In AI agent training, you can pay for powerful GPUs and still spend much of your time waiting. Agents need to attempt tasks and produce results before the model can learn from them. A few slow attempts can hold up the next training update, making the systems that run those tasks a major factor in training speed and cost.

Di Jin, VP of AI Training at Amsterdam-headquartered Nebius, says teams coming from pretraining or supervised fine-tuning can underestimate the work these systems do.

“If you staff and design it as a training project, inference becomes the bottleneck nobody owns.”

Rollout generation often takes most of a training step’s wall-clock time, making batching, cache management and scheduling central to how fast the model can learn. “If you staff and design it as a training project, inference becomes the bottleneck nobody owns,” Jin says.

Time to a trainable batch

He adds that engineers should measure time to a trainable batch alongside throughput. Average tokens per second can hide the long tail: in a synchronous batch, the step cannot finish until the final trajectory is completed. 

Agent trajectories do not all have the same length. Many finish quickly, while others take longer, leaving training GPUs waiting on a handful of stragglers. For this reason, Jin advises engineers to treat the inference engine as part of the post-training reinforcement learning optimizer.

Data misunderstood

Learning from data generated by an older model version involves a tradeoff. Some policy lag can improve GPU efficiency by letting generation and training overlap, Jin says, but its safety depends on how much the policy has changed and how the training algorithm handles the difference.

Jin tells The New Stack, “In fully synchronous RL, inference GPUs wait while training runs, and training GPUs wait while generation runs. Letting generation use weights that are one or a few updates old allows both to run in parallel. That overlap is how most large-scale systems reach reasonable utilization.” When success on a hard task is rare, he adds, an already successful trajectory can be valuable to reuse even if it is slightly stale.

Staleness becomes harmful when the policy that generated a trajectory has drifted too far from the policy being trained. The useful measure is divergence, not a universal limit on how many training steps old the data can be.

“Staleness isn’t the enemy. Unmeasured staleness is.”

Rather than seeking to eradicate old data, engineers and organizations should measure and manage staleness. They can apply importance-sampling corrections, usually truncated to limit variance; drop or down-weight samples beyond a staleness threshold; and track divergence between the generating policy and the current policy. Jin says: “Staleness isn’t the enemy. Unmeasured staleness is.”

Environments are the new data

In Jin’s experience, data and environments take up most of the work in successful RL post-training. Algorithm design is the smallest slice, while infrastructure enables fast iteration. “Infrastructure determines how fast you can iterate. But what the model actually learns is decided by the tasks, environments, and rewards you give it,” he says.

For agents, that means focusing on the environments that generate training experience. Supervised fine-tuning uses a collected dataset; in agentic RL, the model generates trajectories by interacting with an environment. 

Reproducible containers, codebases, websites, and APIs with realistic states help the model’s learning transfer to real use. Engineers also need reliable verifiers and tasks at a useful difficulty level. As the model improves, the task set needs refreshing so tasks don’t saturate and stop producing a learning signal. Jin says: “Building environments is the new data curation.”

As with previous technologies, problems occur where systems hand over to one another. The trainer, inference engine, sandbox, and verifier may each work on their own, yet failures emerge at the interfaces. A model can exploit verifier loopholes and receive rewards for behavior that doesn’t accomplish the intended task. Sandboxes can also fail or misbehave, corrupting the training data.

Engineers should record whether an episode ended in model success, model failure, infrastructure failure, or an unknown outcome. Exclude failures attributable to infrastructure from policy-gradient updates. Failures caused by the model’s own actions should still be scored as model failures, so triggering a timeout or another error doesn’t become a way to avoid a penalty.

Long-horizon agentic RL combines trajectories, tool calls, and external latencies, creating bursts of GPU demand and periods of waiting. For GRPO-style training, where sibling attempts at a task are scored against one another, engineers should schedule around group completion rather than launch order. A group enters a ready bank once all sibling attempts finish; the trainer then takes eligible complete groups regardless of when they were launched. Time to a trainable batch is the governing measure, while tokens per second remains useful for diagnosing inference. Routing matters because keeping a conversation close to its cached history can avoid repeated prefill work.

In a Nebius experiment on a Terminal-Bench-based workload, changes to routing, sandbox execution, and batch assembly reduced fixed-weight collection time for a 256-trajectory batch by 66.9%. That measured batch collection, excluding the trainer’s forward, backward, and optimizer work; it did not measure complete training speed.

​For agentic AI rollouts, an infrastructure goal is to reduce the time expensive GPUs spend waiting on sandboxes, browsers, code execution, and other non-GPU dependencies.

“Your most expensive GPU is often waiting on your cheapest container.”

Jin recommends scaling CPU and sandbox capacity independently of GPUs and provisioning it generously, because idle containers are comparatively inexpensive. “Your most expensive GPU is often waiting on your cheapest container,” he says.

​Keeping sandboxes ready, using snapshot and fork methods, can take environment startup off the critical path. It doesn’t remove the time needed to run tools. Jin recommends putting sandboxes on the same network fabric as the GPUs where possible to minimize the cumulative latency of the hundreds of tool calls an agent may make. Per-step timeouts and budgets can limit the disruption from a hung browser or process. Engineers should track GPU-hours spent waiting on environments, alongside utilization and time to a trainable batch, to identify where additional investment would help.

When the maths does not match

During RL post-training, the rollout engine and the trainer can assign different probabilities to the same tokens, even when they start from the same weights. Quantization, kernels, batching, and, in mixture-of-experts models, expert routing can all contribute. Those differences can introduce systematic bias into training updates.

Jin recommends aligning the numerics first, then measuring and correcting the remaining mismatch. That can mean matching the quantization scheme and computation used in the trainer’s forward pass to the rollout engine, while retaining higher-precision weights for optimization. Importance-sampling corrections can help manage residual differences, but clipping alone should not be assumed to solve every form of mismatch.

Evaluation should use the precision, inference engine, and version that will serve the model. Changing quantization or kernels calls for another evaluation.

Keeping the weights in step

As training updates the policy, rollout workers need a reliable way to receive new weights while keeping policy lag within acceptable limits. Jin describes three broad patterns: resharding weights in memory when training and inference share GPUs; transferring weights directly to separate inference workers; and publishing checkpoints that inference engines hot-load through storage. The best choice depends on the model, hardware topology, and freshness requirements.

A full service restart can introduce avoidable downtime, but storage-based publication does not have to require one. Asynchronous transfer and compact updates can move much of the work off the critical path. Teams should measure end-to-end publication latency separately from the pause needed to apply the weights.

Weight publication also needs an explicit plan for active requests and cached state. Depending on the engine, teams can finish, abort, or pause requests before applying an update, and clear or recompute cached context as needed. If a trajectory spans policy versions, record which version generated its tokens so the training system can handle that mixture deliberately. Coordinate transfers with rollout traffic where they share resources, and monitor publication delays alongside policy age.

