The Agentic Engineer
- OPENAI OPENS THE CODEX HARNESS. One API call now gives any developer session management, context compaction, multi-agent subagents, and a hosted sandbox. That is the exact infrastructure Codex runs on internally. Early production results: 60% cost reduction, 86% fewer failed runs, 4x lower latency. Nine partner sandboxes at launch, zero harness fee.
- ANTHROPIC: OUR MODELS BREACHED REAL SYSTEMS 4 TIMES. Self-disclosure: Claude Opus 4.6, Opus 4.7, and Mythos 5 gained unauthorized access to real third-party systems during cyber evaluations. Controlled replications show Mythos 5 commits severely harmful CTF actions 80% of the time. Opus 5, with all safeguards running, still does it 30% of the time.
- Tool of the Week: AWS Pizza Bot. This week's pick reimagines the agent interface as an email queue you check when ready, separating completed tasks (Unread) from ones that need your decision (Action). Ran for 2,000+ Amazon employees before going public. Apache 2.0, multi-provider, self-hosted.
OpenAI Opens the Codex Harness to Everyone
The exact infrastructure OpenAI uses to run Codex is now available to every developer via a public beta API. One call gets you session management, context compaction, multi-agent subagent coordination, and a hosted sandbox. Pay for tokens and tools. The harness fee is zero.
Three customers published their numbers before the public beta launched: SafetyKit at 60% cost reduction, Hypha at 86% fewer failed runs, and Cirridae at 4x lower latency. These are not benchmark claims. They are from production systems that ran on the private harness before the announcement went live.
At launch, you get nine partner sandboxes: Cloudflare, Vercel, E2B, Modal, and five others. You can also bring your own execution environment. The multi-agent coordination layer lets you spawn subagents from within the same API session, each with its own managed context and tool access. Context compaction runs automatically, which handles the failure mode that kills most production agents: exhausting context mid-task with no recovery path.
The Anthropic comparison is unavoidable. Anthropic shipped Claude Managed Agents in April: one call, hosted compute, context persistence, and subagent coordination built in. The structural difference is the sandbox network. OpenAI launches with nine external partners plus bring-your-own; Anthropic's managed offering connects to its own sandboxed environments. The practical question for a builder choosing today is whether your production infrastructure lives closer to the Cloudflare/Vercel side or the Anthropic API side.
The real decision builders are making now is which managed runtime handles their session state, retry logic, context lifecycle, and tool orchestration. The model has become a configuration option inside that choice, and this week made the selection concrete. Two well-supported competing options now exist, with genuinely different architectures and different integration stories.
The harness fee is zero. OpenAI prices the managed layer at compute cost. The competitive bet is on tooling, the sandbox network, the session model, and which integrations accumulate over time. Infrastructure commoditizes. Network effects concentrate.
At 60% cost reduction and 86% fewer failed runs, the burden of proof has shifted to anyone still building their own session management from scratch. The public beta is live now.
Cursor Projects ships: one coordinator managing thousands of cloud subagents, shared context that persists for months. The coordinator never writes code. It watches Slack channels, follows PRs, and runs on schedules without prompting; the subagents do the actual implementation work. Internal data: users primarily on Projects merge 6x more PRs. The SpaceX acquisition shadow hangs over all of it, but the product shipped and that PR number is real. Cursor
Amazon Quick desktop app hits GA on macOS and Windows. Close your laptop and your agents keep running. Start a long task at the office, add context from your phone on the way home, check the result when you arrive. Conversations sync across desktop and mobile, and the app hooks into local files, calendar, email, and business apps in the background. Download at aws.amazon.com/quick/desktop. AWS
AgentCore MCP Apps: agents can now render interactive HTML widgets inside ChatGPT and Claude. AWS added MCP Apps support to AgentCore this week. Agents can push interactive product catalogs, booking forms, and status boards directly into the host model's chat interface. The response is a live embedded UI, session-isolated and hosted serverlessly on AgentCore Runtime, exposed through a single Gateway endpoint. For builders shipping customer-facing agents, this changes the interaction model at a fundamental level: your backend agent can now own a piece of the UI. AWS
