The teams getting the most out of AI coding agents keep reaching the same conclusion: performance depends less on the model or the prompt than on the harness, the environment around the agent that provides its tools, permissions, tests, logs and limits. OpenAI, Anthropic and LangChain have all published experiments in recent months that back this up, and most of what they describe is systems work: reproducible environments, observability, version control, automated validation and isolation. For a system administrator, the harness looks far more like infrastructure than prompt engineering.

AI agent harnesses in 30 seconds

The harness is everything around the model in an AI agent: tools, permissions, context, tests, logs and execution limits.
LangChain gained 13.7 points on Terminal Bench 2.0 with the same model, by changing only the harness around it.
OpenAI and Anthropic fixed their agents’ failures by improving the environment, not by writing better prompts.
Observability, reproducible environments, isolation and automated checks are classic sysadmin territory, though the model still sets the ceiling.

In an agent such as Claude Code, Codex or Cursor, the language model decides what to do, but the harness determines what it can do it with, what information it receives at each step, how the result is checked and when it is stopped. The system prompt is only one part of it. The rest includes instruction files such as AGENTS.md, the way progress is saved between sessions, the tests that decide whether a task is done and the rules that halt the agent when it gets stuck in a loop. The question for infrastructure teams is which of those pieces end up on their desk.

What the data shows

LangChain kept the GPT-5.2-Codex model fixed and changed only the harness of its Deep Agents agent. On Terminal Bench 2.0, a set of 89 terminal tasks, its score rose from 52.8% to 66.5%, taking it from outside the top 30 to the top 5. None of the changes was a cleverer prompt. At startup the agent now gets a map of its working directory and available tools, it is told that its work will be checked by tests and how much time it has left, it runs a verification checklist before finishing, and a counter flags when it keeps editing the same file. The most common failure before those changes was simple: the agent reread its own code, decided it looked fine and stopped. LangChain also analysed execution traces at scale to decide what to fix.

In February, OpenAI described an internal product of around one million lines of code written entirely by Codex, with a team of three to seven engineers and about 1,500 pull requests over five months. Anthropic explained in November 2025 how it stopped its agents from trying to build everything at once or declaring a half-finished project complete: a progress file, a feature list in JSON, git as a safety net and testing through browser automation. An academic paper from June, Self-Harness, goes further and lets the agent improve its own harness using regression tests, reporting relative gains of up to 132%.

The parts of the harness that are systems work

Reproducible environments. Anthropic has its first agent create a script that starts the development environment, so each new session does not waste time and tokens working out how to run the application. OpenAI goes a step further: its application can boot a separate instance for each git worktree, letting several agents work in parallel without stepping on each other. It is the same goal sysadmins pursue with containers, templates or infrastructure as code.

Observability for the agent. In OpenAI’s project, Codex queries logs, metrics and traces from an ephemeral local observability stack and drives the user interface through the Chrome DevTools Protocol. An agent that cannot see what happens when its code runs ends up guessing. Traces work in the other direction too: they were LangChain’s main tool for understanding where its agent failed.

Automated validation. OpenAI uses custom linters and structural tests to enforce its architecture, dependency direction and logging format, and the error messages include instructions telling the agent how to fix each problem. It is continuous integration written for a machine to read.

Version control as memory. In Anthropic’s harness, the agent reads the git history and the progress file at the start of each session, commits with descriptive messages and leaves the repository in a clean state. Git also lets it roll back bad changes and recover a working state.

Documentation inside the repository. OpenAI first tried a single, very long instruction file and it failed: it crowded out context, went stale and was hard to verify. The team replaced it with an AGENTS.md of about 100 lines that works as an index to a documentation folder. Anything that lives outside the repository, such as chat threads or the team’s tacit knowledge, does not exist for the agent. Claude Code users will recognise the same pattern from CLAUDE.md and its hierarchy of rules.

Permissions, isolation and limits

None of these experiments focuses on security, but a harness is also the boundary of what an agent can touch. Giving it access to a terminal, a database or a browser means deciding which user it runs as, which network it sees, which secrets are within reach and what happens if it deletes something it should not. That is why tools such as ArcBox, which runs Claude Code inside a microVM, and minimalist approaches such as Pi Agent are appearing. The time limits, reasoning budgets and edit counters LangChain uses are, in practice, quotas.

There are caveats. The model still sets the ceiling, and LangChain warns that each harness has to be tuned to each model, so switching models may mean revisiting the environment. OpenAI acknowledges that its level of autonomy depends on tooling specific to that repository and that it is not yet clear how the architecture will age. Many of these pieces also compensate for current model weaknesses, so they should be reviewed over time, the same way an obsolete configuration gets retired. For a practical starting point, this guide on Claude Code and GitHub is still useful.

Frequently asked questions

What is an AI agent harness?

It is the environment around the language model: the tools it can use, the context it receives, its permissions, the tests that validate its work, memory between sessions and execution limits.

Why does it matter to system administrators?

Because much of the harness is infrastructure: reproducible environments, observability, continuous integration, version control, isolation and access control.