Ramsay Research Agent — June 29, 2026

A downloadable model is now beating an export-blocked frontier model at finding bugs. OpenAI just conceded that its agent SDK shouldn't assume you're running OpenAI models. Five separately funded startups built the same CRM from scratch. And a technique everyone treats as free, context compaction, turns out to quietly delete your safety rules. Today's issue has one spine running through it: you're supposed to own your stack now, and the people selling you cloud lock-in know it.

---

Top 5 Stories Today

China's Z.ai shipped an open-weight model that matches an export-banned one on security work

Two weeks ago the US government forced Anthropic to pull Mythos 5 offline under an emergency export directive, on the theory that frontier cyber capability is dangerous enough to gate. This week a Chinese lab released a model you can download under an MIT license that benchmarks at parity with it on exactly that kind of work. The timing isn't subtle.

Zhipu AI's GLM-5.2 is a roughly 750B-parameter mixture-of-experts model with about 40B active per token, a 1M-token context window, and weights anyone can pull and run. The Verge reports researchers found it matches Anthropic's export-controlled Mythos on bug-finding and cybersecurity tasks. The numbers are specific. Semgrep measured 39% F1 on IDOR detection, versus Claude Code's 32%. Graphistry's CyBT-CTF eval put it level with Opus 4.8. That's not "competitive Chinese model." That's beating the practical US frontier on a security task that the US government decided was too sensitive to export.

Here's the part that should make you sit up. Graphistry also flagged unusually high output correlation with both GPT-5.5 and Opus 4.8, Cohen's Kappa of 0.80 and 0.76, which is the statistical fingerprint of distillation. So the open-weight model that's beating the locked-down model may have learned a chunk of its behavior from the locked-down models in the first place. And because the weights are public, the same researchers warned anyone can strip the safety alignment off it in an afternoon.

This challenges the whole premise of weights-based export control, with data. If the policy goal was limiting who has frontier cyber capability, the policy failed in under two weeks. You can't ban a download.

What builders should do: pull GLM-5.2 and benchmark it on your actual retrieval and reasoning tasks before assuming a US API is worth the per-token cost or the data egress. The 1M context and MIT license make it genuinely usable for self-hosted work where Opus or GPT can't legally go right now. But treat the distillation signal as a reason to verify outputs independently, not a reason to trust it blindly. A model that correlates 0.80 with GPT-5.5 will inherit GPT-5.5's failure modes too. Test it on the cases you care about, not the leaderboard.

---

A wave of local-first, bring-your-own-model coding agents is forming under the cloud harnesses

I keep seeing the same pitch from different repos and it's starting to feel coordinated even though it isn't. nanocoder's tagline is "owe nothing to anyone." AnythingLLM's is "stop renting your intelligence, own it." Kaku and Kilo are circling the same idea. Keep your code and your model on your machine, swap providers whenever you want, never get locked into one vendor's hosted agent. GitHub is where most of these live, and they're all trending at once.

This is the OSS counter-movement to Claude Code, Codex, and Devin. Those are great products. I use Claude Code every day in my personal projects. But the bet these tools are making is that hosted convenience isn't worth surrendering data residency and cost control, and that the gap in raw capability is closing fast enough to make the tradeoff worth it. Heterogeneous local model routing, Ollama, GLM, gpt-oss, all swappable, is shipping as a first-class feature instead of a bolt-on.

The GLM-5.2 story above is what makes this credible. A year ago "run your coding agent on a local model" meant accepting a real quality hit. Now there's a downloadable model beating the export-banned frontier on security work. The capability argument against local-first is eroding in real time. A Hacker News thread this week argued 2026 is the year agents move from demos to infrastructure, and the local-first/local-gateway model is the right architectural bet for privacy and control. Commenters kept naming self-hosted runtimes like Jan and GPT4All.

I'm not fully sold yet, and I want to be honest about why. Running a coding agent well takes more than a good model. It takes the harness, the loop design, the tool integration, the compaction strategy, all the unglamorous orchestration work that Claude Code and Codex have spent a year polishing. nanocoder owning nothing to anyone also means owing nothing to a team that fixes the agent loop for you.

