Anthropic donates Agent Skills to the Agentic AI Foundation, NVIDIA ships kernel-level agent sandboxing, and a 360M model fakes a terminal.
The plumbing era of AI agents arrived this week. Anthropic handed Agent Skills to a neutral foundation, NVIDIA dropped a kernel-enforced sandbox for agent fleets, and the open-source community shipped tools to monitor, control, and physically embody agents on $7 hardware. The models are impressive; the infrastructure to run them safely is finally catching up.
Anthropic donated Agent Skills — the open standard for giving AI agents specialized knowledge and workflows — to the Agentic AI Foundation (AAIF), a project under the Linux Foundation co-founded by Anthropic, Block, and OpenAI.
The numbers tell the adoption story: 70+ agent platforms have integrated the standard (including ChatGPT, Cursor, GitHub Copilot, and VS Code), 1 million skills have been published, and nearly 280 million skills have been installed since the December 2025 launch. That's MCP-level traction in under a year.
A skill is dead simple — a folder with a SKILL.md file explaining a task, plus any scripts or reference material the agent needs. Anthropic built it while working on Claude Code, where they found general knowledge tasks went fine but real business workflows needed procedural knowledge the model didn't have out of the box.
This follows the same playbook as MCP's donation: build the standard internally, prove it works at scale, then hand governance to a neutral body before competitors feel locked out. Engineers from Anthropic, Google, and OpenAI will maintain it as individuals, not as company representatives. The roadmap includes versioned releases, a formal proposal process, and security guidance for skill authors.
The pattern here is worth naming. Anthropic has now donated two foundational agent standards — MCP for tool connectivity, Agent Skills for domain knowledge — to the same neutral foundation within 12 months. Both followed the same trajectory: internal tool → open standard → explosive adoption → foundation governance. The difference from how standards usually die in committee is that these ship with millions of users before the governance body even exists.
The security angle matters too. The roadmap explicitly includes security guidance for skill authors and installers. A skill is executable code that runs inside your agent — which means a malicious skill is an RCE vector dressed as a markdown file. The standard needs a trust model before the 280M install count becomes a supply chain attack surface.
My take: agent skills are becoming the package managers of AI — and nobody wants npm owned by a single model provider. The 280M install number is the one to watch. That's ecosystem lock-in at the standard level, not the vendor level. But the parallel to npm cuts both ways: we know what happens to package ecosystems without strong security defaults.
WorldTUI is a 360M-parameter model, fine-tuned from Qwen2.5-Coder-0.5B, that simulates a complete terminal. No real shell. No filesystem. Every keypress goes in, and the model predicts how the screen changes. It handles vim mode switching, tmux panes, environment variables, a Python REPL, and even Snake.
The engineering is tight. Edwards trimmed the embedding table from Qwen's 151,936 tokens to just 333 (the characters that actually appear on a terminal screen), padded to 384 for alignment. That one change cut the model from 990MB to 716MB. Int4 quantization brings it to 208MB — small enough for WebGPU in a browser tab.
The training pipeline is equally clever. Edwards generated 336k synthetic episodes (~2B tokens) by recording real programs in Docker — bash, vim, python, man pages — with randomized usernames, hostnames, and terminal sizes. He injected a 1.2% typo rate to simulate human typing, and 35% of sessions start mid-stream to teach the model to pick up context.
The real innovation is the self-correction loop inspired by DAgger. After initial training, the model's own mistakes become corrective examples — but corrections only use words that appeared in real screens, so the model can't hallucinate its way out of errors. Three rounds of this pushed PresetBench from 24/47 to 38/47 on int4 quantization.
Performance numbers tell the story:
The file readback test is the interesting one — write random values to files, then read them back in separate sessions. That's real memory, not pattern matching.
