DeepSeek open-sources its agent runtime at 82k stars, Google drops Gemini 3.7 Flash at half price, and the trust layer between agents and tools finally gets serious.
Three companies shipped agent harnesses in one week. We're past the "agents are coming" phase — we're now arguing about which runtime wins. The model is table stakes; the orchestration layer is the new battleground.
DeepSeek released Harness (developer preview), an MIT-licensed agent runtime built on an "everything is a plugin" architecture. Within days it hit 82.7k GitHub stars and 7.3k forks — making it the fastest-growing agent framework in open-source history by a wide margin.
The design is opinionated in ways that matter. A Cordis kernel manages plugin lifecycles, where every capability — models, tools, sandboxes, storage, scheduling, UI — is a swappable module. An append-only session log captures everything the model sees: system prompts, reasoning traces, tool calls and results, subagent scheduling, and context injections. You can resume, fork, search, or replay any session from that single event stream. This is the kind of observability that production teams have been building in-house for months; DeepSeek just standardized it.
Four runtime modes ship out of the box. Standard gives you the full toolset (file editing, shell, search, skills, planning, goals, subagents, workflows). Code mode exposes tools via a TypeScript SDK so the model can compose multi-step operations into a single program — not sequential tool calls, but actual programs that orchestrate them. Minimal strips down to persistent bash and a text editor for clean benchmarking. Creator mode lets you build custom agent presets by inspecting the runtime and experimenting with plugin combinations.
Why this matters more than "another framework": DeepSeek is simultaneously the model provider AND the runtime author. When the same team owns both sides of the agent stack, they can optimize the model's tool-use behavior for the harness's specific calling conventions. Anthropic did this with Claude Code. Google is doing it with Gemini Spark. DeepSeek is doing it in the open, with MIT licensing and a community plugin ecosystem tagged dsh-plugin on GitHub. The question is whether that openness holds as the ecosystem grows and competing models want in.
The timing isn't coincidental. The same week, YC-backed QM shipped a multiplayer agent harness (13.5k stars) focused on team collaboration — shared agent workspaces where personal scopes meet shared channels. And Qwen Audio Agent hit v1.10 with a full-duplex voice runtime that keeps agents conversationally present while delegating tasks to backend workers. Three takes on the same insight: the model is done being the product. The runtime around it is.
The most underrated post this week came from a developer who built a policy engine that sits between AI agents and their tools — and tested it against 83 real agents across 10 frameworks. In a week dominated by harness announcements, this is the piece that addresses what everyone building agents is quietly worried about.
The problem is specific: current permission systems are binary. An agent either has database access or it doesn't. But context matters enormously. A DELETE FROM users WHERE id = ? is fine in staging. The same call in production with WHERE 1=1 is catastrophic. A file read on public documentation is harmless; the same tool reading .env is a security incident. Binary permissions can't distinguish any of these cases.
The stat that should concern every team shipping agents: only 18% of MCP server deployments implement any access scoping at all. And 80% of organizations admit agents have taken actions beyond intended scope. We're deploying systems with tool access and hoping prompt instructions are sufficient guardrails. They're not.
The gatekeeper intercepts every tool call through a five-stage pipeline: normalize, score, decide, explain, audit. Instead of allow/deny, it returns four possible decisions:
The critical design choice: the engine runs outside the model context. No amount of prompt injection can override a deny because the decision logic isn't in the prompt. It's a separate process with its own policy configuration, running in its own memory space.
The fail-closed principle is non-negotiable: unknown tool, deny. Malformed input, deny. Engine crash, deny. This inverts the common pattern where agent frameworks default to permissive execution and bolt on safety after deployment. Policy is configured via YAML or OPA/Rego backends, with three shipped posture presets (strict, balanced, permissive) and a shadow mode for observation without enforcement.
When denied, well-behaved agents replan — picking a less-dangerous alternative tool. Both decisions get audited, creating a trail showing the agent was redirected, not just blocked. The author tested this across LangGraph, PydanticAI, CrewAI, OpenAI Agents SDK, Google ADK, AutoGen, LlamaIndex, and smolagents using 206 targeted runs from a covering design that compressed 2,490 possible combinations while maintaining equivalent coverage across all frameworks, agent classes, and decision types.
The architecture lesson for anyone building production agents: stop thinking about tool permissions as access control lists. Think about them as a policy engine with context-aware, graduated decisions. The gap between "agent can use tools" and "agent can use tools safely in production" is exactly this layer — and almost nobody has built it yet.
DeepSeek Harness — MIT-licensed agent runtime with plugin architecture built on Cordis. Four runtime modes, append-only session logs for full traceability, model-agnostic plugin design. 82.7k stars, 12k+ commits, and a full test suite (unit, e2e, snapshot, stress). This shipped as a product, not a proof of concept. Install with npx @deepseek-ai/dsh web.
QM — Multiplayer agent harness for startups from YC Software. Each employee gets an isolated workspace; collaboration happens in shared channels and projects. Harness-agnostic — supports Claude Code, Codex, OpenCode, and Pi driving the same core. Three security postures (strict/auto/dangerous), Postgres-backed sessions, TypeScript/Fastify core. 13.5k stars, 1.6k forks.
Open-Kritt — AI vulnerability research platform that breaks security scanning into focused parallel agent tasks. Each agent runs in a disposable Docker container with root access, a writable repo copy, and internet — they can install tools, compile targets, run tests, and build proof-of-concept exploits. Workflow builder chains prompts into reusable security playbooks. Built by researchers with $1.5M in bug bounty earnings across Immunefi and HackenProof. AGPL-3.0, 1.7k stars.
Qwen Audio Agent — Real-time voice runtime that keeps agents conversationally present during background work. Three-layer architecture: voice frontend (DashScope models or local STT/TTS pipeline), gateway for routing, and backend agents via ACP protocol. Supports 10+ backend harnesses including Claude Code and Codex. Full-duplex with natural interruption. Apache 2.0, 2.1k stars.
Three harness releases in one week (DeepSeek, QM, Qwen Audio Agent) tells me we've hit the "picks and shovels" phase of agents. The models are good enough. The constraint moved to runtime: session management, tool orchestration, sandboxing, multi-agent coordination, and — critically — trust boundaries between agents and the systems they touch.
Look at what Google did with Gemini 3.7 Flash: 33% better on software engineering benchmarks AND half the price. That's the model layer commoditizing in real time. When the intelligence is cheap and getting cheaper, the value accrues to whoever controls the execution environment — the thing that turns a smart autocomplete into a system that can actually do work.
The winner won't be whoever has the best model. It'll be whoever builds the best plugin ecosystem and the smoothest developer experience. DeepSeek betting on MIT and a community plugin tag is the right structural play. But 82k stars doesn't mean 82k contributors, and an "everything is a plugin" architecture only works if third-party plugins are actually good. The JavaScript ecosystem proved that model works; the question is whether AI infrastructure can sustain the same bazaar-style development without the quality floor collapsing.
My money says "agent harness" becomes as standard a layer as "web framework" within 18 months. Every team building agents will pick one — and switching costs will be real. Choose carefully.
— Aaron
Complete guide to OCR-powered email classification systems. Extract text, classify attachments, and route documents to the right teams automatically.
AI EngineeringAgentic CRM lets AI agents manage customer workflows directly. Compare its architecture, deployment model, and open-source trade-offs.
AI EngineeringNarrative traction tools compared: YouTube Analytics, VidIQ, TubeBuddy, Descript Underlord, Valossa on engagement metrics, cost, and workflow.
Content Analytics