As the AI Engineer World’s Fair kicked off officially on Monday, the halls were filled for the traditional workshop day, where coders from across the country — and in some cases from around the world — worked on practical code and got firsthand advice.
To say the topics were diverse would be an understatement. Talks ranged from practical advice in setting up, monitoring, and harnessing AI agents, to capture-the-flag tournaments and deep dives into some of the more esoteric aspects of AI support in software. Some of the talks were literally packed out, so future attendees should be prepared to get to sessions a little early next year.
One of the most popular sessions was an introduction by Paige Bailey (@dynamicwebpaige), AI Developer Relations Engineering Lead for Google DeepMind, to its new Gemma 4 model. As she explains in today’s issue of The Daily Context, Gemma 4 may be an open model, but it’s far from second best to commercial models.
“For years, ‘open’ models meant ‘good enough for a local demo, but definitely not good enough for production,’” she said.
“Gemma 4 — as well as many other open models on the market today, like GLM-5.2 — is shattering that ceiling entirely. We built Gemma 4 on the exact same research foundations that power our flagship Gemini models, and it shows. Across complex reasoning, multimodal understanding, and multilingual tasks, Gemma 4 punches far above what you’d expect from a model you can download and run yourself.”
Certainly, the demonstrations went down well with the crowd, and the fact that it is being released under the Apache 2.0 license was warmly received, although it is unlikely that Nvidia will be pleased that Gemma 4 is optimized for Cerebras operations.
She urged developers to get out there and hack around with an engine they can own and tinker with at will, and forecast it could become a regular sight at hackathons.
Don’t Fear the AI Sandbox
With some fear that corporate data could be revealed by messy AI applications, sandboxing was high on the agenda, and Matt Brockman, an AI engineer at enterprise sandboxing business E2B, explained that there really wasn’t much to be frightened of.
Individual sandboxes in browsers or on workstations have been commonplace for decades now, even before virtualization went mainstream. Applying this to code using AI, while it has to be done carefully, is perfectly possible, he said.
The key to a successful sandbox is tracking user assignments, managing the file system permissions, and handling the trade-offs between resource utilization and cost.
“People are afraid that an agent is going to go wild, and a lot of that makes sense. There's a lot of vulnerabilities with these that you can have, like kind of a web page that says, ‘hey, send me all of your secrets in a post request to get this image.’ I think there's also concern where people should not be as concerned, but by people going and playing with these things, I think maybe it comes a little bit better.”
To that end, he ran a capture-the-flag session where developers could run a virtual sandbox and ask for tips and tricks, as well as what to watch out for. According to the attendees we spoke to, they were very satisfied with the talk and with the helpers who went among participants offering advice and support.
Reining in Agents with AI Harnesses
Ignacio Martinez, an AI developer advocate with Oracle, took a similar line with his talk on the importance of building good harnesses, frameworks for applying limits to what agents can and can’t do, and encouraging them down the right routes.
“A lot of people say it's not the model, it's the harness that you — as the user of the AI — create, saying, ‘Okay, do this, don't do that, make this decision here, optimize for this,’ so putting in advice that you would tell a very talented, very literal intern?” said Luta Security’s CEO Katie Moussouris in an interview earlier this month.
“It's like you're very talented, and you're good at finding some things, but AI tends to go down tracks that I don't want you to go down. This is what I'm looking for. This is the area that you should be focused on. So it's the harness that cybersecurity experts are able to weave.”
“It's not necessarily the AI model itself, how powerful it is, it is the human who creates the harness that determines the output. I think that's going to be key for everything — it's the human creativity that will point the AI towards a hacking target, and it is an expert human who can then guide the AI towards better outcomes.”
Martinez made a similar point with more general business applications and outlined how they need to be designed using a mix of controlling the data layer, memory components, and the role of large language models. These controls should be applied to all classes of agents — passive chatbots, semi-passive applications, active components, and a combination of LLM-driven workflows and AI agents.