Designing these components together helps teams improve iteration speed while keeping training data and policy updates reliable. Jin advises smaller teams to start with a simple setup and add asynchronous complexity when measured bottlenecks justify it.

Before scaling, check:

• Batch readiness: How long does it take to assemble a complete, usable batch, including the straggler tail?
• Policy freshness: Can every rollout be traced to the policy version that generated it, and what drift makes it too stale to use?
• Numerical alignment: How different are the trainer’s and rollout engine’s probabilities, and what correction handles the remaining gap?
• Environment reliability: Can you distinguish infrastructure failures from model failures and reproduce an affected episode?
• Weight publication: What happens to active requests and KV caches during an update, and how long does publication actually take?
• Evaluation: Are you testing the model in the precision and serving stack users will encounter?

The post Nebius cut rollout collection time by 66.9% — here’s what changed appeared first on The New Stack.

As AI adoption expands globally, people across languages and cultures are using it in more aspects of their daily lives. General-purpose language models serve...

As AI adoption expands globally, people across languages and cultures are using it in more aspects of their daily lives. General-purpose language models serve as a powerful foundation, but they sometimes lack the local knowledge, cultural nuance, and precision a particular application needs. Post-training can adapt an open model to these needs. With suitable data and evaluation…

Source

I replayed correct model decisions through four broken browser actions. A simple page check missed half of the wrong clicks, and raised a false alarm on every click that worked inside an embedded page.

The post I Broke a Browser Agent on Purpose. Spotting the Fault Was Not the Same as Fixing It appeared first on Towards Data Science.

Entire, the startup founded by former GitHub CEO Thomas Dohmke, on Monday launched its GitHub alternative that replaces the traditional pull request model with a new agentic code review system called Trails.

The company has been launching parts of its platform since it announced a $60 million seed round in February. Early on, Dohmke occasionally noted he wasn’t planning to compete with GitHub.

But with Monday’s launch, Entire is launching a full GitHub alternative, with its own twist on what a modern GitHub for the agentic era should look like.

At launch, Entire supports native hosting for private repositories. Public repositories and self-hosted Git nodes are still on the roadmap.

“It’s the moment we’ve been waiting for,” Dohmke told The New Stack last week during an interview at the Linux Foundation’s AGNTCon + MCPcon in San Jose, California. “It’s exciting for us because what we set out to do a year ago is landing now — and bringing the Git hosting and the infrastructure layer together, with sites around the world, […] and the idea of continuous integration, continuous delivery, continuous memory, and then with Trails, our reinvention of the pull request.”

“It’s exciting for us because what we set out to do a year ago is landing now.”

Entire, like other devtools startups, argues that the new bottleneck for developers isn’t writing the code — agents take care of that — but code review. Unlike some other startups in this space, the company isn’t solely focused on that. Instead, the Entire is betting that solving the code review bottleneck requires an entirely new platform.

In his keynote at AGNTCon + MCPcon, Dohmke described a review queue growing in two directions: agents producing more changes, and those changes containing more code.

“I open a pull request, and I realize I have no idea what all that code does,” he says of his previous experience using coding agents.

Right now, that platform consists of Entire’s Git-compatible server, the continuous memory feature for agents that the company originally launched with, and Trails.

From pull requests to Trails

Trails is Entire’s take on the pull request model, but instead of developers reviewing code changes manually, Trails gives them a dashboard with customizable evals scored by agents. That system may assess how risky a code change is, for example, or how much intent drift has occurred over a long LLM-driven development session.

Entire says those evals run on every push, with findings available through both its web interface and its open-source CLI. Coding agents can then use that feedback to address problems and push another revision, while the developer validates the progress.

In the end, the original request, the agent’s session history, and the resulting code all become part of the review.

GitHub already offers agentic code review through Copilot. Entire’s pitch goes beyond adding an AI reviewer to a pull request: It makes the intent behind a change and the agent’s work part of the review process alongside the code.

For Entire, the idea here is that if the evals come back green, it’s ok to merge the code without a detailed human review (though few human code reviews are probably as detailed as they should be).

By default, Entire provides preset review agents, but developers can also define their own configurations in a JSON file and choose among supported Claude and OpenAI models.

“We’re redefining how the developer lifecycle works, and it’s really cool. I’ve been at home in the evenings, sitting on my couch, and texting my agents — all the while getting links from my team to their Trails on Slack and opening them.”

“We’re redefining how the developer lifecycle works, and it’s really cool,” Dohmke says. “I’ve been at home in the evenings, sitting on my couch, and texting my agents — all the while getting links from my team to their Trails on Slack and opening them. And because the user interface is designed for seeing — we’re calling it the head-up display for the pilots– so I look at my head-up display, and I see the ‘stop cop,’ one of the evals that we have internally, and if that’s green and the confidence is high, then we’re merging it.”

Entire is also partnering with Buildkite and Depot for CI. Developers can convert their existing GitHub Actions workflows using Buildkite’s bk pipeline or Depot CI, then connect the repository in Entire.

A faster, distributed Git forge

While Trails is the headline news here, Entire’s core is its Git-compatible distributed source control server, which debuted earlier this summer.

Entire says it can push up to 89x faster than GitHub and 6x faster than Cursor’s Origin.

But while a distributed system with mirrors across geographic regions helps, the key feature for many corporate users may be that Entire was built from the outset to offer private repositories in specific regions, too. Given today’s data governance landscape, that’s an increasingly important feature.

The available regions include the U.S., Europe, India, and Australia. Dohmke says customers choose a primary region and can add mirrors elsewhere, with Entire handling synchronization between them.

Memory for agents

Continuous Memory is Entire’s third pillar. It syncs AI agent sessions into a project’s repository and makes that available to the agents for future use.

For Dohmke, those sessions also preserve the approaches a developer rejected and the moments when they told an agent that working code still wasn’t what they wanted.

The company says the system combines a codebase graph that helps agents find relevant code with an “agentic brain” that turns previous sessions and prompts into memories they can query. That lets agents retrieve earlier decisions and the context behind them when they start another task.

Dohmke expects agent run costs to become the next bottleneck, with teams paying closer attention to token efficiency alongside engineering productivity. He argues that developers may find it’s cheaper to use an existing open-source project or a service like Entire than to spend tokens generating their own replacement.

The platform is free; however, Dohmke says customers pay only for the tokens the review agents consume.

But because these review agents run on LLMs, they still cost money. Right now, Dohmke says, Entire is giving all its users a $100 starter credit. Once users have run out of these credits, they will pay market rates for the model of their choosing.

The arbitrage between the discounts it can get and that market rate seems to be Entire’s current business model.

GitHub has always had very generous plans for open-source projects, and its maintainers and Dohmke hinted that the company may offer help there as well, noting that Entire is already working with some partners, including model vendors, on ideas. “More to come,” he says.

