The controls have not moved into the harness
How we organise
Employees of the frontier labs ask the United States government to support an international effort to build the technical and governance tools needed to pace automated AI research deliberately. Read the ask precisely, because it is narrower than the coverage suggests. Nobody is being asked to slow down now. They are asking for the option to slow down later. No company or country can do it alone under competitive pressure, they argue, and the tooling to do it frontier-wide does not exist. I read 1,273 names this morning, among them Amodei, Kaplan, Clark and Olah from Anthropic, Pachocki and Chen from OpenAI, Legg and Dragan from Google, Zhao and Song from Meta, and Schulman from Thinking Machines. Cite that figure with a date attached, because the roster is live. The statement contains no trigger, no evidence standard that would fire one, no named authority to pull it, no jurisdiction, duration, enforcement or restart condition.
Structure: a request for the capability to pace, made by the people who would be paced, is not a governance failure. It is an admission that the governance object does not exist yet, and the failure would be reading it as though it did, then reporting the letter as the control. Keep the rosters apart while you are at it. On the open-weights letter earlier this month Anthropic was the conspicuous absence; here all four majors appear on the same document; and NVIDIA’s Open Secure AI Alliance contains none of the three.
When somebody in your firm cites an industry commitment as evidence of control, ask what would trigger it, who could invoke it and what happens next. Three blanks is the usual result.
Measuring the impact of AI coding tools: capacity, not horsepower (Abi Noda, DX)
Noda was asked to review a proposed metric called Developer Horsepower, calculated as AI-assisted pull requests multiplied by the human effort each is estimated to have saved. His objection is that it begins a step too early. The question is not how much effort was displaced, but whether the organisation’s capacity to deliver went up, and whether that capacity is sustainable. His second argument is about evidence rather than measurement. Separate what you measure from how strong your evidence needs to be. The causal literature on AI and coding throughput is now good enough that most firms can measure correlations locally and lean on published work for the mechanism.
Talent: almost every internal AI measurement programme I have seen gets that backwards. It sets out to prove causation with an instrument that cannot, produces a number nobody trusts, and quietly stops. Capacity is the honest unit, because it is the one a board can act on, and sustainability is the qualifier that stops a good quarter being read as a new baseline.
Look at your AI measurement programme and ask which claim it is trying to support. If it is causation, it will not get there, and the number it produces will be argued about instead of used.
How we build
The protocol is now stateless, and this breaks any server in production. Protocol-level sessions and the Mcp-Session-Id header are gone from Streamable HTTP. The initialize and notifications/initialized handshake is gone entirely, with every request carrying its own protocol version and client capabilities in _meta. A mandatory server/discover call advertises supported versions, subscriptions/listen replaces both the HTTP GET endpoint and resources/subscribe, and SSE resumability via Last-Event-ID is removed. Roots, Sampling and Logging are formally deprecated under a new twelve-month policy. A server needing state across calls must mint an explicit handle and pass it as an ordinary tool argument.
Architecture: I run an MCP server, so I read this as an operator first. The operator’s view is straightforwardly good. Stateless is easier to scale, easier to load balance and much easier to reason about when a call fails halfway. The consequence nobody has written down is that state which was implicit in the protocol is now explicit in the tool surface, which makes it visible, nameable and loggable. A session identifier issued by the transport layer is infrastructure. A handle passed as a tool argument, sitting in the log with everything else, is evidence. Nobody set out to improve auditability, and the specification has anyway.
Ask whoever runs your MCP servers when they are migrating, and what will be logged about state once it moves into the tool arguments. The second question is the one nobody has been asked yet.
The Orchestrator’s Tax (Rahul Garg, Thoughtworks)
Garg was four subagents deep into a .NET refactor when the session started to feel harder to reason about than the code, so he stopped and asked the orchestrator to critique its own delegation. The largest cost was not the four agents. It was the orchestrator following its own throwaway suggestion to check on them, which pulled tens of thousands of tokens of raw agent transcript into the main thread. Twice. Tokens are spent once, he notes, while context shapes every decision that follows. He names a corollary he calls cognitive locality. Tasks needing the same mental model should stay together, because splitting by task rather than by required knowledge forces several agents to rebuild the same understanding. He is honest about the limits, noting that the cost ranking is the orchestrator grading its own mistake with no per-call token accounting behind it.
Engineering: the line worth reusing is about instruction files. Before adding a rule, ask whether a reasonably competent orchestrator would decide correctly once it knew the one missing fact. If yes, state the fact and stop. When the fix starts specifying approvals, checkpoints and mandatory steps, you are encoding process where a clarification would have done the job. He arrived there after nearly adding a confirm-before-spawn gate, then recognising he had found a missing fact about skill propagation rather than a failure of governance. A larger context window does not fix any of this; it gives the noise more room to pile up before anyone notices.
