Perplexity open-sources its agent sandbox, and Reflection's 501B Beam ships
Perplexity open-sources its Firecracker sandbox for agents, Reflection's 501B Beam arrives under Apache 2.0, and Google shows why grading an agent's last message misleads.
Today’s items share one question: where does the trust boundary sit around an agent that can run code? Sandbox, grader and sensor each give a different answer, and none of them is a model.
1 · Top story
Perplexity open-sources the sandbox its agents run in
SPACE is an Apache 2.0 platform for running agent code in Firecracker microVMs. An HTTP API creates Linux sandboxes from templates, runs commands and returns output over a separate data-plane connection. The repo also covers pause, suspend and wake, base snapshots with an optional warm pool, and named egress profiles.
The useful part for a reference architecture is that it’s a self-hostable alternative to a commercial sandbox API, with the isolation boundary at the VM and not the container. Deployment is Kubernetes-first (a Kind walkthrough is provided), and lifecycle calls are asynchronous, so your orchestrator has to poll operation IDs. No release is tagged yet, so pin a commit.
Try this: follow the Kind walkthrough and measure create-to-first-output latency against your current sandbox, then check that a blocked egress call actually fails.
2 · Models & features
Reflection’s Beam: a 501B open model aimed at coding agents
Beam is a sparse mixture-of-experts with 501B total parameters and about 23B active per token, a 1M-token context and five reasoning levels. It’s Apache 2.0, with BF16, FP8 and NVFP4 checkpoints. Reflection reports 81.6% on SWE-bench Verified and 80.1% on Terminal Bench v2.1, and vLLM and SGLang support it from day zero.
The economics are the story. NVFP4 is about 280 GB and Hugging Face suggests four B200s for it, or 8×H200 for FP8, so owning it makes sense only if you already run that class of node or need the weights on your own side of the fence. Otherwise hosted providers (Baseten, Fireworks, Together) are the cheaper way to test it. The scores are Reflection’s own, and Hugging Face’s small hands-on checks were mixed.
3 · Agents
Google’s agent-plugin evals: grade the tool calls, not the closing message
Google Cloud’s team built evals for its new Developer plugin for coding agents and shared four lessons. The sharpest: on an 11-prompt suite, an automated grader marked three prompts as failures that the raw logs showed the plugin had passed. The agent had run the right check, then summarised something else in its last message.
Two more lessons matter for harness design. Flattened telemetry hid parallel dispatch, so a skill’s instructions arrived after the searches had already run. And live runs and plan-only runs fail differently, with roughly half the key findings coming from the gap between them. This is one team and one plugin, so treat it as a pattern to check, not a measurement.
Try this: regrade ten of your agent’s runs from the tool-call trace instead of the final message, and count how many verdicts flip.
4 · Research
Apple shows an 816B model decoding at 37 tok/s on four Macs
Apple’s ML team published the recipe for running large open-weight models on Mac Studio clusters, using MLX with RDMA over Thunderbolt 5. Muse Spark Open (816B, 42B active) at 4-bit reached 36.73 tokens/s decode on four M5 Ultras with tensor parallelism, with a 4.8 s time to first token. The post gives the commands, so it’s reproducible if you own the hardware.
Read it as a data point for private, local inference of coding agents, not for serving. Everything is batch size 1, and with only two machines pipeline parallelism can beat tensor on long prefill. Four M5 Ultras at 512 GB each isn’t a small budget either.
5 · People worth following
The Claude Code team on review that runs while you write
Simon Willison quotes Addy Osmani, Morgan Westlee Lunt and Qing Wang of the Claude Code team. Their argument: “did a human read it” is a weak proxy for risk, and the better question is what could go wrong and which check, automated or human, should catch it. Review moves earlier, running continuously like spellcheck, and most changes get reviewed and fixed by Claude at least once before a person looks.
If you take that seriously, the review step in your pipeline becomes a risk-routing problem: which classes of change need a human, and which need only a passing check. It pairs oddly well with the eval item above, since both ask what you’re actually verifying.
6 · Architecture
Wiz’s runtime sensor becomes a managed add-on on GKE
Google announced the Wiz Runtime Sensor add-on for GKE in preview on October 16, for both Standard and Autopilot clusters. It deploys Wiz’s eBPF sensor, which watches syscalls, processes, network connections and file access to catch reverse shells, privilege escalation and container escapes. Credentials come through Secret Manager sync, and an org-policy constraint, custom.GKEWizSensorEnforced, can require the add-on on every new cluster.
For agent workloads that execute generated code, runtime detection is the layer that still sees what happened after a sandbox policy was bypassed. You need a Wiz account, Workload Identity Federation and Secret Manager sync. The post gives no overhead numbers or pricing, so measure CPU and memory on your busiest node pool first.
Saturday rule: if none of this touches your stack, closing the tab is the right move.
Middle East, India & events · 1
- Jais 3, six open Arabic-focused models plus Jais Speech — MBZUAI’s Institute of Foundation Models and Inception42 released models from 900M to 375B parameters, with a 512K-token context, and a speech model covering dialects from 19 Arab countries and mid-sentence switching to English or French. Weights are on Hugging Face with vLLM and SGLang support; the licence isn’t named, and the benchmark results (24 Arabic benchmarks) are the developers’ own, as reported by Gulf News. Source
Researched and drafted with AI, checked against the linked sources. How we use AI →