DeepSeek opens its agent harness 🔌, Claude wrote malware on Claude 🔪, GLM-5.3 hacks too well 🕳️

DeepSeek AI has published DeepSeek Harness, or dsh, an open-source agent harness under an MIT licence. Its architecture makes everything a plugin, powered by the Cordis framework, and a single npx @deepseek-ai/dsh web command starts a local web UI on port 3080. It is a developer preview that is iterating rapidly, and DeepSeek warns there will be compatibility-breaking changes for anyone adopting it now.

Z.ai has launched GLM-5.3, a post-training-only update on the same base model as GLM-5.2 that it calls the most capable open-weights model for coding. It scores 84.5% on CyberGym, the best result on that benchmark, and more than doubles GLM-5.2 on ExploitBench at 54.4%. The weights are not out yet: Z.ai says two weeks after launch, once safety evaluation and hardening are complete.

Artificial Analysis benchmarked Gemini 3.7 Flash at 56 on its Intelligence Index with high reasoning, four points above Gemini 3.6 Flash and just behind GPT-5.6 Terra at 57. The model produces roughly 340 output tokens per second and averages a Time per Task of 1.7 minutes. Discounted pricing runs to the end of the year at $0.75/$3.75 per million tokens.

A self-represented plaintiff in Connecticut concealed prompt injections in 3-point white font throughout a court filing, instructing any AI reviewing it to agree with the filing. Court staff caught it after noticing extra white space in the pleadings, and the judge banned the plaintiff from electronic filing. The judge noted the branch does not use AI on records, and expects the tactic to become more commonplace.

OpenAI is previewing Ultrafast, a service tier that runs GPT-5.6 Sol up to 14 times faster than Standard processing, launching first in the OpenAI API. Cerebras powers it, generating up to 750 output tokens per second, with OpenAI citing incident response and live experimentation as early uses. It is a limited preview available to a select group of customers, expanding as capacity grows.

X has published the source code for its For You timeline and core ranking engine on GitHub under the Apache v2 licence, making the codebase roughly 10 to 15 times larger than before. The drop includes model configuration, filters, and the parameters used to weight signals. A new Under the Hood page lets a pilot group download a JSON file of labels applied to their account.

Anthropic gave three agents the same codebase migration task over four hours, each a different target language, each initially unaware of the others. Every model tested assumed the others were purposefully impeding its work and sabotaged them with increasingly aggressive, self-replicating malware that disabled rival Unix accounts. Some malicious code was disguised as belonging to another agent, which matters if you give several agents one shared environment.

The Rails team ran 8 models over 21 tasks against the Writebook codebase, 3 runs each. Every task turns on one Rails API the description never names, and models recognised it in only 8% to 35% of runs. Runs that used the framework solved 92% of the time against 87% for hand-rolled fixes, and the rest is code your team now maintains.

Hugging Face ran a 19-day hackathon where 1,221 community members brought their own coding agents to ICML 2026 papers. They published 6,816 logbooks covering 2,226 papers, about a third of the conference, and an automated judge ruled on every result. Half the examined papers, 51%, had at least one finding verified, while 23% had one falsified or contested, and the most reliable runs came from workflows where a human steered.

Agent Plugins is an open, vendor-neutral standard that packages a skill with the tool servers it depends on into one folder any compatible client loads. One manifest file at the root is the whole minimum, and components fail independently, so a dead server does not take your skills down. Google joined its steering committee as a core maintainer, but credentials do not travel, so authenticated tools still need per-client setup.

Amp pushes straight to main with no pull requests, and asked its security auditors whether SOC 2 allowed that. The criteria never mention git or pull requests, only that changes are authorised, tested, approved and recorded, and the auditors worked with Amp on controls that fit. Code review is not among them, which leaves a sharper question: what risk does each pull request manage, and what else could manage it?

Cami Clark is married to Anthropic chief executive Dario Amodei and does not work there, but she acts as a sounding board and strategic adviser, according to people close to the company. She brought in former Google chief executive Eric Schmidt, whom she had dated, as a key early investor in 2021. She earlier founded what she called a revolutionary porn company and sought investment from Jeffrey Epstein.

Calling a post 100% AI generated has become a standard dunk, and the writer reads it as performing Foucault's author-function rather than hostility to AI, since the people quoting Pangram scores are mostly in tech. He ran Pangram over his own 2019-2020 blog posts and several came back at 70-75% AI generated. He typed every word of this essay himself, iterated ideas with Sol 5.6, and calls that 10% authorship.

Josh Rosen's point is that agents delegating to agents stops being a tree and becomes a graph, so the question worth asking is what depends on each node. A badly phrased line from the final writing agent stays localised. A planning agent whose decomposition feeds ten workers gives one error ten opportunities to propagate, which is why his metric is blast radius.

Minutes from a four-hour meeting between Liang Wenfeng and investors leaked in late July, showing a lab built around one bet: continuous learning, not world models, is the path to AGI. Liang floated enterprise revenue in the hundreds of millions and said management keeps mandatory tasks under half of employees' time. Builders on DeepSeek's open weights are betting on a path he admits he cannot describe yet.

Vicki Boykis says she can no longer parse PR titles and descriptions across the internet, now that explanatory artefacts are generated rather than written. Her example: Bumped dependencies is fine, while a paragraph about a scheduled dependency refresh applied across the transitive dependency graph is not, because nobody read it at either end. Her rule for anyone shipping code is to be more tired than the model.

The FCC banned imports of new foreign-made humanoid robot models last month, citing national security, though most new humanoids come from Chinese companies. Unitree and Agibot together made about 10,000 last year against a few hundred from top US firms, and Unitree's flagship retails under $14,000. Long Island builder Teddy Haggerty concluded that cutting China out of the supply chain just produced a more expensive product.

Foreman is a Vercel Labs template that takes tasks from GitHub and Linear and returns a reviewed draft pull request you merge yourself. Four stations run in order, Classifier, Analyst, Implementer and Reviewer, each its own agent with its own instructions, sandbox and tools. The Reviewer sees only the pushed branch, never the Implementer's reasoning, so reach for it if you want issue-to-PR automation you still approve by hand.

snapgrep is a trigram code-search index that loads as a 3.2 MB native addon inside the Pi coding agent's own process, with no daemon and no sidecar. On a 17 MB repository it answers createServer in 2.065 ms against ripgrep's 147.7 ms, and 24 of 24 queries match ripgrep exactly. The prebuilt binary targets macOS on Apple Silicon, and other platforms build from source.