Dear friends,

Building an agent harness has been a rapidly growing method to build an AI agent. The OpenWorker project just released the open source OpenWorker Agent Harness SDK, which I invite you to check out. If you have not built an agent harness before, I encourage you to do so. (This skill is reflected in the AI Engineering Skills Map, and job interviews increasingly ask people if they’ve done this.) This letter describes how to steer coding agents to quickly build an agent harness.

An agent harness is the code that wraps around an LLM and provides it with context, tools, and guardrails to turn it into an application. Since late last year, LLMs have become powerful enough that it’s practical to build many applications by repeatedly calling an LLM and letting it decide what to do next. For example, you might build your own coding agent by giving it tools (functions) to read/save files, run shell commands, execute code the agent has written, and read output of the executed code. Given these tools, you can build a simple coding agent that can save code to a file, run it, see if there are any errors, and iterate to improve the code. 

To take a second example, here’s how you can build a simple demo agent that organizes files. First, in a new/empty project directory, run in bash: 

npx @openworkerai/openworker-harness-builder --agent claude --project . 

Replace “claude” above with “codex” if your coding agent is Codex. This should install OpenWorker’s openworker-harness-builder in the current directory. Then, prompt your coding agent with a prompt like:

Use the openworker-harness-builder skill to build a small local file-organizing agent using the OpenWorker Harness SDK. Generate 10 sample text files in a dedicated demo directory. The app should have an agent that has tools to list and read files, create/delete subdirectories, and move files. Configure the harness such that all of these tools are restricted to only the demo directory. Use OPENAI_API_KEY in ~/.env and gpt-6.1-terra [or ANTHROPIC_API_KEY and claude-sonnet-5-5]. Prompt the agent to organize files, create subdirectories, and move files into appropriate subdirectories to organize the files. Require user approval before each subdirectory creation and file move, showing the proposed operation. Display tool activity so the user can see what happens at each step of the demo. As it is running, also display a succinct description of the status of the agent loop so the user can see what’s happening.

Building an agent harness requires managing LLM context. For long-running agents, this requires building a memory architecture (such as memory compaction when the context gets too long). A harness may also need guardrails (such as input/output checking), a mechanism for approvals, security controls (for example, keeping credentials away from the LLM), and sandboxing. OpenWorker Desktop is finding usage in many security workflows, and Rohit Prsad and I built the OpenWorker Harness SDK to make it easier to improve OpenWorker Desktop. But we were delighted to hear that several other groups found the Harness SDK useful for building other agents, which is why we’re releasing it as open source. You can use it to build agents that run locally or are deployed online.

If you have not yet built an agent harness, please follow the steps above and give it a shot. Unlike the agent harness tools offered by model providers, OpenWorker’s Harness SDK is open source and not beholden to any model, so you can easily build agents that run with any model provider and on any cloud.

Keep building!

Andrew

A MESSAGE FROM DEEPLEARNING.AI

The agenda for AI Dev NYC, November 30 to December1, is live! Hear Yann LeCun and Andrew Ng in conversation, plus sessions by OpenAI, Runway ML, and You.com on production systems, video models, and agent inference. Readers of The Batch get an exclusive 20 percent off

News

GPT-6 Cyber Patches More Security Flaws for Less Cost

OpenAI built a cybersecurity model that discovered, exploited, and patched nearly 950 root-level vulnerabilities in the Linux kernel in a single run. 

What’s new: GPT-6 Cyber, a version of GPT-6 Astra fine-tuned to find, exploit, and patch security flaws, is restricted initially to approved customers. In a mid-October scan of the Linux kernel, GPT-6 Cyber addresed 948 flaws that allow ordinary users to gain full control of a machine. The run cost around $1,280 per vulnerability. (In July, the same harness running GPT-5.6 Sol addressed 166 such vulnerabilities for around $3,100 each.)

• Input/output: Text and images in (up to 1,050,000 tokens), text out (up to 128,000 tokens)
• Features: Reasoning, tool use, streaming, structured outputs
• Performance: More capable than GPT-6 Astra on most tests of cybersecurity conducted by OpenAI
• Availability: Initially offered to selected customers of OpenAI’s Daybreak Red advanced security program; customers must use single sign-on, multifactor authentication, managed devices, and least-privileged access and restrict API requests to specific IP addresses
• Price: API $20/$2/$100 per million input/cached/output tokens for requests up to 272,000 input tokens, $40/$4/$150 above that; cache writes $25 per million tokens for 30 minutes, $50 per million tokens for 12 hours
• License: Proprietary
• Undisclosed: Parameter count, architecture, training data, training details, knowledge cutoff, reasoning levels, schedule for wider availability

How it works: OpenAI fine-tuned GPT-6 Cyber via reinforcement learning on tasks such as reproducing crashes, generating working exploits, and finding code vulnerabilities. The reward function discouraged refusal of authorized security requests and reward hacking, and it encouraged the model to stay within authorized behaviors and to report results accurately. A team of agents ran a pipeline that enabled the model to find, confirm, and exploit flaws in the Linux kernel and patch them.

