For years, the AI race has been told as a scoreboard story. Whose model is better at math, coding, reasoning? But DeepSeek just shared a number that doesn’t fit that story. Its Harness agent app hit 1.54 million daily active users and is chewing through roughly 92 trillion tokens a day.
I don’t think that’s really a growth stat. It suggests the fight is moving away from the chat window and toward the thing running underneath it: the agent runtime.
Benchmarks only tell you so much
Benchmarks still matter. They’re a decent way to compare models under controlled conditions. But nobody buying or using AI at work asks “what’s its score?” They ask, “Can it actually finish the job?”
A model can write a great plan in chat and still fall apart in real life. It can’t reach the right repository, the login to a cloud service expires, a test suite takes too long, or the whole session resets and it forgets where it was. None of that is a model problem. It’s a runtime problem, and benchmarks don’t measure it.
What the numbers actually say
Harness launched August 13. By November 4, DeepSeek says it had 1.54 million daily users, up from about 271,000 at the end of September. That’s over a million added in about a month.
The token count is the more interesting part. 92 trillion a day works out to around 60 million tokens per active user. A normal chat is a question, an answer, maybe a follow-up. Numbers like these only make sense if people are handing off whole tasks, with the agent planning, running code, calling tools, retrying and checking its own work.
A few other figures point the same way:
- About 35,000 third-party plugins exist.
- Around 60% of users have created or installed at least one.
That looks less like an app and more like a platform.
One caveat: these figures only count people using DeepSeek’s official API. Anyone running the open-source version against another provider isn’t in the data.
So what is an agent runtime?
Think of it as everything wrapped around the model that lets it do things. It builds the context, calls the tools, tracks the session, asks for approval when needed, and logs what happened. A raw model has no memory of yesterday, no access to your company’s systems, and no idea what it’s allowed to touch. The runtime supplies all of that.
If the model is the brain, the runtime is the hands, memory and rulebook.
The hard part is understanding what people want
Say you tell an agent, “Figure out why checkout is failing and prepare a fix.” That one sentence is really a pile of tasks: find the right service, pull the logs, look for the pattern, reproduce the bug, write a fix, open a pull request, and get a human to sign off before anything ships.
A chatbot can talk you through those steps. A runtime has to actually coordinate them, deciding which tools to use, in what order, with whose credentials, and what to do when step three breaks. Turning a vague human goal into a safe, trackable plan is most of the job.
Hand-offs are where things go wrong
Real work means jumping between code repos, issue trackers, databases, browsers, calendars and internal docs. Every jump brings friction: logins, permissions, rate limits, messy data formats, privacy rules, approvals, and the need to undo things if they go badly.
The model can suggest an action. The runtime decides whether it’s allowed, does it, records it, and deals with the fallout. Microsoft’s guidance on agent platforms describes the harness as the natural place to enforce policy, with checkpoints on inputs, model calls, tool calls and outputs. In practice, the runtime is where trust gets built.
Why this layer sticks
Here’s the strategic bit. Models can be swapped. Workflows can’t, at least not cheaply.
Once an agent knows your projects, is wired into your repos and ticketing system, and your team relies on its retries and audit trails, leaving gets painful. Every integration adds switching cost. Every plugin adds another reason to stay. That’s lock-in, and it comes from the runtime, not the model.
DeepSeek’s play
DeepSeek is shipping Harness as an open-source agent app that handles coding, file analysis and research with little supervision. It’s pitched as an open alternative to what OpenAI and Anthropic offer. An official plugin marketplace is also planned, with token grants, technical help and promotion for creators.
That matters because plugins bring in developers (and their users), let people shape the tool around their own work, and make it harder to walk away. Whoever owns that layer owns a lot more than a model.
It’s a platform fight now
The contest isn’t just between model labs anymore. It’s about who becomes the default place where agents run. The winner probably needs good, cheap models, dependable tool use, solid SDKs, deep enterprise integrations, real security and audit features, and a healthy plugin ecosystem. If models keep getting closer in quality, the runtime, which holds the context, credentials and history, is the part that’s hard to replace.
More autonomy needs more accountability
There’s a real tension here. The more freedom you give an agent, the more it can get done, and the more damage it can do. You can’t hand something access to your code, cloud and customer data and just hope.
It needs granular permissions, human sign-off on risky actions, sandboxing, full audit logs, policy checks and a way to roll back. Microsoft’s guidance says approvals should be tied to the exact action reviewed, not just the session, and that a policy denial should stop the tool from running at all.
So the better question isn’t “how autonomous can an agent get?” It’s “how autonomous can it get while staying inspectable, reversible and accountable?”
The chatbox was the demo
The chatbox made AI easy to try. The runtime is what will make it useful for real work. If DeepSeek’s numbers hold up, the market is starting to reward tools that do things rather than just answer questions.
Models will keep improving and benchmark records will keep changing hands. But the lasting advantage may go to whoever owns the place where agents plan, remember, ask permission and get things done.
So when every serious lab can build a good model, who owns the layer where the work happens?