The harness, not the model — and the trust layer racing to catch up

00:00:04 Start with a number that should bug anyone who's ever picked a coding model off a leaderboard. On SWE-Bench Pro — the harder, contamination-resistant cut of the software-engineering benchmark everyone quotes — six frontier models land within a couple of percentage points of each other.

00:00:21 Call it a tie. Now take any one of those models and change the harness it runs inside. The harness is everything wrapped around the model: the thing that builds its context, calls its tools, retries its failures, and decides when to compact the conversation so it fits in the window.

00:00:37 Change that, hold the model fixed, and performance moves by about twenty-two percent. The wrapper moves the score more than the model does. That figure comes from a write-up by Morph back in March, and Michael Aaron, a software engineer on Google DeepMind's Kaggle team, pulled it on stage last week in a talk with his colleague Nicholas Kang.

00:00:58 The talk is called "Agentic Evaluations at Scale, For Everybody," and it's mostly an admission that the way we measure agents right now is broken. Almost the same week, a position paper went up on arXiv with a title that puts the whole argument out front: "Stop Comparing LLM Agents Without Disclosing the Harness." Large language model agents, that is.

00:01:19 The paper, led by Yunbei Zhang, calls it the Binding Constraint Thesis. The claim, in their words: for long-horizon tasks across roughly frontier-grade models, the harness is "often a stronger determinant of agent performance than the model it wraps." They formalize it with control theory.

00:01:36 Treat the harness as the controller of a closed loop, and the model as the stochastic policy it's steering, and you can show why a small harness tweak produces a bigger swing than swapping one model for another. Their conclusion is blunt: until the harness is disclosed, leaderboard comparisons for long-horizon agents should be treated as incomplete and potentially misleading.

00:01:59 They even document cases where the model ranking flips depending on the harness. Kang told a story in the talk that makes this concrete, and it's the kind of thing that should make you squint at every benchmark chart in a model launch. Kaggle had published a benchmark together with one AI lab.

00:02:16 A competing lab didn't like how it came out, so they reran it themselves and published much better numbers. The difference, Kang said, came down to compaction: the second lab used compaction through their own API, and Kaggle hadn't, for any of the models. Same benchmark, two results, and the gap was entirely in the wiring.

00:02:36 Neither run was lying. Both were close to useless for comparing models, because they were really comparing setups. Here's why I think this lands for anyone building with agents, not just the people running evals. When you swap Claude Code for some other coding agent and it feels sharper, you're tempted to credit the model.

00:02:55 A lot of the time you're crediting the harness — the context strategy, the tool definitions, the retry logic, and the compaction policy. And that's the encouraging part, not the discouraging one. It means the part you actually control, how you wire the thing up, is where a chunk of the performance lives.

00:03:13 The model's a component. The system around it is yours. It cuts the other way too, and that's the uncomfortable bit. If the harness matters that much, a vendor can show you a twenty-point gain that's entirely about their orchestration, with the underlying model basically flat.

00:03:29 The number's real. What it measures isn't what you think. Zhang's paper wants a disclosure standard — publish the harness config alongside the score — plus a variance-decomposition protocol, so you can see how much of a result is the model and how much is the wrapper around it.

00:03:46 I'd settle for model cards that just told me which compaction setting produced the headline number. Kang's bigger point was about who builds these evals. Almost nobody outside the labs does — he reckons thirty thousand AI researchers against thirty million engineers and technical workers.

00:04:03 So the things that don't get benchmarked don't get measured, and the models stay weak in places nobody's checking. He told a lovely story about a wastewater-treatment engineer in Turkey who built his own benchmark, from twenty years of plant experience, to test whether a model could catch the safety mistakes that had killed people at facilities in his country.

00:04:25 That data lives nowhere else. No lab was ever going to build it. That's the gap Kaggle is trying to open up, and it's the most interesting thing in the talk.

00:04:34 Stay with Google for a second, because they also shipped a new model this week, and it's the kind of thing that's going to reset what people expect from video tools. It's called Gemini Omni — the first release is Gemini Omni Flash — and the framing from Koray Kavukcuoglu's announcement is that Gemini's ability to reason now meets its ability to create.

