Agent Infrastructure in October 2026: Running and Containing AI Agents
The conversation about AI agents has shifted. A year ago most launches were interfaces: a chat window, a sidebar, a nicer prompt box. The launches that landed on Hacker News over the last six weeks are mostly plumbing instead. They answer questions like where the model runs, what stops the agent from wrecking your machine, and how you know whether the thing you shipped actually works inside someone else's client.
This roundup covers ten of them, grouped by the layer they operate at. Every one is a real product with a live URL, and the descriptions stick to what each project says about itself rather than what a category page would claim.
Running the model yourself
The first fork in the road is whether inference happens on your hardware or someone else's. Two recent launches push hard toward your own machine, with opposite strategies.
Magnitude is an open-source inference engine that tunes its kernels on your actual hardware to find the fastest way to run each model. It covers Apple Silicon, NVIDIA, AMD and plain CPU, and the project reports roughly twice the throughput of Ollama. The interesting claim is not the raw number but the mechanism: rather than shipping one set of fixed kernels, it adapts to the machine it finds itself on.
DwarfStar 4 takes the narrow approach on purpose. It is a compact C inference engine for high-memory Mac, CUDA and ROCm machines, built to run frontier open-weight models locally: DeepSeek V4 and V4.1 Flash, GLM 5.x and Qwen3.8 Flash Next. Text and vision models, local APIs, a CLI and a native agent all ship in one MIT-licensed stack. Narrow is the selling point, not a compromise; it does fewer things at a size that fits in your head.
Choosing between them comes down to what you are serving. If you want breadth across many models on mixed hardware, the adaptive engine is the safer bet. If you want one frontier model running as fast as your memory bandwidth allows, the narrow one is built for exactly that.
Containing what the agent does
Once an agent can execute code, the interesting question is no longer what it can do but what stops it.
Plimsoll is a self-hosted sandbox service for running untrusted, agent-authored code. Its distinguishing detail is small and important: each run reports back the isolation boundary it actually executed behind. Most sandboxes ask you to trust that isolation happened. This one tells you which layer you got. It also ships browser-based lessons, so you can understand the model without cloning anything first.
Corral solves the problem one step later. When an agent spawns a runaway process tree, you need a way to kill every command it started instead of hunting through a process list. Corral is a small open-source utility for exactly that, and it is the kind of tool you do not think about until the first time you need it.
Between them they cover both halves of the risk: containing execution before it starts, and regaining control after it goes wrong.
Feeding the agent without burning tokens
Most agent cost is not the final answer. It is everything the agent read in order to get there.
Jevcrawl is an MCP server and CLI that crawls websites for agents with no LLM in the crawl loop. Keeping the model out of the fetching path is the entire design bet: the project reports finding the answer page about twice as often as Crawl4AI and costing roughly ten times less per answer than letting a general model crawl directly. Those are the project's own numbers, so treat them as a claim worth testing rather than a settled fact, but the architecture behind them is sound.
MemorySync attacks the other recurring cost, which is re-establishing context every session. It is persistent memory for agents through an API, and the browser playground demonstrates it in a single move: tell it one fact, reload the page, then ask for it back in your own words, with no signup. Stored facts are not kept verbatim, because the lasting ones are extracted instead. Every API call is shown as it happens in cURL, Python and Node.js, which makes it unusually quick to evaluate.
Knowing whether it works in someone else's client
MCP made it easy to expose a server and hard to know whether it behaves across clients.
MCPJam is a testing, debugging and evaluation platform for MCP servers. It covers OAuth flows, LLM-powered evals and CI/CD integration, and tests a server across sixteen or more major AI clients so you can see what breaks where. The cross-client part is the valuable bit: a server that works in your client and silently fails in three others is the most common way an MCP integration disappoints.
Agents that rewrite themselves
Most agents call a fixed set of tools. A smaller group is attempting something stranger.
Autolith is a self-modifiable general purpose agent written in Lisp. Because the agent is Lisp all the way down, it can rewrite parts of its own behaviour at runtime instead of only dispatching to preset tools. That is genuinely different from tool calling dressed up as autonomy, and equally genuinely harder to predict. It belongs in the experiment bucket rather than the production one, at least for now.
Where the agent lives
Finally, two launches answer the question of whose computer this actually is.
Talorys puts a personal AI agent inside your own Cloudflare account with a single command. It covers chat, memory, tasks, notes and scheduled reminders, and is built to stay inside free-tier limits. Single-user by design, with no telemetry. If the appeal of self-hosting is that your data sits on infrastructure you control, this is among the lowest-effort versions of that idea.
Pizza Bot is a local-first inbox for the agents that work in the background. Long-running agents need somewhere to drop results and requests without depending on a hosted queue, so Pizza Bot gives them a mailbox you own, built with DeepAgents and LangGraph.
How to choose
If you pick only one thing from this list, pick it based on where your agent is actually failing. Slow or expensive inference points at the engine layer. Fear of what the agent will execute points at the sandbox layer. Agents that forget everything point at memory. Servers that break in someone else's client point at testing. The infrastructure wave is useful precisely because it is now separable: you can fix one layer without replacing your whole stack.