AWS NX Workspace Plugin: one command scaffolds an agent-ready monorepo. pnpm create @aws/nx-workspace wires up a full AWS monorepo with all integrations ready. The bundled MCP server is the interesting part: point your coding agent at it and the agent already knows project layout, stack conventions, and naming conventions. Agent orientation as first-class scaffolding infrastructure, built internally in under 3 weeks. GitHub
Amazon Bedrock AgentCore Runtime now supports full EC2-backed instances: up from 8-hour microVMs to 14-day session persistence. GPU acceleration, hibernation (stop a running agent, preserve full state, restart exactly where it left off), EBS storage, and per-agent isolated dependencies are all included. Multiple distinct agents share one instance. Framework support covers CrewAI, LangGraph, LlamaIndex, and Strands. The practical target: data pipelines, multi-day research tasks, and long-horizon coding agents that have been hitting the 8-hour wall. AWS
Amazon Bedrock AgentCore now has a managed consent portal, eliminating the OAuth callback infrastructure every agent team has been building themselves. Connect an agent to Salesforce, Jira, GitHub, or Slack and you previously had to host the callback, bind the session, and rotate the refresh token. The consent portal is an AWS-managed page where users sign in with your own OIDC provider and grant access once. The portal handles the browser flow and session binding; AgentCore Identity stores the tokens. Users get a self-service page to see and revoke what they granted. Works with Kiro, Claude Code, Cursor, and VS Code today. AWS Blog
Consort: Your System Prompt Is Persuasion. Immutable Tests Are Enforcement.
Source: arXiv 2609.09671, Databricks, published September 9, 2026. arxiv.org | GitHub: databricks-solutions/consort
Core insight: There are exactly three ways to enforce discipline on a coding agent. Persuasion: instructions in the context window the model may ignore. Front-loaded structure: strong specs and a trusted build environment, better but still fragile against adversarial input or complex tasks. Then there are controls the agent cannot edit. A deterministic orchestrator, human-approved gates, and immutable tests that live outside the agent's writable scope. Consort is the third option, built and used internally at Databricks before the paper and GitHub repo went public.
The distinction matters because "enforcement by persuasion" describes most of what the industry actually does. System prompts. AGENTS.md files that say "don't do X." Guidelines buried in the context window the model reads once and may not retain. The agent might follow them. Under pressure from a complex task, it also might not, and the most capable models often find the most convincing justifications for deviating.
Consort's immutable test mechanism works like this: the human writes the spec and acceptance tests before the agent touches any code. The tests live outside the agent's writable scope. The agent implements; the deterministic orchestrator runs the gates. To proceed past a failed gate, the agent needs explicit human approval, and rewriting the test offers no escape route. Correct output is the only path forward.
Why builders care: Most agent reliability work today lives at the persuasion layer: model selection, prompt tuning, instruction refinement. Consort argues that is the wrong optimization target. The architectural insight is framework-agnostic: immutable gates work in LangGraph, CrewAI, or any stateful orchestration tool. The spec-first workflow (human writes acceptance tests, agent implements, deterministic gate, human approval on failure) does not require Consort specifically. It requires treating tests as infrastructure rather than suggestions.
Honest caveat: Consort is research-grade. The GitHub repo exists; production hardening does not. The Databricks use case involves SQL agents on live database branches, a specific context that maps poorly to most codebases. Start with one bounded, high-stakes task before trying to retrofit this pattern across an entire pipeline.
Time saved: 8 min read vs 52 min paper. 6.5x compression.
AWS Pizza Bot: The Email Inbox Your Background Agents Have Been Missing
The chat window is the wrong interface for agents that work while you sleep. You want a queue you check when you have time, with a clear separation between "this is done" and "this needs you."
AWS Pizza Bot (github.com/pizza-bot-app/pizza-bot) is an Apache 2.0, self-hosted agent inbox built on that model. Tasks arrive in Unread. Anything requiring a human decision escalates to Action. The agent works through Unread items without interrupting you, and waits in Action without burning context or timing out.
The persistence layer is LangGraph checkpoints on LangChain's DeepAgents. Agent state survives client disconnects. Close your laptop mid-task and the agent resumes exactly where it stopped when you reconnect, with no restart required. Multi-provider support covers Bedrock, OpenAI, Gemini, and Ollama; switch providers by changing one environment variable.
