The interesting question about agent tooling right now is not what an agent can do. It is where it does it — what sits between the model and your machine, and who decides what gets through. These five launches each draw that line in a different place: one measures, one decides, one isolates, one shrinks, and one reframes. Together they are a reasonable picture of what agent infrastructure looks like when it stops being a demo.
Scoring investigators on the same faults
Project Arena is a vendor-neutral Kubernetes incident benchmark for testing AI investigation tools. You deploy a disposable cluster, inject faults across a 21-scenario suite, save the investigation record from whatever product you are evaluating, and score it with a configurable judge. The point is that every product faces identical faults, so the comparison is about the investigation rather than the setup.
The published results are a useful sanity check on the whole idea: Edge Delta's native AI investigations detected and investigated 18 of the 21 scenarios, Grafana's native investigations 12, and Claude started externally on each platform's observability CLI landed in between. Detection for the externally-started agent was not independently measured, and the README says so rather than filling the cell in. Running it means Python 3.10 plus kubectl, and either a local kind cluster or AWS EKS — the cluster type and the scenario suite are separate choices, with a six-scenario smoke fixture if you want a quicker pass.
A policy layer, not a model's opinion
SafeBox puts a deterministic guardrail between an AI coding agent and infrastructure tools such as Terraform and the AWS CLI. It is a proxy that sits earlier in PATH than the real executable, and it decides what passes using explicit TOML policy files rather than asking a model whether a command looks safe. The default policy blocks the operations that ruin afternoons: terraform destroy, kubectl delete, aws ec2 terminate-instances, aws rds delete-db-instance, a recursive aws s3 rm and aws cloudformation delete-stack.
The design choice worth copying is that it never consults the thing it is guarding against. A model judging its own commands is a conflict of interest; a policy file is not. Unsupported shell syntax fails closed, and read and planning operations pass through untouched, so the guardrail does not become an obstacle to normal work. It is MIT licensed and at 0.1.0, which is early — expect to write and maintain a policy per tool.
The agent stays in the container
Abyss is an orchestrator for running your agents in containers. You configure your editor like a normal ACP agent, and Abyss handles Docker: every filesystem and shell request your agent makes is intercepted and executed inside the container rather than on your real machine. Secrets stay invisible until you explicitly mount or copy something in, and you declare the environment once — files to copy, mounts, startup scripts — instead of re-deriving it per project.
What separates it from bending Docker Compose into the same job is that it is agent-shaped from the start: native ACP support, middleware plugins, provisioning. It works with any ACP client, so the isolation is not tied to one editor. It needs Docker on the host, it is MIT licensed, and with four stars it is very early — but the "see no evil, hear no evil, speak no evil" framing is the right default for anything that runs commands on your behalf.
Under a megabyte, no libc
agentc is a coding agent written in freestanding C23 with zero libc. The stripped binary is about 940 KiB, cold-start RSS is roughly 0.7 MB, launch takes under a millisecond, and it builds for six targets from one tree — Linux on x86-64, aarch64 and riscv64, macOS on arm64 and x86-64, and Windows x86-64. It is MCP first for tools, prompts and resources, then a versioned C ABI for C and Rust extensions.
The README's comparison table is the argument, and it is labelled observed rather than estimated: codex ships a 279 MiB native binary with 85 MB of session RSS, Claude Code a 241 MiB single-file binary with 191 MB, and pi a 17.5 MiB bundle plus Node 24 for 209 MB. agentc does the same job in a fraction of that. There is a bench target so you can reproduce the numbers on your own machine rather than trusting them.
Your repository as a place
AgentIntersect World is the outlier here, and deliberately so. It is a local-first 3D workspace that renders your repository as a city you can walk, hosts up to four of your own coding agents — Claude Code, Codex, Hermes or OpenClaw — each with its own identity and avatar, and turns conversation into workstreams with source, diffs, validation results and previews. There is a Code Wheel, a HUD and spatial screens, with explicit terminal controls.
It is built for one operator working locally, not a hosted service, and the README is blunt about what local-first does not mean: your chosen harness may still use cloud models. It is a public preview at 0.15.0-rc.4, the Windows builds are unsigned, and you need an installed, authenticated agent harness to get anywhere. As an interface for agent work rather than another runtime, it is the most speculative of the five — and the only one trying to change how the work feels rather than how it is constrained.
The through line
Notice what none of these do: none of them ask a model to judge itself. One measures outcomes against identical faults, one decides with policy, one isolates by construction, one removes the runtime entirely, and one changes the interface. That is the difference between a guardrail and a suggestion, and it is the part of the stack that turns an impressive demo into something you can leave running.