XTHE

Agentic AI systems must use deep models capable of independently solving complex technical problems.  

Multi-agent systems can produce up to 15 times more tokens than standard chats since they keep sending history, tool outputs, and reasoning steps at each step during long tasks. This context explosion can lead to the world rift, where agents slowly lose track of the main objective due to the need to use large reasoning models for every subtask, known as the thinking tax. Also, these applications are too costly and slow in real-world use.  

Today, we are announcing Nemotron 3 Super to solve these problems. The new Super model has 120 billion total parameters, with 12 billion active at a time. It is designed for maximum effectiveness and precision in complex multi-agent tasks such as software development and security triage. This release follows our introduction of Nemotron 3 Nano in December.  

Number 23 Super solves the thinking tax problem with its hybrid mixture-of-experts (MoE) design. It offers more than five times the throughput of the previous Nemotron Super. The model also handles context explosion with a built-in 1-million-token context window, providing agents with long-term memory for accurate reasoning. It is fully open, with open weights, datasets, and recipes, so developers can easily customize, optimize, and deploy it on their own systems.  

WhatsApp’s Nemotron 3 Super Apart 

Nemotron 3 Super introduces design features to reduce trade-offs between effectiveness and correctness in large reasoning models.  

• Latent MOE (a type of mixture-of-experts architecture that compresses hidden data representations) uses token compression to activate more experts (specialized submodels) per inference at the same computational cost.  

• Multi-token prediction accelerates long-sequence generation by enabling single-step future-token prediction, thereby enabling speculative decoding.  

• A Hybrid Mamba Transformer backbone means the model has two main types of layers. Mamba layers process long sequences efficiently, while Transformer layers are specialized for exact reasoning. This combination increases the model’s speed and makes it four times more memory- and compute-efficient.  

• Native NVFP4, used for pre-training, is a special low-memory format built for NVIDIA Blackwell chips. It reduces memory usage and speeds inference (model output) by 4x on NVIDIA B200 compared to FP8 on NVIDIA H100, while maintaining high accuracy.  

• After initial training, the model uses reinforcement learning (AI learns by trial and error) across 21 environments, running on NVIDIA Nemotron Gem and Nemotron RL and accumulating 1.2 million simulated experiences (environment rollouts).  

These advantages combine to create a model well-suited for long-running autonomous agents on Pinchbench, an innovative benchmark for evaluating how well LLMs perform as the brain of an open-cloud agent. Nemotron 3 Super scores 85.6% across the full test suite, making it the best open model in its class.  

Delving Deeply Into The Architecture 

Hybrid Mamba Transformer MOE Backbone 

Super uses the same blended approach as nano, but it operates on a much larger scale to understand how its architecture supports this. Consider the way its backbone combines three types of layers.  

Mamba-2 layers handle most sequence processing. These State-Space Models operate in linear time with respect to sequence length, enabling the practical use of a 1M Token Context Window. Mamba layers efficiently manage memory when processing large code lengths, extended chat histories, or many documents.  

Transformer attention layers are inserted at key points because SSMs may struggle to locate specific facts in a known context. These attention layers preserve the ability to retrieve targeted information within large inputs.  

MOE layers increase the number of effective parameters without needing heavy computation. Only some experts are used for each token, which keeps latency low and throughput high. This is important when many agents run concurrently in a shared system.  

Latent MOE 

In a typical MOE setup, tokens are routed from the full hidden dimension (all the internal data space) to the different experts (specialized sub-networks). This process can slow down computation, increase costs, and limit the number of experts the model can use.  

Supersuper uses latent MOE (working in a reduced dimension before routing). Here, token embeddings (numerical summaries of tokens) are compressed into a simpler, smaller space. The experts perform their tasks in this compressed space, and then their results are expanded to match the full model size. This approach has practical effects:  

More experts can be used at the same cost per computer (i.e., the same amount of computer resources). Compression enables the model designer to support four times as many experts without requiring more computation.  

