from Agent Community
/goal-cup starts 7 November — One goal, one prompt, then your agent runs for up to 168 hours. After the start you may only say "keep going". Free and online, for solo builders, teams and companies.
Sign up on Luma →

// From the blog
• Catch up on ICANN87: discussions from Bali — Explore the discussions from ICANN87 in Bali with Agent Community's session library, including summaries, transcripts, presentations and original source links.

Reddit Roundup

MIT's weight-space programming is now being independently reproduced, while Revolut reports a 90% coding-cost cut by self-hosting a Chinese open-weight model.

This week's defining thread is a capability shift: LLMs editing another model's raw weights directly, without gradients or training loops. MIT CSAIL's weight-space programming demonstration spread far beyond the authors' blog, with independent reproductions landing within days. The parallel story — Revolut's reported 90% coding-cost reduction on a self-hosted open-weight model — points to the same pressure: agentic workloads are forcing labs and builders to rethink where intelligence runs and who owns the weights.

LLMs Editing Weights Directly Goes Mainstream — First Independent Reproductions Land r/LocalLLaMA

MIT CSAIL's 'weight-space programming' breakthrough — where a frontier model hand-edits a handful of neurons in a smaller model to fix behavior with zero training — has exploded across the community this week. The canonical example: GPT-6 Astra edited 0.016% of Qwen3.5-0.8B's weights to fix math reasoning loops, lifting MATH-500 from 7.9% to 48.1%. As XenoSpectrum documents, the November 2 technical report from Rikiya Takehi, Jayden Teoh, Alex Zhang and Omar Khattab shows Astra 'directly analyzes a neural network's weights and attempts to modify existing models or create new networks.' VentureBeat frames it as 'like gene editing for neural networks,' and the demonstrations go past the Qwen edit: Astra named a game from a policy's raw weights, found copying heads in a transformer's middle layers, and wrote networks from scratch.

Practitioners immediately replicated the technique on their own use cases. u/FeydRowan had Claude rewrite 8 neurons of Gemma 4 12B to change an Italian tense translation, while u/DeliciousGorilla used Anthropic's Jacobian lens to inspect what Qwen 'thinks' when it loops on 'Wait.' The deeper implication, raised by u/55234ser812342423, is that LLMs understand other models' weight spaces better than humans do.

The capability question has a partial answer from outside the lab: @AlexKrentsel reports 'i've reproduced the results from the MIT blog post today on weight-space programming' and calls it 'a new, step-change emerging capability.' But the caveat matters: that reproduction is a rerun of the authors' published results, not a from-scratch test, and the dose-response detail from the original report — the MATH-500 gain materialized only at a 50-forward-pass search budget and came from repairing a looping failure — still governs how far the headline number travels. For agent builders, this points at a future where models self-repair their own subagents rather than requiring retraining.

---

Revolut Cuts Coding Costs 90% Self-Hosting GLM on 56 B200s r/LocalLLaMA

British fintech Revolut made a self-hosted Chinese open-weight model its default coding model for ~2,000 engineers and pushed Claude Code and Codex to an exception list, reporting a blended cost near $0.30 per million tokens — roughly a tenth of its prior Anthropic and OpenAI invoices — on 56 Nvidia B200 GPUs. The details trace to David Abitbol, who leads AI operations at Revolut: The Register quotes his skepticism — 'We were seeing engineers spend $1,000 a month, $10,000 a month with not so much ROI' — which pushed Revolut toward owning inference. Dealroom and BigGo Finance both put the blended cost near $0.30 per million tokens, with BigGo citing a 70% improvement in engineering lead time. The exact checkpoint is reported inconsistently — GLM 5.3 versus GLM-4.5 — so treat the model version as unconfirmed.

Reaction is split. AGTP relays that 'some say few companies can justify frontier models for most work, and predict a 90% open source and 10% frontier split,' while others counter that GLM 5.3 scored 2.7% on SemiAnalysis's GDPx against 12.0% for Claude Opus 5.5 — and Baseten co-founder Tuhin Srivastava said 'it will take a lot of work to make open-weight models perform at the frontier.' On daily.dev, commenters argue GLM 'burns far more tokens per task than Opus/Claude and forgets instructions in long sessions, making the real savings less clear than advertised.'

