The container is no longer the default unit of compute for an AI agent.

Top Story

The container is no longer the default unit of compute for an AI agent. Cloudflare shipped Cloudflare Computer earlier this month, an open-source runtime that treats an agent not as a process launched inside a disposable sandbox but as a persistent “computer” that lives in an isolate, spins up its own container on demand, and survives across runs. It is a direct claim about economics: most agent work should never touch a container at all.

The core move is architectural. Rather than run the whole agent inside a container sandbox — the default for every agent framework today — Cloudflare’s @cloudflare/computer package puts the agent runtime in a Durable Object, the company’s named, stateful isolate. The isolate starts and stops quickly, scales horizontally “infinitely” in Cloudflare’s telling, and keeps agent state alive in SQLite-backed storage, sleeping while the agent is idle and waking on demand. Containers are demoted from the substrate to a tool call: the runtime shells out to a heavier sandbox only when a task actually requires one, such as running unvetted code or heavy media processing.

Cloudflare’s own estimate of the split is the number to sit with: fewer than 10% of agent workloads need a container. Coding, audio/video processing, and document creation, the company argues, all complete inside isolates. The pitch is that the container model cannot scale to “hundreds of millions or billions of concurrent agents,” because there is not enough compute on Earth to run them all that way — a deliberately maximalist framing, but one the industry is clearly groping toward.

The technical keystone is a shared SQLite-based filesystem that both isolates and containers can mount. A task can start in an isolate, hand off to a container mid-run, and come back, all operating on the same files, with every operation governed, audited, and observable. Cloudflare Computer ships three backends: a container variant that exposes the SQLite state as a real FUSE-mounted filesystem to the sandbox; an isolate shell running a just-bash environment in a Dynamic Worker; and an isolate JavaScript backend running ES modules in a fresh Dynamic Worker.

This is explicitly early. Cloudflare calls it a preview for experimentation and prototyping, not production. That caveat matters, because the claim the whole design rests on — that isolate-side execution covers nine out of ten agent tasks without degrading — is precisely what must be proven against real, long-running agent workloads, not demos.

It lands in a week that was otherwise about agent plumbing and its hazards. Google released Gemini 3.7 Flash, pitched as its workhorse model for coding and agents, and shipped a data-agent kit that lets a coding agent query a company’s data directly. Alibaba’s open models crossed three billion downloads, consolidating their lead over Meta and Google on Hugging Face. And the security researchers supplied the counterweight: a coin-sized device that can hack a Boeing 737, and a fresh set of Windows vulnerabilities that bypass protections and install malware remotely. The plumbing is arriving faster than the hardening around it.

What changes: the default unit of agent computing just shifted from the container to the isolate, and every framework built on the container model now faces a credible alternative with very different cost math. The specific thing to watch is whether that 10%-needs-a-container number holds under real workloads — because if it does, Cloudflare Computer stops being an interesting preview and becomes the template for how agents get deployed. The next move belongs to the agent frameworks, and to whoever is first to run a real fleet on it and publish the actual ratio. That number decides whether this is a footnote or the new default. Cloudflare Computer Launch: Giving AI Agents a Persistent Runtime Environment

Also Today

Alibaba AI Models Hit 3 Billion Downloads, Passing Meta, Google | Bloomberg - Hugging Face study · Source Alibaba’s open models crossed three billion Hugging Face downloads, overtaking Meta and Google, per Hugging Face’s summer 2026 State of Open Models report surfaced by Bloomberg. It is a popularity signal, not a benchmark, but the consolidation is real and compound: Qwen keeps extending its lead while Western labs fragment across release cadences and licensing. Download leadership feeds the flywheel that matters most — fine-tune volume, community tooling, and the practical default for anyone deploying locally. The number says less about model quality than about which open family the field has decided to standardize on, and at three billion the field appears to have decided.