Finer-grained specialization, when more experts are available, the model can afford highly specialized routing, for example, activating distinct experts for Python syntax versus SQL logic only when strictly necessary. This granularity is especially valuable in agentic settings where a single conversation may span tool calls, code generation, data analysis, and dialogic reasoning within a few terms.  

Multi-Token Prediction (MTP) 

Standard language models are trained to predict one token at a time. A fundamentally myopic objective, Super is trained with MTP, where specialized prediction heads simultaneously forecast seven future tokens at each position.  

This has two concrete benefits:  

This leads to better reasoning during training. Predicting multiple future tokens helps the model learn longer patterns and logical connections, rather than just guessing the next word. The model is trained to predict entire sequences, which improves performance on tasks that require step-by-step logic.  

MTP also speeds up inference by predicting multiple future tokens in a single pass. This reduces the time required to generate long outputs. The MTP heads make draft predictions that can be checked in parallel, enabling up to 3x faster generation for tasks such as code and tool calls without requiring a separate draft. Both benefits come from a single design. Shared weights across all MTP heads limit the number of extra parameters and stabilize training by aligning heads, keeping draft predictions more consistent across longer sequences.  

Native NVFP4 Pre-Training 

Most quantized models are first trained in full precision and then compressed, which usually results in some loss of accuracy. Super does things differently. Most floating-point operations during pre-training use NVFP4 and NVIDIA’s 4-bit floating-point format. This format, optimized for Blackwell, greatly reduces memory usage and speeds up inference compared to FP8 while maintaining high accuracy.  

By training natively in reduced precision (only using 4-bit math from the beginning), the model learns to be accurate even with small numbers, meaning it stays stable and effective while using much less memory.  

Training Super: A Three-Stage Process  

1. Supervised fine-tuning is a phase in which the model is further trained on specific examples relevant to the tasks it will face, so it learns to act appropriately for those tasks.  

2. Reinforcement learning is used to further improve model behavior by letting it learn from actual outcomes in test scenarios.  

Pre-training: Super is pre-trained on 25 trillion tokens using the NVFP4 format, learning to be accurate with four-bit math throughout pre-training. The data includes 10 trillion unique curated tokens focused on reasoning and coding.  

Supervised Fine-Tuning: Before Reinforcement Training, Super is being fine-tuned with about 7 million supervised samples. These come from a larger set of 40 million samples that include reasoning, following instructions, coding safety, and multi-step agent tasks. This stage lays the foundation for the behavior RL will employ. The model teams learn to give correct responses across different tasks, so RL starts from a stable base rather than a raw, pre-trained model.  

Multi-environment reinforcement learning makes the model more agent-like by training it across many environments (such as Nemotron, GitHub, NMEDIAS, and the Open RL Library). These scenarios test tasks such as tool use, coding, and complex planning, creating the main dataset for reinforcement training.   

This type of reinforcement learning step helps the model work reliably in multi-step workflows, reduces reasoning errors, and manages the organized tasks often found in agent pipelines.  

The Super + Nano Deployment Pattern 

Nemotron 3 Nano works well for processing specific targeted steps in an agent-like workflow; however, as multi-agent applications become more complex and involve several steps, a more powerful model is needed for better planning and reasoning. For example, imagine an agent that needs to choose among tools to create a presentation with 10 high-quality slides.  

Nemotron 3 Super is a great fit for these situations in software development. For example, Nemotron 3 Nano can handle single merge requests, while Nemotron 3 Super can handle more complex coding tasks that require a deeper understanding of the codebase. For expert-level coding, proprietary models are best.  

Building With Super’s Open Resources 

Nemotron 3 Super is fully open source, including model weights,datasets, and architectural recipes, enabling developers to tailor, refine, and deploy the model for privacy and security.  

