DeepSeek's open harness, Supabase buys Turso, Cloudflare's Clef — and the four horsemen of agentic coding

DeepSeek Harness — is a free, open-source agent app for Mac and Windows, now in public preview, in which the model, the tools, the agent loop and even the user interface are plugins you can replace. It is the first credible non-US answer to Claude Code-style tools, which matters the moment a client asks what they can run on their own terms; the forkable session history also lets a team replay a decision rather than re-litigate it in a long chat. Type a request in Creator mode and it writes and installs the plugin itself; the web interface starts with npx @deepseek-ai/dsh web. DeepSeek

Clef and Clef-flash — are two small open models that don't write text at all: you hand them a situation and a set of questions, and they return typed answers with probabilities — is this ticket urgent, which team owns it, how bad is it. Routine routing decisions inside an agent workflow are where token bills quietly accumulate, and this is the cheap, fast layer that takes them off a frontier model. Cloudflare's own threat team had Clef categorise a website in 2.2 seconds where its fastest general model took 4.7; both models are on Hugging Face under Apache 2.0. Cloudflare Blog

Supabase Select 2026 — is Supabase's annual release, and nearly all of it is aimed at the coding agent rather than the human: schema and project settings now live in your repo as code, local Supabase runs without a Docker daemon, and you can ship an MCP server for your own app so customers' agents sign in as users. This is the pattern to point clients at — the backend becomes something an agent can set up, inspect and report on, while a human still approves the merge. Before an agent creates a paid project or runs SQL that could destroy data, the MCP server stops and asks you to confirm. Supabase Blog

DigitalOcean Managed Agents — is a hosted place to run coding agents instead of on your own servers: each session gets its own tiny isolated virtual machine that keeps its state, can be paused, resumed or forked, and goes to sleep when the agent stops working. It is the cheapest way to stop a client building sandbox plumbing in-house, and the permission layer gives you something concrete to show a security reviewer. A single gateway exposes more than 16,000 tools, including GitHub, HubSpot and Stripe, with central permissions and human sign-off required for sensitive actions. InfoQ

Wagtail's GLM 5.3 Flash month — is an honest post-mortem of a challenge to do all of September's development on a single cheap open model, tracking not just spend but energy use. It half worked: the first two weeks came in at $68, then capacity problems at the inference provider pushed the team onto other models. Clients keep asking whether cheap models are good enough for daily work; this is a real answer with numbers, including the part vendors never mention — a small provider can't always serve you. One vibe-coded prototype of an MCP server burned 450M tokens, $150 and 5kWh almost overnight, on a model chosen carelessly. Wagtail

Supabase acquires Turso — Supabase is buying Turso, the team that rewrote SQLite in Rust and runs millions of tiny databases off a single server. The stated goal is letting an agent create a database as casually as it creates a file, then graduate it to Postgres if the thing survives. Infrastructure vendors are now openly pricing for agent-created workloads rather than human ones — useful context when a client asks why their database bill shape is changing. Supabase says it already starts over one million databases per week; Turso's Glauber Costa will lead the agent infrastructure work. Supabase Blog

Epic — Epic, whose MyChart software holds American medical records, has paused most product development — likely for six weeks, its CEO says — to fix security flaws surfaced by running Anthropic's cybersecurity model Mythos over its code. This is the first big, named case of an AI audit forcing a roadmap freeze, and it is exactly the scenario a nervous client board will raise: what if we point one of these at our own codebase and don't like the answer. MyChart covers over 320 million patient records, and the security chief says some customer setups could let outsiders read records with nothing appearing in the logs. TechCrunch

Ahmad Al-Dahle — Airbnb's CTO, who ran Meta's Llama work before joining in January, describes rebuilding how the company works: product, design and engineering skip the document hand-offs and go straight to prototypes, with code as the thing everyone argues about. Internally, a context graph called Everest lets generalists work in parts of the codebase they don't know. A rare case of a large, non-AI consumer company saying concretely what changed in process rather than in tooling — good material for a client who wants to know what 'AI-native' looks like beyond licences. Agents now close about half of support tickets on their own, and the company deliberately keeps safety-related ones with people. Latent Space

Meta diff authoring time — Meta researcher Moritz Beller explains the metric the company watches instead of lines or commits: the active time spent creating, testing and reviewing one specific code change. Year over year, it has fallen by more than 40%, while changes get bigger and more numerous. It is a defensible productivity number to borrow when a client wants evidence, and Meta is clear it is a team-level signal, never a stick to beat individual developers with. The same episode flags the trap: tests written by an agent can pass happily when the code and the tests share one misreading of a vague request. Engineering Enablement by DX

Stripe's integration factory — Two items worth knowing from the same roundup: Stripe has taken the job of deciding what runs when away from the model and written it as ordinary code, and Microsoft reports roughly threefold gains from agentic coding, but only on tasks with a measurable objective. The direction of travel in both is the same one your delivery teams keep rediscovering — the model is a step inside a pipeline, not the pipeline — and Microsoft's caveat is the honest ceiling to quote back at an over-excited sponsor. Stripe says the setup built three new payment integrations and migrated ten, cutting timelines from as long as six months to two-to-six weeks, on its own figures. Dark Factory Dev