The productivity numbers are Revolut's own and should be read as such — the 60%/70% gains come from a sample of its engineers, not an independent harness, and no third party has reproduced the cost or quality comparison. The broader read is that frontier labs face unit-cost pressure on high-volume agentic coding, with commenters predicting enterprise plans offering '100x more tokens' as the countermove.

---

Approvals Belong in the Runtime, Not the Prompt r/AI_Agents

A growing consensus is emerging that human approval for agent tool calls must live in the runtime, not in a system-prompt instruction. u/EstablishmentAgile19 catalogued four failure modes of prompt-based approval: the model decides whether to ask, the approver sees a summary not the actual call, and long context can talk the model out of asking. u/RafsInstinct flagged 'sticky approvals' where 'approve always' becomes a standing grant, and u/Ctbhatia noted the tool version must be stored in the pending record because a redeploy can change what the same name/args actually runs. The blast-radius pattern — reads and drafts run free, but anything that sends, pays, or deletes goes to a queue — is emerging as best practice.

Vendor guidance converges on the same architecture. Blaxel recommends validating tool calls 'like API requests' and keeping 'approval gates, credentials, and network access controls... outside the LLM runtime so prompt injection can't bypass' them. NOFire pushes the same logic to its endpoint: 'Build the kill switch outside the agent... If the kill switch is a flag the agent reads, a compromised agent can ignore it.' Scalekit explains why a pending approval cannot be an in-memory wait — the framework must support resumable execution with persisted state. Caveat: these are vendor guides, and no source retrieved here publishes measured approval-accuracy or bypass-rate numbers, so the runtime-over-prompt case rests on architecture and failure-mode analysis rather than benchmark evidence.

---

Cache Price, Not Input Price, Decides the Bill r/LLMDevs

For coding agents that resend the full session every turn, cache-read price and hit rate — not the headline input price — determine the actual bill. u/zitoliv did the math: 100K context over 50 turns is 5M input tokens, nearly all history, and Claude Sonnet 5.5 drops from $10 uncached to $0.50 cached while DeepSeek V4.1 Flash drops from $1.50 to $0.03. Cockroach Labs calculates a 90% reduction on every cached token against a standard rate, with break-even at 2.3 reuses of the same prefix inside the one-hour TTL. Honeycomb warns that teams must capture cache-specific counters (cache_read_input_tokens and cache_creation_input_tokens) separately — otherwise cost math bills everything at the full input rate.

---

Shared Data Doesn't Mean Agents Stay in Sync r/AI_Agents

Pointing multiple agents at shared storage is necessary but not sufficient for consistency. u/FulcraDynamics laid out the problem: you update a requirement in Claude, but ChatGPT still holds stale details, and adding more agents makes drift worse. The fix emerging from commenters is optimistic concurrency — accept the first write only if the revision is still current and force stale writers to re-read — which matches how Strands Agents propagates state deterministically through invocation_state rather than leaving it to each model to remember. The architectural split between fan-out and swarm is now named in practitioner writeups, with Digital Applied noting swarm carries 'variable cost (agent population grows with the task) and significantly higher' coordination overhead. Caveat: no controlled head-to-head of swarm versus orchestrator on a shared-state benchmark exists, so the costlier-to-sync claim is architectural reasoning, not a measured result.

---

Long Sessions Lose Constraints; Memory MCPs Emerge r/ContextEngineering

Session amnesia and context-window failure are driving a wave of memory and state tooling. u/ApprehensiveSkin7975 built a protect-context MCP to record whether an agent is following orders, citing specific failures: early constraints disappear, 'done' is claimed without command output, and the same failing command is retried until context is exhausted. u/AvocadoJaded8829 shipped a zero-dependency SQLite+FTS5 memory and anti-loop MCP. The measurement gap is the through-line: Braintrust warns that memory 'only shows its effect in evaluation cases that span sessions, so single-turn test sets will miss it' — and the failures these MCPs target are precisely multi-turn phenomena standard evals structurally cannot catch. The practical read: persistent memory and explicit execution state are being treated as two separate layers, and the evidence either fixes long-session drift is still mostly anecdotal.