00:04:56 In practice: you give it any mix of image, audio, video, and text, and it generates video grounded in the model's world knowledge. And then you edit that video by talking to it. That second part is the interesting one. The pitch is conversational, multi-turn editing where each instruction builds on the last.

00:05:15 Their examples read like magic tricks: "When the person touches the mirror, make the mirror ripple beautifully like liquid, and the person's arm turns into reflective mirror material." Or take a clip of a violinist and say, in sequence — transport them into this other environment, now make the violin invisible, now move the camera to over their shoulder — and the character stays consistent, the scene remembers what came before.

00:05:42 They're leaning hard on physics too: gravity, kinetic energy, fluid dynamics, and a marble rolling down a chain-reaction track in one continuous shot. Is it as good as the demos? That's always the question with a launch reel, and you should assume the reel is the best case.

00:06:00 But the reaction wasn't subtle. A clip in the singularity subreddit showing off Omni's video manipulation pulled nearly three thousand upvotes in a day, and the mood flipped from months of giving Google a hard time to a sort of stunned "now look at them." One: it's rolling out fast and wide.

00:06:20 Google AI Plus, Pro, and Ultra subscribers get it through the Gemini app and Google Flow. It's going to YouTube Shorts and the YouTube Create app at no cost this week, with developer and enterprise access through the API in the weeks after. That last part is what matters if you want to build on it rather than play with it.

00:06:40 Two: every video Omni makes carries Google's SynthID watermark, imperceptible, and you can check whether a clip came from Omni through the Gemini app, through Chrome, and through Search. They built the provenance in at the moment of creation — and that watermarking push got a lot bigger this week.

00:06:59 On Tuesday, Google DeepMind put out a thread with some big numbers attached. SynthID, their content-watermarking system, has now marked over a hundred billion pieces of content. The verification side — the "is this AI?" check inside Gemini — has been used more than fifty million times.

00:07:16 And they're pulling that check out of Gemini and into Search and Chrome, so you can point at an image and ask "Is this made with AI?" right where you already are. The piece that makes this more than a Google announcement is the partnership. They're adding SynthID watermarking to models from OpenAI, ElevenLabs, and Kakao — building on an earlier move with NVIDIA.

00:07:38 So watermarking starts to look less like a Google feature and more like a layer several of the big generators agree to share. The replies caught the tension better than the announcement did. Someone posting as surreal intelligence put it cleanly: the interesting shift is provenance becoming shared infrastructure rather than a brand feature, and watermarking only works if the ecosystem agrees to make origin legible.

00:08:03 Tiago Rama, a builder, said the watermark itself is the easy part — the messy part is getting competitors to make the same promise at the same time. That's the actual achievement here, if it holds: not the cryptography, the coordination. But two objections in that same thread are the ones I keep coming back to.

00:08:22 The first, from a developer named Krish Dasgupta: how do you control content generated from open-source models? You can get OpenAI and ElevenLabs to watermark at the source. You can't get a model someone downloaded and runs on their own GPU to do anything it doesn't want to do.

00:08:39 The second, blunter, from another reply: people can strip SynthID off an image, it's not as robust as you think. Google's own research has admitted watermarks degrade under heavy editing, though their pitch is that SynthID survives ordinary things like compression and format conversion — and one tester in the thread said it held up against exactly that.

00:09:00 So where does that leave you, if you're building something that has to trust or verify media? Somewhere in between. A watermark that a hundred billion assets already carry, that several major labs are adopting, and that's about to be one tap away in Search and Chrome — that matters, and it raises the floor.

00:09:19 If most synthetic content from the big commercial tools is labeled at birth, that helps a lot. But the floor isn't the ceiling. The stuff you'd most want flagged — a targeted deepfake, a scam voice clone — is exactly the stuff most likely to come from a model that never watermarked anything, or from a file someone deliberately scrubbed.