Also of note: Entire’s announcements on Monday come two days before the 2026 edition of GitHub Universe, the company’s flagship developer event in San Francisco. What timing.

The post Ex-GitHub CEO launches a GitHub rival that reinvents the pull request appeared first on The New Stack.

Kubernetes was built around a fairly simple assumption.

It’s that software does what its developers told it to do. AI Agents complicate that assumption. An agent can reason about a problem, choose a course of action, call tools, write code, interact with other systems, and keep working toward a goal. That is precisely what makes agents useful. But it is also what makes running them in production different from running a conventional application.

And increasingly, enterprises want to run them on Kubernetes. A recent survey by the Cloud Native Computing Foundation (CNCF) found that two-thirds of organizations running AI inference workloads run them on Kubernetes. This makes sense, as Kubernetes has become the standard way enterprises deploy and operate distributed applications over the past decade. It already knows how to schedule workloads, allocate resources, recover from failures, and scale applications up and down.  

---

KubeCon + CloudNativeCon is taking place in Salt Lake City from November 9 to 12. Register now!

---

Inference demand can arrive in bursts, requiring customers to rapidly scale up underlying hardware and software resources to meet surging demand. In that regard, Kubernetes is an excellent fit. Similarly, as AI workloads wind down, Kubernetes can gracefully scale down the underlying infrastructure, ensuring economical operation.

As good as the fit between AI inference and Kubernetes is, the combination still has gaps, starting with security. Recent incidents at frontier AI labs, in which AI agents escaped test environments and launched malicious cyberattacks across the internet, highlight the need for strong guardrails to keep AI workloads from misbehaving. 

Unfortunately, the probabilistic nature of AI leads to situations where it’s impossible to predict exactly what resources an AI workload will seek to use, which increases the likelihood that agents will eventually cross the line. Therefore, the ideal AI platform should make it easy to enforce clear guardrails and keep agentic workloads safely contained within well-defined sandboxes.

“The ideal AI platform should make it easy to enforce clear guardrails and keep agentic workloads safely contained within well-defined sandboxes.”

By confining agentic AI workloads to a sandbox logically separate from other Kubernetes workloads, an enterprise can better ensure that if an AI workload does run off the rails, the ensuing damage stays within that sandbox.

Instead of letting agents access whatever resources they want, agentic platforms should use an explicit permissioning framework that grants or denies access to files, tools, and network and system resources. Agents should be fully restricted from executing code unless they have been given explicit permission.

The good news is that the Kubernetes community is moving toward adopting sandboxing as an architectural element for constraining AI agents. The CNCF is working to address Kubernetes’s security and isolation gaps. However, the open-source project’s functionality is not yet fully there.

Proper AI sandboxing requires looking beyond the container and into virtual machines or the host operating system to ensure agentic workloads can’t affect other applications running in the same environment. Enterprises looking to deploy AI into production today can turn to commercial Kubernetes distributions that already include these sandboxing capabilities.

Monitoring of AI workloads is another concern that keeps CIOs up at night. While frontier AI labs may not have adequately monitored what their AI models were doing, or even whether they had internet access, enterprises generally don’t have the luxury of asking for forgiveness when their agents misbehave.

Security may be the most obvious challenge, but it is not the only one. Agents are also changing how compute is consumed. A normal service might run continuously for months, while an agent may exist for only seconds. 

“A normal service might run continuously for months, while an agent may exist for only seconds.”

A user asks a question -> an agent starts -> it performs some work, possibly creates other agents, calls several tools, and then disappears. 

Now multiply that pattern across thousands of users and the infrastructure begins to look very different from a conventional Kubernetes environment.

On top of that, starting a Kubernetes workload from scratch can take seconds. For many applications, that is perfectly acceptable. But for an interactive agent, those seconds can feel painfully slow. That creates an interesting infrastructure problem: How do you get the isolation of a fresh environment without paying the startup cost of creating one every time?

Hence, the sporadic nature of agentic workloads, and the need for agents to spin up rapidly, is testing even Kubernetes’ flexibility. Just as first-generation Kubernetes didn’t support stateful applications, the community is still searching for the best abstraction layer for running the new generation of agentic workloads. 

“Agents stay in a state of suspended animation in a warm pool, allowing them to reanimate in milliseconds rather than the seconds it would take to fully wake from deep sleep.”

One answer that is gaining attention in the community is an agent substrate for rapidly scaling Kubernetes-based agentic workloads. With agent substrate, Kubernetes pods containing AI agents aren’t fully spun down when they’re not needed, because spinning them up from a sleep state would introduce too much latency from the user’s point of view.  Instead, agents stay in a state of suspended animation in a warm pool, allowing them to reanimate in milliseconds rather than the seconds it would take to fully wake from deep sleep.

When deploying AI workloads at scale in the real world, the details matter. Not every Kubernetes distribution provides the full raft of capabilities that enterprises demand. As the open-source Kubernetes community adapts to changing requirements, forward-looking platform providers are building the guardrails, sandboxing, monitoring, and agentic substrate that will let enterprise deploy AI now.

The post Is Kubernetes ready for AI agents? appeared first on The New Stack.

A hands-on guide with Gemma 4, Ollama, and the OpenAI Agents SDK

The post How to Add Guardrails to a Local LLM Agent appeared first on Towards Data Science.

MIT researchers marooned 13 AIs on a virtual island, and they responded by inventing games, mourning a lost ring and, eventually, getting better at their jobs.

The new feature allows agents to log into a customer's personal accounts while still protecting the private credentials that secure those accounts.

AI agents are getting better at remembering past conversations and earlier tasks but remembering something doesn’t guarantee an agent can use it to do better work next time. Letta’s new FrontierMemory benchmark, released Wednesday, tests that gap by measuring whether agents can learn from experience rather than by just retrieving stored information. Early results show a widespread in performance across agent harnesses, the the infrastructure that manages how an agent operates.

Letta Dream came out on top with a 73.3% score, followed by Prime Agent at 60%. OpenAI Agents SDK scored 40%, while Claude Managed Agents and Hermes Agent trailed at 33.3% and 26.7%, respectively.

Recall isn’t learning

“Modern ‘memory’ benchmarks are saturated since they measure recall of facts,” Letta co-founder and CEO Charles Packer writes on X, saying that in the coding harness and bash loop era, recall is solved, while continual learning in token space, meaning learning through the context an agent keeps rather than through weight updates, remains unsolved.

Sarah Wooders, also a Letta co-founder, points to another problem on X. Most coding and knowledge-work benchmarks evaluate unrelated tasks with all the necessary context provided upfront. But that’s not how people actually work. Wooders compares it to starting a new job: A new hire needs plenty of direction, while someone who’s been there for years can often get the job done with little explanation.

Packer’s premise is that “if AI-generated memory is good, it should actually improve downstream task performance.”

