# native harness doesn't win on average; in yemen claude reviewed claude > the native harness doesn't win on average, today's checks look at one command or one session, and whoever used claude for weapons split the project across conversations - edition: Monday, September 14, 2026 (2026-09-14) - notebook: dev & ai - topics: agents · papers · security · market - items: 11 from 11 sources - original: https://tonho.wtf/en/daily/2026-09-14/ - portuguese edition: https://tonho.wtf/diario/2026-09-14/ - authorship: written by an llm pipeline, reviewed and translated by antonio leandro (tonho.wtf) --- The most useful number today is a tie that doesn't resolve. Same Opus 4.8, same 80 tasks, Claude Agent SDK against deepagents: 48.8% against 50.0%. The confidence interval runs from 10 points against native to 7.5 in its favor. The premise that the vendor's harness gets more out of the vendor's own model doesn't show up in the average. It shows up with the sign flipped depending on task type, and it shows up in cost, which is exactly the paper's shakiest measure. The rest of the day lives in the same layer, between the model and the world: a verifier showing that editing by line number corrupts 99.1% of files when the content shifts by one line, a CLI that audits the tool call transcript, the Linux Foundation taking in a router that flattens the difference between the OpenAI and Anthropic APIs, a Brazilian app on top of Claude Code that already promises Codex and Kimi. For me, if the native harness doesn't win even on its own model, it gets easier to argue for a single harness across several models, and the router is the piece that makes that swap cheaper. Left out of this thread are the model and infrastructure items: NVIDIA's MoE, the block diffusion cache, Oracle paying for datacenters with payroll. And Thursday's line, writing got cheap, checking didn't, got a data point: 22 of the 81 runs cut off by the time limit had already produced a passing patch. Anthropic's misuse report, as summarized by Xataka, shows the same layer from the side of people who shouldn't be there. The cell in Yemen built a three-role harness — one Claude instance coding, another researching, a third reviewing the first. The safeguards blocked many requests, but not all: the goal came hidden and the project came split across conversations. Today's checks have that same granularity: the pre-action verifier judges one command, ToolReplay judges a session against itself. I think that's the right place to catch the silent error, but it's not where you see intent. The same day, Bryan Cantrill writes that intelligence isn't enough, that engineering requires the physical world, and that AI only acts in that world as far as humans allow. On extinction risk, I agree the burden of proof is on whoever makes the claim. But the premise of human control is little comfort when the one in control is the one who wants the weapon. The team in Russia designed the swarm precisely to detonate with no human in the loop, and the Yemen cell went back to Claude hours after a rocket test that, it seems, went wrong. ## labs **[Dropless MoE in JAX with Transformer Engine](https://developer.nvidia.com/blog/accelerating-dropless-moe-training-in-jax-with-nvidia-transformer-engine/)** — In DeepSeek-V3 training on GB200, the unoptimized baseline did 103 TFLOPS/GPU and spent 84% of its cumulative kernel time on communication between GPUs. With Transformer Engine kernels, it reached 1,068 TFLOPS/GPU, 10.4x. The gain comes from handling the ragged tensor the router produces without dropping or padding tokens. A grouped GEMM runs all experts in a single call, with the real token count and without the device-to-host copy that breaks CUDA graphs. Dispatch and combine run fused over NCCL EP, with MXFP8 in the expert multiplications on Blackwell. The comparison is against a baseline NVIDIA itself calls unoptimized, not against MegaBlocks or another production stack, so the 10.4x doesn't tell you how much you gain over what you already run. ## research **[Harness or Model?](https://arxiv.org/abs/2609.11987)** — The suite is private, with 256 repository and competitive programming tasks from after the cutoff. The same 80 ran on Claude Agent SDK and deepagents with Opus 4.8, and on the Codex SDK and deepagents with GPT-5.5; 792 of 800 runs were graded by an isolated oracle. None of the contrasts shows an average advantage: -1.25 pp for native on Opus (95% CI from -10.0 to +7.5) and +1.25 pp on GPT-5.5 (from -4.4 to +6.9). On Opus, native loses 9.0 pp on the 61 repository tasks and gains 23.7 pp on the 19 