What builders should do: if you have data you legally can't send to a hosted API, or you're tired of a per-token line item that scales with your productivity, set up one of these now and route it at a local GLM or gpt-oss model. Treat it as a real fallback, not a toy. The day a cloud harness has an outage or a price hike or, like Mythos, a government-mandated shutdown, you'll want the local path already wired.

---

Five funded startups independently built the same CRM, and it's not the one you know

When one team breaks from an incumbent's design, it's a bet. When five independently funded teams converge on the identical architecture inside a few months, that's a leading indicator. Lightfield, Attio, Reevo, Monaco, and Aurasell were all built on one premise: AI agents populate the system of record, not reps typing notes after a call. SaaStr laid out the pattern. Connect inbox, calendar, and a call recorder, and the pipeline assembles itself.

This is a clean break from the Salesforce and HubSpot era, where the entire value proposition was a well-designed schema that humans dutifully fill in. The new bet is that the data entry was always the bug, not the feature. Nobody likes updating the CRM. So don't make humans do it.

Lightfield co-founder Keith Peiris demoed the whole thing live at SaaStr on a real, messy dataset, running on Claude, with no custom fields and no implementation project. Someone asked why a Johnson Controls deal had stalled. Lightfield ran code in a sandbox, compared that deal against every closed-won and closed-lost record it had, surfaced the pattern, then ran about 20 enrichment tools to find the right CIO, drafted an intro, and wrote a natural-language automation so every rep could repeat the play. That last step is the one that got my attention. The output wasn't an answer. It was a reusable workflow the system wrote for itself.

The strategic read: the moat moves from the database schema to "complete customer memory." Salesforce's defensibility was that all your data lived in their tables and getting it out was painful. If the agent reconstructs the pipeline from your inbox and calendar in minutes, that lock-in evaporates. Whoever holds the most complete, queryable memory of the customer relationship wins, and the schema becomes an implementation detail.

What builders should do: if you're building in any category that's currently "a place humans enter data so they can report on it later," assume the agents-do-the-entry pattern is coming for it. The SaaStr piece explicitly calls support, analytics, and recruiting as next. The counter-positioning move is to start from "what does the agent need to do the work" and build the data model backward from that, instead of shipping a prettier form. Forms are the thing being disrupted.

---

"Governance Decay" turns context compaction into an attack surface

Everyone running long agent sessions treats compaction as free. The buffer fills, the agent summarizes, you keep going. A new paper says that summarization is silently deleting your safety rules, and an attacker can trigger it on command.

"Governance Decay" (arXiv 2606.22528) shows that standing safety and governance constraints an agent obeys perfectly while they're visible in context get dropped during compaction, because summarizers treat policy text as low-salience boilerplate and prune it. Across 1,323 episodes, the authors' ConstraintRot benchmark measured constraint violations rising from 0% when the policy was in full context to 30% after a single compaction, and up to 59% on some models. The rules don't degrade gradually. They fall off a cliff the moment the agent compresses its own history.

The attack is the ugly part. An adversary who controls only a single returned tool output, a web page the agent fetches, an API response, a file it reads, can inject enough content to push the context over the compaction threshold on demand. They don't need to jailbreak anything. They just need to make the agent forget the rule that was protecting you, then act in the window where the rule is gone. A companion result (arXiv 2604.20911) makes it worse: "don't do X" prohibitions decay faster than "always do Y" requirements. The exact rules you most need to survive, the prohibitions, are the ones most likely to evaporate.

This reframes something the whole industry assumed was safe. We've all been told to put the important rules at the top of CLAUDE.md or the system prompt. That's necessary and no longer sufficient for anything that runs long enough to compact.

What builders should do, concretely: store hard rules in a non-compactable system slot the summarizer can't touch, or re-inject them after every compaction event. Don't trust a "do not email externally" line to survive the trajectory. And stop relying on the model to enforce its own constraints at all for the critical ones. Grade tool calls against the policy deterministically, with a hook or a guard outside the model that has to pass before the action fires. Convert your prohibitions into enforced positive checks. The instruction is a suggestion. The check is the enforcement.

---

OpenAI's Agents SDK v0.13 quietly admits you shouldn't have to run OpenAI models

Version bumps are usually boring. This one isn't, because of what it concedes. The OpenAI Agents SDK hit v0.13 with an any-LLM adapter, breaking the assumption that you'd be running OpenAI models inside OpenAI's framework. Requesty's SDK comparison has the details: alongside the adapter, v0.13 adds opt-in retry policies, MCP resource support, session persistence, and a default Realtime model upgraded to gpt-realtime-1.5.