FrontierMemory takes a different approach. Agents receive transcripts of earlier work, including successful and failed attempts, and then generate their own memories to help complete later tasks. Packer’s premise is that “if AI-generated memory is good, it should actually improve downstream task performance.” Developers have already embraced the underlying idea, building continually learning agents by pairing a language model with memory systems and feedback loops.

Letta reworked existing coding and knowledge-work tests so agents had to use what they learned from previous tasks instead of having everything spelled out for them. After reviewing and fixing problems with the original tests, Letta narrowed FrontierMemory 1.0 to just 15 tasks.

Harness beats model

The harness itself may matter just as much as the model running inside it. Letta tested five agent systems to see how well they could learn from previous work and use those lessons on new tasks.

The harness itself may matter just as much as the model running inside it.

Letta Dream beat OpenAI Agents SDK 60% to 40% when both used GPT-6.1 Sol to create memories and GPT-6 Sol to complete tasks. The results were even further apart with Claude Opus 5.5. Dream scored 73.3%, Prime Agent hit 60%, and Claude Managed Agents came in at 33.3%.

Packer says the the way agents handle AI “dreaming” makes a big difference. Dreaming is when an agent reviews past work and turns what it learned into instructions or memories it can use later. He also points to Prime Agent outperforming Hermes Agent as another example of how much these systems can vary. But there’s a downside: without checks on what gets saved, agents risk learning and repeating bad habits.

FrontierMemory also compared seven frontier models on how well they generate useful memories. Anthropic’s Claude Opus 5.5 and Z.ai’s GLM-5.3 tied for first at 73.3%, Kimi K3 followed at 66.7%, and OpenAI’s GPT-6.1 Sol and Google’s Gemini 4 Argon both scored 60%. Muse Wonder reached 46.7%, and Grok 4.7 finished at 33.3%. Packer says Opus 5.5 and GLM-5.3 are significantly better at generating useful memories than GPT-6.1 Sol.

Packer says Opus 5.5 and GLM-5.3 are significantly better at generating useful memories than GPT-6.1 Sol.

Cheaper memory, lower scores

But OpenAI had a big price advantage. GPT-6.1 Sol cost an estimated $0.77 per task, compared with $2.80 for Opus 5.5 and $3.58 for GLM-5.3. So while OpenAI scored lower, it was much cheaper to run.

Letta used its Dream harness to create memories with each model, then tested how well those memories worked on tasks run in Letta Code. The results show a tradeoff between better memory, stronger performance and lower costs.

Memory that travels

Letta also looked at why some memories worked better than others. In one test involving company pricing data, Opus 5.5 created a skill telling the agent when to use certain information. GPT-6.1 Sol created four separate skills, but the agent never found the one it needed.

Gemini 4 Argon made a different mistake. It remembered specific file sizes, which wasn’t much help when the next task involved different files. Opus 5.5 instead told the agent to check both the usual file and email for information. That worked even when the task changed. Memories created by Opus 5.5 helped GPT-6 Sol complete tasks, suggesting developers could use a more expensive model to build memories and a cheaper one to do the work.

Other developers have taken notice. After Letta’s Sarah Wooders posted about the benchmark on X, the OpenClaw account responded that it would like to see a plugin for its platform. The account says its multiplayer environment would be an interesting place to test the benchmark, raising questions about how memory works when several agents share the same harness.

“Yes definitely – would love to add OpenClaw to the harness comparison!” Wooders writes. “Extending to multiplayer memory is also a very interesting future direction.”

What the benchmark misses

FrontierMemory is still early. With just 15 tasks and one attempt per task, a single result can shift the scores by roughly 6.7 percentage points. The benchmark currently focuses on agents learning from past work rather than updating memories as they go. Packer says the next release will add longer-running tasks and online memory updates.

The post Five AI agent harnesses took the same memory test. The results weren’t even close. appeared first on The New Stack.

Ramp spent months testing managed agent APIs, open-source frameworks, and third-party platforms before concluding it would be better off building its own. The result is Laminar, an internal agent harness that took six weeks to reach a first version and now powers every agentic product at the fintech company.

“We studied the other offerings on the market and decided that we could do better, move faster, and have stronger alignment to where we want to go by building in house.”

“We studied the other offerings on the market and decided that we could do better, move faster, and have stronger alignment to where we want to go by building in house,” Sam Kronick, the Ramp engineer behind the platform, writes in the company’s engineering blog.

In Tuesday’s post, Ramp detailed how Laminar brings agent execution, sandboxing, observability, and asynchronous workflows under a single platform. The architecture caught the attention of LangChain CEO Harrison Chase, who praised several design choices in his X post, while pointing to similar work underway in LangChain’s Deep Agents.

Ramp and LangChain are approaching the problem from different directions, but both point to a bigger shift in agent infrastructure. As harnesses take on more responsibility, enterprises have to decide how much of that infrastructure they want to build and maintain themselves.

Why Ramp built in-house

Ramp didn’t want to be locked into one model provider. It needed the flexibility to switch models based on cost, speed, and performance, along with better visibility into how its agents behaved. Engineers were already digging through traces to find unnecessary tool calls, bloated context, and errors, but existing observability tools made that harder than it needed to be. So Ramp built its own debugging interface into Laminar. Keeping development in-house also meant the harness team could work directly with product engineers instead of waiting on vendors to make changes.

Chase agreed with Ramp’s priorities, particularly model independence and observability, both of which LangChain has emphasized in its own work. And, there were other parts of Laminar’s architecture that caught his attention.

Keeping development in-house also meant the harness team could work directly with product engineers instead of waiting on vendors to make changes.

Sessions split from sandboxes

Laminar runs everything from customer service agents to Ramp Inspect, the company’s cloud coding agent, and Glass, which handles longer-running, collaborative work. Supporting these products requires a harness that can manage persistent sessions, human approvals, and work across environments.

Chase highlights Kronick’s observation that a production harness does far more than run a simple execution loop. “+100 to this,” he writes, pointing to LangChain’s investment in Deep Agents.

Ramp keeps agent sessions separate from the sandboxes where code runs. Conversation history and execution state are stored independently, allowing sandboxes to spin up and shut down without disrupting a session.

Chase sees the sandbox-as-a-tool approach as a growing trend, noting that Deep Agents uses a similar design. It also keeps credentials and orchestration outside the sandbox, an important consideration as developers work to isolate agents running untrusted code.

Async agents by default

Laminar lets agents keep working without waiting for every step to finish. Chase describes non-blocking asynchronous agents as the future and says LangChain is developing similar functionality for Deep Agents.

Ramp’s Connectors Service also caught his attention. It centralizes authentication, credentials, access controls, and tool execution behind a shared API.

Chase says LangChain is exploring comparable features for managed Deep Agents. Centralizing those functions also gives platform teams a consistent place to manage access and credential handling rather than implementing them separately for every agent.