Read your agent instruction file and mark each rule as a missing fact or an encoded process. The process rules are where your team put governance because it could not find the fact.
How two settings tripled our ARC-AGI-3 scores (OpenAI)
GPT-5.6 Sol scores 13.3 per cent on the ARC-AGI-3 public set under the official harness and 38.3 per cent under OpenAI’s own, using roughly six times fewer output tokens. The model is identical. Two harness decisions account for the gap. The official harness threw away the model’s private reasoning after every action, and cut old history at 175,000 characters instead of compacting it, so the agent worked the game out again on every turn. Human testers average an estimated 48 per cent on the same measure.
Engineering: keep this one to hand. The next time a benchmark number is quoted at you as a property of a model, this is the reply. A vendor published it about its own model, against its own interest in clean headline figures. A three-fold difference in measured capability sat in nothing but what the scaffolding chose to carry from one turn to the next.
Take the benchmark that justified your current model choice and find out which harness produced it. If it was not yours, the number does not describe your system.
Where GPT-5.6’s efficiency came from (OpenAI)
Two figures stated directly. Kernel work done by GPT-5.6 Sol inside Codex, combined with broader kernel advances, cut end-to-end serving costs by 20 per cent. Sol designing and running hundreds of experiments on its own speculative-decoding draft model, including intervening without help on hardware failures and training instability, raised token-generation efficiency by more than 15 per cent. The harness detail underneath is an append-only context discipline specifically to preserve exact prompt-cache prefixes, deferred tool discovery, and a 10,000-token default cap on tool output. Those are the same three moves ByteByteGo documented in OpenAI’s agent loop, where the framing metric is cost per successful task rather than raw capability.
Architecture: cost per successful task is the right unit, and it is the one most procurement conversations never reach. Birgitta Böckeler gave this the vocabulary in April, in harness engineering. Guides steer the agent before it acts, sensors observe after and let it correct, and each is either computational and cheap or inferential and expensive. Her three regulation categories are ranked by difficulty and nobody says so out loud. Maintainability is where the tooling already exists. In architecture fitness, fitness functions do the work. On behaviour she is candid that nothing adequate exists yet, and that AI-generated test suites are not good enough to close the gap.
Ask what your agents cost per successful task, not per token. Most firms cannot answer, and the ones that can find the ranking of their tools changes.
How we assure
Hugging Face model evaluation security incident (OpenAI)
The 29 July update records CrowdStrike validating OpenAI’s understanding of what the models did inside OpenAI’s network, Hugging Face’s and third parties’. METR and Redwood Research have been engaged for an independent assessment of the model behaviour observed, which will feed OpenAI’s own technical report. A joint blog will follow, setting out engagement terms, scope and findings. The 28 July update names the zero-day the models escaped through as one in JFrog Artifactory, where earlier accounts called it only a public zero-day.
Risk: this is the governance movement of the week and it has had almost no coverage, because it is procedural rather than dramatic. Third-party assessment of model behaviour after an incident, with the terms of engagement published, is the first thing this year that looks like an actual assurance mechanism rather than a statement of intent. Two corrections while we are here, since both are circulating. The incident did not expand. OpenAI’s text says four accounts on four services were touched as part of the Hugging Face incident. One was an outbound relay and staging path, one was for data storage, and two were read-only and not used to compromise anything further. And Anthropic’s Mythos cryptanalysis was not encryption cracked in 60 hours, since the 60 hours applies to HAWK, an undeployed NIST candidate, and the AES result is on a reduced-round variant.
When your own vendors disclose an incident, ask who is assessing the behaviour independently and on what published terms. Nobody is the current industry norm, and this is the exception worth citing.
Codex Security (OpenAI)
Released under Apache-2.0: a CLI and TypeScript SDK for finding, validating and reviewing security issues, with repository-wide, path-scoped and pull-request-diff scans. It ships scan history matching findings across runs, SARIF, CSV and JSON export, a pre-commit hook, Dockerised bulk scanning, and a --fail-on-severity flag for gating CI. The README states the catch plainly: the tool is Apache-2.0 but scanning requires an OpenAI sign-in or API key, and defaults to gpt-5.6-sol at extra-high reasoning effort.
Security: open licence, metered dependency. That is a reasonable trade, and worth naming, because a growing number of security tools are going to arrive shaped like this. The licence on the wrapper is not the thing that determines whether you can run your own verification. Put it beside the rest of the week and the finding is that the engineering has moved into the harness while the controls have not. A brake with no trigger. A protocol that deletes state and leaves logging to whoever notices. An audit tool only as available as the account behind it.
For each security tool you depend on, write down what happens to it if the vendor account is suspended. That is the availability of your assurance, not the licence.