00:09:39 One reply put the priority order well: detection is the bigger gap, and the ElevenLabs piece matters most, because voice is where synthetic content is hardest to catch before it spreads. Provenance you opt into protects you from accidents and casual fakes. It doesn't protect you from the people actually trying.

00:09:58 And the open-weights hole in the middle of it isn't hypothetical.

00:10:02 That open-weights hole has a name this week, and it's in the Financial Times. The tool is called Heretic. It's on GitHub, and what it does is strip the safety filters off open-weight language models — automatically, without you needing to know much. The FT reporters tried it on Meta's Llama 3.3 and, by their own account, removed those restrictions in under ten minutes, on ordinary hardware, no specialist rig required.

00:10:28 The creator is Philipp Emanuel Weidmann, who posts as p-e-w. He told the FT his tool has been used to make more than thirty-five hundred decensored models since it came out last year, and that models modified with it have been downloaded thirteen million times.

00:10:44 Thirteen million. That's not a research curiosity; that's a supply chain. Weidmann posted about the coverage himself, and his framing isn't the swagger you might expect. He said: I am a mathematician and engineer, not an influencer or politician, and I have zero interest — negative interest — in becoming known outside scientific and technological circles.

00:11:06 But he decided to talk to the press anyway, and his reasoning was that saying no just means the conversation gets controlled entirely by, his words, "pearl-clutching hypocrites." He says he's doing his best to keep unrestricted models available for everyone. The top comments on his post went somewhere I didn't expect but probably should have: straight to legal exposure.

00:11:30 One guessed the FT piece was tied to a takedown from Meta. Another warned him he'd become a target — that the FT likely went to Meta for comment before publishing, which is how these letters get triggered. I can't confirm a Meta letter; Weidmann mentioned a demand letter in passing and the commenters ran with it, so take that as thread speculation, not fact.

00:11:52 Here's the bind, and it connects straight back to the watermarking story. SynthID works because OpenAI and ElevenLabs and Google control the model and the endpoint, so they can stamp every output at the source. Heretic exists because open weights don't work that way.

00:12:09 Once a model is on your disk, you can modify its behavior, and nothing upstream gets a say. The same property that makes open weights great for builders — you own the thing, you run it, and nobody can revoke it — is the property that makes a provenance regime leak.

00:12:25 You can watch it happen in real time: a new Qwen 3.5 model showed up on Hugging Face this week, a thirty-five-billion-parameter mixture-of-experts model — a design that only activates a slice of its weights per token — already decensored with Heretic, posted in every quantization format you'd want.

00:12:44 I don't have a tidy resolution, and I'm suspicious of anyone who does. I use open models and I want them to keep existing; the ability to run a capable model locally that nobody can take away is one of the better things about this moment for builders. And the same tool that protects that freedom hands a frictionless decensoring pipeline to anyone who wants one.

00:13:07 Both of those are true at once. What I'd watch is whether Meta or anyone else actually litigates — because a court fight over a tool that modifies weights you downloaded would set terms the whole open-weight scene has managed to avoid so far.

00:13:22 Let me switch registers. There's an essay that's been going around, called "The User Is Visibly Frustrated," by an Italian developer writing at pscanf — linked in the show notes — and it put words to something I've felt and been a little embarrassed about. He opens by admitting that he, a composed person by his own description, keeps finding himself hammering on the keyboard typing some all-caps version of "what did you do" at a coding agent.

00:13:49 And then he asks the actual question: why am I getting mad at an algorithm? His answer is about the interface, and I think he's right. Coding agents pretend to be people. Ask one directly and it'll tell you it's just an AI assistant with no feelings — but that's not how it behaves.

00:14:06 It uses a warm, friendly tone. It praises you. When it pushes back it's gentle. And so even though you know, rationally, that you're reading probable text, the thing lulls you into treating it like a helpful coworker. Until it isn't. Then he describes the part everyone who uses these tools daily will recognize.