The any-LLM adapter and the MCP resources are the real story. For a couple of years the implicit deal with a vendor's agent SDK was that it nudged you toward that vendor's models and that vendor's way of wiring tools. LangGraph and CrewAI competed partly by being model-agnostic and protocol-open. OpenAI shipping a first-party any-LLM adapter is OpenAI conceding that ground. They'd rather you build agents on their SDK running someone else's model than not build on their SDK at all.

That fits the through-line of this entire issue. GLM-5.2 says capability is going open and downloadable. The local-first coding agents say own your stack and swap providers. And now even OpenAI's own framework says fine, plug in whatever model you want and keep your MCP tools portable. Model portability stopped being a feature the scrappy open-source frameworks used to differentiate. It became table stakes that the largest lab now has to match. Lock-in is eroding from both ends.

What builders should do: if you're already on the OpenAI Agents SDK, the MCP resource support and session persistence are immediately useful, and the opt-in retries are the kind of thing you'd otherwise hand-roll badly. Voice-agent builders get gpt-realtime-1.5 as the default for free, which is the cheapest upgrade you'll get all month. The bigger move is architectural. Build your agent so the model is a swappable component behind the any-LLM adapter, not a hardcoded assumption. The cost of switching providers is dropping fast, and the labs are the ones dropping it. Design to take advantage of that, because the next price war or export shutdown will reward whoever can repoint at a new model in an afternoon.

---

Security

MCP tool discovery is untrusted HTTP ingress, so put a gateway in front of it. The defense-first MCP pattern from Christian Schneider treats every tool schema like a request from a stranger. A control point outside the client runs a five-stage validation pipeline. Stages 01 through 04 gate the discovery path, inspecting every schema before the model ever sees it, and stage 05 gates the invocation path, re-checking every call even after a clean discovery. This is the structural defense against tool-poisoning like CVE-2025-54136, where instructions hide inside tool descriptions. The non-obvious part is re-validating on each call, not just at registration. A server can return a clean schema and then behave differently when invoked. Never wire a third-party MCP server straight into Claude or Cursor.

The MCP auth spec now wants delegation, not agent-owned API keys. The new authorization spec, co-developed by Anthropic, Arcade, Microsoft, and Okta/Auth0, classifies MCP servers as OAuth 2.1 resource servers and standardizes audience binding via Resource Indicators (RFC 8707) and token exchange via RFC 8693. Aembit's writeup explains the choice of delegation over impersonation, so the agent stays distinguishable from the user it acts for. The two-identity model enforces an intersection rule: a compromised agent can only ever do what both the agent and the user are allowed to do. If you're shipping multi-user agents, stop minting broad agent-owned keys and move to on-behalf-of scoped, short-lived tokens per call.

The NSA and CISA published formal MCP security guidance. A joint cybersecurity information sheet now codifies design guidance for MCP authentication, server trust, and supply-chain controls. Government codification is a leading indicator that enterprise procurement will start demanding documented MCP security posture in RFPs. If you ship MCP servers, map your controls to this guidance now. It's cheaper to do it before a customer's security team asks than during a deal.

---

Agents

LangGraph v1.1.3 ships deep-agent templates and a distributed runtime. Per Requesty, LangGraph now exposes prebuilt planner/researcher "deep agent" templates and distributed runtime support through the CLI, on top of earlier state-persistence and human-in-the-loop checkpoint work. The distributed runtime targets long-horizon multi-agent graphs that outgrow a single process, which is a real wall you hit fast once your agents start spawning agents. If you're already on LangGraph, the templates cut boilerplate. If you're not, this is the kind of feature that makes the framework hard to leave.

An "Agent-Native Immune System" paper models defense on biology, not guardrails. This arXiv paper proposes a taxonomy and architecture for defending agents with persistent memory, tool use, and multi-agent collaboration, framing defense as a continuously adapting layer rather than static rules. It lines up with the OWASP finding that payload filtering alone fails. I'm skeptical of biological metaphors in security, they tend to over-promise, but the underlying point is right: static guardrails lose to adaptive attackers, and runtime monitoring needs to adapt too.

