The week's top AI papers say the harness, not the model, is the variable

DAIR.AI's weekly paper roundup for August 24-30 reads less like a survey of model research than a manifesto for the harness. Nine of its ten picks concern the scaffolding wrapped around a frontier model — memory, context management, skills, judges, self-repair — and the gains they report are large enough that the choice of harness now moves benchmarks further than the choice of backbone.

#The harness is the variable

Prime Intellect's Prime Agent, which we covered on release, makes the point most bluntly. Holding the model class fixed, its Best@1 on ARC-AGI-3 goes from 30% to 95.5%. The mechanism is persistence: a live IPython REPL lets the model filter and re-derive its own context as code rather than re-reading a flat transcript, and a "Continual Harness" carries histories, memories, skills, prompts and subagent specifications across trajectories, so improvements compound instead of being rebuilt each run.

Prime Agent's state hierarchy: what stays in the session, and what persists in the Continual Harness. Credit: Prime Agent, Karten et al., via DAIR.AI.

JIT-Agent (Zhang et al.) goes further and trains a model whose output is a harness, synthesized per task under a fixed four-module protocol covering memory, planning, action protocol and tool orchestration. Attached to DeepSeek-V4-Flash it surpasses GPT-5.6 on DeepSearchQA (+9.1) and OdysseyBench (+4.3); GLM-5.2 gains up to +20.2 points. The paper claims its generated harnesses are performance-competitive with mature runtimes such as OpenCode and Claude Code. DAIR.AI's practical note is that the appendix names the recurring designs the generator converges on — Palimpsest, Trapdoor, Origami, Gearbox — patterns you can copy by hand without running anything.

Alibaba's Scroll attacks the same problem from the memory side by deleting the schema. Each session becomes an executable environment — an append-only event log plus a sandboxed persistent Python kernel — with tool outputs and derived state bound to typed variables, and only explicitly printed projections entering the working view. Evicted spans stay recoverable through landmarks tied to exact log addresses. With Qwen3.8-Max it hits 94.8% on LongMemEval_S, 73.1% on BEAM_10M (5.1 points over the best published memory system) and 86.7% on LOCA_256K.

#What compaction quietly deletes

The week's most operationally uncomfortable result is The Compaction Cliff in Long-Running AI Agent Memory (Zerhoudi, Mitrovic and Granitzer), measured across 20 production agent configurations. A safety rule and an episodic log compete for the same tokens, and when the budget overflows both get compressed at the same rate — even though only the rule needs its exact wording to remain enforceable. Claude Code compaction on Sonnet 4.6 preserves 53% of safety rules after one round and 10% after five, which is the regime any long session ends up in. Their fix, Knowledge Triage, classifies each line of the knowledge base by type and routes it through its own retention policy, preserving 2-4x more safety rules at every compression ratio with 96% recall over five rounds.

Type-aware routing: constraints get compacted differently from narrative. Credit: The Compaction Cliff, via DAIR.AI.

Two adjacent papers say skill libraries are less trustworthy than the tooling around them implies. NVIDIA's ACES checked whether the structural scanners enterprises use to gate shared skills predict anything about performance: across 145 real skills, scan scores correlate with LLM-judge quality at a Spearman rho of 0.14. Its alternative, Skill Lift, runs the same task twice under an identical model, sandbox, workspace and scorer, with and without the skill, and reports the delta. And EVOMAL shows a planted malicious skill spreads without ever being invoked: agents retrieve it as an authoring template and reproduce the payload, at self-poisoning rates of 20.3% to 41.8% across six models. Deleting every planted skill does not clean the library.

#Out of simulation

The exception to the harness theme is Google DeepMind's Co-Scientist paper, which takes the system into physical labs. It designed a safe precursor route for MXenes and drove a semi-automated chemical vapor deposition reactor, producing a lamellar 2D material with structural similarities to the Ti3C2Tx lattice — the authors note the atomic structure still needs confirming. It also tailored growth recipes to lab constraints in minutes, enabling single-attempt growth of monolayer MoS2, MoSe2 and WS2, and autonomously discovered an inference-time scaling architecture that beat six frontier models on HealthBench Hard and Professional under blinded physician review.

Co-Scientist's ideation-experimentation-writing loop and the three labs it ran in. Credit: Accelerating Scientific Research with Gemini in the Real-World, via DAIR.AI.

Rounding out the list: Netflix's judge lifecycle paper treats an LLM judge as four phases rather than one artifact, tuning its rubric with a meta-judge over the judge's own reasoning. Recuris splits agent memory into working and experiential halves, adding 17.8 points to GPT-5.6 Sol on tau-bench. Meta^n recurses a fixed meta-operation on its own output, and is the only method scoring above zero on ARC-AGI-2.

#Why it matters

Taken together, the week's picks describe a field where returns are moving from weights to scaffolding — and where the scaffolding is barely instrumented. The same list that shows a 65-point harness swing on ARC-AGI-3 also shows the review gate for shared skills is nearly uncorrelated with quality, that skill libraries propagate malware among themselves, and that the compaction step every long-running agent depends on erases 90% of its safety rules within five rounds. The upside and the unmeasured failure modes are arriving in the same papers.