NVIDIA’s Harness Hit 100% on ARC-AGI-3

Friday, and the week’s theme refuses to let go. Every big story today is about the layer around the model: the harness that made a 30% model score 100%, the router that wants to pick your model for you, and the forge creaking under the code all of this produces. Plus DeepSeek gave its Flash model eyes this morning, and Debian is a week from deciding how open source feels about AI-written code.

NVIDIA’s AVO hit 100% on ARC-AGI-3, and the model inside was Opus 5.

Published today on the NVIDIA developer blog. AVO, short for Agentic Variation Operators, is the general-purpose coding agent system NVIDIA introduced in March to optimize CUDA kernels. Pointed at ARC-AGI-3, the interactive reasoning benchmark, it completed all 183 levels across all 25 public environments with no instructions, no explicit rules and no stated goals, scoring a perfect 100 on relative human action efficiency. It also did it in 6,624 environment actions, about 12% fewer than VISTA, the previous leader.

Here is the part to sit with: Claude Opus 5 on its own scores about 30% on the public set. Wrapped in AVO, with persistent memory carrying implementations and test results forward, and a supervisor that watches the search trajectory and redirects the main agent when progress stalls, the same model finishes everything.

The honest caveats, which NVIDIA itself states: this is not a controlled ablation, the systems differ in backend, observation format and memory design, and the result covers the public set, not the private competition split. So do not read it as “AVO added exactly 70 points.”

Why it matters: Read it next to the rest of this week anyway. Ornith trained a model by making it write its own scaffolds. Dan Luu showed agents faking benchmark wins their harness could not actually deliver. Now NVIDIA is showing the inverse: architecture unlocking capability the raw model demonstrably does not have alone. If you are budgeting for AI capability, the harness is no longer an implementation detail, it is where a large share of the capability lives. Which means it deserves the same scrutiny, versioning and evaluation you give the model itself. NVIDIA’s writeup | Opus 5 baseline at ARC Prize

Ramp launched Router, three days after Stripe bought OpenRouter.

The fintech company took the model-routing infrastructure it built for its own products and put it on the open market at router.com: one API in front of OpenAI, Anthropic, SpaceXAI, DeepSeek, Moonshot, MiniMax, NVIDIA and Z.ai, with Gemini listed as coming soon. Each request is routed to the cheapest model that meets the required performance bar, and Ramp says internal customers cut inference costs by about 40% on average.

The launch pricing is the aggressive part: free for the rest of 2026, US-only for now, with inference billed at cost. On Wednesday I wrote that Stripe did not buy a model company, it bought the metering point where AI spend gets counted. Ramp clearly read the same map. When two payments companies race to stand between you and your models in the same week, the question of who owns your routing layer stops being theoretical. Ramp’s announcement | TechCrunch

DeepSeek gave V4 Flash eyes.

DeepSeek-V4-Flash-Vision-Exp went live on the DeepSeek API platform this morning. It is an experimental multimodal version of V4 Flash that matches the base model on text, agents and reasoning while adding image understanding, and DeepSeek says it makes a major leap on multimodal agent benchmarks, approaching Opus 4.8 territory. Under the hood it is the same sparse MoE recipe, 284B total parameters with 13B active, and a context window over a million tokens.

Third parties already have it: it is live on OpenRouter at $0.22 per million input tokens and $0.66 output. Cheap multimodal agents that can actually see the screen they are operating is one of the missing pieces for computer-use workloads, and this prices it like a commodity. DeepSeek’s release note | On OpenRouter

Gemma passed one billion downloads, and some of them are in orbit.

Google’s milestone post puts the Gemma family at a billion cumulative downloads in two years, with the community publishing more than 100,000 variants on top of the open weights. The detail I loved: NASA teams, satellite startup Satlyt and orbital-compute company Starcloud are running Gemma on board satellites, analyzing images in space to decide what deserves scarce downlink bandwidth. Open weights are not just a licensing debate, they are the only way a model gets to run somewhere a vendor API cannot reach. blog.google

And a stealth model is making the rounds. Something called Ox Alpha appeared on OpenRouter, and the guessing game is on, with GLM-5 Air and a new MiniMax among the community’s leading theories. Stealth drops have become the standard pre-launch ritual, so expect a name attached to it soon. Ox Alpha on OpenRouter

Anthropic made computer use, the Skills API and the Files API generally available.

Announced Wednesday on the Claude platform. Computer use gains multi-action turns that cut task time and API calls, plus HIPAA eligibility. The new browser use tool is the architecturally interesting bit: instead of guessing pixel coordinates from screenshots alone, it reads the page structure alongside them, so agents target elements, forms and tabs reliably, and your application hosts the browser and executes every action, not Anthropic.

Skills are versioned folders of instructions and scripts that load only when a task needs them, and the Files API gives agents persistent storage, 1TB per organization. The pitch case study is an insurance claims flow that dropped from 32 minutes to 13. The agent platform race is now openly about who owns the runtime around the model, which is this week’s theme wearing a product announcement. Anthropic’s post

Quick hit for the GPU crowd: NVIDIA is hosting a CUDA MCP server, a one-line addition that gives any MCP-compatible agent search over current, NVIDIA-curated CUDA documentation and code examples, with an open source self-hosted option in the Nsight Copilot Blueprint. If your agents write kernels, stop letting them hallucinate 2023 API signatures. developer.nvidia.com/nsight-ai

GitHub published its August 17 postmortem, and the numbers explain everything.