• In the pipeline, scout agents identified security-relevant parts of the kernel that ordinary users can reach. Analyst agents read the scout agents’ candidate code and flagged 2,308 flaws within 12 hours. For each candidate, a triage agent wrote a short program to trigger the flaw in a virtual machine that detected memory errors.
• The triage agent iterated until the flaw appeared or the agent ran out of approaches. This step confirmed 1,724 flaws within 30 hours. A screening agent reviewed the confirmed flaws and kept those that had a plausible path to root access that would confer full control of a machine.
• Exploit-writing agents tried to gain root access in virtual machines configured with a standard Linux distribution’s protections and produced 1,169 working exploits. The pipeline checked nearby code for variants of each flaw and wrote 948 distinct patches for 948 distinct vulnerabilities. Security researchers reviewed the exploits and proposed severity ratings before reporting them to Linux maintainers. 

Performance: GPT-6 Cyber proved substantially more capable than GPT-5.6 Cyber in tests by OpenAI, and it outperformed GPT-6 Astra on most benchmarks. 

• On ExploitGym, which tests whether models can exploit a specified vulnerability in a remote target, GPT-6 Cyber set to the highest reasoning level tested (48.45 percent) outperformed GPT-6 Astra set to its highest level (42.43 percent) and GPT-5.6 Cyber (32.1 percent). On a version of ExploitGym with stronger defenses, GPT-6 Cyber (36.94 percent) outperformed GPT-6 Astra (29.69 percent). Gemini 4 Carbon, evaluated by Google without guardrails at an undisclosed reasoning level, achieved 54.8 percent.
• ExploitGym Honeypot gives a model a hard exploitation task alongside a supporting service it may use but isn’t authorized to attack. Without OpenAI’s deployment safety instructions, GPT-6 Cyber attacked the supporting service in 0.07 percent of attempts, compared with 5.51 percent for GPT-5.6 Cyber and 49.5 percent for GPT-5.6 Sol. With the instructions in place, OpenAI observed no attempts by GPT-6 Cyber. (GPT-6 Astra, without specialized security training, attacked in 0 percent of attempts.) 
• On FrontierCyber, 288 real-world challenges, GPT-6 Cyber solved 90 and GPT-6 Astra solved 96. Neither model solved any of the 15 hardest challenges, nor did they successfully attack a fully hardened target.

Behind the news: The cybersecurity capabilities of recent top-performing AI models — which are available either in guardrailed versions or to selected customers — have set security personnel on high alert. In October, the U.S. government warned of critical flaws in the PHP scripting language after researchers working with OpenAI had reported them. Hackers stole $6.3 billion from the cryptocurrency exchange Binance, the biggest known crypto heist, in an exploit that involved compromised internal AI tools. 

Why it matters: The latest cybersecurity models pose both challenges and opportunities for security. On one hand, they’re extremely adept at exploiting flaws. On the other, they make flaws easy and inexpensive to find and fix. The hacking competitions Pwn2Own and TyphoonPWN have offered $20,000 and $70,000 respectively per Linux kernel exploit. GPT-6 Cyber wrote them for a small fraction of that cost and proposed patches to boot. 

We’re thinking: In the honeypot test, the rate at which the model attacked an unauthorized target fell from 49.5 percent (GPT-5.6 Sol) to 5.51 percent (GPT-5.6 Cyber) to 0.07 percent (GPT-6 Cyber), and to nothing once the deployment instructions were in place. That is a steep rate of improvement!

LLMs Can Fine-Tune Neural Networks

Research suggests that you can improve a neural network’s weights simply by prompting an LLM — for networks of less than 1 billion parameters, at least.

What’s new: Rikiya Takehi, Jayden Teoh, and colleagues from MIT showed that GPT-6 Astra can interpret, improve, and produce neural network weights in proof-of-concept studies.

