AI This Week: Open Tools for Safer Agents

The model isn’t always the thing that needs upgrading. Google showed this week that rewriting an agent’s prompts, tools, and memory can lift a weaker model past a stronger one, and Perplexity open-sourced the sandbox it uses to keep its own agent in check. Anthropic previewed Claude Duet, an agent that comes to you with what needs your attention instead of waiting to be asked. Inception and MiniMax both launched fast, cheap models built for agents, Krea released an image model focused on editing, GitHub described developers shifting from operating tools to directing agents, and OpenAI posted big gains on COBOL and other legacy languages. Here’s the breakdown.

TL;DR

🤖 Agentic AI

Google Open-Sources a Framework That Improves Agents Without Touching the Model

Google Cloud AI Research has released Harness², an open-source framework (version 0.1.0, Apache-2.0) that improves an AI agent by refining everything around the model rather than the model itself. That “harness” includes the system prompt, guardrails, memory, tool guidance, subagents, skills, scripts and plugins, each exposed as an editable file. The model’s weights stay frozen throughout.

It is built for real-world deployment, where tasks arrive unseen and nothing confirms whether an answer is correct. For each task, the agent first runs with its base setup. An editor model then proposes two revised harnesses, one aimed at general failures like planning or tool use and one aimed at domain-specific knowledge. Both are tested on the same task, and only the changes supported by observed behaviour are kept. Lessons from each task are saved to a shared library that informs future revisions.

Across three professional benchmarks, a single refinement step improved every model and harness pairing tested. The biggest jump came from GLM-5, which rose from 64.2 to 75.7 on WorkBuddy-Bench, enough to overtake the unrefined Gemini 3.5 Flash. Weaker models gained the most. The trade-offs are extra runs per task and the need for developers to sandbox the system themselves.

Why it matters: Most conversations about agent performance still centre on which model to buy. Harness² suggests a lot of the gap lives in the scaffolding, and that a cheaper model with a well-tuned harness can outperform a stronger one used off the shelf. For organizations building agents, that shifts investment toward the configuration layer they actually own and control, rather than waiting on the next model release. It also raises a governance question: an agent that rewrites its own prompts, guardrails and tools mid-deployment needs clear review and containment, especially when guardrails are among the files it can edit.

Perplexity Open-Sources SPACE, the Sandbox Behind Its Computer Agent

Perplexity has open-sourced SPACE, the in-house sandbox platform it built in July to replace the commercial provider powering its Computer agent. A sandbox is the isolated workspace where an agent runs code and handles files, and SPACE is designed to contain an agent’s actions independently of whatever safeguards exist in the model itself.

Each SPACE sandbox runs inside its own small virtual machine, coordinated by a central control plane. The platform treats the sandbox as untrusted, so network access and credentials are managed outside it, letting agents reach approved services without credentials ever sitting in their workspace. Frequent snapshots support pausing, resuming, recovering and branching sessions, and SPACE stores only changes to keep those operations efficient.

According to Perplexity, SPACE now handles millions of sandbox creations per day and creates sandboxes three to five times faster than its previous provider. In its own published security testing, agents made no successful escapes from the virtual machine to the host in 108 attempts, though some found ways around network restrictions; Perplexity says it fixed those gaps and they did not succeed in follow-up testing. Akamai has launched SPACE on its cloud platform, Crusoe plans to add it to its managed AI services and CoreWeave has published setup guidance for evaluation.

Why it matters: The core design principle here is the important part: assume the agent will eventually cross a line, and build the walls so it doesn’t matter. Keeping credentials and network control outside the workspace is a pattern any team deploying agents should be copying, whether or not they use SPACE. The test results are also instructive. The virtual machine held, but the network layer did not at first, which suggests that is where agent containment is most likely to fail in practice. With infrastructure providers already offering it, SPACE has a real chance of becoming a common baseline, though teams should still run their own testing rather than relying on a vendor’s self-reported evaluation.

Anthropic Opens a Research Preview of Claude Duet, a Proactive Agent App

Anthropic has launched a research preview of Claude Duet, a standalone app where Claude acts as a proactive agent rather than waiting for prompts. Built around Claude Opus 5.5 and aimed at professionals and small business owners, it sends a morning brief on priority items across connected apps, checks those apps every few hours and messages users only when something needs attention. It can also take on tasks ranging from scheduling meetings to building dashboards, financial forecasts and web apps. Access is by waitlist, starting with US Pro and Max subscribers, on iOS, Android and claude.ai.

Claude Duet runs on its own virtual machine with a browser, so work continues when the user’s devices are off. It carries over memory, skills and connected apps from a user’s Claude account and can draw on more than 6,000 connectors, including Gmail, Slack, QuickBooks, Gusto, HubSpot and Shopify. It reads, drafts and prepares work independently, but waits for approval before sending messages, making payments, signing documents or deleting anything. Some actions, like trading securities or moving money between accounts, are blocked even with approval.

