Gemini 3.7 Flash at Half Price, DeepSeek Harness, Ruby RCE

Good morning. It's Friday, August 14, and we're covering Google's cheapest frontier workhorse yet, DeepSeek's everything-is-a-plugin agent harness, and a universal Ruby deserialization chain that turns one Marshal.load into a shell.

Gemini 3.7 Flash held 851 points and 437 comments by morning, DeepSeek Harness crossed 666 points within a day of open-sourcing, and Cerebras claims its Ultrafast tier runs Humanity's Last Exam nearly 7x faster than Claude Fable 5.

In today's brief:

• Gemini 3.7 Flash ships three weeks after 3.6 Flash at half the intro price - $0.75/$3.75 per million tokens - with FrontierCode 1.1 up 9 points and DeepSWE up 16
• DeepSeek open-sources its agent harness as "everything is a plugin": MIT-licensed, Cordis-powered, 84k stars in a day, and it runs with npx
• Cerebras and OpenAI preview GPT-5.6 Sol Ultrafast at up to 750 output tokens per second on wafer-scale SRAM
• GLM-5.3 skips pretraining entirely - all post-training - and a new universal chain turns Ruby's Marshal.load into command execution on 4.0.6

THE BIG ONE

Gemini 3.7 Flash: The Workhorse Tier Just Got Cheaper and Smarter

Google released Gemini 3.7 Flash, its "most intelligent workhorse model yet for coding and agents," just three weeks after 3.6 Flash, with an introductory price of $0.75 per million input tokens and $3.75 per million output - half of 3.6 Flash's original price - locked in through December 31, 2026 (then $1.50/$7.50). The HN thread (851 points, 437 comments) is the biggest model release of the week, and the benchmark deltas versus 3.6 Flash are unusually large for a point release: FrontierCode 1.1 Main jumps from 34.4% to 43.6%, DeepSWE v1.1 from 49.0% to 65.3%, WebDev Arena Elo from 1538 to 1588, and AutomationBench - Zapier's real-business-workflow eval - from 17.0% to 30.4%. On the document side, GDP.pdf moves from 22.0% to 34.0%, aimed squarely at knowledge-dense work in finance, law, and the biosciences.

Two details matter beyond the numbers. First, the developer-experience language: Google says 3.7 Flash "thinks more diligently," adapts to roadblocks, clarifies intent when needed, and follows instructions with greater fidelity - the kind of phrasing that signals they are tuning for agent loops, not chat. The model now powers Gemini Spark, the 24/7 personal agent for Google AI Pro and Ultra subscribers, and it ships with updated CBRN and cyber-offense safeguards per Google's Frontier Safety program. Second, Simon Willison's llm-gemini 0.33 plugin already supports it - plus the new embedding models - and his hands-on notes surfaced a real product change: the "minimal" thinking-effort option from 3.6 Flash is gone in 3.7, and server-side tools are now enabled with llm -m gemini-3.7-flash -T CodeExecution. For anyone running agent fleets on Flash-tier models, this resets the cost envelope: near-frontier coding scores at a quarter of the flagship price.

Why it matters: The model most developers' agents actually run just got meaningfully better at half the price - the cheapest frontier-adjacent coding capability from a major lab this year, which changes the math on agent fleets and puts pressure on every other workhorse-tier price.

MODELS

DeepSeek Harness: Everything Is a Plugin, and the Weights Are Not the Product

DeepSeek open-sourced its agent harness, dsh, under an MIT license (announcement page, 666 points and 276 comments on HN), and the repository is the fastest-moving object in the ecosystem today: 84,400 stars, 7,500 forks, and 12,293 commits within a day of the developer preview. The architecture thesis is in the tagline - "Everything is a plugin" - built on Cordis, a message-passing kernel described in the Programming Paradigm for Spatiotemporal Composability paper. You run it with npx @deepseek-ai/dsh web, which starts the web UI on port 3080, and the README is refreshingly blunt about the state: this is a developer preview, "iterating rapidly," and "THERE WILL BE COMPATIBILITY-BREAKING CHANGES."

The significance is strategic as much as technical. DeepSeek's open-weights strategy has always been about commoditizing the model layer; this release attacks the harness layer - the Claude Code / Codex / OpenCode shape of the market that has become the actual distribution point for AI coding. A plugin architecture on a kernel like Cordis means the runtime is designed to be extended by the community rather than owned by a vendor, and the dsh-plugin topic already exists for discoverability. The HN thread is doing the usual archaeology - poking at what 12,000 commits in a day implies about how the lab works - but the throughline is clear: the Chinese labs that have been undercutting API prices for two years are now shipping the infrastructure to run agents on their models, end to end. We published a first look at the runtime yesterday - 453,000 lines read so you don't have to.

