The Frontier Agent

A plain while-loop: sample the model, run its tool calls, append results, repeat until it stops calling tools.

Delegate exploration, research and review to child agents with fresh context that return condensed results.

Externalized plans: plan mode up front, task lists updated in the loop, progress files across sessions.

An append-only session log outside the harness: crashes and pauses resume from the last event.

Build the smallest high-signal context each turn: stable prefix, short project map, just-in-time reads.

Folders of instructions, scripts and references; only name + description load until the model opens one.

Context window as working memory; plain-file notes and searchable transcripts as long-term memory.

Summarize old turns and clear stale tool results near the limit, so one session can run for hours.

Agent loops run ~100:1 input to output; a stable, append-only prefix turns most input into cheap cache reads.

A reasoning model that thinks between tool calls, keeps that reasoning across steps, and scales effort.

Typed tool calls emitted in parallel, large catalogs loaded on demand, multi-step chains run as code.

The open standard connecting agents to tools and data; the 2026-07-28 spec made it stateless.

Shell and code run inside OS-level or VM isolation, with scoped writes, egress control and no credentials.

Pixel-level GUI control via screenshots, zoom, mouse and keyboard; the fallback when no API exists.

Tool results return as observations; tests, browser checks and separate evaluators decide continue vs done.

Span-level traces of every model and tool call, transcripts you actually read, and evals reporting pass^k.

Tiered permissions: allowlists for safe actions, a model reviewer for the rest, humans only on escalation.

Assume injection sometimes succeeds; limit what a hijacked agent can reach, leak or change.