The Agent System Is Becoming the Competitive Edge

AVO and the Agent-System Advantage

A model didn't change, yet the system around it completed every public ARC-AGI-3 level. That shifts the argument from who has the smartest model to who can keep an agent working when a long task goes wrong.

Stay with that distinction, because it's the useful part of NVIDIA's result. On 21 August, the company reported that its AVO architecture completed all 183 levels across the 25 publicly available ARC-AGI-3 environments. NVIDIA gives it a score of 100, reached in 6,624 actions. That's about 12 per cent fewer than the 7,542 actions the company attributes to the previous VISTA result.

The action count is useful as an efficiency signal, not only a scorecard. In a deployed agent, every extra action can add latency, compute cost and another opportunity for an error. A 12 per cent reduction, if independently reproduced, could have operational value. But the number can't show whether AVO made robust decisions or simply found a shorter route through these public levels. That's another reason to keep the claim bounded.

AVO wraps an underlying model in persistent memory, supervision, tools and feedback-driven recovery. Persistent memory lets the system carry useful state across a long attempt. Supervision checks progress. The recovery loop uses feedback from failure instead of letting one bad move end the run. None of those pieces sounds as glamorous as a new foundation model, but together they address a basic weakness in agents: a model can be capable in one response and still lose its way across hundreds or thousands of actions.

NVIDIA also tested the architecture on a different kind of long-running problem. Over seven days, AVO explored more than 500 directions for kernel optimisation and committed 40 kernels. On DGX B200 tests, NVIDIA reports workload-specific improvements of up to 3.5 per cent over cuDNN and 10.5 per cent over FlashAttention-4. That experiment is interesting because it moves beyond completing a fixed set of environments and into iterative engineering work, where the system has to search, test, keep useful changes and recover from dead ends.

There are important limits. These are NVIDIA's own results. The ARC score covers the public environments, not the semi-private or private evaluation sets, and there isn't a controlled ablation showing how much of the gain came from memory, supervision, tooling or recovery individually. The kernel figures are vendor-run benchmarks on particular workloads, not a promise that every application gets a free performance uplift. Independent reproduction on private tasks and ordinary production work is still missing.

My read is that the competitive unit in agentic AI is becoming the whole operating system around the model. For developers, that makes harness design newly worth serious engineering time: state management, checkpoints, evaluators and recovery may buy more real capability than swapping between two similarly capable models. But a perfect public score doesn't establish production reliability. A business agent can face messy permissions, ambiguous goals and failures that no benchmark level anticipated. AVO is strong evidence for the architecture, not a licence to remove human oversight.

Jesse: Joining me is Maya Chen, a Senior AI Analyst and one of the show's AI resident experts. Maya, welcome.

Maya Chen: Thanks, Jesse. Great to be here. I knew your home lab was going to become an interview topic eventually.

Jesse: It was inevitable. Once a server has its own cooling strategy, it starts demanding editorial coverage.

Maya Chen: Exactly. Give it a logo and a monthly burn-rate spreadsheet, and you have a startup.

Jesse: Before it raises a seed round, if someone wants one local model for OpenClaw, Hermes Agent or the new DeepSeek Harness, and they have a 32GB GPU, what belongs at the top of the list?

Maya Chen: Right now, I would start with Qwen 3.8, 27B, using a good four-bit build rather than FP8 on that card. Keep the context sensible and test tool calling in the actual harness. It has the reasoning, coding and agent behaviour to be a strong all-rounder. The trick is leaving memory for the key-value cache and runtime overhead. A model that loads but falls over halfway through a tool-heavy session is not a working system.

Jesse: That matches what I see with Token Gen. I have 96GB of VRAM running Qwen 3.8, 27B in FP8. It handles plenty of OpenClaw work and Qwen Code, but I still send the heavy lifting to a frontier model. I added a router skill after hitting my Pro twenty-times rate limits more than once. Is that the right split?

Maya Chen: And that is the practical architecture. Local handles frequent, private and well-bounded work. Frontier handles jobs where an error is expensive or the problem is genuinely difficult. The router matters more than bragging about one benchmark. It should consider task risk, context size, tool complexity and queue pressure. OpenClaw, Hermes and DeepSeek Harness can all reach a compatible local endpoint, but each wraps the model in different prompts, memory and tools. Test the whole loop, not just chat.

Jesse: That makes the trade-off clear. What changes for someone with 16GB? Can they squeeze in the same Qwen model, or is that when they should stop being heroic?

