Harness engineering is the discipline of designing the software that surrounds a language model and turns it into a working agent. It covers four things: context delivery, tool interfaces, memory, and sandboxes. The model supplies the reasoning. The harness decides what the model sees, what it can do, what it remembers, and where it runs.
Why the harness now matters as much as the model
The industry spent years arguing about which model is smartest. On early 2026 leaderboards, the harness moved the score at least as much as the model did.
The first comparison holds the model steady and varies the harness. On the Terminal-Bench 2.0 leaderboard, Claude Opus 4.6 scored between 58.0% and 74.7% across seven harnesses, all submitted between 5 and 23 February 2026. The highest of the seven was Terminus-KIRA from KRAFTON AI at 74.7%. Confidence intervals sit near plus or minus 2.5 to 2.9 points, so a 16.7 point spread is not noise.
The second comparison runs the other way and holds the harness fixed. On SWE-bench Verified’s bash-only board, nine frontier models ran the identical mini-swe-agent scaffold at matched reasoning effort, all submitted on 17 February 2026. Their scores spanned just 66.6% to 76.8%, a 10.2 point gap.
Two cautions keep this honest. On the newer Terminal-Bench 2.1 board, harness spreads collapse to between 0.2 and 8.1 points once reasoning effort and submission dates are matched, so the gap appears to be narrowing. Besides that, tuning a harness per model risks hill-climbing on the evaluation, a real danger when a leaderboard is read as proof.
The anatomy of an agent harness
An agent harness is the software scaffolding around a model. Anthropic describes it as
“the loop, tools, context management, and guardrails that turn raw intelligence into a working agent”.
METR called it scaffolding back in 2023: scaffolding plus a model equals an agent. Four parts do most of the work.
Tool dispatch and MCP
Tool dispatch is what turns a model’s request into a real action. The model returns a tool-use block, the harness runs it and returns the result, and the loop repeats until the model stops asking.
The Model Context Protocol standardizes how an agent reaches those tools, and calls itself “an open-source standard for connecting AI applications to external systems”.
Anthropic created MCP and donated it to the Agentic AI Foundation in December 2025, and the MCP specification warns that tools “represent arbitrary code execution”.
Memory and state persistence
State persistence is how an agent survives its own context window. Context compaction is the usual answer, and the Claude Agent SDK summarizes earlier messages as the limit approaches.
Compaction is lossy, and Anthropic says so: “While compaction preserves continuity, it doesn’t give the agent a clean slate.” Durable state therefore belongs outside the transcript: Claude Code re-injects project memory files after compaction, and LangGraph gives agents short-term memory through checkpointers and long-term memory through stores.
Isolated sandboxes
A sandbox is the boundary between a mistake and an incident. Claude Code’s built-in sandbox uses Seatbelt on macOS and bubblewrap plus socat on Linux and WSL2, and by default a command writes only to the working directory and the session temp directory.
OpenAI Codex offers read-only, workspace-write and danger-full-access modes, runs with network off by default, and applies one rule: “deny always wins over allow.” Heavier isolation goes as far as microVMs such as Firecracker, and E2B says its same-region sandboxes “start in less than 200 ms”.
Guardrails and permissions
Guardrails decide what an agent may attempt, and isolation decides what the attempt can reach. Anthropic draws the line cleanly: “Permission modes decide whether a tool call runs and whether you are prompted first. Isolation restricts what a command can access once it runs.”.
Claude Code ranks its permission modes from Manual up to bypassPermissions, with acceptEdits, plan, auto and dontAsk in between, and deny rules block in every one of them. The OpenAI Agents SDK adds input, output and tool guardrails, any of which can raise a tripwire and halt the run.
Harness engineering vs prompt engineering
The core difference is scope. Prompt engineering shapes one exchange with a model. Harness engineering shapes the system around the model for the length of a task.
| Dimension | Prompt engineering | Harness engineering |
|---|---|---|
| Focus | How you talk to the model | The system wrapping the model |
| Primary output | Text generation | Multi-step actions and state management |
| Scope | A single input and output lifecycle | Long-running task execution |
| Skillset | Linguistics and context phrasing | Software engineering and systems architecture |
| Failure mode | A bad answer | A run that drifts, fails silently or does damage |
| Unit of iteration | A reworded prompt | A changed tool, check or boundary |
Context engineering sits between the two. Anthropic defines it as “the set of strategies for curating and maintaining the optimal set of tokens (information) during LLM inference”. That is one job the harness does, and because every token carries a cost, it is a budget decision too.
Neither replaces the other: a harness contains prompts, and a bad system prompt sinks a good agent. But when an agent fails on real work, the cause is usually structural, such as an unusable tool error, a context window full of noise or a missing check.
One comparison helps here, borrowed from classical cybernetics rather than from AI: the harness acts as the governor, the regulator that keeps a powerful engine inside a safe operating band.
Why scaffolding matters for coding agents
Coding agents are where harness engineering stopped being optional. OpenAI’s account of adopting Codex is blunt about why: “Early progress was slower than we expected, not because Codex was incapable, but because the environment was underspecified.”
How harness engineering regulates a codebase
A coding agent needs more than the task. It needs the repository explained. Planning artifacts do that: AGENTS.md was contributed by OpenAI to the Agentic AI Foundation, and Claude Code reads CLAUDE.md, with documented guidance to keep it under 200 lines. Anthropic documents structured artifacts that hand off context between sessions, so a fresh context window starts from a written plan.
It helps to know where those artifacts stop. Anthropic notes that settings rules are enforced by the client, while CLAUDE.md shapes behavior without hard enforcement. Our Claude Code guide covers the setup in practice.