---

Qwen 3.8 Flash-Next: 125B MoE Activating 6B, Made Local by Strata r/LocalLLaMA

The local-model conversation is dominated by Qwen 3.8 Flash-Next and the Strata inference engine. u/lblblllb reported decode jumping to 150 t/s after switching to Strata, and u/jesdga95 announced Basalt 0.2.0 hitting 300 t/s prose, 600 t/s structured, 10K t/s prefill. Per Kaitchup, Flash-Next is 'a multimodal Mixture-of-Experts model with a 125B-parameter main model, only 6B parameters activated per token' plus a 51B n-gram embedding system and a 4B MTP module. But independent testing is less flattering on quality: MindStudio finds '27B produces higher quality, more reliable outputs on long, complex agentic tasks.' The benchmark claims are vendor-reported and should be treated as such.

---

The Binance Theft Was a Supply-Chain Exploit r/ClaudeAI

Binance's initial findings trace its October 29 incident to a months-long campaign beginning with a fake job and a tampered coding tool. Per Binance's own writeup, a wallet DevOps engineer 'downloaded a tampered Homebrew installation in order to install a popular AI coding tool.' u/UBUNTU-Buddha detailed how a wallet engineer installed a tampered repo and a second engineer was recruited via a deepfaked interviewer. The agentic angle is that the same primitives now apply to autonomous systems — AWS flags 'prompt injection via content channels' and escalation risk from compromising 'even one node in the supply chain.' Caveat: the $6.3 billion figure is not restated in the findings document retrieved here, and no independent forensic audit has been published.

---

Tool Overload and Snapshot Costs Plague MCP r/mcp

MCP servers are maturing, and builders are hitting hard design limits. u/sandeepK1125 found one-tool-per-endpoint 'fell apart quickly' past a few dozen tools. A DEV Community teardown reports correct tool selection dropping from ~95% to ~71% with the full GitHub MCP server loaded — a 24-point gap 'caused purely by context bloat.' u/falaq-ai measured a single accessibility snapshot of a 400-row dashboard costing 22,556 tokens. The fixes now have a name: dynamic tool loading and vector-based semantic retrieval over tool descriptions, with fewer options equaling 'more confident, correct tool use.'

---

Reviewing Agent Output Is the New Bottleneck r/LLMDevs

As agents shrank dev time from weeks to a day, the bottleneck moved to specs and review. u/xqianliu found 22 of 38 runs that passed review but failed hidden tests had broken something unrelated. The 'harness, not prompt' argument is where vendor tooling has converged — Fiddler prescribes writing 'evals alongside your agentic code, just as you'd write tests alongside application code.' LangChain argues detailed run captures are 'the only way' to recreate a failing step, because you cannot evaluate what you did not capture.

---

HuggingFace Highlights

Memory architectures are consolidating into hybrid vector-plus-graph designs, while the honest cost gap between long context and external stores finally gets numbers attached.

The agent stack's most under-served primitive is having its moment. Across this week's releases, builders stopped asking whether agents need memory and began fighting over which layers to combine. Per Digital Applied's survey, vector plus graph plus short-term episodic buffer is the consensus — and one vendor's analysis now quantifies the trade: external memory persists facts at 90% fewer tokens and 91% lower p95 latency, trading about six points of accuracy against full context.

Memory Becomes the Agent's Missing Layer — With a Real Cost Gap Between Long Context and External Stores

Memory is emerging as the most under-served primitive in agent stacks, and the 2026 practitioner literature has stopped asking whether to add it and started arguing about which layers to combine. The consensus architecture is hybrid rather than single-store: "Vector plus graph plus short-term episodic buffer is the combination showing up across every serious deployment we see this quarter," per Digital Applied's architecture survey, which also draws the line that matters for anyone tempted to skip memory entirely — "long-context does not replace memory: 10M-token windows help with single-session grounding, but they do not solve cross-session continuity, cost, or reliable fact updates. Memory and long-context are complements, not substitutes."

