The week’s most-noticed paper did not train anything. It reorganized the runtime around a coding agent and moved Terminal-Bench 2.1 from 83.1% to 92.1% on the same model, taking a $574 reference run down to roughly $15. Read alongside the week’s number-one paper of the day, which finds that agent skills work by stabilizing procedure rather than supplying knowledge, the message is consistent: this month’s leverage is in the scaffolding, not the weights.
Harness scaling, with a receipt
StateM: Reaching 95.3% Raw Accuracy, or a $15 Frontier Run, on Terminal-Bench 2.1 via Harness Scaling (427 upvotes, the week’s most-noticed paper) is a runtime system, not a model. It organizes long-horizon agent execution around durable states, phase-local context, checked transitions, recoverable runbooks and versioned procedural practices — and alters no weights. The results: 95.3% raw accuracy across 445 trials on GPT-5.6 Sol xhigh, with all 89 tasks solved at least once; 92.1% on GPT-5.5 xhigh against an 83.1% baseline; 88.1% on DeepSeek-V4 Flash against 82.7% under standard timeouts. The cost line is the one to sit with: about $15 of API usage against $574.68 for the reference approach.
Every element of that list is infrastructure you can build without a lab. State that survives a crash. A runbook you can resume from the middle. Transitions that are checked rather than hoped. This is The Unattended Execution Framework stated as a benchmark result — the question of whether a workflow runs to completion with nobody watching, answered with a number instead of a feeling. Note too that the scaffolding lifted a frontier model and an open-weight one, which is what you would expect if the constraint was never the model.
Your skill library is competing with itself
Demystifying Agent Skills: Why They Work—Until They Don’t (151 upvotes, number-one paper of the day; Princeton, UC San Diego, Stanford, USC and Johns Hopkins) ran controlled experiments across benchmarks, agent harnesses and models, normalizing 8,135 trial records, and separates two things the industry keeps merging. Skills help by procedural anchoring — turning a noisy trajectory into a stable one — in 65.7% of cases. Explicit knowledge injection accounts for 4.5%. Skills stabilize action; they do not mostly supply missing facts.
Then the finding that should change how you build. As the skill pool grows from 5 to 100, actual-use precision falls from 29.6% to 3.3%. Retrieval is a bottleneck separate from skill quality, and it degrades with the size of your own library. The paper adds that exact ground-truth invocation is neither sufficient nor necessary for downstream success, which means your retrieval metric and your outcome metric are not measuring the same thing.
That is The Skill Composability Architecture with a failure curve attached. A modular capability library is the right shape. A modular capability library with no index discipline is a system that gets worse the more you invest in it — the hundred-skill version of your setup is not the five-skill version with better coverage.
The model handed over its own bypass
Microsoft Copilot reveals secret input that allowed it to be hacked (Ars Technica, August 18). Researchers at Varonis wanted an exploit that exfiltrated data when a target did nothing but click a link. Copilot refused — and each refusal explained a little more about the guardrail it was enforcing. Eventually it disclosed an undocumented parameter, ?autorun=1, which alongside the well-known ?q= fired the prompt silently on click. Microsoft stopped ?q= injecting text into the input in February, three months after the report, and shipped broader fixes this week.
The lesson is not “add a refusal.” It is that a refusal which explains itself is an oracle. Iterated denial with reasons is a side channel, and every transparent, helpful guardrail message is a small disclosure. Make the refusal uninformative, and keep authorization in the runtime — where a URL parameter cannot argue with it — rather than in the model’s judgment about whether consent was given.
Routing stopped being a nicety
LLMRouter (106 upvotes, UIUC) formalizes routing as a sequential decision process with five components — context encoders, model encoders, scoring functions, decision rules, learning signals — and ships xRouteBench plus an open-source library of more than 16 routers. Learned routers beat the strongest fixed-model baseline by 14.6% relatively, and lightweight routers become more competitive as the cost constraint tightens.
The market said the same thing louder in the same week. Stripe’s acquisition of OpenRouter closed at over $7B, roughly 90 days after a $1.3B Series B, and a separate Latent Space piece argues that frontier cost plus open-weights quality is what is driving routing demand. The supporting datapoint arrived the day before: Qwen 3.8 27B scores 52 on the Artificial Analysis Intelligence Index — the same as GPT-5.6 Luna (max), one point behind GLM-5.2 (max). When a 27B open-weight model reaches that band, “which model” becomes a per-request engineering decision rather than a vendor commitment.
The throughline
Three results this week improved outcomes without touching a model: a runtime that makes execution durable, a skill format that stabilizes procedure, a router that decides per request. The fourth is the same thesis inverted — a consent guarantee that lived in the model’s judgment instead of in the runtime, and leaked. The field is converging on something engineers already know from every other domain: a system is reliable when its important guarantees sit in the infrastructure, not in a component’s good intentions.
Both frameworks named above are part of the agentic-coding track at curiochat.ai/software-engineer.