On security, Anthropic says Claude Duet never directly sees passwords or sign-in tokens, and a new classifier blocks sharing of the most sensitive data, such as credit card numbers and government ID, while health or financial details are only sent on explicit instruction. Purchases go through Stripe’s Link using a virtual card. Anthropic acknowledges it may still misjudge what’s urgent, is weaker at personal errands and can’t yet show users its browser. Background checks also count toward plan usage limits.

Why it matters: Most AI assistants still wait to be asked. Claude Duet flips that, and in doing so it makes judgment the product: deciding what deserves an interruption is harder than completing a task, and Anthropic admits it is still tuning that. The design also echoes this week’s broader theme of containing agents through the system around the model, with credentials kept out of reach, hard limits on financial actions and approval gates before anything irreversible. The trade-off to watch is cost, since an agent that monitors in the background consumes usage even when it has nothing to report, which could limit how proactive users can afford to let it be.

💻 AI in Development

OpenAI Targets Legacy Code With Big Gains in COBOL and Fortran

OpenAI says its latest models are significantly better at working in low-resource programming languages like COBOL, Fortran and Visual Basic. These languages have far less public code and documentation for models to learn from than Python or JavaScript, yet they still run critical systems. OpenAI cites figures showing COBOL supports more than 40% of online banking systems and 95% of ATM transactions, while Fortran is used in weather forecasting and nuclear reactor safety analysis.

To measure progress, OpenAI built two evaluations. MultiLangBench asks a model to build a SQLite-compatible database engine from scratch in 20 languages. There, GPT-6 Astra averaged an 87.4% test pass rate, up from 26.8% for GPT-5.6 Sol, with COBOL the hardest language at 72.1%. The lower-cost GPT-6 Luna reached 40.3% at roughly 78% lower estimated API cost. OpenAI is releasing the MultiLangBench setup and test suite on GitHub.

The second evaluation tests whether a model can migrate COBOL programs to languages like Java, Python or Rust while producing byte-for-byte identical outputs. GPT-6.1 Sol hit 86.6% accuracy at low reasoning effort, compared with 5.4% for GPT-5.6 Sol, at 39% less cost. At higher effort, it reached 97.9%. OpenAI notes that production migrations still require expert review and testing against each system’s business rules.

Why it matters: Legacy modernization is one of the most expensive and risk-averse problems in enterprise IT, largely because the original developers are often gone and the business rules live only in the code. The COBOL migration test targets exactly that risk: OpenAI’s own example is a rewrite that rounds values COBOL would have truncated, which runs cleanly but produces different financial results. A jump from 5% to 87% on behaviour-preserving migration, if it holds up on real codebases, could change the cost math for banks, insurers and governments that have deferred modernization for years. The caveats are that both evaluations are OpenAI’s own and the migration test is already near saturation, so it will soon stop telling us much. Releasing MultiLangBench publicly is the more useful move, since teams can check results in the languages they actually maintain.

GitHub Pitches “Ambient Intelligence” as the Next Developer Interface

In a post on the GitHub blog, Martin Woodward argues that AI is changing how developers relate to their tools. Instead of memorizing commands and navigating editors, developers increasingly describe an outcome and let agents like GitHub Copilot gather context, edit files, run tests and return a pull request for review. The developer’s job shifts toward setting direction, defining constraints and judging the results, while remaining accountable for what ships.

Woodward frames the emerging workflow in three layers: an input layer that captures intent (text, voice or physical controls), a harness that plans and acts, and a control plane where developers inspect, redirect and approve the work. Tools like MCP, repository instructions, skills and hooks supply the context and policy underneath.

As a practical example, GitHub spent 18 months working with Logitech on its MX Keypad, which now integrates with the GitHub Copilot app. Keys can be mapped to submit a saved prompt, open or resume a Copilot session, run an IDE command or trigger a multi-step sequence. Woodward is careful to say a physical control only earns its place when it removes enough friction for a frequently repeated action. The post closes with an offer of three months of Copilot Pro+ for those who try it.

Why it matters: The keypad is the least important part of this story. The real signal is GitHub publicly reframing the developer as a director and reviewer of agent work, with the bottleneck moving from writing code to deciding whether it is right. That raises the value of senior judgment and code review, and it puts pressure on teams to answer the governance questions Woodward lists himself: what agents can run unattended, how credentials are scoped and what evidence should accompany a change. It is also worth reading as vendor positioning, since the post ends in a product promotion, but the direction it describes matches where agentic tooling is clearly heading.

🚀 New Models

Inception Launches Mercury 3, Its Largest Diffusion Language Model Yet

Inception has released Mercury 3, a diffusion-based language model that it calls the most capable of its kind to date. Most language models generate text one token at a time, an approach known as autoregressive. Diffusion models take a different route, and Inception’s pitch is speed: Mercury 3 runs at 1,068 tokens per second on NVIDIA GPUs, which the company says is four to eight times faster than speed-focused models like GPT-6 Luna and Claude Haiku 5.5, while matching or beating them on a range of benchmarks.