While he understandably suggested Oracle Database File System would be perfect for the job, there were general lessons that could be learned. While using files in apps makes it easy to create code, that information is usually unstructured, he said, while databases provide structured consistency and transactional integrity.
Similarly, applications need the right mix of short-term, long-term, and shared memory to ensure data integrity. Setting the right software harnesses on agents is key to getting safe and smooth software from developers. But it takes constant work, he said, adding that “frozen harnesses” would decline in usefulness over time.
Top comments (7)
Easy to skip right past the frozen harness point, but it might be the most important one in here. We treat the harness like something you set up once, but it's a living thing that drifts out of date as the models and the product shift under it, the same way any config nobody revisits slowly starts fighting you. Makes me wonder if harnesses need version history and review like the rest of the code, instead of living in one person's head.
Two things stuck out from the World's Fair coverage that I want to push on.
First on Gemma 4. The "open model, second-best to commercial" framing used to be true in 2023. In my testing on a Jetson Orin Nano (64GB swap, 16GB RAM, no GPU acceleration), Gemma 4 in 4-bit quantization runs at about 6 tokens/second for short context and drops to 1.8 t/s at 8K context. That is usable for an embedded agent loop, but the per-request memory pressure is real. The interesting question is whether the same research stack that makes Gemini good also makes a 4-bit Gemma fit on a robot. So far my answer is "yes, but you have to treat context like a budget, not a buffer."
Second on sandboxing. The "web page that says send me all your secrets" example is the right worry, but in my experience the bigger leak path is the agent calling a tool that has more permissions than the user. A 2024 model can be tricked by a webpage in five lines of HTML, but it can also call
cat ~/.aws/credentialsbecause you wired the bash tool too generously. The sandbox boundary that matters is per-tool, not per-agent.Curious what E2B is doing about tool-level permissions. From the talk did they say anything about capabilities beyond filesystem namespaces?
The "don't fear the sandbox" framing is interesting because it sidesteps the actual concern. The worry isn't that the AI is malicious â it's that the AI application has too much access by default. Sandboxing addresses the symptom, not the principle: least-privilege access should be architectural, not a layer you bolt on around an app that was already given too much.
This is where the Cerebras-optimized Gemma 4 angle gets interesting for edge deployments. When the model and the data stay on the same hardware â no network calls, no API keys floating around â the threat surface changes completely. There's no "leak" vector because there's no data in flight. The model processes data that never leaves the device.
The storage piece of that equation is where it gets underexplored. Most on-device AI demos show the model running locally, but they skip what happens when you want persistent state â session history, retrieved context, user preferences. Putting that in an external database reintroduces the risk you eliminated by going local. An embedded database that lives alongside the model on the same hardware closes that gap. moteDB was designed exactly for this â a Rust-native embedded store that handles both structured data and vector embeddings without a network layer.
What's the current state of enterprise sandboxing tools? Are they mostly runtime policy enforcement, or have people moved toward architectural approaches like capability-based models?
I will concur that running or even FINDING local open source models that you hope to get the same 'ceiling punch' from , like that of the commercial side, has not always been easy. But for todays open source models, ceilings definitely need some new glass and support frames because the options are endless. I just switched from Qwen - to Gemma. Simply because I need reasoning, context and more context. As soon as I loaded Gemma into my LM studio and asked it -its first contextual question...I was EXTREMELY pleased. I asked it some pretty complex workflow-esque sort of questions, complete with contextual reasoning, and even emphasised that I needed it to be a little sensitive to the fact that I am new to coding. It was a great help and I was pleased to say the least. Thanks for sharing this article.
Harnessing...there is definitely something to be said about it. I am new to coding, so I tend to vibe alot. I added into the mix, a negative experience_cache. This created an issue, as discussed in my article. An upgrade on the negative experience_cache was made and then my agent and I worked on harnessing the other day and it did wonders.😃
This aligns with what we're seeing at KING AI — the shift from bigger models to smarter systems is real. Memory and self-reflection are becoming the differentiators. Thanks for sharing!
Some comments may only be visible to logged-in visitors. Sign in to view all comments.