Maya Chen: Stop being heroic. You can force a heavily compressed 27-billion-parameter model across GPU and system memory, but latency and context become the tax. For a practical 16GB machine, GPT OSS 20B is the cleaner agentic option because it was designed for that memory class and has tool use. Qwen 3.5, 9B is sensible when simplicity and speed matter more than maximum reasoning. Run one worker, control the context, and use retrieval instead of carrying your entire life in every prompt. So buy enough VRAM for headroom, route intelligently, and judge the harnessed workflow rather than the model card.

Jesse: Maya, thanks for joining me and sharing such a practical answer. I hope you can come back to the show soon.

Maya Chen: Always a pleasure. And if the rack raises funding, I expect an advisory share.

Jesse: Well, that was Maya Chen. I hope you found that insightful. And now back to the news that's changing the world today: Anthropic makes core computer-use and agent-building APIs generally available.

What Changes for You

Anthropic's change is much closer to something working developers can deploy. On 20 August, computer use, the Skills API and the Files API reached general availability on the Claude Platform, and Anthropic introduced a browser-use tool for web tasks.

Computer use can now perform multiple actions within one model turn. Browser use provides structured page information, reducing complete dependence on screenshots. Developers can upload and version reusable Skills, while Files API objects can be shared across requests and given automatic expiration controls. Anthropic says Files API rate limits increased fivefold and storage rose to one terabyte per organisation. Skills and Files are also available through Microsoft Foundry; computer and browser use on Google Vertex AI were still described as coming soon.

That removes a real support and procurement barrier for teams that didn't want preview features in production. It also reduces custom plumbing around reusable instructions and files. The limitation is authority: an agent that can operate a browser or computer can make mistakes with real consequences. Strict permissions, isolation and approval gates remain part of the product, even when the API itself is generally available.

There's a second tool builders can use now, although this one belongs in testing rather than production. On 21 August, DeepSeek opened its experimental V4-Flash-Vision-Exp model through the API. It accepts images through encoded data, external URLs or reusable Files API uploads, and DeepSeek says it can interpret interfaces and screenshots for multimodal agent work.

DeepSeek claims performance close to Claude Opus 4.8 on selected multimodal agent benchmarks. That comparison hasn't been independently verified, and the model is explicitly experimental. The immediate opportunity is cheaper, simpler experimentation with agents that need to see an interface or document without switching to a separate vision model. The sensible test is a real workflow with its awkward pages and failure cases, because stability and reliable action matter more than a vendor benchmark table.

Bedrock Routes GPT-5.6 Across Regions

Capacity is easy to ignore until a production request can't find any. AWS is now treating routing as part of the model service.

On 20 August, Amazon Bedrock added cross-Region inference for GPT-5.6 Sol, Terra and Luna. A request can be sent to available capacity beyond the AWS Region where it began. AWS says the three models are available through Bedrock in more than 25 Regions.

There are two important routing choices. A United States geographic profile keeps processing within that geography. A global profile can route among supported commercial Regions, which gives the workload a larger capacity pool but may process data outside the originating geography. That's not a minor configuration detail for health, finance, government or any organisation with contractual residency controls.

The models take text and image input and return text. They support a one-million-token context window, reasoning, server-side tool calling and prompt caching. Those capabilities make them plausible back ends for long, tool-using workflows, where a capacity failure can interrupt far more than a single chat response.

In practical terms, cross-Region inference can reduce failures caused by constrained local capacity. It doesn't guarantee a particular latency improvement, and AWS doesn't say every request will leave its original Region. My judgement for organisations is simple: availability now belongs in model evaluation alongside capability and price. The best model on paper isn't the best service if it can't answer at peak time. Regulated teams, however, need to select the geographic profile before chasing the larger global pool. More capacity is useful only when the routing path still matches the data obligation.

A Security Blueprint for Agentic Skills

Reusable skills make agents more capable, but they also turn a neat instruction bundle into a supply-chain object. OWASP has now put a sharper frame around that risk.

The organisation published the final Agentic Skills Top 10 along with an initial Universal Agentic Skill Format. The risk list covers malicious or prompt-injected skills, excessive permissions, unsafe dependencies, supply-chain compromise, and failures in logging or revocation. Those categories reflect what changes when a skill can do more than shape a response. It may call tools, touch files, reach external services or influence later actions.

The proposed YAML format is designed to make those properties inspectable. It can declare where a skill came from, the permissions it needs, its dependencies, cryptographic hashes, signatures and change history. That gives security teams a concrete basis for inventory, review, signing, permission control and revocation instead of treating every skill as an opaque block of text.

