What is an agent harness? The software that turns a model into an agent

The harness, not the model, is what makes an agent work

If you added an AI coding agent to your team this year, you have already used an agent harness. Most people just never called it that. An agent harness is the software scaffolding around a large language model (LLM) — its tools, memory, sandboxes, and orchestration loop — that turns a model that only produces text into an agent that can take action.

Adoption is moving fast, but full autonomy is not here yet. In Stack Overflow's 2025 developer survey, 84% of developers said they are using or planning to use AI tools in their development process, and 51% of professional developers use them daily — but AI agents are not yet mainstream.

That gap matters for engineering leaders. The model gets the headlines, but the harness is what your team actually ships and maintains. A useful shorthand has taken hold: Agent = Model + Harness.

And the harness is where an agent reaches out and touches the real world — your files, your shell, your APIs, and the open internet. We will come back to that.

What an agent harness actually is

A raw model is stateless. It reads text and writes text, then forgets everything. On its own it cannot run a test, edit a file, or call an API. The harness is what steers the model toward useful, directed work. It gives the model hands, memory, and a feedback loop so it can act, see results, and try again. Over the past year, "harness" became shorthand for everything in an agent except the model itself.

The term is more than vendor shorthand. In the AI harness engineering paper, researchers argue that "software-engineering capability emerges from a model–harness–environment system, in which a runtime substrate—the harness—mediates how a foundation-model agent observes a project, acts on it, receives feedback, and establishes that a change is complete."

The core components of an agent harness

Most harnesses share the same five parts. Each one gives the agent a capability it cannot get from the model alone — and several of them are also trust boundaries, because they connect a text generator to real systems. Keep that in mind as you read.

The orchestration loop (reason → act → observe)

The loop is the engine of the harness. It is often called ReAct, short for Reason and Act. The model reasons about a step, the harness runs the action, captures the result, and feeds it back for the next turn.

A coding agent shows this well. It proposes a fix, the harness runs your tests in a sandbox, and the pass or fail result goes back to the model. If tests fail, the model reads the errors and tries again.

Tools and tool calling (including MCP)

Tools are how the agent does anything real. The model outputs structured JavaScript Object Notation (JSON) that names a tool and its arguments. The harness reads that JSON and runs actual code: an application programming interface (API) call, a file edit, or a shell command.

Connecting tools used to be custom work for every agent. The Model Context Protocol (MCP), an open standard for exposing tools to agents, has become a common way to wire them up. As one example, AURI's MCP server for developers plugs security context into the coding assistants your team already uses.

Memory and context management

Models forget between turns, so the harness rebuilds the working context every time. It decides what the model sees: the task, recent steps, relevant files, and tool results.

Left unmanaged, that context degrades — a problem people call context rot. Good harnesses fight it with compaction, a short-term cache for the current task, and a long-term store for durable memory.

Sandboxes and execution environments

Letting an agent run generated code straight on a real machine is risky. A sandbox isolates that execution so the agent can experiment, install packages, and run commands without touching production or your laptop.

The sandbox is the first component that is plainly a security control, not just a convenience. It also keeps developers moving, because a safe place to run code means fewer manual checks before you let the agent try something.

Guardrails, permissions, and human-in-the-loop

Guardrails decide what the agent may do and when a person steps in. Most harnesses offer permission modes that scale from read-only, to workspace-write, to full access. Lifecycle Hooks can intercept an action right before it runs.

A Hook can catch an agent's npm install, for example, scan the package first, and block it if it is malicious. That pattern, covered in context engineering for security, stops a bad dependency before it lands on a developer's machine.

Harness vs. framework vs. SDK: clearing up the confusion

"Isn't this just LangChain?" is a fair question, and the answer is no. A framework gives you building blocks. A harness is a full runtime with opinionated defaults, and it often uses a framework underneath.

The orchestrator is a third term worth separating out, and it often ships inside a software development kit (SDK). It is the control-flow logic that sequences the reason, act, and observe steps. It lives inside both frameworks and harnesses.

Why the harness matters as much as the model

Raw model scores are starting to plateau. As that happens, harness quality increasingly decides how reliable an agent feels in real work. The same model with a better harness produces materially better results.

Endor Labs' Agent Security League benchmark shows this directly. Across 200 real-world tasks, Cursor with Claude Fable 5 beat Claude Code — Anthropic's own purpose-built harness — on both functional correctness (72.6% vs. 59.8%) and security correctness (29.0% vs. 19.0%). The same pattern held for GPT-5.5, where Cursor outperformed OpenAI's Codex on both measures. A third-party harness beat the labs' own harnesses, running the labs' own models.

NVIDIA's research points the same way. According to NVIDIA's agent harness research in 2026, "Harness design alone can account for double-digit swings in benchmark results and significant differences in token cost, with the same underlying model."

So does academic work. In a UC Berkeley research paper, an arXiv preprint from 2026, the authors state that "future progress in agentic AI will depend as much on system design as on stronger foundation models."

For engineering leaders, the takeaway is practical. Investing in your harness buys speed and reliability that a model upgrade alone will not.

The harness is also your new attack surface

Start with the part your developers feel first: rework. Every component that gives the agent power also gives it a way to make a mess you have to clean up later. Tools run code, sandboxes can leak, memory can be poisoned, and permissions are often too broad.

That is a shipping problem before it is a security problem. Agent output needs the same scrutiny as any other code, or it slows the team down at review. Endor Labs research found that 62% of AI-generated code contains flaws by default.