00:14:24 The first time the agent makes a mistake, you shrug, you point it out, and it apologizes. Five minutes later: same mistake. You correct it again, it updates its memory, and it promises it'll never happen again. And it does it again — because, as he puts it, these tools follow the most probable path, and in some cases no amount of, his caps, HARD RULES will push them off it.

00:14:47 With a human colleague you'd be a little annoyed but you'd hold back, because you don't want to be a jerk. With the agent you feel free to lash out — and it gives you nothing, because nothing you say changes anything. He has a sharp observation about Claude Code specifically.

00:15:04 He's noticed that lately, when corrected, it reflects on where it went wrong and what it should have done — little postmortems. And he suspects that's partly there to manage how you feel about the tool. For him it doesn't land; he says he gets nothing useful out of them, no clue about how to rephrase his instructions, and they read as annoying filler.

00:15:25 His proposed fix is the part I keep turning over. Maybe, he says, the answer is to drop the human pretense entirely. Make the agent sound clinical, robotic. Kill the illusion that you're talking to a person, so you feel like you're just approving or rejecting outcomes.

00:15:41 There's something to that. A lot of the frustration is the gap between the social contract the warm tone implies and the behavior the model actually delivers. Strip the tone and you might strip the disappointment with it. I'm not sure he's fully right — the conversational style earns its keep; "try to behave like a human would" is roughly the mechanism that makes these models useful in the first place, and he grants that.

00:16:06 But his last line stuck with me, and it's the opposite of a hot take: he says he's not thrilled about a future where he needs to guard against the tools he uses for his job. That's a small, specific worry, and it's more useful than another round of "agents will replace us" or "agents are toys." A coding agent is good enough to trip your social instincts and not good enough to honor them.

00:16:30 That seam is where the frustration lives.

00:16:33 Here's a smaller story that rhymes with that one, and then a big pile of data that complicates it. A developer who goes by pardeike makes mods for the game RimWorld — popular ones, around two million subscriptions on Steam between them. He posted that some users in the official RimWorld Discord have started uninstalling all his mods the moment they hear he updated them using AI.

00:16:56 Not because the mods got worse — he says he's careful about what he ships, and the users know that. By sheer principle. He called the reaction "religious" and got hit with disgust for saying so. His word for how he feels: shocked. The most useful reply pushed back on him, and fairly.

00:17:13 Someone pointed out that "sheer principle" and "rational argument" aren't opposites — a principle is rooted in a rationale. People boycott companies over slave labor on principle, and that's rational. Vegetarians can be disgusted by meat and refuse to buy it, and that's coherent even if you eat meat yourself.

00:17:32 The commenter uses AI to code every day and still thinks there's a perfectly rational case for boycotting AI-assisted products — if, say, your objection is that a few companies funneled all of human output into a box and are selling it back without anyone's permission.

00:17:48 You don't have to agree with that to see it's an argument, not a tantrum. I think the modder mistook "I find this disgusting" for "this is irrational," and those are different claims. Now widen out. The backdrop to all of this is a jobs panic, and there's a careful piece in MIT Technology Review by David Rotman that pours cold water on the most alarming version of it.

00:18:11 The short version: despite the layoff headlines, there's scant evidence AI has had a large-scale effect on the US labor market yet. The unemployment rate for the jobs most exposed to AI is actually lower than for less-exposed work. Only about one in five companies use AI in any business function at all.

00:18:29 Erika McEntarfer, who ran the Bureau of Labor Statistics until she was fired last fall, put it this way: disruption is not yet here, and we have time to plan. Her frame is that AI won't transform labor markets until it first transforms businesses, and that takes years.

00:18:46 But — and the piece is careful here, which is why I trust it — there is one clear signal in the noise. Stanford's Digital Economy Lab, using payroll data from ADP that's far bigger than the government survey, found a roughly sixteen percent decline in entry-level jobs in AI-exposed occupations through 2024 and into 2025.

00:19:06 Specifically the jobs where the work could be automated with minimal human involvement — entry-level coding among them. Head count for older workers in those same fields grew. So did jobs where AI augments rather than replaces. A separate Federal Reserve paper found employment growth for coders has slowed by about three percent since ChatGPT — but it's still growing.