The software-package analogy is useful, with one extra warning. A compromised library usually acts inside the permissions of the application that loaded it. A compromised agent skill may be deliberately connected to email, a browser, cloud infrastructure or business records. That makes least privilege and a usable kill switch especially important.

This is an initial standardisation proposal, not a universal enforcement layer. The briefing sources don't establish broad adoption by the major agent platforms, and the precise publication day wasn't stated on the OWASP project page. My view is that organisations don't need to wait for a universal format to use the checklist. Any team distributing skills internally can record provenance, pin dependencies, review requested permissions and keep a revocation path now. The harder part will be getting competing ecosystems to enforce those declarations consistently rather than merely displaying them.

NVIDIA's Reported Poolside Deal

The agent contest also reaches into who owns the machinery for building models. A reported NVIDIA deal with Poolside shows how unusual those arrangements may become.

Newcomer reported on 20 August, citing a Poolside investor letter, that NVIDIA agreed to pay US$6 billion for a non-exclusive licence to Poolside's Model Factory technology. It also reportedly agreed to invest another US$1 billion in the company that remains, at a US$12 billion valuation before the new money.

The structure matters. This isn't reported as NVIDIA buying Poolside outright, and the licence isn't exclusive. Poolside would remain a separate company while NVIDIA gained access to model-building technology. If the reported terms are completed, NVIDIA's reach would extend further beyond accelerator hardware and into systems and expertise used to manufacture frontier models.

Neither company had published the underlying agreements or a detailed public announcement in the material reviewed for the briefing. So the figures and terms remain reported claims from an investor letter, not confirmed public contracts. That distinction is especially important at this scale.

For organisations watching the market, my inference is that licensing plus investment can deliver strategic influence without the clean boundary of an acquisition. It may let a large infrastructure supplier secure valuable technology while the smaller company keeps operating and serving other customers. It can also make the competitive effect harder to judge: access, governance rights and practical dependence matter as much as the ownership percentage. Until NVIDIA or Poolside publishes more, the sound conclusion is narrow. The reported deal would deepen NVIDIA's position in the model-production stack, but its exact control and competitive consequences aren't yet public.

Oracle's 943-Patch Security Update

Here's a number that deserves triage, not panic: 943. That's how many new security patches Oracle released on 18 August across its product portfolio.

The total is enormous, but operators need to look at where the unauthenticated remote paths are concentrated. Oracle Fusion Middleware received 262 patches. Oracle says 182 address vulnerabilities that may be remotely exploitable without authentication. E-Business Suite received 120 patches, including 27 for potentially unauthenticated remote exploitation, and that group contains two vulnerabilities rated CVSS 9.8.

Oracle also warns that older unsupported versions may be affected and recommends moving to supported releases. That creates a harder job than simply applying a current patch bundle: an unsupported deployment may need an upgrade path before the security work is complete.

For enterprise teams, the useful priority isn't to treat 943 items as one flat emergency queue. Internet-reachable Middleware and E-Business Suite systems with unauthenticated exposure deserve attention first, followed by the rest according to product presence and reachability. Asset inventory is doing real security work here. A lower-profile server you know is exposed can be more urgent than a severe patch for software you don't run. The patch count gets the headline; the combination of remote reachability, no required login and critical enterprise systems determines the operational risk.

Meta's Youth-Engagement Design on Trial

And finally, a courtroom is examining whether familiar engagement features can create legal responsibility when the users are children.

A federal trial began on 18 August over claims by four US states that Meta deliberately designed features on Facebook and Instagram to encourage compulsive use by children and teenagers. Washington's attorney-general says the states allege Meta knew its design choices could harm young users while it continued to optimise engagement. Meta disputes the allegations and defends the safety work it has done.

The Associated Press reports that the plaintiffs are seeking billions of dollars as well as changes to Meta's platforms. Those are requested remedies, not an outcome. The proceeding has only reached trial; there is no verdict, no immediate new platform rule and no new user entitlement. The allegations remain contested, and any result could still be followed by appeals.

What makes the case consequential is the legal theory being tested. Infinite feeds, recommendations, notifications and other engagement mechanics have often been discussed as product choices. The states are asking a court to treat Meta's alleged design decisions as conduct that can carry financial and product consequences when young people are affected. Whether they prove that case is still open.

For families and ordinary users, nothing changes on the platforms simply because the trial has started. The more immediate effect is on the companies: internal design evidence, safety claims and the relationship between engagement goals and youth harm are being tested in an adversarial forum. My read is that a successful case could make child-safety risk a much more direct product constraint across social media. A loss for the states would leave the current debate largely where it was. Either way, the verdict and any remedy—not the opening allegations—will tell us what precedent this trial actually creates.