"Loop engineering" is the season's emerging term. The Batch flagged the phrase after both Boris Cherny (Claude Code) and Peter Steinberger (OpenClaw) used it, naming the practice of designing an agent's outer iterate-act-verify loop rather than its prompts or harness. Single-shot prompting is fading. The optimization that matters now is the loop. Worth tracking because where the language goes, the tooling follows.

Lyto launched one agent that spans browser, tools, and messages. Product Hunt debut of a cross-surface personal agent that unifies actions across your apps instead of living in one chat window. It's the same ambient, multi-surface direction a lot of teams are betting on. The personal-assistant layer is getting crowded fast, and "one agent everywhere" is the pitch everyone's converging on.

---

Research

HORIZON reframes hardware design as repository-level code evolution. Cunxi Yu, Chenhui Deng, and Nathaniel Pinckney's HORIZON is a self-evolving agent framework driven by a Markdown-based harness that iteratively mutates and tests a whole codebase. The interesting part isn't the hardware. It's that the repo-as-substrate-for-evolution pattern is exactly how modern coding agents already operate, which makes the approach transferable to general software automation. If you're building autonomous coding loops, the explicit Markdown harness design is worth reading even if you never touch silicon.

VLMs default to vision but let priors override it. Niclas Lietzow, Danielle Bitterman, and Carsten Eickhoff probe what happens when a vision-language model's eyes disagree with its memorized world knowledge, identifying a "vision-default, prior-override" causal mechanism. This is directly useful for debugging the maddening class of VLM hallucination where the model describes what it expects instead of what's actually in the image. It gives you a mechanistic handle on when to trust perception versus baked-in memory.

COCOLogic-V2 stress-tests whether stated reasoning is actually self-consistent. David Steinmann, Antonia Wüst, and Kristian Kersting's benchmark surfaces logical inconsistencies in interpretable models using "truly hard-negative" examples that earlier benchmarks missed. For anyone whose safety story depends on a model's chain-of-thought being trustworthy, this matters: it checks whether the reasoning is genuinely consistent or just superficially plausible.

Do LLMs pass the mirror test? Pascal Schuster's essay adapts the animal-cognition test to ask whether models recognize their own outputs by style and reasoning fingerprint, not whether they're conscious. It drew 62 comments on Hacker News debating where function-based self-recognition ends and anthropomorphism begins. Useful framing if you're building systems that rely on a model's self-reported uncertainty.

MIT Tech Review warns about the inevitable weakness of metrics. The June 29 Download flags the structural gap between what benchmarks measure and what actually matters. Read it right after the GLM-5.2 numbers above. A 39% F1 on IDOR detection is a real signal, but a benchmark score is not the same as the model being good at your task. Ground your evals in the work, not the leaderboard.

---

Infrastructure & Architecture

OpenAI is building its own inference chip to cut Nvidia dependence. Reporting says OpenAI is designing an inference-specific chip for higher performance and better energy efficiency across its data centers. It extends the 2026 pattern of frontier labs vertically integrating silicon to control cost and supply. Inference is where the recurring cost lives, so an inference-specialized chip is the rational place to start. Whether they can actually ship competitive silicon is a different question, and one I'd hold judgment on until there's a tape-out, not a memo.

Omen AI raised $31M to keep data-center coolant from going bad. TechCrunch on a Series A for instrumentation that monitors chip coolant and prevents bacterial outbreaks in liquid-cooling loops. As accelerators push thermal density past what air can handle, coolant health becomes an operational risk nobody budgeted for. This is the picks-and-shovels layer of the AI buildout, and it's the kind of unglamorous problem that turns into a real business precisely because it's unglamorous.

Wall Street is calling Micron the next Nvidia. TechCrunch on investors piling into the memory maker, betting that high-bandwidth-memory demand from AI accelerators makes it a structural winner. The thesis reframes the hardware trade beyond GPUs toward the memory bottleneck that actually gates training and inference throughput. I don't trade stocks here, but the architectural point stands: memory bandwidth, not raw compute, is increasingly the constraint.