Mercury 3 is more than 40 times larger than Mercury 1, and Inception says this proves the scaling patterns behind traditional models hold for diffusion too. It offers a one million token context window, up from 260,000 in Mercury 2.5, and is priced at $0.20 per million input tokens and $0.70 per million output, with 50% off at launch and a 90% discount on cached input.

Early-access partners are using it where delays are most noticeable. TinyFish AI reports Mercury 3 completed half of 50 live web navigation tasks, beating GPT-6.1-Sol, while education platform RevisionDojo says hints and marked answers now return in about a second. The model is available through Inception’s API, OpenRouter, Baseten and Vercel, and is compatible with the OpenAI API.

Why it matters: For agents, speed is not just a nicer experience. Every step in an agent loop waits on the model, so faster generation means more attempts and more checking within the same time budget, which can translate directly into better results. Mercury 3 also makes a credible case that diffusion is a viable alternative architecture rather than a research curiosity, which could widen the field beyond the current approach. That said, the benchmark comparisons and partner results all come from Inception’s own launch materials, so teams with latency-sensitive workloads like voice or support should test it against their own use cases. The OpenAI-compatible API makes that experiment cheap to run.

MiniMax Launches M3.1 Flash, a Low-Cost Model Built for Agents

MiniMax has released M3.1 Flash, a fast, low-cost model aimed at agentic work, coding, computer use and cybersecurity. The company revealed that “Space Bunny,” an anonymous model that processed more than 200 trillion tokens before launch, was an early version of M3.1 Flash. MiniMax says the new model makes online inference nearly three times faster and cuts usage costs for agentic tasks by 70% compared with its predecessor.

On MiniMax’s reported benchmarks, M3.1 Flash scored 73.7% on the DeepSWE v1.1 coding benchmark, 61.7 on OSWorld V2 for computer use and 82% on CyberGym for vulnerability discovery. It ranked first among Chinese models on both OSWorld V2 and Agents’ Last Exam, and the company says it can complete end-to-end business workflows across SaaS tools in areas like sales, finance and HR. Typical output speeds exceed 200 tokens per second.

Pricing is flat at $0.15 per million input tokens, $0.60 per million output and $0.015 for cached input. The model is available now through the MiniMax API, its M Plan subscription and MiniMax Code, with model weights to be released later. A more capable Pro version is also on the way.

Why it matters: Alongside Mercury 3 this week, M3.1 Flash points to a clear trend: the competition is shifting toward cheap, fast models that are good enough to run agents at scale, where cost per completed task matters more than raw capability. Prices this low make high-volume automation viable for workloads that were previously too expensive to hand to an agent. The planned weight release is notable too, since it would let organizations self-host rather than send data to a third-party API, which may matter for teams with procurement or data-residency constraints. Two cautions: the benchmark results are self-reported, and strong low-cost cybersecurity capability cuts both ways, lowering the barrier for attackers as much as for defenders.

🎨 Creative AI

Krea 3 Puts Editing Ahead of Generation

Krea has launched Krea 3, an in-house image model built primarily for editing existing work rather than generating images from scratch. Users describe changes in plain English, such as swapping materials, outfits, lighting, settings or text, while the rest of the image stays intact. The model can draw on up to six reference images at once, and use cases range from placing furniture into a photo of an empty room to turning an architect’s pencil sketch into a photorealistic render.

Krea says Krea 3 matches the quality of Google’s Nano Banana Pro and OpenAI’s GPT Image 2.5, but is much faster and cheaper. By the company’s figures, a 2K edit takes under eight seconds and costs $0.06 through its API, compared with 30 seconds and 15 cents for Nano Banana Pro and 80 seconds and 22 cents for GPT Image 2.5. Users can choose between modes that trade speed for quality.

Krea also calls it the first editing model with dedicated style reference support, letting users attach up to four images whose look the output will share without copying them. Regional editing and bounding boxes are already available, and specialized versions for e-commerce, filmmaking and real-time use, the last built with Fal, are planned.

Why it matters: Most professional creative work is revision, not blank-canvas generation, and Krea is betting that the bigger market is tools that fit into that reality. Editing a client’s own photos and assets while keeping everything else consistent is far more usable for agencies and brand teams than generating something new and hoping it matches. The style reference feature targets one of the most persistent weaknesses of image models, keeping a consistent look across outputs. The speed and price comparisons come from Krea itself, and the coverage leans promotional, so the claims are worth testing. But if they hold, the cost gap is wide enough to matter for teams producing images at volume.

Keep ahead of the curve – join our community today!

Follow us for the latest discoveries, innovations, and discussions that shape the world of artificial intelligence.