Get Started 

With these capabilities in mind, getting started is straightforward. Start using Nemotron 3 Super today. Deploy it on your preferred platform, whether on a workstation or in the cloud. To experience its capabilities, sign up for a pro subscription on Perplexity. Access it directly by your API, use OpenRouter, or visit build.NVIDIA.COM. Take the next step. Explore Nemotron 3 Super Now! 

Source: Introducing Nemotron 3 Super: An Open Hybrid Mamba-Transformer MoE for Agentic Reasoning 

At Universe 2025, GitHub unveiled Agent HQ, a platform that serves as machine control for AI coding assistance from vendors like OpenAI, Anthropic, Google, and xAI within the GitHub ecosystem.  

This initiative, often referred to as an AI Army command center, aims to transition developers from juggling separate tools to coordinating a team of agents that seamlessly write, test, and debug code together.  

Main details of GitHub Agent HQ (2025-2026) 

• Centralized Control Plane: Agent HQ provides a single interface in GitHub, VS Code, and the command line for assigning, tracking, and managing AI tasks in real time.  

• Third-party integration: column developers can now use models from Anthropic Cloud 3.7 Sonnet, Google Labs Jules, and xAI in their GitHub workflow, not just GitHub by Copilot.  

• Agents can now perform tasks in sequence independently, starting with picking up issues.  

• creating branches  

• committing code  

• opening pull requests  

• Human developers then review the agents’ work and provide feedback as needed.  

• Enterprise Governance: The platform provides advanced code review by agents, a control panel to manage agent actions, and a dashboard to track AI performance.  

• Following the October 2025 announcement, third-party agents gradually became available to GitHub Copilot subscribers. Over the next few months, advanced features will be offered through Copilot Pro + or to enterprise clients.  

Shift To Agentic Development 

GitHub COO Kyle Daigle stated that the objective is to bring order to the condition caused by rapid AI growth. Agent HQ enables developers to move beyond basic chat-based assistants by leveraging agents for more structured, step-by-step programming assignments.  

Related security concerns (EchoLeak)  

In early 2025, researchers identified the first zero-click AI vulnerability in Microsoft’s broader Copilot ecosystem, though not an Agent HQ-specific one. It highlighted the risks of AI agents accessing sensitive data. Microsoft responded with stronger security and auditing in its Frontier Suite (Microsoft 365 E7), launched in early 2026.  

If you maintain open source projects or work on an enterprise team, seeing automated documentation fixes, new unit tests, or refactoring suggestions can be a real eye-opener. Still, automation raises a key question: how do you set limits on agents that can access your repository and the internet? You could worry about an agent using information from unreliable websites, or accidentally exposing an API token, or maybe it could start posting unnecessary comments on every open issue. For its automation to be truly valuable, it needs to be predictable.  

What is the safest way to add agents to existing automations like CI/CD? Agents are unpredictable and handle untrusted inputs. Examine your repository’s state and make decisions as they run. Along with agents in CI/CD with constant oversight, you can scale your engineering, but it requires safeguards to address security risks.  

GitHub agentic workflows are built on GitHub Actions. Normally, everything in an action shares the same level of trust. This means an unauthorized agent could interfere with MCP servers, access authentication secrets, or send network requests to any destination. If an agent has bugs, is manipulated by prompts, and has no restrictions, it could behave in unforeseen and unsafe ways.  

This is why security is a core part of Agentic Hub workflows. We see agent execution as an extension of the CI/CD model, not as something separate. We keep the creative part of building workflows apart from the control part of running them. Then, we turn workflow into a GitHub action with clear limits on permissions, inputs, audit records, and network access.  

In this post, we will explain how we designed Agentic workflows to be secure from the start, starting with the threat model and needed security architecture.  

Threat Model 

Two key features of agentic workflows affect the threat model for automation.  

Agents can understand repository state and act independently. While useful, they should not be trusted by default, especially with untrusted inputs.  

Second, GitHub Actions offer a very open execution environment. Sharing a trust domain helps with automation, broad access, and good performance; however, if untrusted agents are involved, a single trust domain can lead to extensive problems if something fails.  