Feedback loops and recovery paths
Every harness component is either a guide or a sensor. Guides steer the agent before it acts, while sensors “observe after the agent acts and help it self-correct”. Anthropic’s documented PreToolUse hook is one such sensor, filtering test output down to failures only and cutting “tens of thousands of tokens to hundreds”.
Recovery paths matter because errors compound. Research presented at ICLR 2026 found that per-step accuracy degrades as steps increase. The same work identified self-conditioning, where models “become more likely to make mistakes when the context contains their errors from prior turns”, and scaling does not fix it.
METR’s time horizons show what reliability costs: Claude Opus 4.6 sustains a task horizon of 718.8 minutes at a 50% success rate, but only 69.9 minutes at 80%. Designing for that 80% case is harness work, which is why evaluation beyond benchmarks matters.
Leading harness frameworks and approaches
Every major lab now ships a harness alongside its model.
Anthropic’s Claude Agent SDK exposes “the same tools, agent loop, and context management that power Claude Code” in Python and TypeScript. Claude Managed Agents, in beta, is a pre-built agent harness running in managed infrastructure for long-running, asynchronous work.
OpenAI ships three layers that coexist. The Responses API gives direct control. The Agents SDK adds primitives for Agents, Handoffs, Guardrails, Sessions and State, and Tracing. AgentKit, announced on 6 October 2025, adds Agent Builder, a Connector Registry, ChatKit and expanded Evals.
The Agents SDK also ships Sandbox Agents, an execution harness that spares you “file staging, filesystem tools, shell access, sandbox lifecycle, snapshots”. The SDK is still pre-1.0.
LangChain puts it plainly: “A model by itself isn’t an agent. It becomes one when you wrap it in a harness”. Its harness product is Deep Agents, which bundles a built-in filesystem, context management, subagent delegation, skills and long-term memory, with LangGraph supplying durable execution underneath.
Microsoft Agent Framework is the direct successor to AutoGen and Semantic Kernel, built by the same teams. It supports .NET, Python and Go, and ships a Harness Agent component for long, multi-step tasks. Google ADK 2.0 casts the widest net on languages, covering Python, TypeScript, Go, Java and Kotlin.
Adoption is past the experiment stage, in line with agentic AI trends. LangChain’s State of Agent Engineering report found that 57% of more than 1,300 professionals had agents in production, rising to 67% at organizations above 10,000 employees.
How to build your first agent harness
Build the smallest harness that fails visibly, then let failures tell you what to add.
- Start with the bare ReAct loop. ReAct is the canonical minimal loop, reason, act, observe, repeat, from a 2022 paper by Shunyu Yao and colleagues. mini-swe-agent runs it in about 100 lines of Python for the agent class and scores above 74% on SWE-bench Verified. On the same model it still trails a tuned scaffold by roughly 5 to 12 points.
- Add tools sparingly, then strip them back. Vercel reported that with the model held fixed, replacing 15 specialized tools with bash cut token use from about 102,000 to about 61,000 and run time from 274.8 to 77.4 seconds. Anthropic reported cutting one workflow from 150,000 tokens to 2,000 by presenting tools as code modules.
- Make the environment explicit instead of the prompt clever. OpenAI’s team concluded that “building software still demands discipline, but the discipline shows up more in the scaffolding rather than the code”. Write down build commands, test commands and conventions. Guesswork is what drives up running costs.
- Add sensors before you add guides. A guide predicts what the agent will get wrong; a sensor catches it after the fact. Tests, linters, type checks and hooks all qualify, and LangGraph’s interrupt function saves state and waits for a human when a step needs judgment.
- Assume the model will absorb your scaffolding. Google DeepMind’s Logan Kilpatrick said in June 2026 that “the model eats that scaffolding and it becomes part of the native model system”, and he expects much of it to land in the model itself within twelve months. Anthropic agrees that harnesses encode assumptions that go stale, but concludes differently: “the space of interesting harness combinations doesn’t shrink as models improve. Instead, it moves.”
Conclusion
Harness engineering changes the question from ‘which model is smartest?’ to ‘which system makes model intelligence reliably useful?’. For AI agents, that is the more important engineering question. A model can reason, but without context management, tools, state persistence, sandboxing and feedback it has little control over a real workflow.
For organizations, this also means the choice between AI agents and fixed AI workflows is not only about autonomy. The more autonomy you add, the more the harness matters. If you want to build an agent that can work safely across company tools and processes, DataNorth’s AI Agents Development service can help design and implement the runtime, integrations and control mechanisms around the model.
Frequently asked questions (FAQ) about Harness Engineering
What is the difference between an AI agent and an LLM?
An LLM is a model that generates text from a prompt. An AI agent is that model plus a harness: the loop, tools, memory and guardrails that let it act over many steps. METR’s 2023 formula holds: scaffolding plus a model equals an agent.
What is agent scaffolding?
Agent scaffolding is the software wrapped around a model that turns it into an agent. METR used the term in 2023, calling scaffolding plus model combinations agents. Harness is the newer word for the same idea, formalized by LangChain as Agent = Model + Harness.
Who coined the term harness engineering?
No single person owns it. Mitchell Hashimoto published the phrase on 5 February 2026 and noted at the time that no accepted term existed yet. OpenAI popularized it days later, and the most-quoted definition came from Vivek Trivedy and LangChain. Some writers credit Trivedy, who makes no such claim.
Is harness engineering the same as context engineering?
No. Context engineering is one part of harness engineering. Anthropic defines it as curating and maintaining the optimal set of tokens during model inference. A harness also covers the agent loop, tool dispatch, sandboxing and permissions: systems problems, not context problems.