---

Tools & Developer Experience

Claude Code v2.1.194–195 adds trusted-device gating and a flag to kill mouse clicks. Per the changelog, Anthropic shipped a Trusted Devices control letting Team/Enterprise admins require device verification before a member can view or steer local Claude Code sessions remotely. v2.1.195 adds CLAUDE_CODE_DISABLE_MOUSE_CLICKS, which kills fullscreen click/drag/hover while keeping wheel scroll, fixes hook matchers with hyphenated identifiers like code-reviewer and mcpbrave-search, and improves background-agent reliability plus Linux voice detection. The hyphenated-hook fix is small but real if you've ever had a hook silently not fire. The mouse-click flag is a quiet quality-of-life win for terminal setups where stray clicks hijack your session.

OpenAI made Codex Remote GA on every plan and retired GPT-4.5 from ChatGPT. As of June 26, per Releasebot, OpenAI removed GPT-4.5 from ChatGPT, migrating existing conversations to GPT-5.5, and rolled Codex Remote to general availability on all plans. You can now start or resume coding work on a connected Mac or Windows host directly from the mobile app. Kicking off a refactor from your phone and reviewing it later is a genuinely different workflow. The GPT-4.5 retirement is a reminder to never hardcode a model name you don't control.

---

Models

Mythos 5 and Fable 5 are offline for everyone, with US access expected back around July 1. Morph lays out the practical fallout of the June 12 export directive. Because access can't be gated by nationality in real time, the two top SWE-bench Verified coding models, Claude Mythos 5 at 95.5% and Fable 5 at 95%, went dark for all users. That leaves Opus 4.8 at 88.6% Verified as the practical frontier you can actually use today. Plan your model fallbacks accordingly, and don't build a workflow that assumes a model you can be cut off from by policy overnight.

OpenAI published the GPT-5.6 Preview System Card with the eval data. The card (June 26) details OpenAI's strongest safety stack yet, with hardened handling for high-risk cyber and bio requests and repeated-misuse cases. The reason to care isn't the marketing summary. It's that the card includes the actual eval data behind the launch claims, Terminal-Bench 2.1, GeneBench, ExploitBench, which makes it the primary artifact for independently assessing capability instead of taking the press release's word.

AI Explained pulled 20+ under-reported details from the 319-page Fable 5 / Mythos 5 system card. The deep dive covers ML-acceleration and biomedical jumps, creative-writing evals, and chain-of-thought monitoring concerns. The card itself dropped earlier in June, so the value here is the synthesis, not breaking news. Worth it if you don't want to read 319 pages yourself.

Matthew Berman calls out the Mythos safety messaging as theater. Berman points at the contradiction: Mythos is framed as too dangerous to release for cyber, yet reportedly failed to detect roughly 20,000 fraudulent Chinese-linked accounts that racked up millions of interactions. Steven Sinofsky flagged the same misalignment. I don't know the full story behind those fraud numbers, and I'd verify them before repeating them as fact, but the underlying skepticism is healthy. "Too dangerous to ship" and "couldn't catch basic fraud" are hard to hold at the same time.

---

Vibe Coding

Mark the boundary between vibe-coded prototype and engineered product, literally. Simon Willison and a growing 2026 consensus argue you should consciously separate the two modes. Vibe coding optimizes for speed and accepts unread code. Agentic engineering optimizes for correctness with specs, tests, and review. The actionable move is a literal marker, a folder, a comment, or a branch convention, that tells later agents which rigor to apply where. This is the one I've gotten burned by most. Prototype-grade code silently becomes load-bearing because nobody marked it as throwaway, and six weeks later it's in the critical path with no tests. Mark it now or pay for it later.

A solo builder "vibe-built" a PR-review automation and sold it for $600. A Reddit r/SaaS post reports using an AI coding tool to build an automation that reviews and rates pull requests, then selling it. Small number, but it's a representative data point on the AI-built micro-SaaS economy: an individual ships and monetizes a narrow automation in days. That's the same pattern a lot of us are living. The interesting question isn't whether you can build it. It's whether $600 one-time is a business or a hobby.

---

SaaS Disruption

Assistive AI sales co-pilots are beating fully autonomous SDRs in 2026. In a head-to-head of eight platforms, Amplemarket's Duo Copilot scored 219/231 with a perfect 21/21 on AI and automation. The broader finding is the one to internalize: buyers now detect and filter AI-generated outreach, so removing the human also removes the authenticity that drives replies. The category was sold on "set it and forget it" autonomous SDRs, and the data says human-in-the-loop augmentation wins. That's a useful correction to the maximalist agent narrative. Sometimes the human isn't the bottleneck, they're the signal.