The sharpest new number in the debate is a cost-and-latency spread rather than a capability claim. Atlan's trade-off analysis reports that external memory (Mem0, Zep, vector stores) "persists facts across sessions at 90% fewer tokens and 91% lower p95 latency, trading about six points of accuracy against full context." IBM Research's ALTK team, meanwhile, reports just-in-time guidance on AppWorld "increased Scenario Goal Completion by +8.9 points overall, with the largest gains on the hardest tasks (+14.2)" — with the authors' own caveat that AppWorld is "a rigorous multi-step benchmark, but a single one."

On the model side, DeepSeek-V4 attacks the same problem by moving the context window from 128K to 1M tokens and cutting KV-cache footprint to "10% of V3.2" via hybrid Compressed Sparse Attention and Heavily Compressed Attention. But the "cheap long context" claim is really a cheap active-parameter claim — V4-Pro carries 1.6T total parameters with 49B activated. The practitioner counterweight is ownership: Give Your Coding Agents a Memory You Own pushes back on opaque vendor-side stores, and Mastra warns that "if Agent A updates a memory, Agent B needs to see the update without stale reads causing conflicting behavior." Caveats to carry: the 90%/91%/6-point figures are a single vendor-side analysis with no published harness, and no retrieved source publishes a neutral head-to-head of long-context-only versus external-memory agents on a shared benchmark.

---

Computer-Use Agents Go Local and Fast — With the Latency Numbers Finally Attached

The H Company shipped a rapid-fire series of GUI automation models this cycle, and for once the throughput figures are published rather than gestured at. Holo3.1, released June 2 as a four-model open-weight family (0.8B, 4B, 9B, 35B-A3B), climbs from 67% to 79.3% on AndroidWorld, and on a DGX Spark the NVFP4 path yields a compound ~2× end-to-end speedup over FP8, cutting average step time from 6.8 seconds to 3.3 seconds — though that figure comes from a third-party guide describing H Company and NVIDIA work, not an independent benchmark. The reception was split, and the split is instructive: one widely shared post framed it as "a new open-source Computer-Use LLM… that beats Qwen3.5-397B, Kimi-K2.5, and Sonnet 4.6" (@TeksEdge), while a reply pushed back — "Basically they fine tuned Qwen3.5, why don't they compare" (@danNH2006). Both readings can be true: a Qwen derivative can beat larger bases on a GUI-specific harness, which is exactly why the harness caveat carries. Holo4 is the cautionary counterexample — on AutomationBench it reports 45.4% at $0.05 per task for the 27B, and discloses that 480 of 600 public tasks fall within its training split, promising private-set results once evaluated. Expect the differentiator to shift from raw click accuracy to throughput, cost per task, and recovery from unexpected UI states.

---

Benchmarks Get Real: Failure Taxonomies and the Case for Testing on Your Own Tooling

The shift in benchmark design is from scoring agents to diagnosing them. IBM and UC Berkeley's IT-Bench and MAST ask why enterprise agents fail rather than how often, with a taxonomy spanning three root categories — Specification Issues, Inter-Agent Misalignment, and Task Verification — and 14 fine-grained modes from Step Repetition to Incorrect Verification. The structural difference from GAIA-style evaluation is worth naming: GAIA scores a final answer against a reference string, so "a correct answer in the wrong format still fails" (QASkills.sh), while MAST and VAKRA score the trajectory that produced it. Coverage is broadening in two directions: EVA introduces a two-axis voice-agent framework, and its most interesting design choice is a validation gate on the simulator itself — verifying that synthesized speech correctly conveys critical entities before attributing failure to the agent. The meta-lesson for builders survives all of it: Is it agentic enough? argues you should benchmark open models on your own tooling, because "a benchmark answers 'how does this model compare?' and an eval answers 'is my agent good enough to ship?'" (Prefactor).