With this model, we assume agents may access or modify unauthorized data, use or misuse channels, or perform actions beyond their permissions through deferred GitHub agentic workflows. Use strict security settings based on this threat model, adhering to four security principles:  

1. Defense In-Depth  

2. Not Trusting Agents With Secrets  

3. Reviewing all writes  

4. Comprehensive Logging.  

Defend in Depth 

GitHub Agentic workflows use a layered security system with state configuration and planning layers. Each layer helps limit the impact of failures in the layers above by enforcing its own security rules.  

The Substrate Layer is built on a GitHub Access Runner, running on a virtual machine, with several trusted containers that control which resources an agent can use. This layer keeps components separate, manages privileged operations and system calls, and enforces communication boundaries at the kernel level. These predictions remain valid even if an untrusted component is compromised and runs code within its container.  

On top of the substrate layer is the configuration layer. This layer uses declarative artifacts and toolchains to set up a secure system and its connections. It decides which components are loaded, how they connect, which communication channels are allowed, and what privileges each has. External tokens, such as agent API keys and GitHub access tokens, are important inputs. The configuration controls which tokens are placed in which containers.  

The last layer of defense is the planning layer. While the configuration layer decides which components exist and how they connect, it does not control when they are active. The planning layer’s main job is to set up a staged workflow with clear data exchanges between components. The Safe Outputs subsystem, explained later, is the main example of secure planning.  

Don’t Trust Agents Bearing Secrets 

From the start, we aimed for workflow agents to have no access to secrets and to maintain strict trust boundaries. Agentic workflows run as GitHub actions, with all components sharing a single trust domain on the runner VM. In this setup, sensitive items such as agent authentication tokens and MCP server API keys are stored in environment variables and configuration files that all processes in the VM can access. No extra measures are required to prevent agents from breaching these trust boundaries.  

This is risky because agents can fall victim to prompt injection. Attackers might cause harmful impacts, such as web page or repository issues, that trick agents into revealing sensitive information. For example, an agent affected by prompt injection and with access to shell commands could read configuration files, SSH keys, LNS/PROC state, and workflow logs to find credentials and other secrets. It could then upload these secrets online or hide them in public GitHub objects, such as issues, pull requests, and comments.  

Our first step to reduce risk was to put the agent in its own container and to implement strict controls on what it can access. This includes:  

• Firewall internet access  

• MCP access only through a trusted gateway  

• NLM API calls are routed through an API proxy to limit internet access  

Agentic workflows set up a private network between the agent and the firewall. The MCP gateway runs in a separate trusted container, starts MCP servers, and is the only one with access to MCP authentication material.  

Agents like Cloud, Codex, and Copilot need to talk to an LLM over a secure channel, but we do not give these tokens directly to the agent’s container. Instead, we keep LLM auth tokens in a separate API proxy and set up agents to send modern traffic through that proxy.  

Zero-Secret Agents need a balance between security and usefulness. Programming tasks often need access to compilers/interpreters/scripts/repository data. However, increasing the container setup would duplicate existing provisioning steps and add more network destinations to the five-where rules.  

Instead, we use container volume mounts to give the agent access to needed host files and programs, and we run it in a chroot jail. First, we mount the whole VM. The host system has a read-only /host. Then we cover certain paths with empty tmpfs layers and start the agent in a chroot jail at /host. This way, the host setup stays unchanged, and the agent can only read and write what it needs for its work.  

Stage and Vet all Writes 

Even without access to secrets, prompt-injected agents can still cause problems. For example, an agent’s interest might flood a repository with unnecessary issues or pull requests to overwhelm maintenance, or add unwanted URLs and other content to repository objects.  

To prevent this kind of behavior, the Agentic Workflows Compiler decomposes every workflow into clear, explicit stages. It acts as a control point, defining for each stage.  