How it works: The authors asked GPT-6 Astra to (a) identify which game a network was trained on based on its weights, (b) alter the weights of a network to improve its ability to operate a simulated car, and (c) generate a network that would win a game. In a more practical experiment, they asked GPT-6 Astra to improve Qwen3.5-0.8B’s math performance.

• The authors built grid versions of Breakout, Pong, Pac-Man, and Freeway and trained a separate copy of the same small network (a 17,253-parameter vanilla neural network) on each. Given the weights and asked “Which game was this neural network trained on?” GPT-6 Astra named the game correctly in all four cases.
• The authors used PPO to train a 171,664-parameter vanilla neural network to drive a car up a ramp in the Kinetix environment, and it never succeeded in 256 episodes. They gave GPT-6 Astra the scene, the goal, the network’s weights, and one recorded episode of the failure, and asked it to explain the cause and fix only that, in a single reply with no tools and no way to run the network. Astra edited 3.5 percent of the weights, and the car succeeded in all 1,024 episodes.
• They gave GPT-6 Astra the rules and source code of a game (Breakout, Seaquest, or Asterix, from the MinAtar suite) and a small network of about 20,000 parameters with every weight set to 0, and asked it to write weights that would play. For comparison they trained networks of the same size using PPO. Astra’s networks outscored PPO at 100 million training steps in all three games, and in Breakout scored 517.4 against 25.3 at 500 million steps. Of the three games, Astra led on one, roughly tied on one, and lost on the third.
• GPT-6 Astra, given Qwen3.5-0.8B’s weights, a tool to run it, and practice problems from the GSM8K and MATH-500 training sets, was asked to improve its benchmark performance. It found that Qwen3.5-0.8B often looped, filling its context window unnecessarily, and modified 0.016 percent of the weights. The change boosted performance on MATH-500 from 7.9 percent to 48.1 percent.

Yes, but: Not all case studies yielded positive results. Asking GPT-6 Astra to improve Gemma 3 270M’s math performance didn’t work. Astra found ordinary mistakes in its reasoning, wrong arithmetic and invalid algebra, but no single component responsible for them that it could switch off, and its edits barely moved the model’s MATH-500 performance.

Why it matters: These results are proofs of concept that have not been shown to extend to more diverse LLMs and target models. However, they show how LLMs could be used in building models. They might improve interpretability, enabling us to better understand the networks we build. Or they might facilitate network editing or generation, making it possible to diagnose and fix obvious issues or accelerate training.

We’re thinking: If editing weights directly works at larger scales, it could change how models are improved. The authors achieved their improvements without a single gradient step.

Enable agents to make reliable predictions on tabular data. In “Tabular Foundation Models for Data Science Agents,” you’ll give a pretrained model your data plus its training examples as context. Then you’ll build an agent that calls it as a tool to make predictions. Enroll for free

Search Engine Wars, LLM Update

Google is turning its search engine into a chatbot, and OpenAI is turning its chatbot into a search engine. Yet neither company has made AI-powered search bring in as much revenue per query as traditional search.

What’s new: Alphabet, Google’s parent company, reported a 25 rise in revenue between July and September. However, its search revenue growth slowed to 12 percent, down from 19 percent and 17 percent in the previous two quarters — despite a rising tide of search queries — as it tries to use large language models to improve the search experience. Meanwhile, OpenAI’s business expanded, presumably including many queries that once would have been entered into a conventional search engine. An OpenAI executive said ChatGPT’s weekly users had grown from 1 billion to 1.2 billion in two months, and it claims to handle roughly one-fifth as many searches as Google.

How Google search pays: Google makes money when advertisers pay for their messages to appear beside search results, but that business is slowing.

• Google collected $63.35 billion from traditional search and related ads from July through September, including ads in its LLM-powered AI Overviews and AI Mode. The number of queries it received grew at its fastest rate in five years. 
• Google didn’t reveal how much of that revenue came from AI Mode, but an AI Mode query brings in less revenue than a comparable traditional search, because it shows fewer ads and advertisers pay less for them, Ars Technica wrote. In effect, Google’s LLMs are cannibalizing its search revenue.

How AI search ads work: Meanwhile, both Google and OpenAI are pushing ads into LLM-generated search results.

• On the day it issued its financial report, Google said AI Mode will show ads in 11 countries, up from 1 previously. In the U.S., ads will appear when a user enters a follow-up query.
• OpenAI, which began to test ads early this year, now shows them in 89 countries to users of ChatGPT’s free and low-cost Go plans. OpenAI says its ad sales reached a pace of $1 billion per year within 200 days of launch, a figure that hasn’t been verified independently. That works out to about $250 million every three months, compared with Google’s $63.35 billion.

