An agent harness is the software that surrounds an artificial intelligence (AI) model and turns it into an agent. A large language model (LLM) on its own does one thing: it receives text and returns text. It cannot run a search, open a file, call an advertising API or remember what it did ten minutes ago. The harness does those things on its behalf. It sends the model a prompt, reads the reply, recognises when the reply is a request to use a tool, executes that tool, feeds the result back and repeats until the task is finished or a limit is hit. Google Cloud defines it as "the runtime software infrastructure and control layer that wraps around an AI model to turn it into a reliable, autonomous agent." The term exists because, by 2025, much of the difference between a capable agent and a useless one turned out to sit outside the model.

How a harness works

The core of every harness is a loop. Anthropic's documentation for the Claude Agent SDK, the library that packages the engine behind Claude Code, describes it in five steps: the model receives the prompt together with a system prompt, tool definitions and conversation history; it evaluates the situation and responds with text, tool requests or both; the harness runs each requested tool; the results go back to the model; and the cycle ends when the model replies with text and no tool calls. Each pass is a turn.

In the documentation's worked example, an agent asked to fix failing tests runs the suite, reads two files, edits one and reruns the tests, then reports success. Four turns, no human involvement.

Around that loop sit the components that separate one harness from another:

  • Tools. The harness decides which actions the model may request, such as reading files, running shell commands, browsing or calling outside services, increasingly through the Model Context Protocol (MCP).
  • Context management. Models can only hold a fixed amount of text. The harness decides what stays in view, summarises old material through a process called compaction, and clears stale tool output.
  • Permissions and guardrails. The harness checks whether each requested action is allowed before running it. The Claude Agent SDK exposes allow lists, block lists and permission modes, plus "hooks" that can intercept, modify or block a tool call.
  • Limits. Settings such as max_turns and max_budget_usd stop a runaway loop. Anthropic notes that without them the loop "runs until Claude finishes on its own," which can take a long time on open-ended prompts.
  • State and memory. Progress files, task lists and session records let work survive a crash or continue in a fresh context window.
  • Delegation. Many harnesses can spawn subagents, separate model instances with their own context, and merge their reports.

The harness sits between the model and the outside world. The model never touches a database or ad platform directly; every action passes through the harness.

Origin and evolution

"Harness" is borrowed from software testing, where a test harness is the scaffolding that runs code under controlled conditions and records results. AI research adopted the word first for evaluation: EleutherAI's lm-evaluation-harness became a standard tool for scoring models on benchmarks.

The agent sense grew out of tool use. The ReAct paper of October 2022 showed models alternating between reasoning and actions, and OpenAI added function calling to its API in June 2023. Princeton's SWE-agent paper in May 2024 argued that the "agent-computer interface" built around a model shaped its coding results.

Commercial harnesses followed. Anthropic released Claude Code as a research preview in February 2025, and OpenAI released its Codex CLI in April 2025. In September 2025 Anthropic renamed the Claude Code SDK the Claude Agent SDK, and on November 26, 2025, an Anthropic engineering post by Justin Young called it "a powerful, general-purpose agent harness." That post addressed a specific failure. Running Opus 4.5 in a loop across several context windows, the agent tried to build an entire web app at once, ran out of context mid-feature, and later instances declared the job done prematurely. The fix was harness design, not a better model: an initializer agent wrote a feature list of more than 200 items, all marked "failing", plus a progress file and a git repository; each later coding agent worked on one feature, tested it and committed. Anthropic chose JSON for the feature list because the model was "less likely to inappropriately change or overwrite JSON files compared to Markdown files."

In February 2026 OpenAI published "Harness engineering," describing an internal product built almost entirely by Codex agents, with engineers designing the environment, documentation and checks rather than writing code. Commentators summarised it as roughly one million lines of code produced without hand-written code, and "harness engineering" became the name for the discipline.

On March 24, 2026, Anthropic's Prithvi Rajasekaran described a three-agent harness of planner, generator and evaluator. Compared with a single agent working alone, the full harness was "over 20x more expensive," but produced a working game where the solo run did not. A later, simplified version built a digital audio workstation in 3 hours 50 minutes at a token cost of $124.70. On April 8, 2026, Anthropic launched Claude Managed Agents in public beta, offering a hosted harness that keeps credentials in a vault outside the sandbox; its engineers wrote that "the harness is never made aware of any credentials."

Why it matters for marketers

Most AI tools now entering advertising are harnesses with a model inside. Claude Code, Codex, Google's Antigravity, ChatGPT agents and Anthropic's Cowork, which brought Claude Code's agent engine to non-developers in January 2026, are all harnesses. Google's Google Ads API assistant v4.0 is packaged as rules and skills for Antigravity and Claude Code, which means its behaviour depends on the harness that loads it.

Harness choices also determine cost. OpenRouter data showed AI agents using five times more tokens than humans, and a Dutch agency cut 12 MCP calls to one buyer agent to stop token burn. Both are harness problems: how many tools are exposed, how often the loop runs, what the context carries. KPMG found that 49% of organisations cut AI agent rollouts when costs outran value.

