The Agent Stack Needs Adult Supervision

The AI-agent market has reached its familiar adolescent phase: it has learned to operate tools, discovered autonomy, and acquired no obvious instinct for consequences. The interesting contest is no longer merely which model writes the cleverest function. It is who owns the harness—the layer that decides what the model may touch, how it works, where its state lives, and whether its highly confident improvisation becomes a merge commit, an invoice, or a small incident report with a very large distribution list.

OpenAI is pitching Codex as an engineering worker distributed through ChatGPT, an IDE extension and a CLI, with worktrees, cloud environments, Skills, parallel workflows, testing, review and scheduled background operations. That is a broad claim on the software-development stack, not a new autocomplete button. The product page also presents customer claims of faster iteration and better review, including Duolingo’s assertion that Codex performed best in its backend-Python code-review benchmark. OpenAI’s product page is, naturally, more forthcoming about outcomes than methodology—the industry’s preferred division of labour.

Meanwhile, DeepSeek has released an MIT-licensed developer-preview agent harness in which “everything is a plugin.” Its README also offers the useful companion principle: “THERE WILL BE COMPATIBILITY-BREAKING CHANGES.” DeepSeek Harness is therefore candid about the bargain: extensibility now, interface archaeology later. This is not a criticism. It is what infrastructure looks like before its abstractions have survived contact with other people’s production systems.

The old frontier metaphor is unusually apt here. The Economist argues that “It is time to impose law and order on the frontier.” Its excerpted argument does not supply the underlying evidence for its provocative headline, so treat that phrase as framing rather than a demonstrated catalogue of agent misdeeds. But the central engineering point stands: autonomy without boundaries is not a product category. It is a security review waiting for a calendar invite.

A harness is not just an ergonomic shell around a model. It is where an organisation encodes permissions, execution environments, tool interfaces, auditability, approval gates, retry policy and failure containment. Once an agent can open a pull request, run tests, inspect alerts or perform scheduled work, those details cease to be implementation trivia. They are the constitution, except the constitutional convention is held in a YAML file maintained by three people who are also on pager duty.

DeepSeek’s project is explicit that it is powered by Cordis and organised around plugins; it provides local Web UI launch paths through npm or source, while warning that it remains in developer preview. The repository shows considerable activity and public interest, but neither stars nor an MIT licence establishes security, reliability or production readiness. An interface becoming popular is not the same as an interface becoming safe. Kubernetes also taught this lesson, at tremendous expense and in several file formats.

Codex’s stated ability to carry team practices through Skills and to operate across connected interfaces points toward the same control-plane question from the proprietary side. OpenAI’s description says it can support background issue triage, alert monitoring and CI/CD; that makes the definition of which repositories, credentials, environments and side effects are permitted more material than another glossy claim of end-to-end completion. A model’s reasoning may be frontier-grade. Its token should still be suburban.

The likely near-term differentiator is therefore not raw agent cleverness but legibility under stress. Can a staff engineer determine why a tool was selected, what data was exposed, which policy approved the action, and how to stop the next one? If the answer requires replaying an opaque conversation while a deployment rolls back, the harness has not orchestrated work. It has merely added a new species of distributed-system failure.

The other land grab is beneath the harness. River AI says it has raised $1.1bn across seed and Series A financing to customize open-source models for enterprises, with General Catalyst and AMP PBC leading and Nvidia, AMD Ventures, Y Combinator and Temasek participating. SiliconANGLE’s report describes a company beginning with LoRA-based customization and contemplating something much more vertical: agent personalization and continual learning, a custom chip and a compiler to move customer PyTorch models efficiently onto that silicon.

LoRA is the practical clue amid the capital-theatre fog. Rather than retraining an entire model, it adds a relatively small number of trainable components. River says its API can tailor models in 15 to 20 minutes and can produce systems up to four times more cost-efficient than proprietary alternatives; those are company claims without disclosed benchmark methodology, named comparisons or customer evidence. Still, the strategic logic is clear enough: if models commoditize at the general layer, the value migrates to proprietary context, adaptation pipelines, deployment economics and the operational machinery around them.

That logic connects directly to agents. A generic coding agent may understand a language; a useful enterprise agent must learn the local dialect: repository conventions, service ownership, build peculiarities, policy constraints, and the historical reasons nobody is allowed to touch billing-legacy. River’s planned feature direction, “personalization and continual learning for agents,” is thus commercially sensible—and operationally radioactive. Persistent adaptation means the system that acts on an organisation may increasingly be shaped by that organisation’s data and habits.

Nvidia and AMD participation is also a reminder that the AI stack is not neatly separated into model companies and hardware companies. River’s reported chip and compiler ambitions remain just that—ambitions inferred from job postings, without a production timeline or manufacturing commitment. But they illustrate the incentive: own the tuning layer, the runtime and perhaps the silicon, and every customer-specific optimisation becomes harder to unbundle. Vertical integration is what happens when latency, margin and strategic anxiety all attend the same board meeting.

The agent boom is converging on a less cinematic but more consequential question: who bears the cost of being wrong? Vendor pages understandably foreground parallel work, autonomous execution and impressive testimonials. Open-source projects foreground composability and developer velocity. Investors fund personalization and the infrastructure beneath it. None of these is frivolous. They are simply incomplete until the system has a credible answer for irreversible actions, sensitive context and slow-moving degradation.

For engineering leaders, the practical response is almost offensively conventional. Start with bounded tasks and isolated environments. Separate read access from write access. Require review where a plausible failure has a costly blast radius. Log tool calls and approvals. Make rollback real, not a slide titled Rollback Strategy adjacent to a stock photograph of a mountain climber. Evaluate agents on the repositories, policies and failure cases they will actually encounter—not on a demo whose most threatening dependency is a cheerful TODO.

That is not an argument against letting agents do useful work. It is an argument against mistaking an agent’s surface fluency for institutional competence. Codex’s product claims, DeepSeek’s rapidly changing plugin harness and River’s customization pitch all point to a future in which models are more embedded, more tailored and more empowered. Codex, DeepSeek Harness, and River AI’s reported plans are three versions of the same proposition: intelligence is being productized as an operator.

Operators need fences, keys and records. The frontier did not become productive because everyone trusted the cowboys. It became productive because, eventually, somebody built the boring machinery that made trust unnecessary.