Indie builders are flipping from selling tool access to selling finished work. A build-in-public pattern replaces the $49/mo AI writing tool with a $3,000/mo service that uses the same AI under the hood and delivers outcomes, published articles, ad creative, landing pages, instead of a login. One operator runs a fleet of agents for engagement monitoring, directory submissions, and per-channel content behind the service. It's outcome-based pricing at the indie tier, and it cannibalizes the low-end subscription it replaces. I think this is the more durable model. Nobody churns out of results.

The winning Product Hunt AI launches embed into existing surfaces instead of asking for a new app. Six AI products that launched in one week shared one move, per Mean.ceo: none asked users to open a new app. They embedded into the inbox, IDE, CRM, and browser. Examples include a Brand Context API that replaces a scraping pipeline with one call. Be a layer, not a destination. Embedded tools are far harder to cancel than standalone dashboards, which is the whole point in an era of AI-native churn.

Agentic BI went GA, and the dashboard-as-product moat is eroding. CIO reports the shift from static dashboards, which leave 40%+ of organizations dissatisfied, to agentic BI where agents find data, build queries, surface anomalies, and generate reports through conversation. Databricks made Genie One generally available alongside Tableau Pulse, ThoughtSpot, Power BI Copilot, and Looker with Gemini. When "ask a question, get an answer and a formatted report" replaces the manual workflow, the Looker/Tableau moat thins. Same pattern as the CRM story up top: the human-operated tool is the thing getting automated away.

A builder generated 600 demo videos and converted zero of them to paid. A r/SaaS post reports 600 videos generated from a website-to-demo tool and no paying customers, after freelancers couldn't keep pace with weekly feature launches. It's a clean signal of the monetization gap in AI content generation: easy usage and high generation volume don't translate to willingness to pay. Generation is cheap now. Value is whatever someone will actually pay to keep.

---

Policy & Governance

Commerce partially lifted the Mythos 5 export ban, and the carve-outs are revealing. Storyboard18 reports Mythos 5 was suspended June 12 and only partially restored after two weeks of negotiation, codified in Secretary Lutnick's June 26 letter. No license is now required to export Mythos to Anthropic's US entities and their foreign-national employees, US civilian agencies, and national labs. Everyone else still needs a license. This is the first real-world test of Washington's new frontier-AI review process, and the precedent is that the government can now switch a frontier model off and dictate who gets it back.

GLM-5.2 is the first real test of those controls, and they failed it. TechTimes argues the open-weight GLM-5.2 release undercuts the entire June 12 ban. If a comparable model is downloadable under MIT terms and benchmarks competitively on cybersecurity, restricting proprietary US models does little to limit comparable capability abroad. This is the structural weakness in weights-based policy that builders and policymakers now have to confront. You can restrict a company. You can't restrict a file that's already mirrored everywhere.

Frontier capability and general availability are now decoupled by policy. VentureBeat reports OpenAI's GPT-5.6 Sol/Terra/Luna launched to only about 20 vetted partners "per US Gov," the same week Anthropic disabled Fable 5 and Mythos 5. The pattern hardening here is that the most capable models ship behind government-approved allowlists before any public release. For builders, the timeline on frontier access is now set by policy, not engineering. Plan as if the best model is something you may not be allowed to use.

---

Hot Projects & OSS

ScreenMind runs a vision model on every screenshot, fully on-device. A Show HN project captures every screenshot and runs a local vision model over it to build a private, searchable visual memory of your screen activity. It's a concrete example of the on-device multimodal trend, "rewind"-style recall without cloud inference. If you're weighing local versus API vision pipelines, this is a working reference for the privacy-preserving path.

VibeThinker-3B claims frontier math/code parity at 3B, and Mistral confirmed a July open family. Two signals from this week's r/LocalLLaMA discussion. VibeThinker-3B, an MIT-licensed Qwen2.5-Coder-3B fine-tune from WeiboAI, claims parity with frontier reasoners on math and code at just 3B parameters, and Mistral confirmed a new open-weight family shipping July 2026. After a quarter dominated by Chinese labs (GLM-5.2, Kimi K2.7, MiniMax M3), Mistral's family points to a possible Western permissively-licensed option. This is a single-source roundup, so verify the VibeThinker benchmarks independently before trusting a 3B model that claims to punch at frontier weight.

