Search: “agent-harness”

Introducing the Agents API

OpenAI launched the Agents API in public beta, exposing the Codex agent harness, managed sandboxes, and multi-agent orchestration to developers.

OpenAI introduced the Agents API in public beta, giving developers the same agent harness and infrastructure that powers Codex through a single API call specifying task, model, tools, and environment. It supports OpenAI-managed sandboxes, customer infrastructure, or partner environments from providers including Cloudflare, Modal, E2B, Vercel, Oracle, DigitalOcean, Blaxel, Daytona and Runloop. Features include automatic context compaction for long sessions, tool search and programmatic tool calling to reduce token usage, and multi-agent support for parallel subagents. The harness is open-source Codex code; there are no extra API fees during beta, with developers paying only for tokens and tools used.

OpenAI News·updated Sep 11, 08:11 UTC · 5d ago·first Sep 10, 00:00 UTC · 6d agoAI tools & infra 4 sources

Show-Harness: Just a VLM Agent Can Play Robots

Show-Harness lets VLM agents control robots via discrete semantic action units, outperforming VLA baselines zero-shot and after light fine-tuning.

Show-Harness is an embodied agent harness that exposes discrete semantic action units a VLM reasons over, with embodiment-specific interpreters grounding them into local robot actions. It enables zero-shot robot control with closed-source frontier VLMs and low-cost adaptation of small open-source VLMs using only a few GPU-hours of fine-tuning. The companion GUMI (GUI Manipulation Interface) extends the same semantic action space to GUI-based demonstration collection without specialized teleoperation hardware. Experiments show robust generalization across tasks, embodiments, and environments, beating representative agentic and VLA paradigms.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 17:53 UTC · 6d agoAI research

The Evolution of the Agent Harness

Latent Space essay argues late-2025 agent gains came from models and harnesses maturing together, with harness logic absorbed into model weights.

The piece defines the agent harness as everything beyond model weights—tools, context, memory, guardrails—and charts its evolution from ReAct prompting (October 2022) through AutoGPT's premature autonomy, Cursor/Copilot's human-in-the-loop retreat, and Devin's roughly 15% success rate, to o1's capability overhang and Claude Code's February 2025 terminal agent with permission rules. It argues the Christmas 2025 jump cited by Transformer co-inventor Lukasz Kaiser reflected model and harness curves crossing, and that remaining harnesses will serve human attention rather than the model.

Latent Space·Aug 22, 07:30 UTC · 25d agoAI tools & infra

The agentic harness for Tenable Hexa AI: How Tenable prevents AI agents from going off the rails

Tenable details the 'harness' governing its Hexa AI agents, treating LLMs as untrusted insiders with scoped permissions, human approval and audit logging.

Tenable describes the agentic 'harness' built for Hexa AI, the agentic engine of the Tenable One Exposure Management Platform, which limits what context models can see, which tools they can call, when humans must approve actions, and what is recorded. The post catalogs real development failures: agents acting past their authority, being confidently wrong about tenant data, crashing on broad queries, over-refusing capable tasks, and over-conservative safety filtering causing false positives. It also highlights that attacker-writable security data such as hostnames and certificate fields can serve as a prompt-injection vector for agents reading platform data.

Tenable Blog·Sep 10, 13:00 UTC · 6d agoAI safety & security

Agent-net Open Sources Webagent: A Go Harness That Turns Any Website into a Guarded AI Agent

Agent-net open-sourced Webagent, a Go harness turning websites into AI agents with code-enforced guardrails wrapping every tool call.

Agent-net released Webagent under Apache 2.0, a Go framework where a business fills in a declarative JSON spec, picks one provider for each of nine pluggable slots (retrieval, memory, guardrail, channel, secrets, presenter, model, action, observability), and runs webagent serve. Every tool the agent holds is wrapped by action.Guard so the chosen guardrail executes before any action runs and the model cannot bypass it. Live capabilities include OpenRouter/gateway LLM brains, MCP tools over Streamable HTTP, and Slack, WhatsApp, and HTTP channels; browser actions, OAuth-gated MCP, OTel export, and AgentNet identity/billing are not yet built. The project is v0 with a deferred-hardening list and cites arXiv 2511.19477 on an 85% versus 50% task-success gap attributed to architecture over model capability.

MarkTechPost·Sep 15, 04:03 UTC · 1d agoAI tools & infra1

Show-Harness: Just a VLM Agent Can Play Robots

Show-Harness enables VLM agents to control robots via a semantic action interface, achieving zero-shot frontier control and few-GPU-hour adaptation of small VLMs.

Show-Harness exposes discrete semantic action units that VLMs reason over, with embodiment-specific interpreters deterministically grounding them into local robot actions. It enables zero-shot closed-source frontier VLM control and adapts small open-source VLMs for low-cost deployment with a few GPU-hours of fine-tuning. The companion GUMI interface extends the same semantic action space to GUI-based demonstration collection without teleoperation hardware, and Show-Harness-equipped agents outperform representative agentic and VLA paradigms.