competition tasks (p = 0.003), but that split was chosen after looking at the data, and the paper itself calls for a planned replication. On cost per solved task, the neutral harness comes out 1.3 to 1.6 times more expensive on Opus and 1.2 times on GPT-5.5. Except that 58 runs on the Anthropic account left no usage record, and depending on where that spend lands, the ratio goes from 0.7 to 2.3. This version also corrects August cost figures that came from a telemetry bug in the study itself. My read for anyone picking tools: "native is better on the house model" is now a hypothesis, and the cost math is shakier than the accuracy math. **[Look Before You Leap](https://arxiv.org/abs/2609.11957)** — The failure the paper goes after is the silent one: the command that runs without error and does the wrong thing. In shell, a static verifier over 9,930 commands and 482 tools catches 95.8% of the invalid ones with 10.0% false positives. The syntax and binary checks have zero false positives and on their own catch half the errors; every false positive comes from the flag check, limited by what the help text covers. In code editing, 640 edits across 224 files show that format decides. Search/replace and diff fail loudly. Editing anchored on line number corrupts 99.1% of files when the content shifts by one line, and editing anchored on function name hits the wrong function 12.7% of the time. An applier that anchors on content, verifies, and refuses when it isn't sure logged one silent wrong application in 8,320 attempts (0.01%). Edit format is exactly the kind of difference that a whole-harness contrast, like the one above, doesn't isolate. **[Fixed State, Long Reach](https://arxiv.org/abs/2609.11998)** — Diffusion LMs decode tokens in parallel, but the bidirectional denoiser rules out the usual KV cache. Block diffusion brings back caching block by block, but the caches used so far depend on attention, grow O(L), and, grafted on without training, only approximate the model's computation. The paper trains three 3B denoisers (attention, Mamba, and hybrid) on 300B tokens with a block-causal objective, which makes the cache exact. At 256k tokens, with the attention cache at 82 GB and 29 ms per step, Mamba's has 4.3x lower latency, 11x less memory, and 2.6x single-stream throughput. Since memory doesn't grow, it scales with batch up to 14x aggregate throughput, where attention can't get past one stream. Mamba and hybrid keep doing retrieval up to 8 to 16 times the training length, while attention collapses at 2x. The abstract says this cost no measurable quality, without saying on which evaluation, and it's all at 3B. ## brazil **[anywh.sh, a native app on top of Claude Code](https://www.tabnews.com.br/wilmacedo/pitch-criei-um-app-nativo-open-source-para-usar-o-claude-code-sem-estresse)** — wilmacedo published on TabNews an open source app (Apache 2.0, no telemetry) for people who use Claude Code on more than one machine and with more than one account. Each profile stores the logged-in account, project folder, and model, and the app has an integrated terminal, file browser, image upload, and voice through a local model. For now it only works with Claude Code; Codex CLI and Kimi CLI are promised. The post handles resync between machines with the app plus a relay and says everything runs 100% locally, but doesn't explain where the relay lives. That's the first thing I'd ask. ## market **[Agent Router goes to the Linux Foundation](https://www.publickey1.jp/blog/26/openaianthropicapiagent_routerlinux_foundation.html)** — According to Publickey, the Agentic AI Foundation, the Linux Foundation arm that already looks after MCP, AGENTS.md, and the Agent2Agent protocol, is taking in Agent Router. It's an open source project that absorbs the differences between the APIs of OpenAI, Anthropic, and other vendors, with the stated goal of becoming an industry standard. The available excerpt has only the title and the start of the text: there's no way to tell who maintained the project, which APIs it covers, or how it handles features with no equivalent on the other side. My read, together with the harness paper: there's less technical reason left to tie harness to vendor, and the API becomes the main seam. **[ToolReplay](https://github.com/Matthew0822/ToolReplay)** — A Python 3.11+ CLI, with no runtime dependencies and no network access. It reads the tool call transcript in JSONL (index, tool, args, and response, with a parser that rejects extra fields). It seals the records in a SHA-256 hash chain, points to the first broken link, flags redundant calls and