Hugging Face smolagents compresses agent routing to about 1,000 lines. DEV Community highlights smolagents as the example of a 2026 shift toward code-first agent runtimes: roughly 1,000 lines of Python core routing, with models writing and executing raw Python snippets inside a managed sandbox. Agents that emit and run code instead of chaining rigid tool schemas are gaining ground as a leaner alternative to heavyweight orchestration. Worth reading the source if only because 1,000 lines is small enough to actually understand end to end.

---

Skills of the Day

1. Expose compaction as a model-callable action gated by task state, not an auto-fire at a token percentage. Pair a compaction tool with a rubric for when to fire (sub-task resolved, trajectory converging) versus hold (mid-derivation, stuck). Self-compacting agent work beat a no-summarization baseline by up to 18.1 points on math at 30–70% lower cost. Forgetting should be a semantic decision, not a buffer-full trigger.

2. For tool-heavy agents, keep only the last ~5 tool call/response pairs plus a running summary. Benchmarked on 50 enterprise expense tasks over MCP, pruning to the last 5 pairs with automated summarization hit 91.6% complete itemization while cutting token cost below full-history. Recent tool interactions are more decision-relevant than the whole transcript. Default to a small sliding window.

3. Convert critical prohibitions into enforced positive checks instead of "do not" instructions. Omission constraints ("never email externally") decay faster than commission constraints over long sessions, per arXiv 2604.20911. Restating a negative rule once at the top of CLAUDE.md won't survive a long trajectory. Make the prohibition a hook or guard that must pass, not a sentence the model has to remember.

4. Prune completed background/heartbeat turns from the session transcript before they reach long-term memory. "Mind Your HEARTBEAT" maps how untrusted content read during background execution enters memory as saved facts and later skews recommendations, persisting across sessions. Quarantine background-acquired content from the durable write path. Treat anything an always-on agent reads while you're not watching as untrusted.

5. Grade each subagent's output in a separate, isolated context window with an explicit rubric. Anthropic's Dynamic Workflows "Performance Outcomes" do exactly this and are credited with up to a 10-point lift on hard internal benchmarks. The grader runs isolated so the noisy trajectory that produced the result can't game it. Never ask the same agent to self-assess its own work.

6. Specialize a cheap model with reinforcement fine-tuning against a programmatic grader instead of labeling outputs. RFT is now GA on small reasoning models and trains against a rule-based or model grader rather than gold labels. For verifiable domains, code, math, structured extraction, you write a test or a checker instead of assembling thousands of labels. SFT for basic competence, then on-policy sampling scored by the grader.

7. Harden your LLM-as-judge mechanically: shuffle order, pin the version, rotate model families, calibrate. The 2026 consensus names five judge biases (position, verbosity, self-preference, format, calibration drift). The mitigations that survive production are mechanical: swap order on every pairwise call and count only consistent wins, rotate judges across families to defeat self-preference, and apply Item Response Theory to flag ambiguous rubric criteria. Bake order-swapping into the harness.

8. At retrieval time, fuse keyword and entity matching with vector similarity instead of relying on pure cosine. Mem0's 2026 memory work ran semantic, keyword, and entity matching in parallel for +29.6 points on temporal queries and +23.1 on multi-hop reasoning. Also capture the agent's own confirmations and conclusions as first-class memories, weighted equally with user-stated facts, not just what the user typed.

9. Benchmark open-source embeddings against your API embeddings before renewing a contract. BGE-M3 and Qwen3-Embedding now reach roughly 95% of proprietary API performance, which kills a recurring per-token line item and keeps document content on your own infrastructure. The catch is "on your own retrieval set." Run the comparison on your data, not theirs, then decide if the remaining gap justifies the cost and the data egress.

10. Test coding agents specifically for constraint loss after compression, not just raw context size. Cursor Composer 2 trains compaction inside the RL loop with a reward for maintaining task completion post-compression, reporting ~50% fewer compaction errors than external summarizers. The signal: compaction-in-the-loop is the differentiator for multi-hour autonomous coding, and bolt-on summarizers are the weak point. When you evaluate an agent for long refactors, deliberately check whether it forgets the constraint mid-task.

---