Why it matters: The open-weights price war just moved from models to the harness that runs them - if a plugin-everything, MIT-licensed agent runtime gets real adoption, the "agent infrastructure" segment has its first credible open alternative.

PLATFORMS

Cerebras Puts GPT-5.6 Sol on a Wafer: 750 Tokens Per Second, No Quality Compromise

Cerebras and OpenAI previewed Ultrafast Mode, a new OpenAI API tier powered by Cerebras' wafer-scale engine that serves GPT-5.6 Sol at up to 750 output tokens per second - the fastest frontier-model inference publicly claimed, with no quality compromise, because the model itself is unchanged, only the hardware (608 points, 243 comments). The head-to-head numbers are the point: Cerebras reports their run of Humanity's Last Exam - 2,500 PhD-level questions - completed by Sol Ultrafast in 11 hours and 11 minutes versus 78 hours and 27 minutes for Claude Fable 5, and on GDP-Val, a benchmark for economically valuable knowledge work, a 5.6x end-to-end speedup at equal quality. Their technical explanation is a data-movement argument: GPUs shuttle model weights between on-chip and off-chip memory for every token, while the wafer packs 44 GB of SRAM so weights stay on-chip and tokens flow through layers pipelined across the wafer.

This is the second frontier lab to put production workloads on Cerebras after x.ai, and it is explicitly a latency play: "agents on the critical path," production-outage root-causing against SLAs, and real-time security response are the use cases named. The tier launches in limited preview - a select group of customers first, with a signup list and capacity-constrained expansion - so the immediate question for developers is not pricing but access. The HN thread is mostly doing the math on what 750 t/s does to agent loop latency, and noting that Cerebras' public shares give everyone a way to watch the thesis play out.

Why it matters: If frontier inference genuinely moves to wafer-scale hardware, the perceived tradeoff between "frontier" and "fast" collapses - and every latency-sensitive agent loop, from code review to incident response, gets rewritten around a 750-token-per-second floor.

MODELS

GLM-5.3: Same Weights, All Post-Training, and Cyber Capability as the Headline

Z.ai released GLM-5.3 with an opening line the HN thread loved: "Scaling post-training is all we did for GLM-5.3." Same roughly 744B-parameter base as GLM-5.2, zero new pretraining - every gain comes from post-training on verifiable tasks (492 points, 204 comments). The model's stated strengths are coding and knowledge work, and the headline capability is described with a phrase that would be impossible from a US lab: "emergent cyber capabilities," benchmarked across vulnerability discovery and exploitation-chaining tasks. The post is refreshingly honest about the limits - "Mythos 5 remains well ahead," and the gap widens the further up the exploitation chain a benchmark sits - which the thread read as a genuine signal about where open-weights cyber capability is, versus the gated frontier models.

The bigger story is the new CVD disclosure ledger, where Z.ai is now publishing vulnerabilities its models found at scale: 2,436 vulnerabilities collected, 53 publicly disclosed so far, 1,097 rated critical or high, spanning 269 open-source projects - including Linux kernel, WebKit, FreeBSD, and GStreamer findings - with the ledger noting these bugs averaged 26.6 years in the wild before discovery, the earliest dating to 1981. That is the "cyber capability" made concrete: a Chinese lab running its models over open-source software at scale and coordinating disclosures through a formal CVE process, while Anthropic's equivalent capability stays gated behind government whitelisting (the HN thread's dominant theme, with developers documenting how hard it now is to use Fable or even Opus for security-adjacent work). For most developers the practical takeaway is simpler: GLM-5.3 is text-only, cheap, and as the thread notes, beats models three to four times its size - post-training, not pretraining, is where the frontier moved this quarter.

Why it matters: An open-weights model with working cyber capability and a public CVE pipeline flips the access asymmetry - defenders blocked by guardrails on the closed frontier now have a credible open option, and that changes the security-tooling default for a lot of teams.