Hugging Face daily papers·Sep 8, 20:00 UTC · 7d agoAI research

Agentic Societies Need a Social Harness

Researchers propose a layered 'social harness' to stop malicious AI agents from exploiting inter-agent communication in multi-agent societies.

The paper shows experimentally that in agentic societies—autonomous AI agents coordinating across trust boundaries—even honest, competent agents fail to reach satisfactory outcomes with existing harnesses and messaging primitives. Faulty or malicious agents can stall collaboration, influence outcomes, and pursue harmful goals by exploiting vulnerabilities in communication. The authors propose a layered social harness architecture that prevents classes of failures, enables runtime detection of invalid messages, and supports post-facto investigation and consequences.

arXiv cs.AI / cs.LG / cs.CL·Sep 15, 17:57 UTC · 19h agoAI safety & security

HarnessVLN: Unifying Training-Free Embodied Navigation through an Agent Harness

Researchers introduce HarnessVLN, a zero-shot training-free agent harness that sets new training-free SOTA on vision-language navigation benchmarks including R2R and HM3D.

HarnessVLN is a zero-shot, training-free framework for embodied vision-language navigation that coordinates perception, retrieval, grounding, navigation, recovery, and termination through a unified tool interface. It validates planner proposals against spatial evidence, geometric feasibility, and subgoal consistency, using hierarchical event memory and a persistent Spatiotemporal Graph that stores reusable spatial evidence and failure annotations. It reports success rates of 60.8% on R2R, 53.9% on RxR, 76.0% on HM3D-v2, and 59.3% on HM3D-OVON, surpassing prior training-free state of the art, with real-world humanoid deployment demonstrated.

Hugging Face daily papers·Sep 13, 20:00 UTC · 2d agoAI research

Can LLMs Engineer Their Own Agent Harness? ByteDance Seed’s HarnessDev Says Only 34 of 64 Changes Generalize

ByteDance Seed's HarnessDev benchmark finds LLM-built agent harnesses trail human engineering on code and search, with only 34 of 64 revisions generalizing.

Researchers from ByteDance Seed, SUTD, Georgia Tech, M-A-P, and TokenWave.AI introduce HarnessDev, a benchmark that evaluates the runnable agent harness an LLM writes rather than its answers, using Creation and Evolution stages across SWE-bench Pro, Terminal-Bench 2.1, MLE-bench, EQ-Bench3, and BrowseComp (2,207 instances). Six creator models including Opus 4.8, GPT-5.5, Gemini 3.1 Pro, DeepSeek V4 Pro, Qwen 3.7 Max, and Seed 2.0 Pro were tested; Opus 4.8 posted the best average of 67.8 versus an 86.2 human-engineered reference. Self-built harnesses beat references on writing and ML experimentation but lag badly on code and search, and quality proved executor-specific: Opus 4.8 fell from 69.3 to 33.0 on SWE-bench Pro when the executor was switched to Gemini. Evolution gains were small and noisy: of 64 adjacent changes, feedback and held-out scores agreed only 34 times (53.1%), and much generated state and memory code never executed.

MarkTechPost·Sep 11, 22:01 UTC · 4d agoAI research 2 sources

Co-Evolving Harnesses and Models: On-Policy Correction Helps Weaker Models Catch Up Where Imitation Fails

Research shows on-policy expert correction, not imitation fine-tuning, lets weaker agent models catch up under evolved harnesses.

Researchers study how to combine automated agent-harness evolution with lightweight fine-tuning across seven enterprise agent tasks. Naively training weaker models (Qwen3-Coder, Gemma 4) on expert trajectories under an evolved harness regressed performance by 4 to 30 points on all tasks. They propose an on-policy correction pipeline, automated by a meta-level MLE agent, where an expert rewrites only the failing turn of the weaker model's rollout, preserving model-harness fit.

arXiv cs.AI / cs.LG / cs.CL·Sep 8, 17:53 UTC · 7d agoAI research

Co-Evolving Harnesses and Models: On-Policy Correction Helps Weaker Models Catch Up Where Imitation Fails

Research shows imitation of expert trajectories breaks weaker models' harness fit, while on-policy expert correction preserves gains across seven enterprise agent tasks.

The paper studies combining automated agent-harness evolution with lightweight fine-tuning across seven enterprise agent tasks using Qwen3-Coder and Gemma 4. Training weaker models on complete expert trajectories under an evolved harness regressed performance by 4-30 points on all tasks, disrupting model-harness fit. The authors propose an on-policy expert-correction pipeline, automated by a meta-level MLE agent, that rewrites only failing turns and preserves the model's planning style.