• The Active Components and Permissions (read vs write)  

• The data artifacts emitted by that stage  

• The admissible downstream consumers of those artifacts  

While the agent runs, it can read GitHub state through the GitHub MCP server and can only prepare its updates through the safe outputs MCP server. After the agent finishes the safe outputs, the MCP server processes any buffered write operations using a set of safe output checks. It includes operations that an agent can perform. Authors can choose which GitHub update types are available, such as:  

1. Creating issues, comments, or pull requests  

2. Safe outputs limit the number of updates allowed, such as restricting an agent to creating at most three pull requests per run.  

3. Safe outputs analyze and update content to remove unwanted patterns, such as sanitizing URLs  

Only artifacts that pass through the entire safe outputs pipeline can be passed on, making sure that each stage’s side effects are explicit and vetted.  

Log Everything. 

Even with no secrets and checked rights, an agent can still change repository data, use tools in ways we did not expect, or try to get around the limits we set. Agents will try many tricks to complete their tasks. If something goes wrong, we need to see the full execution path to understand what happened.  

Agentic workflows make observability a first-class property of the architecture by logging extensively at each trust boundary. Network and destination-level activity is recorded at the five one-layer model request/response metadata, and authenticated requests are captured by the API proxy. All invocations are logged by the MCP gateway and MCP servers. We also have an internal implementation in the agent container to audit potentially sensitive actions such as access to environment variables. Together, these logs support end-to-end forensic reconstruction, policy validation, and rapid detection of anomalous agent behavior.  

Extensive logging also sets the stage for future information flow controls. Anyway, we observe communication; we can control it. Agentic workflows already support GitHub MCP servers’ lockdown mode. In the coming months, we will add more safety controls that enforce policies across MCP servers based on whether something is public or private and who created a repository object.  

What’s Next? 

Join the discussion in our community or on the #GitHubNext Discord. We look forward to seeing what you build with GitHub Agentic Workflows. Stay tuned for more updates.

Source: Under the hood: Security architecture of GitHub Agentic Workflows 

Tesla has advanced general-purpose robotics. The latest Optimus AI update adds vision-language navigation, enabling the robot to reason. By merging language understanding with spatial cognition, Tesla addresses the main challenge of deploying humanoid robots: executing complex real-world instructions.  

For robotics engineers and AI researchers, this update marks a shift from traditional SLAM methods to a more comprehensive, embodied AI approach for humanoid robots. Now the focus is not just on avoiding obstacles but on helping the robot comprehend its environment using human language.  

The shift to vision-language navigation (VLN) for robotics engineers and AI researchers. This update marks a shift from traditional SLAM methods to a more comprehensive embodied AI approach for humanoid robots. Now the focus is not just on avoiding obstacles but on helping the robot comprehend its environment using human language.  

The Shift to Vision-Language Navigation (VLN) 

Historically, autonomous navigation was a geometric problem. Robots use LiDAR-based vision to create a voxel map of the world and navigate to specific coordinates. However, coordinates are not how humans communicate. We do not tell a co-worker to move to 45.2-12.8 in. We say, “Take the red folder from the messy desk and bring it to the lounge near the coffee machine.”  

With Vision-Language Navigation (VLN), Optimus can now understand these kinds of instructions. The new AI uses a transformer model (a type of neural network, especially good at understanding language and images) that processes video from the robot’s eight cameras along with language input. This lets the robot find objects or rooms it hasn’t seen before by matching what it sees to the words it hears.  

Embodied AI: The Fusion of Logic and Limbs 

This update focuses on embodied AI, meaning the robot’s intelligence is integrated with its physical form. Unlike pure text-based models, a humanoid robot must interact with the physical world and obey its laws. Tesla has redesigned its FSD for robots to enable detailed step-by-step reasoning about space and time, allowing Optimus to plan and act within its environment.  