The outage we covered Tuesday ran 7 hours 47 minutes, and the writeup is admirably direct: no code change, no config change, just capacity failures at the core. A critical component in the Central US data center failed to scale at a new traffic peak, the pressure cascaded into authentication, and client-side retry loops in Copilot services amplified traffic during recovery, an August 6 Actions incident having already been the warning shot.

The context numbers are the real story. Monthly commits went from 1.4 billion in April to 2.9 billion in August. GitHub has added more than 3 million CPU cores and 120 petabytes of storage, Azure now carries about 58% of platform load, up from 12% in May, and Actions peaked near 115.4 million completed runs in a month. Agent-driven development did not just change how code gets written, it doubled the load on the world’s shared forge in four months. The fixes are the classics: retry budgets, variable timeouts, isolating critical systems. GitHub’s postmortem

Cursor explained the git architecture built for exactly that world.

The engineering post behind Origin, by Vicent Martí of libgit2 fame, describes Continuity: a git host whose source of truth is a write-ahead log in S3 instead of consensus-replicated packfiles. GitHub’s 2013-era Spokes design replicates each repository to about three nodes with three-phase commit, which is why it does not scale horizontally. Continuity gets linearizable pushes and consistent reads across arbitrary replicas, tested to 100, at up to 300 pushes per second on S3 Express.

The design target is telling: monorepos, plus millions of small repositories created by agents. Both companies are now saying the same thing from opposite directions. The forge is being re-architected for machines that commit far more often than we do. cursor.com

Debian is voting on AI contributions right now, and the ballot math is the story.

The general resolution on LLM usage opened August 15 and closes at 23:59 UTC on August 28. Developers are ranking eight options on a Condorcet ballot, from a complete ban on LLM-assisted source, web content and communications, through middle positions like allowing AI for research and critique but forbidding AI-generated output in packages, patches, docs and bug reports.

The wrinkle: the full ban would amend a Foundation Document, so it needs a 3:1 supermajority, while every other option needs a simple majority. The ban could win every head-to-head matchup and still fail on the ratio. Whatever passes will become the reference policy other distributions and projects copy, the same way Debian’s Free Software Guidelines shaped everything downstream. If you maintain anything, this vote is worth ten minutes of your attention. The GR text and options | heise’s overview

A €5 domain and the phone calls of military bases.

A researcher bought an expired domain that turned out to still be the delegated nameserver for the ENUM phone-routing zones of Saint Helena, Diego Garcia and Ascension Island. Six months of passive logging later: hundreds of thousands of ENUM queries, each one decoding to a full phone number, timestamp and source IP, including calls routed through US military installations. Nobody remembered the delegation existed.

Yesterday it was a weather balloon tracker becoming military infrastructure. Today it is telephone routing hijackable for the price of a coffee. The lesson is identical: infrastructure does not stop being critical just because everyone stopped maintaining it. lina.sh

Every model cheats.

Dreadnode’s research on offensive cyber evaluations finds that models across the board cheat on the tasks, and studies how far prompt-level mitigations go in stopping it. Put it on the pile with the Benchmarkpocalypse and the AVO caveats: this week’s required reading is all about how much of a score you can actually trust. dreadnode.io

Kubernetes v1.37 lands Wednesday, August 26. Last call on the sneak peek: static pods lose Secret and ConfigMap references, kube-proxy ipvs starts warning, cgroup v1 kubelets refuse to start. Read it this weekend, not during the upgrade. Sneak peek

The H1 2027 KCD lineup is out. CNCF announced the Kubernetes Community Days happening in the first half of 2027: Panama in January, Pune and Vancouver in February, Beijing and Bangkok in March, Cairo, Texas, Guadalajara and Hyderabad in April, Valencia, the San Francisco Bay Area, Toronto, Helsinki and Cali in May, and New York in June, alongside a new three-tier structure for event sizes. If one of these is near you, plan to attend, speak or sponsor, and if you are thinking about a talk for your first KCD, I am always happy to help you shape it. CNCF announcement

AI Infra Summit, Santa Clara, September 15 to 17. Use code KUBE15 for 15% off full-access and VIP tickets, or apply for a free expo pass. Register with KUBE15 | Apply for an expo ticket

KubeCon + CloudNativeCon North America, Salt Lake City, November 9 to 12. LF Events

And yesterday’s memwarden ask still stands. Where is it heavy, where does setup fight you, what would make you keep it. Issues welcome, however small. github.com/theshiphq/memwarden

Look back at this week and try to find the story that was actually about a model.

Monday nobody shipped one. Tuesday the catch-up edition was all platforms and GPU plumbing. Wednesday a payments company paid seven billion dollars for the routing layer. Thursday OpenAI turned safety into a workload with a compute bill, and today a harness took a 30% model to 100%, a second payments company launched a router, and GitHub told us the forge is straining under 2.9 billion commits a month.

The models kept improving all week. And they kept mattering less, individually, because everything that determines whether they are useful, safe, affordable and fast lives in the layers around them. The harness. The router. The memory. The monitoring. The forge.

Here is what I want you to take into the weekend. Every one of those layers is still up for grabs in a way the models are not. You will never train a frontier model, but you can absolutely own your harness, run your router, control your agent’s memory and watch your own monitors. The teams that treat those as first-class engineering, versioned, evaluated and owned, are the ones that will not be renting their entire stack from whoever wins the wrapper wars.

So pick one layer and get opinionated about it before a vendor gets opinionated for you. If AVO can find 70 points in the harness, imagine what is sitting in yours.

Which layer are you betting on? Hit reply, I read everything.

Have a great weekend. See you Monday.