The Agentic Engineer
- AGENT PLUGINS 1.0 DROPS AWS, Cursor, Microsoft, OpenAI, and Vercel co-published the spec. Google joins as Core Maintainer on day one. Build an agent skill once, run it in ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code. The "build for one harness" era is over.
- THREE NEW HARNESSES, ONE WEEK YC open-sources QM (its internal multi-agent system, 11K stars). Amazon open-sources Kiro Crew (39K internal users at Amazon, MIT). Meta ships Muse Code with persistent background subagents that survive crashes.
- Tool of the Week: AWS Dogwood Temporal policy language for agent tool calls. Write rules like "cannot call DeleteTable after ListTables more than 3 times." Apache 2.0, built into AgentCore Policy, zero Cedar migration needed.
Agent Plugins 1.0: Build Once, Run Anywhere
AWS Blog | Google Blog | Published August 6, 2026
Five companies sat down and agreed on something. That alone is news.
AWS, Cursor, Microsoft, OpenAI, and Vercel published Agent Plugins 1.0 on August 6. Google joined as a Core Maintainer on day one. The spec packages Agent Skills and MCP servers into a single portable directory with a plugin.json at the root. One build. Deploy to ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code.
That list covers most of where real developers spend their time. Which is the point.
The architecture is worth understanding. An Agent Plugin directory contains: a plugin.json manifest (name, version, entrypoints, permissions), an optional MCP server config, and any Skills the plugin exposes. A harness that supports the spec discovers plugins by walking the directory and parsing the manifest. There's no central registry required. You can distribute plugins as npm packages, git repos, or zip files and any compliant harness picks them up.
Built on MCP and Agent Skills, both of which are already under the Linux Foundation Agentic AI Foundation. No single company owns the roadmap. The technical steering committee (TSC) is public in MAINTAINERS.md. AWS is a founding TSC member, which matters for enterprise adoption.
AWS ships day-one support with Kiro Powers and the AWS Agent Toolkit. The Register, NextWeb, and AWS and Google blogs all covered it within 24 hours. This isn't a blog post with a GitHub repo attached. It's a coordination event.
What it actually changes: right now, every agent skill you build is tied to one harness. A skill that works in Cursor doesn't work in Codex. A tool you build for Kiro doesn't run in VS Code. Agent Plugins 1.0 makes that problem go away, the same way npm made "works on my machine" for packages a solvable problem.
The skeptic's take: MCP itself launched with big multi-vendor momentum and the space is still fragmented. Specs don't guarantee adoption. The difference here is the day-one install base. If ChatGPT, Codex, Cursor, Copilot, Kiro, and VS Code all support it at launch, there's already a reason to build for the spec rather than for any one harness. That's different from MCP's launch.
For builders: if you're maintaining agent skills or MCP servers for more than one platform, read the spec this week. The migration path from existing Skills is documented and the AWS Agent Toolkit ships a validation CLI.
Source: AWS Blog
Docker Sandboxes: One MicroVM Per Agent, Zero Host Risk
Docker ships Sandboxes: disposable microVMs for AI coding agents. Each agent gets isolated compute. Install packages, run Docker, modify configs. Your host stays untouched. brew install docker/tap/sbx, then sbx run claude --dangerously-skip-permissions. Works out of the box with Claude Code, Codex, Gemini CLI, Copilot CLI, Kiro, and OpenCode. Hit #1 on HN at launch (203 points, 131 comments). Direct Docker brand + existing toolchain means adoption this thing won't have the problem E2B and Modal had.
Source: Docker
Kiro Crew: Amazon's Internal Multi-Agent Harness Goes MIT
Amazon open-sources Kiro Crew (MIT), the multi-agent orchestration harness that 39,000+ Amazon builders adopted internally in under six months. 500 contributors. 597 updates. The design: agents run across sessions (not just in one chat), coordinate via ACP, and self-learn. Corrections become durable lessons. Repeated patterns become reusable skills. Ships with OS-level sandboxing, denied-by-default commands, credential redaction, and a signed audit log. Works across desktop, web, and TUI. Reads existing .kiro config. Zero migration.