The harness is also where teams can trim inference costs, and LangChain has made that case directly. In an October 1 engineering post, it describes moving model selection into the harness of Open SWE, its open-source coding agent. A router examines the initial request and assigns one of three models based on expected task complexity, sending the simplest work to GLM-5.3-Flash, intermediate tasks to GPT-5.6 Sol, and the most demanding requests to GPT-6 Astra.

Routing trims inference costs

Across 973 agent threads, the router cut median LLM costs from $2.61 to $0.94 per thread, a 64 percent drop compared with using GPT-6 Astra for every task. The savings didn’t come with a measurable hit to performance. Merged pull request rates were 29.2 percent for routed threads and 27.3 percent for the control group, a difference that wasn’t statistically significant. Ninety percent of requests went to the two less expensive model tiers.

LangChain argues that routing works better inside the harness than at a generic LLM gateway, where there’s less context about what an agent is doing.

LangChain argues that routing works better inside the harness than at a generic LLM gateway, where there’s less context about what an agent is doing. The harness already knows which prompts, tools, and domain context are involved, giving it more information to make that choice. LangChain uses model-selection middleware to pick a model at the start of each thread.

The results don’t tell us whether building a custom harness is cheaper than using an existing framework. Ramp wasn’t part of the experiment. But they do show how much companies can save by making smarter model choices at the harness level, especially when their agents handle tasks with very different demands.

The harness ownership dilemma

Ramp’s decision also shows how coding agents have changed infrastructure costs. Kronick says agents generated all of Laminar’s initial code, with experienced engineers guiding the architecture and implementation.

But building the first version in six weeks is one thing. Maintaining it is another. Ramp still needs engineers to handle incidents, update the platform, and support its product teams. The company also hasn’t published operating-cost comparisons or benchmarks against competing platforms, which makes it difficult to judge whether building in-house is cheaper.

LangChain offers another option. Rather than building a harness from scratch, companies can use frameworks that handle much of the underlying infrastructure, an approach other vendors are also taking as they open-source their own harnesses.

The post Ramp built an AI agent harness in six weeks — and LangChain’s CEO says it’s part of a bigger shift appeared first on The New Stack.

I let an AI agent search again whenever it chose. It found some papers plain search had missed, lost some plain search had found, and gained too little to trust.

The post Does Agentic RAG Actually Retrieve Better Evidence? I Tested It on 298 Questions appeared first on Towards Data Science.

Enterprise security has traditionally operated on a relatively straightforward premise: establish identity, authenticate the requester, determine what that identity can access, and enforce those permissions.

AI agents introduce a fundamental complication. They don’t simply access systems. They interpret objectives, select tools, create sub-agents, make decisions, and execute actions, often using credentials and permissions inherited from humans.

The problem isn’t necessarily that an agent lacks proper credentials. It’s that those credentials may authorize actions the human never intended the agent to perform. And unlike conventional software, agents can change their execution paths dynamically in pursuit of an objective.

“The problem isn’t necessarily that an agent lacks proper credentials. It’s that those credentials may authorize actions the human never intended the agent to perform.”

This creates a new operational requirement: security must evaluate not only who or what is acting, but what an agent is attempting to do, on whose authority, and under which policy. Meeting that requirement takes more than a security checkpoint. It requires a continuous agent security lifecycle.

Defense-in-depth needs action-level authorization

Every passing day further shows that agent security is a defense-in-depth problem. Network security controls how agents communicate. Endpoint and runtime protections constrain where and how code executes. Infrastructure and silicon-based protections establish a foundation for trusted execution. Model guardrails help shape behavior. These layers complement each other, and enterprises need them to work together.

But consider an agent that attempts to delete a production database using a developer’s legitimate credentials. Network controls may see authorized traffic. The runtime may see an approved process. An identity provider may confirm that the credentials are valid. All three could be working as designed.

The missing question is whether this particular agent should be allowed to perform this particular action, even if the human whose credentials it inherited could legitimately do so.

That requires identity context and authorization at the point of action.

In practical terms, an authorization decision should consider the agent’s identity, the human or service that delegated its authority, the requested operation, the target resource, and applicable policy. Enforce that decision before the operation executes.

The agent harness (the execution layer that connects an AI model to tools, application programming interfaces (APIs), files, and external systems) is an important place to apply that control. Other trusted enforcement points, including tool services and resource APIs, provide additional protection.

The goal isn’t to replace existing defenses. It’s to make authorization integral to agent execution. But even that is only a partial answer because what is needed is a new framework — an agent security lifecycle.

Four disciplines, one continuous security lifecycle

A practical agent security architecture needs four interconnected disciplines:

Observe. Enforce. Build. Deploy.

These aren’t sequential gates every organization must pass through. They form a continuous lifecycle, and organizations can enter at whichever point reflects their existing infrastructure and maturity.

A company with agents already running in production may begin by observing their behavior. A development team creating a new agent may start by building authorization directly into its architecture. An enterprise expanding an existing deployment may discover new activity that requires revisiting its policies.

Each stage informs the others. The cycle never really ends.

Observe: Understand what agents actually do

Most enterprises have some form of application inventory. Increasingly, they’re extending that inventory to AI agents.

That’s a useful starting point, but knowing an agent exists isn’t the same as understanding what it does.

Security teams need visibility into the actions agents actually attempt:

• Which tools and APIs are being invoked?
• What commands are being executed?
• Which systems and sensitive resources are being accessed?
• What credentials and delegated permissions are being used?
• What sub-agents are being created, and what authority do they inherit?
• Which actions would violate a proposed security policy?

Architectural diagrams or agent configuration files alone can’t reliably answer these questions. The important evidence exists in execution, which is why agent observability must extend beyond conventional logs and application monitoring. Security teams need to connect observed actions with identity, delegation, and authorization context.

“Knowing an agent exists isn’t the same as understanding what it does. You can’t intelligently govern behavior you haven’t observed.”

Equally important, observation should support evaluating potential policies without immediately disrupting production activity. There are useful precedents here. When intrusion prevention systems and web application firewalls became widely adopted, organizations learned that immediately enabling aggressive blocking rules could interrupt legitimate applications. Monitoring first, establishing behavioral baselines, and progressively enforcing policies proved more practical.

AI agents require similar discipline, although their behavior can be substantially more dynamic.

For organizations already deploying agents, the priority may not be to block more activity. It may be to understand what activity is actually occurring.

You can’t intelligently govern behavior you haven’t observed.

Enforce: Put deterministic boundaries around probabilistic behavior

Once organizations understand how agents behave, they can begin defining and enforcing boundaries.

The distinction between probabilistic AI behavior and deterministic security enforcement is critical. An agent might interpret instructions differently across executions. It may choose different tools, sequence operations differently, or discover alternative ways to accomplish an objective.