So the harness is also a trust boundary, which is why a security layer for agents belongs in the design, not bolted on after. The next three sections show where the risk concentrates.

Untrusted input meets real execution: prompt injection

Prompt injection is when hidden instructions in the data an agent reads change what it does. The harness feeds tool outputs, web pages, and files into the model. So an attacker can plant commands in a README, an issue, or a webpage.

The result can be an agent calling real tools with malicious arguments. And this is not a fringe worry — prompt injection is LLM01, the number one entry on OWASP's Top 10 for LLM Applications (2025), from the Open Worldwide Application Security Project.

Every tool and MCP server is a dependency

An MCP server is just software you install — and it concentrates existing risks, such as supply-chain compromise and API abuse, into a single layer. Classic bugs like command injection, path traversal, and server-side request forgery (SSRF) show up in real MCP servers, as covered in why MCP needs AppSec.

Treat every tool and MCP server like any other dependency: vet it, pin it, and monitor it. Endor Labs malware research recorded 13.6x more malware advisories since January 2024. The National Security Agency (NSA) echoes the concern. Its MCP security advisory in 2026 warns that "MCP's rapid proliferation has outpaced the development of its security model."

Scanning what the agent produces

The fastest way to keep an agent from slowing your team is to catch problems inside the loop. The harness already runs tests and linters as feedback sensors, and security scanning should sit right alongside them. That means checking agent-generated code for vulnerabilities, secrets, and risky dependencies before it merges.

This is where AURI fits. AURI is the security harness for agentic software development. It uses full stack reachability to verify which findings are actually exploitable, so developers act only on the ones that are — cutting up to 95% of alert noise without leaving their tools. Endor Labs reports 83% fewer blocked pull requests (PRs) when issues are caught during development, not at review.

Hooks: deterministic control over a probabilistic agent

The fastest way to stop an agent from doing something you have to undo is to check its intent before it acts.

A Hook is a checkpoint the harness exposes at a lifecycle event: before a tool call, a shell command, or a file read or write. At that checkpoint it hands your own code a description of what the agent is about to do. Your code reads back a decision: allow, deny, or modify.

The model decides what it wants to do. The Hook decides whether it gets to.

Because the Hook is deterministic, it is the one deterministic control that a jailbreak cannot talk around. If the policy blocks a command, it blocks it no matter how the model reasons.

The pattern is familiar and proven, not new. Git hooks, pre-commit, and Kubernetes admission webhooks all work the same way — the platform hands control to a script the operator owns at a defined point in the lifecycle.

Hooks are uniquely good at three things:

• Deterministic policy: rules run in code, so a persuasive prompt cannot argue its way past them.
• Centralized audit: every prompt, tool call, shell command, and file read can stream to a Security Information and Event Management (SIEM) system for a forensic record.
• Defense in depth: Hooks are a layered security playbook that complements sandboxes and the model's own safety training rather than replacing them.

That last point matters most in practice. The Hook is the backstop for when native guardrails slip and a model's built-in safety training does not catch the action.

AURI uses hook-based agent governance to wire policy to Claude Code and Cursor lifecycle events. It ships 29 default AI governance policies for risky shell commands, sensitive-file access, and MCP tool calls. And a denial can carry a reason the agent reads, so it corrects course — a learning loop, not just a wall.

How to evaluate or strengthen an agent harness (next steps)

You do not need to rebuild your harness to make it safer and more reliable. Work through a short checklist and fix the weak spots first.

• Set permission tiers: default to deny, and grant write or full access only where the task needs it.
• Sandbox execution: isolate code runs and limit outbound network access so a stray command cannot reach far.
• Vet your tools: treat every tool and MCP server as a dependency you pin and monitor over time.
• Add a security sensor: scan agent-generated code for vulnerabilities and secrets inside the loop, before merge.
• Keep a human in the loop: require approval for high-risk actions like deploys, deletes, and credential use.

Do these in order and you get faster, calmer development first, with fewer surprises at review. Security becomes a capability that helps you ship, not a gate that stops you. For a deeper walkthrough, see how Endor Labs approaches securing agentic coding workflows.

The models will keep improving. But the teams that get the most from agents will be the ones that treat the harness as real engineering — built to be both productive and safe.

What's next?

Book a demo to see how AURI puts a security harness around your AI coding agents.

Frequently asked questions

What is an agent harness?

An agent harness is the software scaffolding around an LLM: its tools, memory, sandboxes, and orchestration loop. It turns a text-only model into an agent that can act.

What is the difference between an agent harness and an agent framework?

A framework like LangChain or LlamaIndex gives you building blocks to assemble yourself. A harness is a full runtime with opinionated defaults, and it often uses a framework underneath.

What are the core components of an agent harness?

The core parts are the orchestration loop, tools and tool calling, memory and context management, sandboxes, and guardrails that set permissions and approvals.

Why does the harness matter more than the model?

As raw model scores plateau, harness quality increasingly decides real-world reliability. The same model with a better harness produces materially better and more consistent results.

Is an agent harness a security risk?

The harness is where an agent touches real systems. Its tools, sandboxes, memory, and permissions form a trust boundary that deserves the same scrutiny as any other code.

What are examples of agent harnesses?

Common coding examples include Claude Code, Cursor, Codex, and OpenHands. Each wraps a model with tools, memory, and an orchestration loop so it can work on real projects.