Frontier agents top out at 0.48 on complete computational-biology studies

Thirteen frontier models were handed twenty complete computational-biology studies in BixBench3, and the best of them, GPT 5.6 Sol, scored 0.48. Gemini 3.1 Flash Lite scored 0.00. The benchmark mirrors how a scientist actually delegates: the human picks the research question and the high-level method, the agent gets the raw data from a published study and has to produce the artifacts the original paper reported, peak call matrices and differential expression tables among the 138 graded outputs across twenty tasks.

The failure gradients are the useful part. Scores drop from 0.36 on tasks with under 100 GB of raw data to 0.10 above it, and from 0.36 on one- or two-step analyses to 0.24 once three or more sequential steps are required. Cost does not behave the way most people assume: agents averaged 6.8 hours, 102 million tokens and $43 per task, the worst single run burned 24 hours, 1.07 billion tokens and $525, and the highest-scoring agents were also the cheapest. That inverse relationship argues against reading a long, expensive trajectory as evidence of effort. BixBench3 arrives days after Terminal-Bench-Science staked out adjacent territory for terminal-driven research workflows, and the two together make scientific execution the most actively measured agent domain right now.

A second paper narrows in on a decision every agent makes hundreds of times per run. Tunable Tool-Call Rates in LLM Agents via Representation Steering shows that whether an instruction-tuned model reaches for a tool is governed by a single linear direction in its residual stream, extracted from the model’s own tool-use preference signal with no training. Add the direction with strength alpha and the call rate moves monotonically from near 0% to over 90% while the calls stay well-formed. Dialing it up induces calls precisely on the questions the model cannot answer from parametric knowledge, which nearly doubles open-domain QA accuracy, 0.29 to 0.56. The direction generalizes to tools it was not extracted on, without favoring any particular tool, and the recipe transfers across dense, MoE and multimodal architectures. Code is published. Everything practitioners currently do to manage over-calling and under-calling lives in prompt text and post-training; this puts it on an inference-time dial that traces a cost/accuracy Pareto frontier in a single sweep.

On the security side, harden.run posted its benchmarks for a post-trained cybersecurity small language model paired with inline reference monitoring, a program-analysis technique that instruments what the agent writes rather than judging it from the outside. The claim is that the combination beats GPT-5.5-xhigh on LinuxArena and SleightBench. Coding agents author arbitrary code, so the surface is not one a red-team prompt sweep covers, and putting a runtime monitor between the agent and the machine is a structurally different bet from asking a larger model to review the diff. Worth reading the full benchmark tables before believing the headline, but the architecture is the interesting claim, not the leaderboard position.

AWS shipped two things. Amazon Redshift now integrates with the Agent Toolkit for AWS, pairing the AWS MCP server for authenticated API execution with a set of Redshift skills: SQL syntax references to cut query-generation errors, metadata discovery so an agent can explore schemas without hand-writing SQL, data loading patterns, materialized view guidance, and an end-to-end migration path through discovery, schema and SQL conversion, data movement, validation and performance comparison. It covers provisioned clusters and Serverless workgroups, requires no infrastructure change, and costs nothing extra. The named clients are Claude Code, Kiro and Cursor, which is the shape most vendor integrations now settle into: an MCP server for execution plus curated skill packages carrying the procedural knowledge the model does not have. Separately, Meta’s Muse-Glimmer-30B and Alibaba’s Qwen 3.8-27B landed on SageMaker JumpStart, aimed at local agentic workflows and long-horizon multimodal reasoning respectively.

Opslane went up on Hacker News as an open-source agent that combines error tracking with session recording and opens a PR only when it can verify the fix. Abhishek Ray’s framing comes from quarterly bug bashes at Robinhood that ended in declaring bankruptcy on the Sentry backlog: error trackers surface thousands of exceptions with no user-impact signal, and the issues that matter most often throw no exception at all. Opslane ranks by how many users hit a given problem and scans recordings for rage clicks, dead clicks and abandoned forms. The example from an early customer is a dropdown in an onboarding flow that closed itself when clicked. No exception, no bug report, just users selecting nothing and dropping out. It self-hosts from one Docker Compose file and ships an MCP server, so “what broke for users this week” gets asked from Claude Code rather than a dashboard.

The sharpest practitioner post in the window is also the shortest. CLAUDE.md is easier to grow than to trust argues that the reflex to add a rule whenever an agent repeats a mistake produces a file nobody can verify: instructions describing code that no longer exists, workarounds that became permanent architecture by default. The proposed audit is narrow and testable. Every instruction has to point at current code, a test, or an ADR, and anything that cannot gets flagged for removal; temporary warnings need an owner or an expiry condition. Behavior that matters belongs in a test, a repeated command belongs in a script, a decision with history belongs in an ADR, and the agent file keeps only the repo boundaries the agent needs before it touches anything. The wrinkle Gleb_SV names is real: running the audit means asking the tool being constrained to evaluate its own constraints.

Away from tooling, Sean Goedecke published Selling out, asking whether the professional mindset his blog spends its time teaching does psychic damage. He works through Marx’s senses of alienation, Debord and Vaneigem on role-playing as addiction, Sartre and de Beauvoir on bad faith, and C. Wright Mills on the white-collar “standardized loser,” then rejects most of it for software engineers on the grounds that presenting a work self is ordinary human behavior rather than self-deception. The version he grants: professional software engineering is a subservient role, humiliation accumulates whether or not you are role-playing it, and technical ability buys enough power to absorb it. One footnote is worth the click by itself, conceding that if LLMs turn out to have negative cognitive effects, the physical-toll argument he dismissed comes back into play for knowledge work.

What to watch: the cheapest agents scoring highest on BixBench3 sits badly next to every pricing tier that sells a longer trajectory as the premium option. If the residual-stream steering result generalizes past the paper’s setup, some of that spend turns out to be a dial nobody has been turning.

Feed note: the item stream’s newest entries are from the early hours of August 28, so this issue covers August 27 and 28.