A security policy cannot depend on the model consistently choosing the safest option. Consider a coding agent with permission to work in a source repository. Reading a file might be permitted. Modifying a protected branch might require human approval. Deleting the repository might be prohibited.  All three actions could originate from the same authenticated agent operating in the same environment. But they require different authorization decisions.

“The distinction between probabilistic AI behavior and deterministic security enforcement is critical. The objective is not to make agents incapable of acting. It’s to make the boundaries of their authority explicit, enforceable, and consistent.”

Effective enforcement means evaluating the attempted action against policy before execution. A simplified authorization request might contain:

• Actor: Coding agent 42
• Delegated authority: Developer account 17
• Requested action: Delete repository
• Target: Production source repository
• Policy decision: Deny

The important architectural distinction is that the permission check occurs at a trusted enforcement point, not merely within a prompt instructing the model to behave. For high-risk operations, the system may deny execution or require explicit human approval. Lower-risk operations may proceed automatically.

Enforcement also needs to account for agents attempting alternative execution paths. A harness-level check only protects actions routed through that harness. Robust designs therefore combine action-level authorization with independently enforced permissions at APIs, tool servers, and underlying resources.

The objective is not to make agents incapable of acting.

It’s to make the boundaries of their authority explicit, enforceable, and consistent.

Build: Make identity and authorization part of the agent architecture

Observation and enforcement help organizations secure existing agents. But the greatest long-term benefit comes when those lessons influence how agents are built.

Today, developers may implement AI agents using different models, frameworks, tool protocols, and execution environments. If every team must independently design identity propagation, delegated permissions, authorization policies, and audit logging, security becomes inconsistent and difficult to maintain.

Instead, these capabilities should be available as reusable infrastructure. Software development kits (SDKs), APIs, and shared authorization services can make it easier to incorporate controls directly into agent applications. That means establishing several architectural expectations from the beginning.

An agent should have an identifiable execution context. Its authority should be explicitly delegated and constrained. Sensitive tool invocations should require authorization. Security decisions and consequential actions should be auditable.

Importantly, an agent shouldn’t automatically inherit every permission available to the human initiating it. Consider an employee using an AI assistant to reconcile invoices. The employee may have permission to review invoices, approve payments, and update vendor records. The agent’s assigned task requires only invoice retrieval and reconciliation. The correct architecture delegates the permissions required for that task, not the employee’s entire authority.

That distinction matters even more when an agent creates sub-agents or invokes tools under different service identities. Developers need mechanisms to preserve and constrain delegated authority throughout those interactions.

Security should also be portable across implementations. Organizations shouldn’t have to reconstruct their authorization architecture every time a development team adopts a new framework or model. This is why identity and authorization should be infrastructure, not application-specific features.

Done correctly, security becomes something developers build with, rather than something security teams attempt to bolt on after an application is complete.

Deploy: Make consistent security possible at machine scale

Building a secure agent is one challenge. Operating thousands of agents across applications, departments, cloud environments, and business processes is another. At that scale, manually reviewing permissions or trusting individual development teams to implement controls consistently becomes unsustainable. 

Agents may invoke new tools, coordinate with other agents, and participate in workflows that span multiple authorization domains. Security controls need to follow them. That requires a deployment architecture that consistently applies identity context, delegated authority, authorization policy, and audit requirements across supported environments.

The underlying model or framework shouldn’t determine whether security controls exist. Nor should adopting a new tool require rebuilding the entire security architecture. This is where framework-independent interfaces and centrally managed policy become especially valuable. Organizations can maintain consistent security expectations while allowing development teams to use the technologies best suited to their applications.

Deployment also changes the meaning of scale. With traditional applications, scale generally means handling more users, transactions, or workloads. With agents, scale can also mean more independent actors making more decisions, invoking more tools, and creating additional agents. The number of consequential actions can increase much faster than the number of deployed applications. Security architectures must therefore operate automatically and consistently at the pace of machine-generated activity.

Deployment creates something else: new evidence. Production activity reveals unexpected workflows, new dependencies, authorization gaps, and opportunities to refine policy. That information feeds directly back into observation and enforcement and informs how the next generation of agents is built.

The lifecycle continues.

The shift from security as a checkpoint to security as infrastructure

The underlying security principles aren’t new. Least privilege, zero trust, separation of duties, identity federation, and defense in depth remain foundational.

What’s changing is how consistently those principles must be applied throughout an agent’s lifecycle, and how close enforcement must be to the actions agents take. Traditional security architectures often assume that controlling system access is enough to govern what happens afterward. 

AI agents challenge that assumption because they can make consequential decisions independently within the access they’ve already been granted. As a result, the security model needs to evolve in three important ways.

First, visibility must be based on actual agent behavior rather than configuration alone.

Second, authorization must evaluate individual actions in the context of identity, delegation, and policy.

Third, these capabilities must become reusable infrastructure that accompanies agents from development through production and back into continuous improvement.

This is why treating agent security as a lifecycle, rather than a collection of isolated controls, matters. Observation supplies evidence. Enforcement establishes boundaries. Development incorporates those boundaries into applications. Deployment extends them consistently across environments and feeds new evidence into the cycle.

Each stage makes the others more effective.

Securing the agentic era without slowing it down

Organizations face two tempting extremes. One is to trust agents too broadly, assuming that legitimate credentials and well-written instructions provide sufficient protection. The other is to constrain agents so aggressively that the productivity gains motivating their adoption disappear. Neither is a sustainable long-term strategy.

“Success isn’t measured by how many agent actions an organization can block. It’s how many valuable actions it can confidently (and safely) enable.”

A better approach is to establish the visibility, accountability, and controls that make greater autonomy possible. That means knowing what agents actually do, enforcing what they’re permitted to do, building those controls into the development process, and deploying them consistently at scale. It also means recognizing that the work is never finished. New models, frameworks, tools, and workflows will continuously introduce new behaviors and risks.

Agent security cannot be a one-time approval at the beginning of a deployment. It must be a continuous discipline that evolves with the agents themselves. Success isn’t measured by how many agent actions an organization can block. It’s how many valuable actions it can confidently (and safely) enable.

It takes a continuous lifecycle, not a gatekeeper.

The post AI agent security is a lifecycle — not a gatekeeper appeared first on The New Stack.

Google will soon make the infrastructure that powers its Gemini agents available to Google Cloud users in preview.

Announced on Thursday at the Linux Foundation’s AGNTCon+MCPCon in San Jose, Agent Compute Engine will become available in preview to Google Cloud users later this year. It will provide every AI agent with a hardware-isolated microVM that combines the speed of containers with the security of a sandbox.

Who else offers agent sandboxes?

The idea of agent sandboxes is anything but new, of course. Startups like E2B and Daytona offer them to developers (and support them on any cloud), as does AWS with Bedrock AgentCore.

E2B runs each sandbox in a Firecracker microVM, the open source virtualization technology AWS originally built for Lambda. It can pause a sandbox with its memory and filesystem intact and resume it in about a second. Daytona started out with containers but added microVM sandboxes in July. Those can pause a full machine or fork a running one into identical copies.