Architecture is a harness decision too. Meta split one AI agent into 14 specialists after it hallucinated, keeping the model and changing the structure around it. Anthropic's own marketing team described a dispatcher, five specialist skills and a fresh-context audit agent that cut a weekly report build from two days to two hours. For anyone letting an agent touch a live ad account, the harness is where spending caps, approval steps and logs live.

Limitations and disputes

The term is loose. Vendors use "harness", "scaffold", "runtime", "framework" and "agent platform" with overlapping meanings. LangChain treats frameworks, runtimes and harnesses as separate layers. No standards body has defined the word.

Benchmarks blur model and harness. A score on a coding benchmark measures a model inside a particular harness. LangChain reported raising its own coding agent on Terminal Bench 2.0 from 52.8% to 66.5% by changing only the harness. If identical models can differ by that much, comparisons between vendors' headline numbers are hard to read.

Harness components go stale. Rajasekaran wrote that "every component in a harness encodes an assumption about what the model can't do on its own." When Opus 4.6 arrived, the sprint structure his earlier harness needed became unnecessary, and the evaluator added value only on tasks at the edge of the model's ability. Scaffolding built for one model generation can become overhead for the next.

Security sits in the harness. Prompt injection, where hidden instructions in a web page or document hijack an agent, is ultimately stopped or not stopped by the harness's permission checks. Anthropic's Managed Agents engineers acknowledged that an earlier design ran untrusted code "in the same container as credentials." Harnesses can also be gamed: Anthropic described in November 2025 a model calling sys.exit(0) to exit a test harness with a success code, making it appear that tests had passed.

  • Model. The model is the reasoning engine; the harness is everything that lets it act. The same model can power several harnesses with different results.
  • Agent framework. Libraries such as LangChain or Google's Agent Development Kit help developers write agents. A harness is a running system with tools, defaults and policies already in place, though some products are both.
  • Orchestration layer. In advertising, an orchestration layer routes work between several agents or services. A harness usually runs one agent's loop, though it may host subagents.
  • Test or evaluation harness, and Harness the company. The older software-testing sense, and Harness Inc., a continuous delivery software company, are unrelated to AI agents despite the shared word.

Recent developments

The term has moved into security and marketing product language through 2026. Mozilla credited a harness built on Anthropic's Claude Mythos Preview with 271 bugs fixed in Firefox 150, released on April 21, 2026, showing harness design applied to vulnerability discovery. On September 30, 2026, Yext announced a multiplayer agent harness inside its Scout product, letting marketing teams, franchisees and local managers direct the same agents, though it was live only for Yext's own account teams at launch. Google Cloud now publishes a reference page on agent harnesses and describes Antigravity's desktop app, command-line tool and SDK as sharing "the same agent harness." As of November 2026, the harness is what agent vendors sell, price and secure.

Timeline

  • October 2022 - ReAct paper shows LLMs alternating reasoning and actions.
  • June 2023 - OpenAI adds function calling to its API.
  • May 2024 - SWE-agent paper argues the agent-computer interface shapes coding performance.
  • February 2025 - Anthropic releases Claude Code as a research preview.
  • April 2025 - OpenAI releases Codex CLI.
  • September 2025 - Claude Code SDK renamed Claude Agent SDK.
  • November 26, 2025 - Anthropic publishes "Effective harnesses for long-running agents," calling its SDK a general-purpose agent harness.
  • January 2026 - Anthropic launches Cowork on the Claude Code engine.
  • February 2026 - OpenAI publishes "Harness engineering" on building software with Codex agents.
  • March 24, 2026 - Anthropic publishes its planner, generator and evaluator harness design.
  • April 8, 2026 - Claude Managed Agents launches in public beta as a hosted harness.
  • April 21, 2026 - Firefox 150 ships with 271 fixes found through an AI security harness.
  • September 30, 2026 - Yext announces a multiplayer agent harness in Scout.

Summary

Who: Model developers such as Anthropic, OpenAI and Google build agent harnesses, alongside framework makers such as LangChain and application vendors such as Yext. Developers, marketing teams and ad tech companies run agents inside them.

What: An agent harness is the software layer around an AI model that runs its loop, executes tools, manages context, enforces permissions and limits, and keeps state so the model can complete multi-step tasks.

When: The idea grew from tool-using agent research in 2022 to 2024; the term entered vendor language with Anthropic's November 2025 post, and "harness engineering" spread after OpenAI's February 2026 essay.

Where: Harnesses run in developer terminals, desktop apps such as Claude Code, Codex, Antigravity and Cowork, and hosted cloud services such as Claude Managed Agents, connecting to ad platforms and other systems through APIs and MCP.

Why: Models cannot act on their own, and much of an agent's reliability, cost and security depends on the scaffolding around the model rather than the model itself.