Definition
Agent harness is an agent harness is the software wrapped around an AI model that runs its loop, executes its tool calls, manages its memory and context, and enforces limits, turning a model into an agent.
An agent harness is everything around the model that makes it act. The model only reads text and writes text. The harness is the program that takes what the model asks for, does it, and hands back the result.
A model can say "run this search" or "edit this file," but it cannot do either on its own. The harness:
A common shorthand is agent = model + harness. Some writers say "scaffold" for the same idea, and the exact boundary varies from source to source.
Think of the model as a very capable contractor who can only talk. The harness is the site manager who passes along the instructions, hands over the tools, writes down what was done and can pull the plug. Swap the contractor and the site manager still works. Fire the site manager and nothing gets built.
Two agents running the same model can behave very differently because their harnesses differ. Much of what people call an agent's quality is harness quality: how well it recovers from errors, how much it remembers and how it checks its own work.
The harness is also where safety belongs. A rule written in a prompt is a request. A rule enforced in the harness, such as a blocked domain, a spending cap or a required human approval, holds even if the model misbehaves. That is why careful builders keep permissions and logs somewhere the model cannot edit, often inside an agent sandbox.
An AI agent is the combined system. The harness is its non-model half. AI guardrails are checks that usually run inside or beside the harness. A framework is a library of parts for building harnesses, while an orchestrator manages several agents, each with a harness of its own.
Ask what the harness lets the agent do without asking you, where its logs go, whether you can stop a task mid-step, and which of its limits depend on the model behaving. If you can answer those four, you understand your agent better than most people running one.
It is the code that wraps an AI model so it can act: it runs the loop, executes tool calls, manages memory and context, and enforces limits.
The model reads and writes text. The harness turns that text into actions, feeds results back and applies permissions and logging.
Microsoft CEO Satya Nadella called on Saturday for an AI "emergency brake": controls outside the model, tamper-proof logs and a human who can stop a task mid-run. Treat it as a checklist for your own agents, not a press line.
A developer says Claude and Codex agents rebuilt a popular first-person shooter as C++ over about three months, with 83% of functions byte-exact. The game is the headline. The locked test harness that kept the agents honest is the part to copy.
CrowdStrike says a likely Chinese-speaking, financially motivated actor ran ARTEX, an open-source agentic pentest tool, against South Korean financial firms from late September, and cites industry reports of breaches at two banks. The model under it was swappable, and that is the warning.