Three new vulnerabilities exposed in Microsoft Windows that can bypass security protections and remotely install malware · Source At USENIX, Birmingham and Durham researchers showed a remote attack, CVE-2026-23670, that rewrites the SPD chip on a DIMM so the memory controller maps twice the real capacity, opening a backdoor that can resurrect flawed old drivers, disable antimalware, and reach the VBS enclave — no physical contact, just a script. Corsair, G.Skill, and ADATA each ship lines with unprotected chips against JEDEC guidance. Alongside it sit a Defender privilege-escalation zero-day that bypasses the earlier RoguePlanet patch and a DEF CON technique that installs signed vendor drivers at system level with no admin and no login. Microsoft patched the memory hole in April; the others ship with no such luck. It is the old through-line again: every new execution surface arrives faster than the hardening around it.

Maximizing the value of your Claude Code sessions · Source Claude’s own cost guide for coding sessions makes plain that token economics now dominate how a fix gets priced. Output runs about 5x input, cache reads 0.1x, and the cache is keyed on model, effort level, and fast mode — so switching any of those mid-conversation reprefills everything at full price. The prescriptions follow: /clear between tasks, @-mention files instead of naming them, /context once in a fresh session, and /compact before a break, since the cache expires after an hour on subscription but five minutes on an API key. The larger point is that agentic tooling has turned a flat-fee editor into a metered one, and the pricing model now shapes workflow as much as the language model does.

RISC-V: They should have known better · Source dmitry.gr’s collected dismissal of RISC-V is a density-and-latency indictment from the embedded core up. A base-ISA interrupt costs at least 44 cycles against a Cortex-M0’s 27 because nothing pushes registers in hardware; the Zcb extension’s compressed byte stores reach only offsets 0-3 and halfword stores only 0 or 2; and the Zba fix for array access arrived two years late and still leaves six to eight bytes of code where ARM uses four. Some gripes are fair, some are advocacy with a snarl, and a few feel like haggling over an ISA that already won the microcontroller war despite, as the author concedes, itself. The essay’s real value is the reminder that openness and good design are not the same attribute.

Cloudflare Adds Agent Tracing, with Truncation Limits and Uneven Payload Defaults · Source Cloudflare’s agent tracing, the companion to the persistent-runtime launch in the lead, adds agent-level spans to Workers traces — invoke, model call, tool, approval — with subagent work nested under its parent in a single waterfall. Free in beta, metered per span under Workers Observability from October. The useful caveats sit buried in the docs: session replay is a debug aid, not an audit trail; approval spans don’t measure the human-in-the-loop wait; and Think and Flue ship opposite payload-privacy defaults on the same platform. Teams chasing a recurring failure will find three-to-seven-day retention short. Telemetry for agents solves a real problem; its privacy and retention defaults are the unsolved ones.

In Brief

• Google released Gemini 3.7 Flash, its self-described workhorse model aimed squarely at coding and agent workloads. (Source)
• Researchers showed a coin-sized device that opens a 737’s exterior hatch in under a minute and can redirect the autopilot or sabotage the flight plan. (Source)
• A contest write-up documents using OpenAI’s Codex in an auto-research loop to land a kernel that runs 232x faster. (Source)
• Mixedbread launched Toast 1, a specialised search agent it claims matches or beats frontier search quality. (Source)
• Anthropic published a short illustration of how Claude’s text watermarking is intended to work. (Source)
• Part 7 of a series on concurrent network servers works through how Rust handles the problems raised in earlier installments. (Source)
• A quantizer measures per-weight-group KL divergence on Qwen3.8-27B to find which groups really matter before quantizing, across three builds. (Source)
• Google’s Data Agent Kit gives coding agents Agent Skills, MCP servers, and IDE integrations for querying data securely. (Source)
• A survey of every US power plant that came online this year finds a surging solar buildout alongside new gigawatt-scale gas projects. (Source)
• Raph Levien continues his decades-long search for a curve family better than cubic Béziers with hyperbezier curves. (Source)
• An essay traces how the 1978 JIS X 0208 encoding became a spectre haunting Unicode’s handling of Japanese text. (Source)
• An essay argues AI isn’t outthinking mathematicians so much as out-remembering them, and that distinction is what models actually owe their results to. (Source)

One Line

seeing the model call directly above a bad tool argument is the debugging view i want

— Mykyta Pavlenko, replying to Cloudflare’s agent-tracing announcement on X