But the distillation finding is what stopped me. Edwards tried shrinking the model by removing a single layer. Next-token accuracy barely moved: 99.3% to 98.9%. But exact memory readbacks collapsed from 64/64 to 0/64. The model looked fine on every surface metric while quietly losing its ability to remember anything.
That's a finding worth internalizing. We routinely judge models by aggregate accuracy and miss that specific capabilities can vanish without moving the top-line number. A 16-layer student kept perfect memory but scored 65 on ShellBench versus the teacher's 78 — confirming that accuracy and capability are different axes entirely.
The model runs in-browser via WebGPU at 208MB quantized. Grammar-constrained decoding ensures every output is a valid screen update. Parallel row decoding dropped large-frame p95 latency from 6.7s to 0.87s on an RTX 4090. On an M4 Mac, a single keypress resolves in ~60ms.
The practical takeaway for anyone doing model compression: your eval suite can pass while your model's actual skills are gone. If you care about specific capabilities — memory, multi-step reasoning, tool use — test those capabilities directly. An aggregate benchmark that ticks up 0.4% while a critical ability drops to zero is worse than useless; it's actively misleading.
NVIDIA/OpenShell — A kernel-level sandbox runtime for autonomous AI agent fleets. Each agent runs in isolation with formal policy enforcement: filesystem, network, and syscall restrictions, plus credential injection only for approved endpoints. The key differentiator is formally verified policy changes — before a policy update goes live, a prover checks whether the new rules grant access to anything dangerous (new host + credentials, new API method), and flags it for human review. Agents never see real credentials; OpenShell injects them only into requests headed for approved endpoints. Written in Rust with Python/TypeScript/Go SDKs. Deploys on Kubernetes via Helm. 18.4k stars, Apache 2.0.
Louis-CFM/coucou — A companion app that monitors AI coding agents from your Mac's notch (or system tray on Windows/Linux, plus iPhone via iCloud sync). Hooks into Claude Code, Cursor, Gemini CLI, Codex, and 7 other agent platforms via config hooks that fall back silently if the app isn't running. View live file diffs, approve or deny permission requests from the notch, and jump to the matching terminal window. The fail-safe design is the right call — the monitor never blocks the agent. 6.3k stars, MIT.
onehumanbeing/esp32-iphone-agent — Let an AI model operate a real iPhone using a $7 ESP32-S3 board. The architecture is beautifully simple: the ESP32 runs its own Wi-Fi hotspot and acts as an AirPlay receiver (eyes) and USB HID device (hands). A SwiftUI app on the phone decodes the mirrored H.264 stream, sends screenshots to any OpenAI-compatible vision model, and translates the response into taps and swipes. No jailbreak, no developer account, no Mac needed at runtime. BLE throughput caps mirroring at 480x1040 at 5fps, so each step takes a few seconds — enough for automation, not gaming. 3.6k stars, MIT.
Agent infrastructure just had its "Docker moment." Not a single breakthrough — a convergence. Sandboxing, packaging, monitoring, and governance all shipping in the same week, from different teams who didn't coordinate. That's a market pull signal, not a supply push. A year ago we were debating whether agents were useful; now NVIDIA is writing formal verification provers for agent policies and a Mac notch app is managing permission requests across 12 agent platforms. The teams that treat agent infrastructure like they treat cloud infrastructure — with isolation, policy enforcement, and audit trails — are the ones that will actually ship agents to customers. The rest will ship demos that work great in the conference talk and break on the first Tuesday in production.
— Aaron
How to turn failing production agent traces into hermetic CI regression tests. Tracely vs Langfuse, LangSmith and Promptfoo, with the replay pattern.
AI EngineeringLiteLLM, Portkey, OpenRouter, Cloudflare and Vercel AI Gateway compared on fallbacks, fees, self-hosting and lock-in. Which LLM gateway fits your stack?
AI EngineeringMastra vs LangChain.js and LangGraph.js for production TypeScript agents: workflows, memory, human-in-the-loop, deployment, and when to pick each.
AI Engineering