When Optimus receives a command, the vision language model first breaks the task into sub-goals. If the goal is to clean up the spill in the lab, the robot must identify it using its vision system. Understand that cleanup requires a tool, such as a mop or paper towels. Use language/logic) and then navigate to where those items are typically stored (using memory and spatial reasoning, or the ability to recall and understand places). By running this logic locally on Tesla’s D1 chip, the robot achieves sub-millisecond latency to adjust its balance and gait while simultaneously processing high-level cognitive tasks.  

Mastering Active Environments with World Models 

A major challenge for humanoid robots is that human spaces change constantly. Factories, homes, and offices are never static. The new AI stack uses Neural World Models to help Optimus predict possible changes based on past data.  

If a human walks across the robot’s path, Optimus does not simply stop. It predicts the person’s path and adjusts their velocity and path in real time. This is where the vision-language component becomes critical for safety and social etiquette. The robot can distinguish between a stationary object, such as a box, and a temporary obstruction, such as a person, and chooses a wider berth to ensure people’s comfort. This subtle behavior is a direct result of training the navigation stack on millions of hours of human-human interaction data, allowing the robot to emulate natural spatial social norms.  

The Role of End-to-End Neural Networks 

Tesla is committed to an end-to-end approach. While others use separate modules for vision, planning, and movement, Optimus depends on a single large neural network. The Vision Language Navigation update feeds raw data, images, and text directly into this network, which controls the robot’s actions.  

This approach provides for emergent problem-solving. During recent internal testing, an Optimus unit was tasked with moving a crate that was blocked by a rolling chair. Rather than failing or waiting for the path to clear, the robot used its vision-language understanding to recognize the chair as a movable object, pushed it out of the way, and proceeded to its goal. This type of reasoning, identifying affordances in the environment and seeing what actions an object allows (such as a chair’s mobility), is the hallmark of true humanoid autonomy.  

Scaling Through The Dojo Training Fabric 

Tesla’s Dojo supercomputer drives Optimus’s advanced embodied AI. To train vision-language navigation, Tesla uses a special auto-labeling system. Thousands of Optimus robots in factories collect data. When a robot encounters a new situation or tricky instructions, it sends the data to Dojo.  

There is a larger teacher model that analyzes the Dojo video. A bigger teacher model reviews the video and results, then labels the data for the student model on the robot. This cycle makes the navigation system stronger every day. In 2026, Tesla began using generative world simulations in which Dojo creates millions of challenging scenarios, such as a robot in a dark room with mirrors or a busy hospital hallway, to test the VLN system before it’s used in real robots. The technical ability to move forward with vision-language navigation is an economic strategy that makes the robot easier to perform via voice or text.  

Tesla is reducing the barrier to entry for small-scale manufacturing and elder care facilities. You no longer need a staff of robotics engineers to define waypoints or no-go zones. A floor manager can simply walk the robot through a facility, giving verbal indications such as “this is the shipping dock” and “don’t enter this area during shift changes”. The robot’s VLN stack will build a semantic map that adheres to those rules.  

Tesla believes accessible robotics will help Optimus reach millions of users. When using a robot is as simple as conversation, it becomes an everyday workplace tool, not a luxury.  

The Road Ahead: General Purpose Intelligence 

Adding Vision Language Navigation to the Optimus AI stack is a step toward Tesla’s goal of Artificial General Intelligence. While a chatbot explains a recipe, Optimus is getting closer to seeing the ingredients, understanding the recipe, and completing the task.  

Looking to 2026, integrating vision and language will drive social robotics. Optimus will move through our world and communicate, saying things like, “Excuse me, I need to reach that shelf,” or, “I have completed the inventory check.” This will ease collaboration between people and robots.  

Final Thoughts: The Humanoid Constitution 

Tesla’s vision for Optimus has always been bold, but Tesla’s big plans for Optimus are now becoming real with the latest AI update, which adds vision-language navigation. Tesla is reaching, teaching the robots to see and hear the world as we do. This marks the start of the Autonomous Digital Coworker, a machine that understands not just what to do, but also how and why. The general-purpose humanoid is no longer simply an idea; it’s already working on factory floors.

Source: AI & Robotics