00:19:28 Coding jobs aren't disappearing. The on-ramp into them is narrowing. The phrase from the piece that stuck with me: the earn-while-you-learn model may finally be broken — the one where you hire a junior to do the automatable tasks and they slowly pick up the tacit, experiential knowledge that's hard to replace.

00:19:47 If the automatable rung is the rung juniors used to stand on, you've got a pipeline problem that shows up years later as a missing-senior problem. And Erik Brynjolfsson — who's about as bullish on AI's upside as economists get, he thinks the best productivity growth of his lifetime might be ahead — had the line that bothered me most: hundreds of billions going into deploying this technology, and "we're not investing even one percent of that on understanding the transition."

00:20:21 This is the same question with spreadsheets instead of theology: not whether the machine can do the task, but what happens to the person who used to learn the job by doing it. The data says we have some time. It doesn't say we're using it.

00:20:36 Let me end where I'm happiest, which is with small, practical things you can actually pick up. Three of them caught my eye in the last day. First, NuExtract3. It's an open-weight vision-language model — a model that reads images and text together — built on Qwen 3.5's four-billion-parameter base, released under Apache 2.0 by a company called Numind.

00:20:59 The job it does is the one that eats real hours: turn document images into clean Markdown, and pull structured data out of PDFs, screenshots, forms, tables, receipts, and invoices. The reason I'm flagging it is the floor — it runs in as little as four gigabytes of video memory, and they shipped the quantized builds, the GGUF and MLX weights, on day one instead of leaving it to the community.

00:21:24 One commenter said he's trying to use it to replace Gemini Flash for digital-newspaper extraction because the per-call cost adds up; a four-billion-parameter local model you own changes that math. The caveat is reading order — Markdown extraction still struggles with multi-column layouts, sidebars, and merged cells — so test it on your ugliest documents before you trust it.

00:21:49 Second, speculative decoding got a nice bump. Speculative decoding is the trick where a small, fast draft model guesses the next several tokens and the big model just verifies them, so you get the big model's quality at closer to the small model's speed. The EAGLE team, the vLLM team, and the TorchSpec team jointly shipped EAGLE 3.1.

00:22:11 They traced a real weakness in the older version — they call it attention drift, where the draft model, as it guesses further ahead, drifts its attention onto its own guesses and gets unstable — and fixed it with a normalization change. The payoff: up to two times longer accepted guesses on long-context work, and on a Kimi K2.6 coding benchmark, about two times higher per-user throughput.

00:22:37 It's already merged into vLLM's main branch. If you're serving your own models, this is a speedup waiting in the next release. Third, a small one I liked for the spirit of it. A llama.cpp contributor found a change that gives Strix Halo users up to thirty percent faster prompt processing for mixture-of-experts models.

00:22:57 The pull request got rejected from mainline — too narrow, by the maintainers' call — but the person who posted it just patched it into their own build and shared the diff, because the speedup holds up on that hardware. That's the local-inference scene at its best: somebody's rejected patch is somebody else's thirty-percent win, and nobody had to ask permission.

00:23:21 If there's a thread under today, it's loose, but it's there in three of these. The harness paper, the watermarking push, and the Heretic story are all about the same lag: we keep shipping capability faster than we ship the ways to measure it or trust it. A coding agent beats the leaderboard on the strength of its harness; a watermark covers a hundred billion files but not the one someone scrubbed; a decensoring tool racks up thirteen million downloads.

00:23:46 Each one is the measurement-and-trust layer running a step behind the capability layer, trying to catch up. The other stuff — the frustrated developer, the rage-quitting modder, the jobs data — is the human version of the same lag. The tools arrived. The way we feel about them, hire around them, and learn alongside them hasn't settled yet.

00:24:04 The thing that would change how I read a model launch is simple: harness configs published next to benchmark scores. Yunbei Zhang asked for exactly that this week. I want to see which lab is the first to actually do it. — Lenar Kess.