2% across 15 benchmarks" for the K-Quant-Dynamic build — figures VentureBeat notes are "Meta's own measurements, not independent evaluations" (VentureBeat).

On the Hub, small fine-tunes are doing the tool-calling work — gemma-4-E2B-it, talkie-1930-toolcalling, and others show tool-calling is now a standard post-training target even at 2-4B scale. Caveat: none of these four model cards publishes a benchmark table in retrieved sources, so the small-fine-tune-vs-frontier function-calling comparison has no measured answer here.

---

Memory Becomes the Differentiator: Ownership, Sizing, and Million-Token Context

Three posts attack agent memory from different angles, sketching the design space. funes argues memory should be a portable, user-controlled artifact rather than a vendor-side vector store. IBM Research puts a number on the question using a hidden-Markov framing to size memory budgets — and is explicit about its evidence base: results "are validated on AppWorld — a rigorous multi-step benchmark, but a single one," with broader benchmarks "in progress."

On raw capacity, DeepSeek-V4 ships a million-token context. The retrieval curve is the part to carry: per the technical report, "retrieval performance remains highly stable within a 128K context window," with "degradation... visible beyond the 128K mark," while performance "at 1M tokens remain[s] remarkably strong." A paper review quantifies the fade — MRCR 8-needle averages 0.59 for V4-Pro-Max at 1M tokens (Andrey Lukyanenko). The design lesson stands either way: long context and external memory are substitutes at the margin — if attention over 1M tokens is reliable, aggressive summarization becomes optional; if it degrades past 128K, memory architecture carries the load.

Caveat: the IBM memory-sizing results are IBM-reported on a single benchmark, and no retrieved source publishes a neutral cross-lab head-to-head of portable-memory schemas against in-model long context.

---

Quick Hits

• Voice agents get a proper eval framework: ServiceNow's EVA splits evaluation into EVA-A (Accuracy) and EVA-X (Experience), with the audio-LLM judge explicitly marked BETA — while NVIDIA's Magpie TTS claims 32ms time-to-first-audio on B200, but a Daily hands-on build shows the LLM leg — not TTS — blows the sub-200ms budget on local hardware (V2V 508ms on RTX 5090, 1180ms on DGX Spark) (Daily).

• Enterprise agents get configurable: IBM's CUGA lands on Hugging Face, and watsonx Orchestrate shipped to GA with an Agent Catalog of 150+ agents, with Think 2026 demos from Aramco, Cleveland Clinic, and Elevance Health (Enterprise DNA). The missing piece remains the audit trail — vendor-reported claims with no neutral comparison of audit completeness.

• Structured CodeAgents and agent-first CLIs: Structured CodeAgent proposes typed intermediate state for debuggability, but no retrieved source publishes a failure-rate reduction — and an InfoQ survey finds AI-generated code increases debugging and failure rates (InfoQ). The hf CLI redesigned for agents signals Hub infrastructure treating agent callers as first-class.

• Robotics closes the loop: Amazon and Hugging Face's Strands + LeRobot streamlines record-train-deploy, but the independent summary "has not independently run the robot workflow or verified production reliability," and the walkthrough warns to "be extremely cautious of prompt injection from untrusted data sources."

---