What is an agent harness? The software around an AI model that lets it act

An agent harness is the software wrapped around an AI model that lets it act: it feeds the model a task, runs the tools the model asks for, passes the results back, manages what the model remembers, and repeats until the job is done or stopped. The model supplies the judgment. The harness supplies the hands, the notebook and the guardrails. Two stories in October 2026 show why the distinction matters.

The short definition

A model on its own takes text in and returns text out. To do anything in the world, such as run code, click a button or search a site, something has to execute those actions and show the model the outcome. That something is the harness. Anthropic's engineering team uses the word for its Claude Agent SDK, calling it "a powerful, general-purpose agent harness adept at coding" in a November 26, 2025 post on long-running agents. The post never gives a formal definition, but its description makes the job clear: a loop around the model with tools and context management, including compaction, so work can continue past a single context window.

If you have read our explainer on what an AI agent is and how it differs from a workflow, the harness is the part that makes the loop real. The agent is the model plus the harness.

What a harness actually does

Most harnesses handle five jobs.

• Tools. It defines what the model may do, such as run shell commands, edit files, browse a page or call an API, and it carries out the call.
• Context. It decides what the model sees each step. Because a context window is finite, the harness compacts or drops old material and keeps notes.
• Memory across sessions. A fresh session starts with no memory of the last one, so the harness has to supply logs, progress files or version-control history.
• Control. It limits steps, spending and permissions, and decides when to stop or hand back to a person.
• Environment. It sets up the sandbox the agent works in, including what is installed and what is reachable.

A worked example from Anthropic

Anthropic's post describes what goes wrong without good scaffolding. Each new session of a long-running agent starts without memory of earlier ones, and compaction alone did not keep a basic web app project on track. Two failure patterns appeared: the agent tried to build too much at once, and later agents declared the project finished too early.

The fix was harness design, not a better model. An initializer agent sets up the environment on the first run, with a setup script, a progress log, a git commit and a feature list. A coding agent then makes incremental progress each session and leaves the code in a clean state. The feature list is a JSON file in which every feature starts as failing, and agents may only change the pass or fail status. The team chose JSON because models are less likely to overwrite it than Markdown. Each session follows a routine: check the working directory, read the logs and notes, pick one unfinished feature, then start the dev server and run a basic test before new work.

That is the point. The same model can look competent or useless depending on its harness.

Why the harness changes the score

This is also why benchmark numbers need a harness named next to them. Epoch AI's SpireClimb benchmark, published October 14, 2026, has models play Slay the Spire through a visual computer-use harness, and the authors say that choice may hide some of the models' reasoning ability. Put another way, part of a low score can be the interface, not the intelligence. Our guide to what AI leaderboards rank and what a top score hides makes the same point for scoreboards generally.

The harness is also where the risk lives

Because the harness grants the model its powers, it defines the blast radius. On October 19, 2026, security firm NorForge published its analysis of Cairn, an AI penetration-testing system. In Cairn, tasks are projects with a goal, agents post discoveries to a shared blackboard, and a human can add hints. NorForge found more than 20 exposed control panels it judged likely malicious, and says one worker's name suggested a Claude Code harness driving a DeepSeek model, which it says is not confirmed. The harness, not the model, made it possible to run attacks around the clock with little supervision, and its missing access control exposed the operators.

That is a safety lesson in ordinary software terms: permissions, logging, sandboxing and login screens. For the stronger version of the idea, see our explainer on AI containment.

Questions to ask when you read an agent claim

• Which harness? The same model scores differently in different harnesses. A claim without one is incomplete.
• How much human help? Hints, retries and manual resets all count.
• What was the budget? Steps, time and spending shape results.
• What could it touch? Permissions decide whether a failure is a bug or an incident.
• Who can see inside? Logs and transcripts are how outsiders verify what an agent did.

Our take

When someone says "the model did this," ask what was around it. The harness is where much of the engineering, much of the cost and much of the risk sits, and it is the part labs publish least about. Treat any agent result as a statement about a model and a harness together, and treat any missing harness detail as a reason to discount the headline. Anthropic's post lists open questions itself, including whether one general agent beats a team of specialized ones, so the design is still moving.