MicroVM sandboxes and recursive harnesses power users actually wire into loops

Google Research

Research framework for recursive agent harnessing that edits prompts, memory, skills, tools, and subagents via Propose-Probe-Compose while keeping model weights fixed.

Use caseUse it to run open-world harness optimization loops on JobBench, LAB, or WorkBuddy and accumulate an improvement library across tasks.

deadtrickster

Firecracker and libvirt sandboxes for coding agents with layered rootfs, 60ms checkpoint restores, a verify gate, and live run interaction.

Use caseUse it to run an agent with root inside a microVM, copy work out only after a host-side verify script passes.

NVIDIA

Execution layer that gives apps and eval systems a consistent interface to compose, validate, and switch agent harnesses with normalized telemetry.

Use caseUse it to run the same consumer config against Claude Code, deepagents, OpenHands, or Pi adapters without rewriting integrations.

AlekseiUL

Local-first governance layer for agent memory with deterministic routing, ownership, review gates, scope-aware retrieval, and auditable receipts.

Use caseUse it to keep multi-agent memory from leaking preferences or silently overriding facts via SQLite and MCP tools.

aws-samples

Reference Arbiter control plane on AWS that fabricates workers on demand, evaluates authority scopes, and records legibility for multi-agent systems.

Use caseUse it to prototype constitutional multi-agent coordination where every dispatch is governed and escalations become case law.

amotivv-inc

Open protocol for AI memory infrastructure defining pods, capability tokens, Merkle-anchored audit trails, and Memory Card discovery.

Use caseUse it to standardize how agents store, retrieve, and share semantic memory across applications with verifiable receipts.

Daniel Singer

Anthropic described a three-part split of session log, external harness brain, and on-demand sandboxes so credentials never enter the guest and failures become tool errors the model can recover from. The redesign also blocks prompt-injection exfiltration by injecting secrets only at a host proxy.

Read

spirosoik

Brig open-sources an Apache-2.0 Go CLI that boots a full guest kernel for agents, mounts only the named project, and keeps host keychain and SSH agent out of reach. The post highlights controlled autonomy for remediation and auto-approved local coding loops.

Shipped