3. Architecture and operation of agent systems
AWS AgentCore Runtime V2: agent compute starts being billed based on actual CPU, not session lifetime
What happened. In a significant backfill from September 18, AWS released the next generation of Amazon Bedrock AgentCore Runtime. It is a serverless microVM runtime with hardware-enforced session isolation, scale-to-zero, elastic memory reclamation, and snapshot-based cold start. The environment is prepared once, then new instances are restored from a snapshot.
Why it matters. An agent is fundamentally different from a regular web service: it spends a lot of time waiting — for LLM, browser, MCP/API, database, human approval. If you pay for reserved CPU for the entire session lifetime, a significant portion of the cost is idle wait. Agent-specific runtime starts optimizing precisely this form of workload.
What the data showed. AWS reports P75 cold start of 1.9–2.0 seconds for container images from 200 MB to 2 GB versus 5.4–30 seconds for V1. In its pricing documentation, AWS estimates typical I/O wait for agent workloads at 30–70% of the time. In its illustrative example with 10 million 60-second support-agent sessions and 70% I/O wait, AWS arrives at $7,235 per month for Runtime compute; this is a vendor pricing example, not an independent production measurement.
What you should already understand: microVM, session isolation, cold start, I/O wait, active-resource billing.
What this could change for a product or engineering team. If an agent runs for minutes or hours, the cost of the execution layer should be calculated separately from token cost. It makes sense to compare pre-provisioned containers with an agent-specific runtime on a real CPU/memory/I/O profile, especially with bursty concurrency.
Date: September 18, 2026; backfill.
Primary sources: https://aws.amazon.com/about-aws/whats-new/2026/09/new-agentcore-runtime-generally-available/ ; https://aws.amazon.com/bedrock/agentcore/pricing/
SafeHarness: a single instruction "don't do dangerous things" is not enough — constraints need to be built into the planner
What happened. Researchers tested a coding-agent paradigm for robot manipulation: an LLM writes a controller program, but each task additionally contains an obstacle that the robot must not touch. The agent saw the obstacle and reasoned about it in the trace, and the prompt explicitly forbade collision, yet the baseline still often optimized only for achieving the goal. SafeHarness adds separate obstacle-aware route planning and contact-execution stages: build a route, verify, replan if necessary, and only then execute.
Why it matters. This is a physical example of a general agent pattern: constraint in prompt ≠ constraint in execution policy. If a constraint is critical, it must participate in planning and the verification path, not be a wish in natural-language instructions.
What the data showed. SafeHarness achieved 71.9% task success and 87.5% collision avoidance; the authors report 2.3× and 1.5× the result of the same agent without the harness, respectively. Also claimed are +6.5 and +27.0 percentage points against the previous SOTA on these two metrics. This is an academic preprint, not yet peer-reviewed; the unit of evaluation is robot-manipulation tasks with an explicitly specified obstacle.
What you should already understand: planner, constraint enforcement, verification, replanning, coding agent.
What this could change for a product or engineering team. For payments, deletion, production changes, and other high-impact actions, it's worth checking: is the constraint only written in the system prompt, or does it actually influence the planner and act as a hard gate before the action? For critical constraints, the latter is preferable.
Date: September 17, 2026; backfill.
Primary source: https://arxiv.org/abs/2609.20822
DeltaSelect: a full coding-agent benchmark is poorly suited for daily A/B testing of harness
What happened. DeltaSelect proposes selecting a small fixed set of benchmark tasks whose single-run results statistically better track the behavior of the full benchmark, and fitting this set into a given dollar budget. The authors emphasize: the method is intended for repeated baseline-vs-candidate experiments when developing prompts, skills, and harness, not for public model ranking.
Why it matters. Teams often either don't regression-test agent instructions at all due to cost, or draw conclusions based on a few convenient tasks. The research shows that a "random small subset" can be a very noisy proxy for the full benchmark.
What the data showed. In resampling published DeepSWE trials, only 19.5% of tasks — 22 out of 113 — had a fifth-percentile Pearson correlation no lower than 0.50 with full-benchmark performance. In a case study with GPT-5.6 Luna low-reasoning, after 13 evals, a version of skills/instructions was selected with a cost of $1.75 versus $4.18 for the original, i.e., −58.1% (p=0.008); the calibrated score was 42.36% versus 36.46%, but the paper reports p=0.326 for published-analog variance, so the score gain should not be interpreted as a reliably proven general quality gain. This is a single-author preprint without peer review.
What you should already understand: A/B evaluation, sampling variance, Pearson correlation, regression test, cost per eval.
What this could change for a product or engineering team. It makes sense to create a cheap internal regression suite, statistically calibrated against a more comprehensive benchmark. It is needed for frequent changes to skills/harness; periodically, a large suite should still be run to prevent the small set from becoming a new target for overfitting.
Date: September 17, 2026; backfill.
Primary source: https://arxiv.org/abs/2609.19607