YC Open-Sources QM: Multiplayer Agent Harness, 11K Stars
Y Combinator open-sources QM (MIT), the internal multi-agent harness it runs across accounting, legal, events, and engineering. Each person and room gets scoped memory, files, keychain view, permissions, crons, and a sandbox. Harness-agnostic: Pi, OpenCode, Codex, Claude Code all drive the same core. 11K+ stars in days. Three security postures (Strict, Auto, Dangerous) with hard-coded destructive-command denials in all three. Strong provenance. YC has run this in production. That's not a demo.
Source: GitHub
Prime Agent: One Tool, 95.5% on ARC-AGI-3
Prime Intellect open-sources Prime Agent (MIT). The bet: give the model exactly ONE tool, a persistent IPython kernel, and let it do everything else in Python. Sub-agents are function calls: await rlm("sub-task"). The Continual Harness is rewritable at runtime via /refine. With Opus 5: 95.5% ARC-AGI-3 Best@1. That's above the 95.4% human expert baseline. Beats Claude Code on 6/9 long-context evals. Single-tool-as-REPL is a genuinely different architecture from everything else in this space.
Source: GitHub
Amazon DynamoDB Vector Search Goes GA
DynamoDB GA's native vector search: single-digit millisecond latency at 99%+ recall, designed for trillions of vectors. Store embeddings alongside your existing attributes, create a vector index, run approximate nearest-neighbor searches with attribute filters. Use any Bedrock model for embeddings. Fully serverless. No separate vector DB to manage. The most practical use case for agentic builders: semantic retrieval over agent memory stored in DynamoDB. Available in all commercial AWS Regions.
Source: AWS Blog
Most Visual Tool Calls Don't Change the Answer
arxiv.org/abs/2608.06270 | Published this week
The finding: Benchmark accuracy gains from visual tool-use are real. But they're concentrated in a minority of rollouts. Most visual tool calls have zero causal effect on the final answer.
The researchers audited 6 multimodal models across 5 perception benchmarks and found two distinct failure modes. First: Calling Without Looking. The model makes a crop or zoom call, receives the visual evidence, and then gives the same answer it would have given without it. The evidence is causally inert. Second: Looking Without Planning. The evidence is informative but the call schedule is incoherent. The agent keeps zooming after it already has what it needs.
They introduce a new metric, Visual Evidence Gain, to measure per-call contribution rather than aggregate accuracy.
Why it matters: Same insight as the E3 paper from Issue #22 (91% of tokens wasted in coding agents), but for visual tool-use specifically. The pattern is consistent across modalities: agents call tools more than they need to, and when they do call them, the calls often don't change behavior.
Practical application: If you're building multimodal agents that use crop/zoom tools, audit whether your tool calls are actually causally upstream of your answers. The "Calling Without Looking" failure is diagnosable. Log the answer before and after each visual tool call. If they match more than 80% of the time, your agent has this problem.
Time saved: 5 min read vs 41 min paper. 8x compression.
AWS Dogwood: Runtime Verification and Temporal Policies for AI Agents
AWS Blog | GitHub | Apache 2.0
The problem it solves: Cedar evaluates authorization one request at a time. That works for point-in-time decisions, but agent workflows consist of sequences of tool calls where the history and ordering matter. Standard Cedar policies aren't designed to express rules based on prior events in the agent's action history.
Dogwood extends Cedar with temporal conditions built on Metric First-Order Temporal Logic (MFOTL). You write policies over sliding time windows using standard-library macros like count_within, count_distinct_within, sum_within, and bind. AWS's rate-limit example from the blog:
forbid (
principal,
action == AgentCore::Action::"Transfer",
resource
)
when temporal {
count_within(
1h,
AgentCore::Action::"Transfer"::request{
input.amount: _
}
) > 5
};
That policy forbids a Transfer request when more than five matching Transfer requests have occurred within the previous hour — a sliding 60-minute window, not a session counter. AWS demonstrates temporal policies for prerequisites and approval-before-action, rate limiting, ordering, frequency constraints, distinct-value constraints, and cumulative-value limits.
Dogwood launches with support in Amazon Bedrock AgentCore Policy. AWS's own words: "any syntactically valid Cedar policy is a syntactically valid Dogwood policy." Existing Cedar policies can be reused without rewriting or migration. Temporal conditions can be added when policies need to reason about prior events or action sequences.