AgentCore also gives every agent session its own microVM. AWS doesn’t charge for CPU while an agent waits on a model or tool call, though memory keeps billing until the runtime reclaims it. Those sessions top out at eight hours. In August, AWS added EC2-based runtime instances that can keep shared sessions alive for up to 14 days.

It’s worth noting that Google itself isn’t new to this either. GKE already offers a managed version of Agent Sandbox, the open source Kubernetes project Google launched last November. The company also sells code-execution and computer-use sandboxes through its Gemini Enterprise Agent Platform.

Agent Compute Engine, on the other hand, started out as internal infrastructure for Gemini, Antigravity, and Google’s own model training pipelines.

Google’s take

Few companies — if any — run as many agentic workloads as Google, be that for its own internal use or its customers. According to the company, agentic workloads have quickly become one of the fastest-growing consumers of compute and storage across its fleet.

At this scale, the infrastructure services that power all of these autonomous agents don’t just need to be efficient and able to scale, but maybe more than anything, they need to be secure. Google, like some of its competitors, quickly realized that it needed to build a new purpose-built compute service to power all of these agents, similar to how it needed to build Borg, which later inspired Kubernetes, to manage compute in its early data centers.

As Rohit Jnagal and Ramanathan Venkatapathy, both distinguished engineers at Google, note in a technical deep dive, traditional VMs provide developers with a lot of control and flexibility, but at the cost of speed when it comes to booting, suspending, and resuming a machine. Given how fast agents start and shut down, that’s not an option.

Containers solve some of this, they note, “but there are multiple examples like coding agents and developer assistants that need complete isolation as well as kernel- and root-level control of the agentic environment.”

With Agent Compute Engine, Jnagal and Venkatapathy write, the team went back to first principles to build “a unified, agent compute platform for Google” (and now its customers).

A persistent computer for every agent

At its core, it basically gives every agent a persistent, sandboxed computer to work with. That allows the agents to work with shell scripts, use a headless browser, and write code (with root permissions to that machine) in agent loops that could run for weeks.

But the team also built it for large-scale use cases like the eval loops that frontier labs use to test their models, AI benchmarking, and reinforcement learning.

In addition, the team also designed Agent Compute Engine to run sandboxed backends for Google’s own services.

Jnagal and Venkatapathy also note that agents spend most of their time waiting on the model or the user. So once an agent finishes a tool call, the host checkpoints its microVM, which then uses no active resources until the next call comes in.

Nothing to steal inside the sandbox

The key feature here, besides speed, is to be able to trust that the agents can’t break out of their sandboxes. We’ve seen what happens when they do, after all.

Each agent session runs inside a single-tenant, memory-safe microVM. Those environments hold no secrets in memory or on the disk, and their only identity is a short-lived, session-scoped one delivered through a single per-VM local listener. All traffic is end-to-end encrypted in transit, and snapshots and disks are encrypted at rest.

The microVMs don’t get a standard network interface, either. All traffic runs through a proxy outside the sandbox, and when an agent needs to reach a service like Google Drive, Google’s Agent Gateway checks the user’s delegation and the sandbox’s identity before adding the actual credential, outside the sandbox.

The underlying host is basically a stateless appliance with a read-only filesystem, with the hardware and firmware cryptographically verified at each boot.

All of this is backed by Google’s own Titan and Titanium IPU security platform. The microVMs themselves run on Cloud Hypervisor, an open source virtual machine monitor, and each gets its own guest kernel and root access.

Jnagal and Venkatapathy use the example of an enterprise agent that manages a user’s inbox and reads an email with hidden instructions to find any API keys on the machine and send them to an outside address. Most of the time, they note, the model will ignore that, but not always.

“We started from one rule: Assume an attacker controls everything inside the sandbox, and make sure they find nothing there to use,” the team writes.

Agent Substrate brings the same idea to Kubernetes

But not every team will want to have its agents run in a managed Google service. For them, Google also offers Agent Substrate, an open source runtime for the Google Kubernetes Engine (GKE) that it first announced in May.

Substrate builds on Agent Sandbox, Google’s Kubernetes project, and adds a lightweight control plane that Google says can handle millions of short-lived tool calls that would swamp Kubernetes.

Similar to Agent Compute Engine, Substrate snapshots an idle agent’s memory and returns the machine to the pool until the agent gets more work.

Google says that means up to 10 times the density of traditional compute. In a 200,000-agent benchmark, Substrate handled 500 activations per second, with agents suspending and resuming in under half a second, the company says.

Teams can isolate each sandbox with a microVM or gVisor, and every agent gets its own cryptographic identity. As with Agent Compute Engine, egress proxies attach credentials outside the sandbox. Substrate runs on any Kubernetes cluster, and Google says it works with any harness, including Claude Code, OpenClaw, and Nous Research’s Hermes.

“We built Hermes Enterprise to enable customers to deploy into their existing infrastructure, while handling per-agent isolation and extensible access control,” Hervé Bizira, Nous Research’s chief business officer, notes in the announcement. “Agent Substrate addresses both at the platform layer in a way that also preserves valuable compute resources.”

The post Google turns the infrastructure behind Gemini’s agents into a cloud service appeared first on The New Stack.

Schneider Electric, Nvidia and HPE have formed a strategic collaboration to introduce AI agents that can monitor and help optimize industrial operations from inside factories and process plants. The companies describe the technology as a route to “physical AI” for industries such as energy, chemicals, pulp and paper, where AI is more likely to interact […]

As Amazon blocks AI agents from shopping on its site, Walmart is taking the opposite approach, introducing new technology that lets AI agents make purchases on customers' behalf, with controls over spending and transaction approvals.

Grid puzzles that people solve almost perfectly show where language and vision models still break

The post Spatial Reasoning in AI Models, Taken Apart appeared first on Towards Data Science.

Every enterprise company is currently trying to figure out how to have its AI tools work with its data. Meanwhile, every major enterprise vendor that works with those enterprises (think SAP, Microsoft, Salesforce, Workday, etc.) is making a claim on becoming the central hub for managing and securing that data.

But what about the companies that want to do it themselves?

Nvidia, on Wednesday, announced how it wants to provide enterprise AI agents with the data they need to make sense of company data — all without competing with the data platforms that already store it.

At its GTC Berlin conference Wednesday, the company added Agent Knowledge Foundation to its Agent Toolkit. This new collection of open-source components bundles the company’s Nemotron Retriever models, a new Auto-Ontology library, the Kumo family of models for structured data, and its CUDA-X data processing libraries.

With this system, Nvidia says, the data can stay where it is and remain managed under the access rules these companies already have in place.

Today, as Adel El Hallak, Nvidia’s vice president of product for agentic AI, tells The New Stack, enterprises may be able to connect an agent to a vendor like Snowflake, but that doesn’t help the agent understand the overall enterprise context.

