DeepSeek’s Super-agent Design Puts a Router Behind Every Task

DeepSeek’s Harness team published “Exploring Super-agent Design: Towards a More Autonomous Agent System” on November 1, 2026, arguing that the constraint on coding agents has moved from model capability to human attention. The design pairs one long-lived router session that handles every human conversation with isolated worker sessions that each take a single task, and it ships alongside an MIT-licensed prototype.

The argument: sessions are the bottleneck

The article’s premise is a number about people, not models. A person can follow only about three to five active sessions at once, so an agent that requires management cannot scale past that. Meanwhile a single-session agent blocks on long operations, mixes context between unrelated tasks, and stops entirely when the local machine sleeps.

DeepSeek’s definition of a super-agent has four properties: it stays continuous across sessions, runs several complex tasks at once, acts proactively on what it observes, and stays online and recovers from failures without being restarted. The team’s own instance is described working one feature request from a group chat through a pull request review and back, with the same agent tracking every change.

The architecture in five parts

A router plus workers split provides continuity and throughput at once: the router holds the conversation and dispatches, and each worker runs in isolation so that one task’s context cannot leak into another’s. Work arrives as triggers — a chat message, a pull request comment, a CI result, an email — filtered before anything is dispatched, so the agent can be proactive without a person typing a prompt each time.

Around that sit three supporting pieces: full-duplex, multi-channel interaction so a person can talk to the agent while its tools are still running, a session database that keeps a task’s state addressable across restarts, and isolated execution environments. A watchdog keeps the whole thing alive when the machine it runs on does not.

In DeepSeek’s synthetic test, the split finished tasks at a p50 of 12.4 minutes against 20.4 for a single-session agent, and a p95 of 15.7 minutes against 29.5. The cost is visible in the token ledger: 23.2 million cache-read tokens per run, against 6.1 to 10.8 million for the single-session baseline. Isolation and continuity are not free.

What the prototype actually does

The repository, dsh-superagent, is narrower than the article. It is a proactive coding agent for one GitHub repository, packaged as a bundle for DeepSeek Harness, and it optionally listens to Feishu as well. When someone the team has allowed asks for work, it opens a ticket, runs it in its own agent session and its own directory, and answers in the original conversation — usually with a pull request. A web panel lists the tickets that need a person.

The implementation is more careful than the average agent demo. A ticket holds a worker slot for the whole turn, with one extra slot reserved so a person’s message never queues behind new work. Background jobs get 30 minutes and are then killed, with the results available on the next turn. Auto-merge is off by default and, when enabled, is limited to pull requests the agent opened, with required approvals and fewer than 200 changed lines. Each ticket can prepare its own directory with a command such as git worktree, which is how a worker gets a clean checkout.

The philosophy is the interesting part

The project’s first document is not about agents but about attention: “take as little human attention as possible, and give as much value as possible.” From that it derives rules that are unusually conservative for this category. The agent acts only when asked or when a written rule the team authored allows it. It speaks only when someone must act or can use a result. It asks one concrete question at a time rather than burying a question in a report. And proactive work starts in a mode that only records what the agent would have done.

The operator guidance is blunter still: start narrow, tune for less noise rather than explaining the noise, and do not use the agent to produce volume. That last point is aimed at exactly the failure mode these systems invite.

The open problem is security

The README is honest about the boundary. Blocked commands and per-ticket directories “establish defaults, not a security boundary” — a worker can still execute a program by absolute path. Combine that with the architecture’s premise, which is that untrusted events from GitHub and chat flow in automatically, and the agent runs shell commands as the operator’s operating system user.

DeepSeek also flags the gap between article and code. The article “discusses architectural ideas” and is not a description of existing DeepSeek Harness features, and some designs it describes are future directions not implemented in the prototype. The code itself is labelled research software that “may still contain bugs”.

What This Means

The proposal is that the frontier of agent work has moved from the model to the system around it: scheduling, isolation, storage, recovery, and the discipline of not spending a colleague’s attention. That is a reasonable reading of where coding agents actually fail in practice, and it explains why so much recent work is about harnesses rather than weights.

For a lab or a small team, the copyable ideas are the cheap ones: one router that owns human contact, isolation per task rather than per conversation, a person-priority execution slot, and rules about when the agent may speak. The part to be sceptical of is autonomy. A system that acts on triggers from untrusted sources, with shell access and no enforced sandbox, is a design worth reading before it is a system worth deploying.

This post was drafted with AI assistance and reviewed by RITS staff.

Sources

• GitHub — deepseek-ai/dsh-superagent-prototype (MIT licence; philosophy, domain model, execution and architecture documents)
• DeepSeek Harness — Exploring Super-agent Design: Towards a More Autonomous Agent System (machine translation of the Chinese original, November 1, 2026)