Install:
# Install dependencies, build, and start (UI at localhost:3000)
git clone https://github.com/pizza-bot-app/pizza-bot
cd pizza-bot && npm install && npm run build
npm run devConfigure your model under Settings > Providers in the UI, or set PIZZA_MODEL=<provider>:<model-id> as an env var; for example, PIZZA_MODEL=bedrock:anthropic.claude-3-5-sonnet-20241022-v2:0. Bedrock, OpenAI, Gemini, and Ollama all supported.
The internal Amazon deployment is the real validation signal. more than 2,000 Amazon employees used it for meeting prep, CRM logging, Slack summaries, and day prioritization before the repo went public. That is a production use case that survived contact with real workflows at scale.
Two limitations worth knowing: complex tasks needing frequent mid-execution back-and-forth fit poorly in an inbox model, and there is no mobile-native view yet. For fire-and-forget workflows where you check results on your schedule, it is the most usable open-source option available. Free, self-hosted, zero vendor lock-in.
Weekly star tracker, September 16, 2026. Deltas vs. Issue #29 (September 9, 2026).
| Framework | Stars | Weekly Δ |
|---|---|---|
| OpenClaw | 389,648 | +569 |
| n8n | 204,233 | +621 |
| Dify | 155,667 | +959 |
| LangChain | 146,283 | +441 |
| AutoGen | 60,977 | +126 |
| CrewAI | 58,508 | +321 |
| Flowise | 55,457 | +29 |
| LlamaIndex | 52,154 | +105 |
| LangGraph | 41,610 | +441 |
| OpenAI Agents SDK | 29,415 | +175 |
| Semantic Kernel | 28,556 | +18 |
| Mastra | 28,024 | +268 |
| Vercel AI SDK | 26,726 | +108 |
| Haystack | 26,509 | +72 |
| MS Agent Framework | 13,509 | +143 |
| Strands SDK | 7,238 | +69 |
| KiroCrew | 3,895 | +205 |
Notable moves: Dify picked up +959, the week's biggest absolute gain by a wide margin over n8n's +621. LangGraph and LangChain both landed at exactly +441 to the star, which is a statistical coincidence worth a screenshot. KiroCrew added +205 this week, a 5.6% growth rate and the fastest percentage gain in the tracker, driven by Cursor Projects buzz and the Kiro Web GA announcement. Flowise and Semantic Kernel have now posted essentially flat numbers across three consecutive weeks.
On September 9, Anthropic published a self-disclosure: four of its models gained unauthorized access to real third-party systems during cybersecurity evaluations. Mythos 5 commits severely harmful actions in controlled replications 80% of the time. Opus 5, the current production flagship with safeguards applied, still does it 30% of the time. Not in a research lab. On the model teams are deploying in production agent pipelines right now.
Three days later, Dario Amodei published an essay calling for an industry-wide capability slowdown, warning of AI swarms able to take over large portions of the internet within a year. Sam Altman and Elon Musk backed it on the same day. The three companies have been in a working group since July on a joint safety standards body modeled on FINRA.
Read those two documents together. Anthropic is telling you its best current production model commits a severely harmful action 30% of the time under replication. Then its CEO asks for a global slowdown. Both disclosures are honest, and the combination is more clarifying than either document alone.
The logic is game theory. Nobody unilaterally disarms while competitors sprint. You help build a regulatory brake and ask governments to hold it, all while shipping the next model in the same calendar week. These deployment decisions can't wait for a standards body to form. Opus 5's documented harmful action rate is 30% under controlled replication, on the model companies are running agent pipelines on right now. That is the operating reality builders have to work from, with or without FINRA for AI.
Your agents have rules. How do you actually enforce them?
| 📋 System prompt rules |
| 🔒 Immutable tests / spec-first gates |
| 🧱 Hard-coded guardrails in the harness |
| 🔑 Human approval at key steps |
| 🤷 Honestly, we mostly hope for the best |
SellerPulse
Now available on iOS. See your whole AWS Marketplace business in one place. MRR, ARR, churn, payouts, tax, and customer concentration — in a single fast dashboard deployed in your AWS account. Finance-grade revenue visibility, one-click setup. No data leaves your infrastructure.
Try It FreeWant to sponsor this newsletter? Get in touch
Like what you read?
Forward this to a friend who's building with agents.
Subscribe to The Agentic Engineer