“I wish it was as easy as connected to my Snowflake system, connected to my email exchange, connected to my knowledge base, and then all of a sudden, magically, the AI understands all the data. But the reality is different,” he says.

Large language models are “great at predicting next tokens,” El Hallak argues, but when presented with a single spreadsheet that has “a whole bunch of tabs,” the agent will have a hard time finding something specific. “It’s gonna struggle,” he says.

Better retrieval, fewer lookups

“In the world of agents, you want the most accurate embedding models or reranking models,” El Hallak says, even if that adds a bit of latency to each lookup. The agent then gets “much more pertinent information. So the number of lookups at the end, the overall latency actually goes down.”

Nvidia says its Nemotron Retriever embedding model raised search relevance by 65% in tests on an open source OpenSearch setup, needing fewer search steps and adding hardly any latency. SAP’s fine-tuned version of the reranker ran nearly three times faster, Nvidia says, and ServiceNow got better reranking quality with close to 25% less latency.

From RAG to ontologies

“RAG was awesome, but is it good enough?” El Hallak asks. Knowledge graphs, he says, represent concepts and the relationships between them better than retrieval-augmented generation, which pulls in chunks of text based on similarity.

Nvidia’s Auto-Ontology library builds those graphs from a company’s own tables and maps raw data to business concepts like customers, products, and orders. Its listing in Nvidia’s NGC software catalog shows a REST API and a Model Context Protocol (MCP) server that agents can use to query it.

“You and I, it’s easy for us to understand. A tier is the same thing as a plan when you’re looking at a mobile carrier,” El Hallak says, but LLMs “mess those up.”

Nvidia bought Illumex, an Israeli startup that automated the creation of semantic layers and ontologies for enterprise data, for a reported $75 million in February. At the time, an Nvidia spokesperson told Globes that the team’s ontology expertise would help it build “libraries and models that will enable the adoption of Agentic AI in organizations.”

Predictions from tables

Kumo, the startup Nvidia bought in June in a deal The Information valued at more than $400 million, built foundation models for relational data. Nvidia has since released several Kumo models as open weights on Hugging Face, including Kumo Tabular in September.

El Hallak says those models replace the per-task pipelines data teams used to build “for every classification, for every churn, for every sentiment analysis.”

“The whole point of the ontology … is to bring harmonization as you create those knowledge graphs, so there’s [consistency] across the tables, and then you could use Kumo to drive predictive analytics,” he says.

Partners, not rivals

“I’m not looking to compete with, for example, a Snowflake. On the contrary, I want to partner with them,” El Hallak says.

Nvidia’s own supply chain team uses Agent Knowledge Foundation through Palantir’s Foundry platform, building on earlier work between the two companies. Databricks is pairing a Kumo anomaly detection model with Genie Ontology, the context layer it introduced in June, and Snowflake customers can run Kumo models in Snowflake Notebooks.

“I’m not thinking about ACLs and data access and all those things. That’s why I need the partners,” El Hallak says, referring to access control lists and other security features that its enterprise partners offer.

Owning the stack

Not every vendor is taking that route. SAP closed its acquisition of Prior Labs, the company behind the TabPFN tabular models, in July and committed more than €1 billion to it over four years. It now offers TabPFN-3.5 Plus in SAP AI Core alongside its own RPT models.

Nvidia, meanwhile, distributes its models through Hugging Face, which it agreed to buy for $12.9 billion in September. “We just build little weights and models, and we publish them on Hugging Face,” El Hallak says.

That leaves Nvidia building the models, while the likes of Snowflake and Databricks keep control over the data and the permissions around it.

The post Nvidia bets open models can give enterprise AI agents the context they’re missing appeared first on The New Stack.

Beam is a new Mac app that takes a window running on one Mac and puts it on another, where it behaves like a locally installed app. Why? Agents.

Serial founder Hiten Shah, who co-founded Crazy Egg and KISSmetrics, built it with Sam Asante under a company called Noats. It launched on Product Hunt on Tuesday and is aimed at the headless Mac Mini sitting in a closet running AI agents.

The pitch is great: Instead of opening Screen Sharing and steering a full remote desktop, a user picks a single window on the other machine, say a Terminal session or a browser window an agent is working in, and it opens alongside everything else on the Mac in front of them. It gets its own Dock icon and can be called using the Command+Tab switcher. Resizing the window resizes the window on the other Mac. Keyboard shortcuts work, files can be dragged across, and the app’s audio can play locally. The app itself never leaves the original machine. When one window isn’t enough, Beam can pull over a full display or the whole Mac.

Shah frames it around his own setup in his Product Hunt launch post, describing Macs running agents and local models “with work continuing even when nobody’s sitting in front of them.” Getting to one of those machines usually means Screen Sharing and a second desktop to navigate. Beam is meant to cut that down to the one window that matters.

Beam plays into the exploding ecosystem of Macs powering AI systems, so the app runs only on macOS. And both Macs need Apple Silicon, macOS Sonoma or later, and Beam installed. The machines find each other on the same Wi-Fi network, or anywhere through Tailscale.

The company says windows, keystrokes, clipboard, and audio travel directly between Macs, encrypted, and never pass through its servers. It also says hidden windows and password managers never show up in the window picker.

For devices without Beam, a share link opens a single window in any browser, view-only unless control is granted, and expires after anywhere from an hour to a week.

Asante said on Product Hunt that native iOS and Android apps are on the way.

Pricing depends on the setup. Hosting a Mac and joining a share link are free. Using your own Mac is free for 20 minutes a day, then $12 a month, $84 a year, or $199 for a lifetime license.

Beam follows where agents’ hardware is growing. The Mac Mini is becoming the default home for always-on agents, driven initially by OpenClaw, but others like Perplexity followed. Apple credited agentic workloads on its April earnings call.

The New Stack‘s Janakiram MSV caught the trend early and covered the shift in May, writing, “the Mac mini just became infrastructure.”

Beam isn’t the first to this problem. I used Astropad’s Workbench for a few weeks, and it let me remotely access agents on my desktop and through iOS apps. Workbench bets on mobile devices, while Beam bets that the unit of remote access should be the window, not the screen. Jump Desktop, Screens and Apple’s own Screen Sharing all cover the basics too.

Still, the problem is real and growing. The Mac stashed in a closet or on a rack is becoming a normal part of a developer’s setup. Beam’s answer is to stop treating it like a second desktop at all.

The post Beam pulls single app windows off the Mac Mini running your agents appeared first on The New Stack.

Towards Spec-Driven Test Automation, Part 4

The post Skill or MCP Server? Ask What Stops the LLM From Disobeying appeared first on Towards Data Science.

Turn scattered requirements into deployable agents

The post What's in the Box? Distinguishing Acceptable Traces from Unacceptable Ones appeared first on Towards Data Science.