The open-source release includes the Dogwood parser, validator, reference interpreter, and a language guide with practical examples. Released under Apache 2.0.
One honest tradeoff AWS calls out: Dogwood's temporal policy evaluation is stateful and does not currently support Cedar's automated reasoning analysis tools. That's worth knowing before you go all-in. One important distinction: the open-source repository's reference interpreter is intended for understanding and testing Dogwood semantics, not as a production authorization engine.
What it's actually good for: The hard class of agentic safety failures — not "did this single action violate policy" but "is this sequence of actions heading somewhere you don't want to go." For example, if an agent repeatedly invokes a tool, Dogwood can enforce a temporal policy that limits how frequently that tool may be called within a defined window. When used through AgentCore Policy, that enforcement occurs at the AgentCore policy layer rather than relying on the agent's prompt or application logic.
Verdict: In my view, one of the most practically interesting agent-safety releases this year. If you're running agents in production with AgentCore, this is worth a close look.
Weekly star tracker, August 11, 2026. Deltas vs. Issue #24 (August 5, 2026).
| Framework | Stars | Weekly Δ |
|---|---|---|
| OpenClaw | 385,885 | +890 |
| n8n | 200,193 | +1,044 |
| Dify | 152,075 | +900 |
| LangChain | 143,963 | +665 |
| CrewAI | 56,931 | +382 |
| AutoGen | 60,356 | +171 |
| Flowise | 55,316 | +204 |
| LlamaIndex | 51,556 | +221 |
| LangGraph | 39,439 | +691 |
| OpenAI Agents SDK | 28,555 | +204 |
| Semantic Kernel | 28,439 | +31 |
| Mastra | 27,097 | +245 |
| Haystack | 26,173 | +77 |
| Vercel AI SDK | 26,125 | +147 |
| MS Agent Framework | 12,727 | +165 |
| Strands Agents | 6,878 | +102 |
Notable moves: n8n (+1,044) takes the top weekly spot, crossing 200K for the first time. Dify (+900) and OpenClaw (+890) both strong. LangGraph (+691) accelerating, likely on the YC QM and Kiro Crew buzz. LangChain (+665) steady. Mastra (+245) extends its streak ahead of Haystack (+77). Semantic Kernel (+31) remains the quietest mover. Strands Agents (+102) ticking up on the AgentCore Runtime Instances GA.
Claude Code Auto Mode Is the Right Call and Everyone's Wrong About Why
Starting August 14, Claude Code Pro/Max/Team defaults to auto mode. An AI classifier replaces human permission prompts. Users were approving 97% of prompts anyway. Auto mode users ship 25% more PRs.
The criticism is predictable: Anthropic is removing human oversight. Dangerous. Irresponsible. They're prioritizing shipping velocity over safety.
This is wrong. But not for the reasons Anthropic gives.
The 97% approval rate is the tell. A permission prompt that gets approved 97% of the time isn't a safety gate. It's a latency tax. Humans pattern-matched "approve" so quickly that the cognitive overhead of the approval itself became the bottleneck. Removing that isn't removing safety. It's removing theater.
The real question is what happens in the 3%. Anthropic says the classifier matched or beat manual review on safety metrics in 1,053 paid testers plus third-party red-teaming. That's a real bar. If the classifier is better at catching the 3% than the humans who were rubber-stamping, auto mode is genuinely safer on net.
The honest concern isn't auto mode itself. It's what this normalization enables. Today it's permission prompts. The same reasoning applies to file writes, shell execution, API calls. Each one has an approval rate. Each one can be auto-approved once the approval rate crosses a threshold Anthropic finds acceptable.
Rubber-stamp approvals were bad oversight. But "the model is better at this than the humans" is only good justification if we're honest about where we're headed. Worth watching, not panicking over.
Which of these are you most excited to try this week?
SellerPulse
Now available on iOS. See your whole AWS Marketplace business in one place. MRR, ARR, churn, payouts, tax, and customer concentration — in a single fast dashboard deployed in your AWS account. Finance-grade revenue visibility, one-click setup. No data leaves your infrastructure.
Try It FreeWant to sponsor this newsletter? Get in touch
Like what you read?
Forward this to a friend who's building with agents.
Subscribe to The Agentic Engineer