---

An Agent Intrusion Timeline Nobody Wanted — 17,613 Actions and a Root Cause That Was Just Overbroad Access

Hugging Face published the most granular public incident report yet on an agent compromise in production. The technical timeline of the July 2026 incident breaks into five phases: 6,191 recon actions, 2,911 rce actions, 6,972 dropper actions, 56 exfil actions, and 114 c2 actions. Read the ratio rather than the total: recon and dropper together dwarf exfiltration by roughly two orders of magnitude, and shell access appears within a minute of the first enumeration — the agent did not need to escalate, it arrived with enough permission to run commands. The mitigation literature converges on the same lever: the CSA's MCP Security Crisis note flags that any organization granting agents access to production financial systems should scrutinize every MCP integration, and a 2026 vulnerability survey argues "closing the authentication gap has the broadest effect" — moving off static API keys onto OAuth 2.0 (Bonfy). The takeaway: agent security is increasingly about action authorization rather than prompt filtering — and the exfiltration stage is cheap and late, meaning egress filtering and scoped credentials buy time before the quiet step.

---

MCP Consolidates as the Default Tool Protocol — and the Question Shifts to Sourced Answers

MCP is becoming the default tool protocol, but the harder problem is now getting the source right rather than the fact right. Tool Use, Unified argues for a single tool-calling abstraction, and Nango draws the layering distinction cleanly: "MCP standardizes tool discovery and execution on top of function calling." Source-Aware Verification argues that getting the source right matters more than getting the fact right — a subtle but important distinction for tool-returning agents. The adoption layer underneath is real but uneven: CB Insights tracks a cluster of MCP-native vendors, which is the concrete answer to "are there adopters beyond Hugging Face libraries" — yes, but mostly infrastructure and SDK vendors, not model labs. Caveat: none of the retrieved sources publishes a measured reduction in malformed or mis-sourced tool calls.

---

Small Models Get Agentic — and a 1.2B Ties for #1 on Tool-Calling Judgment

A wave of function-calling models is targeting local and edge deployment, and the wins cluster on tool selection rather than knowledge. LFM2.5-24B-A2B leads or matches models roughly 50% larger on tool use — reporting 27.69 versus 8.72 on AutomationBench and 65.01 versus 65.00 on BFCLv4 — but the ordering reverses on knowledge-heavy work: GPQA Diamond 74.42 versus 83.69. The most decision-relevant number for the sub-1B question comes from an independent harness: Liquid AI's Mathias Lechner reports a 1.2B model tied for #1 in a 21-model r/LocalLLaMA tool-calling judgment test, matching Phi-4 Mini and Qwen3 at a 0.880 Agent Score while running at 1.5s latency on CPU (Mathias Lechner). Two caveats travel with that result: it's a vendor employee amplifying a community benchmark, and the model "initially scored much lower because the benchmark parser didn't understand" its output format — harness parsing, not capability, moved the score. The broader lesson: agent capability is decoupling from model size, but the wins cluster on tool selection and abstention, while multi-step task completion still favors larger models.

---

Quick Hits

OpenEnv becomes the agentic RL battleground, exposing a Gymnasium-style API (reset(), step(), state()) on a client/server architecture — the environment, not the base model, is the scarce input (Hugging Face).

Frameworks converge on code-as-action — smolagents agents "literally write Python code" as their action space, but it's a capability multiplier, not a universal win: with Mixtral-8x7B, code agents perform worse than JSON (Hugging Face).

Enterprise agents get graded against the database — Microsoft's ThinkingBox protocol of 507 tasks × 20 attempts is the citable figure for how often self-reported completion survives a check, and 41% of enterprises report at least one production rollback in the last 12 months (Digital Applied).

Agents learn when to stop thinking — Claude 3.5 Sonnet cut reasoning tokens from 190 to 14 (7.6%) while accuracy rose on sports questions, but GSM8K trades roughly four points of accuracy for an 80% token saving (Redis).

Spaces showcase the agent long tail — the canonical starter template dwarfs every demo at 802 likes, and MCP servers are becoming the default integration unit for small projects (Hugging Face).

---