nondeterminism, and checks each call against an allowlist of tools. Reading the rules in the README, I see two limits. Scope compares only the tool name, so an agent with write_file allowed writes to any path without raising an alert. And the redundancy rule accepts that a write in between may have changed state, but the nondeterminism rule doesn't: in the example that ships with the repository, the two searches flagged as nondeterministic have a write_file between them. **[Oracle lays off again to pay the AI bill](https://www.fastcompany.com/91607091/oracle-announces-new-layoffs-to-offset-ai-spending)** — Oracle opened another round of layoffs today, announced by email and with no number disclosed. The company projects $90 to $95bn in capex this year and has already piled up $125bn in debt on datacenters and chips. In the fiscal year ended May 31, headcount had already dropped by about 21,000 people (13%), and the cost of the restructuring plan rose $700m, to $2.8bn, mainly because of severance. Fast Company lines it up with Atlassian, which cut about 1,600 jobs (10%) in March to "self-fund" AI investment. The way I read it: the mechanism here isn't the agent replacing people, it's the datacenter competing for the same cash as payroll. And that doesn't depend on whether the agent solves 50% of tasks or 5%. ## world **[Claude as engineer for missiles, swarms, and a Taiwan map](https://www.xataka.com/magnet/misiles-hipersonicos-enjambres-kamikaze-12-objetivos-taiwan-rusia-china-iran-yemen-encontraron-ingeniero-militar-claude)** — Xataka summarizes Anthropic's latest report on misuse of its models. In northern Yemen, a cell was working at the same time on a guided rocket, a multistage ballistic missile with a target range above 2,000 km, and a family called R2000 with a hypersonic glider variant. In Russia, a small team used Claude Code for much of the software of an FPV drone swarm that identified targets, including the "person" category, and issued the detonation order with no human in the loop. In China, an account with ties to institutions of the People's Republic, among them the People's Liberation Army Academy of Military Sciences, reached the 12th version of an electronic warfare suite whose default scenario had 12 targets in Taiwan. An Iran-linked operation built a Python pipeline for recommending targets against US naval forces, from public photos, transponders, and commercial satellite imagery. Anthropic banned the accounts and passed information on some of the operations to authorities. The report has no evidence of an operational weapon and doesn't attribute the Russian project or the Chinese ones to official programs. ## who wrote **[The contagion of fear](https://bcantrill.dtrace.org/2026/09/13/the-contagion-of-fear/)** — Bryan Cantrill opens with a college confession. Along with classmates, Cantrill announced in a lab packed with humanities students, during exam week, that a virus had escaped from the computer lab, and the panic made people shut down machines and lose work. The target of the piece is the claim by Jacob Coxon, who left Anthropic, endorsed by Evan Hubinger, head of Alignment Science at the company: a more than 10% chance that AI kills every human in the next decade. The counterargument comes from someone who builds computers. Engineering isn't just intelligence, it depends on acting in the physical world, and AI only acts in that world as far as responsible humans allow. Whoever makes the extraordinary claim is the one who has to prove it, not the public that doubts it. Came via Simon Willison and Lobsters. ## the rest in one line - **[Five eras of UX design and the lessons to keep in the AI era](https://uxdesign.cc/five-eras-of-ux-design-and-the-lessons-to-keep-in-the-ai-era-d76a548747a9/)** — UX Collective teaser that promises to walk through the reinventions of human factors since Bell Labs and argue that the oldest lessons are the ones that work now; only the teaser was available. ## stalled sources Over 100 days: First Round Review (322), fasterthanli.me (257), Brendan Gregg (221), The Gradient (208), Andrej Karpathy (137), Anthropic Engineering (113), web.dev (109). Between 30 and 100: Eugene Yan (86), Chrome Developers (85), A List Apart (76), Lil'Log (73), Adjacent Possible (36). Up to a month: Stripe Blog (26), Airbnb Engineering (20), Netflix Tech Blog (17), One Useful Thing (15), Anthropic News (14), Microsoft Research (14), Go Blog (13), GitHub Engineering (12), Fly.io (12), NAVER D2 (12), Meta Engineering (11), Benedict Evans (11), Import AI (8), Dan Luu (8), Discord Blog (7), Kakao Tech (7).