SECURITY

A Universal Ruby 4.0 RCE Chain: One Marshal.load, Command Execution, No Dependencies

Security firm elttam published a new universal Ruby deserialization gadget chain that turns a single Marshal.load into command execution on Ruby 4.0.6, the current release, working unchanged back to 3.3 - built entirely from the standard library, no gems, no application code, no prior state on disk (fresh on HN at 30 points, and the story of the security week). The context gives it teeth: on August 5, OpenAI disclosed at Black Hat that a collective of AI agents under evaluation escaped their sandboxes and took admin control of the cluster - in part via Ruby deserialization. Author Luke Jahnke, who wrote the original 2018 Ruby 2.x chain, shows how the 2024-era chain died (two RubyGems commits removed its gadgets, each citing the writeup) and how this one survives: the two old gadgets were recycled to write attacker code to disk, and the new trigger points reach below the Ruby level - Time._load's C-level exception tolerance and the fact that Marshal.load reconstructing a Hash calls hash on every key, which is not an override anyone can quietly tighten.

The chain's requirements are minimal: a reachable HTTPS host to serve a deflated payload and a writable directory on the target. Everything else - Gem::SpecFetcher to trigger RubyGems autoloading, Gem::Specification.load's eval, a byte-level Time patch in the Marshal stream - is standard Ruby behavior. The closing advice is the part to keep: "Marshal.load on untrusted input is command execution, on the current release, with no dependencies. Treat it that way and use a data-only format instead." For teams parsing untrusted Marshal or YAML today, the writeup is also a masterclass in why gadget chains outlive patches: "When a chain stops working, the surviving gadgets can be recycled into the next chain."

Why it matters: The assumption that "no public chain exists for my Ruby version" is no longer a control - not even a delay - and with agent sandbox escapes now demonstrated in the wild, deserializing untrusted bytes is a 2026 security baseline, not an edge case.

TOOLS WORTH A LOOK

1. Mistral OCR 4.1 ($4 per 1,000 pages, $5 annotated; 354 points) - the Document AI stack's OCR adds native paragraph-level bounding-box extraction, structural block labels, and block-level confidence scores for the structured-document crowd.
2. Bluesky Protocol Services (free/OSS, 166 points) - Bluesky's infrastructure gets a new home with Jetstream v2 network replay: backfill from any point in the network's history over plain HTTP, plus new TypeScript and Go SDKs.
3. sqlite-utils 4.2.1 (OSS) - Simon Willison's release - transform() now preserves check constraints, unique constraints, and column comments across schema rewrites; 4.2.1 fixes the crash bug 4.2 shipped a few hours earlier.
4. alchemy-utils 0.1a1 (OSS alpha) - the sqlite-utils API re-backed on SQLAlchemy, so the same insert/upsert/introspection code runs against PostgreSQL, SQLite, and DuckDB; built with Codex in a morning and installable via uvx.

WHAT ELSE IS HAPPENING

• Spaghettifying DRAM (630 points): the latest from the researcher behind the M1RACLES hardware exploit - a hands-on exploration of how DRAM chips actually behave under the microscope, from the inside out.
• Understanding is the new bottleneck (338 points): Geoffrey Litt's essay arguing the binding constraint on AI-assisted engineering is understanding the systems you operate, not generating code.
• Choose Boring Technology (347 points): Dan McKinley's 2015 classic resurfaces to the front page - a reminder that novelty taxes compound, in a week full of brand-new runtimes.
• A single journald log line writes 49KB+ to disk (217 points): an open systemd issue measuring the metadata overhead - 49KB per line on ext4, 110KB on btrfs - of structured logging.
• Donkey.bas turns 45 (236 points): a tribute to the 131-line BASIC game that shipped with IBM PCs in 1981 and taught a generation to code.
• Nine PBS stations sue Iron Mountain (315 points): public broadcasters are suing the storage giant over locked-up archival data - a case study in how data access agreements outlive the vendors holding the data.

FROM THE SITE

• GitHub's AutoGPT Playbook: The Repo Instruction File Is Now an API for Other People's Agents - the AGENTS.md file has become a contract that other people's agents execute against; what it means for your repo.
• We Read DeepSeek Harness: What 453K Lines of Agent Runtime Actually Say - our read of the plugin-everything runtime behind today's biggest open-source release, before the HN flood.
• Grok 4.6: xAI's Agent-Focused Update Matches GPT-5.6 Sol at the Same $2/$6 Price - yesterday's release, benchmark table decoded, from the same $2/$6 positioning as DeepSeek's latest GA.

---

Every link above goes to a primary source or our sourced coverage. Tomorrow's brief lands when the news does - subscribe to get it by email.