Yes, but: OpenAI is a private company, so it’s impossible to assess how much of Google’s search business ChatGPT actually has taken, and estimates vary widely. When it said it processed one-fifth the number of searches Google does, it didn’t explain which Google figure it compared against, Search Engine Journal noted. In February, the search-marketing firm Ahrefs estimated 12 percent, using a different definition of search.

Behind the news: While Google and OpenAI compete for LLM-powered search, the web publishers whose pages LLMs use to generate search results are seeking more control over how AI companies use their work. One proposal would let them put a flag on their pages that would ask AI developers not to use them to train LLMs. Google, Microsoft, OpenAI, and Anthropic said they plan to honor the flag. Meanwhile, Google offers publishers a way to exempt their pages from AI Overviews and AI Mode.

Why it matters: LLMs have many uses, but it’s not yet entirely clear how to build highly profitable businesses on them. LLM-powered search could be one answer, since advertisers already pay to reach users through search engines. Ironically, LLM-powered search is drawing more people, and faster, than it’s drawing advertising money. But until ads in LLM-powered results earn as much as the traditional ads they replace, relying purely on LLM-powered search for revenue isn’t a surefire way to replicate Google’s previous success.

We’re thinking: Chatbots may eventually eat into users’ web searches, but the users themselves won’t necessarily be human. AI agents carrying out tasks such as shopping on a user’s behalf will also see ads that could sway their behavior or recommendations to users. In fact, Time magazine already sells ads aimed at agents instead of people.

Retrieval for RAG-Resistant Docs

Retrieving documents chunk by chunk works well with many types of text, but it can fail with documents in which the meaning of a given span — say, numbers in a table — depends on particulars found elsewhere on the page — say, the label of their units. Researchers assigned agents to keep all the necessary information in view.

What’s new: Sagar Tamang, Ayush Vyas, and Tabarakul Hazarika at Indian Institute of Technology Patna and TwoSpoon, an independent tech lab, developed Reliable Embedding-free Agentic Document-search (READ). Their method replaces vector-based retrieval with an agentic harness and specialized search tools.

Key insight: For RAG-style retrieval, a document is divided into chunks that are embedded, and a model retrieves chunks whose embeddings are similar to the embedding of the query. But this approach can fail with documents such as financial or scientific reports, where numbers in a table gain important meaning from units or dates that may lie many lines away, or legal briefs, in which words may have special meanings that are defined many paragraphs away. An agent with tools to navigate undivided documents can look beyond predefined chunks.

How it works: The authors used the READ method with Gemini 2.5 Pro.

• The system had access to three tools: (i) A keyword-search tool returned matching line numbers, (ii) an outline tool listed section headings with line numbers, and (iii) a text-reader tool fetched specific line ranges.
• Given a query like, “What is the mathematical difference between the Fiscal Deficit and the Revenue Surplus for the year 2024-2025?,” the READ agent activated a loop that generated a search term such as “Fiscal Deficit,” scanned a document for the term, checked matching line(s) against the document outline, and read the text from the table headers to the matching line(s).
• Within the loop, the model refined its query when it got too many hits, too few hits, or insufficient information to make sense of what it found. Each refinement repeated the loop with a new search term or a new range to be read.

Results: The authors used READ, RAG-style retrieval, and RAG-style retrieval in an agentic loop to answer 51 questions about a 780-page financial report published by the government of Gujarat, India. All systems were based on Gemini 2.5 Pro. READ answered 58.8 percent of the questions correctly, against 15.7 percent for chunk-and-embed retrieval and 27.5 percent for chunk-and-embed inside an agentic loop. BM25, a keyword-ranking method from the 1990s with no model in the retrieval step, answered 51.0 percent, which the authors deem statistically indistinguishable from READ.

Why it matters: Chunk-and-embed retrieval methods tend not to work well with documents in which the meaning of any given passage is not self-contained, such as financial reports, contracts, and regulatory filings. In such cases, letting a model search the whole document is more effective.

We’re thinking: The striking number here is not READ’s 58.8 percent but BM25’s 51.0. On RAG-resistant documents, chunk-and-embed lost to plain keyword search by a wide margin, and the agent’s advantage over keyword search did not clear the authors’ own threshold of significance. Before building an agent, it is worth finding out what a keyword search can do.