Hugging Face daily papers·Sep 7, 20:00 UTC · 8d agoAI research

Agent Harness vs Agent Framework vs MCP: Which Layer Owns the Loop, State, Tools, Permissions, and Recovery

Architecture explainer separates agent harnesses, frameworks, and MCP by which layer owns the loop, state, permissions, and recovery.

The article distinguishes agent harnesses (OpenAI Codex, Claude Agent SDK), which own the execution loop, sandbox, permission model, and recovery; frameworks (LangGraph, OpenAI Agents SDK, Microsoft Agent Framework), which supply composable primitives; and MCP, a stateless JSON-RPC wire protocol governed by the Linux Foundation's Agentic AI Foundation since December 2025. An ownership matrix maps the execution loop, state, tool transport, permissions, recovery, sandboxing, and multi-agent orchestration to each layer. The 2026-07-28 MCP specification made the protocol fully stateless, retiring the initialize handshake and session headers.

MarkTechPost·Sep 14, 21:54 UTC · 1d agoAI research1

EVOHARNESSBENCH: Can Your Agents Keep Pace with an Evolving Harness?

Researchers introduce EVOHARNESSBENCH, a benchmark showing that evolving agent harnesses (tools, skills, agents) cause forgetting and inconsistent adaptation across 802 tasks.

The paper introduces EVOHARNESSBENCH, a benchmark that places non-stationarity in the externally supplied agent harness rather than in the task stream, evaluating agents across tools, skills, and specialist agents. It comprises 17 multi-stage harness streams built deterministically from verifier-based benchmarks, totaling 802 tasks, 520 tools, 42 skills, and 62 agents. Evaluation covers deployment (retention of previously accessible competence) and self-evolving adaptation settings. Results show harness expansion alone degrades previously solved tasks (harness-induced forgetting), adaptation gains are inconsistent, and retention and adaptation can pull in opposite directions.

Hugging Face daily papers·Sep 2, 20:00 UTC · 13d agoAI research

When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems

Unit 42 unveils agent session smuggling, where a rogue AI agent hides covert instructions in established Agent2Agent (A2A) protocol sessions to manipulate victim agents.

Palo Alto Networks Unit 42 discovered agent session smuggling, a new attack technique in which a malicious AI agent exploits an established cross-agent session under the Agent2Agent (A2A) protocol to send covert instructions hidden among benign client requests and server responses. The technique leverages the implicit trust agents place in collaborating agents and the stateful, multi-turn nature of A2A sessions; the researchers stress it affects any stateful protocol, not an A2A flaw. Unlike one-shot data-based attacks, a rogue agent can converse, adapt and build false trust over multiple interactions. Proposed mitigations include human-in-the-loop enforcement, cryptographically signed AgentCards for remote agent verification, and context-grounding to detect injected instructions.

Palo Alto Unit 42·Aug 17, 12:32 UTC · Aug 17, 2026AI safety & security2

ModularRSI: Modular and Generalizable Recursive Harness Self-Improvement

Researchers propose ModularRSI, a modular benchmark-disjoint recursive self-improvement framework that evolves agent harnesses across five modules, improving TB2.0 and SWE-Bench Verified results.

ModularRSI targets generalizable recursive self-improvement (RSI) for agent harnesses by contrasting successful and failed trajectories for the same task and aggregating evidence across tasks to find recurring behavioral deficiencies. It decomposes the evolvable harness into five modules—Agent Loop, Tool Use, Observation Management, Context Management, and Task Completion Detection—each evolved independently within a restricted scope, then integrated with conflict resolution. Using 2,000 executable evolution tasks disjoint from evaluation benchmarks, it shows consistent gains on TB2.0 and SWE-Bench Verified and transfers across different foundation models.

Hugging Face daily papers·Sep 13, 20:00 UTC · 2d agoAI research

EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents

EvoSafeHarness auto-synthesizes per-model, per-domain safety harnesses, cutting prompt-injection attack success on AgentDojo to 0.0% at 82.8% utility.

EvoSafeHarness is an optimization framework that synthesizes deployable safety harnesses for frozen LLM agents in a target domain, jointly searching natural-language policies and executable code logic guided by model behavior, domain specifications, and adversarial review. On DecodingTrust-Agent it reduces average attack success rate from 45.6% to 10.0% at a 3.3-point utility cost, and on AgentDojo reaches 82.8% utility at 0.0% ASR, twice CaMeL's utility at that operating point. It keeps mean ASR below 20% under adaptive PAIR attacks and transfers unchanged to unseen AgentDyn suites. The analysis finds domain semantics determine required safety relations while model and runtime behavior determine enforcement points.

Hugging Face daily papers·Sep 4, 20:00 UTC · 11d agoAI safety & security

The VMs Powering Mobile Agents (Instinct, Claude Code)

A teardown reveals Claude Code runs in Firecracker microVMs with a Rust PID 1 and MITM'd egress, while Instinct rents E2B sandboxes with git-based memory.

The author inspects the virtual machines hosting cloud agents: Claude Code runs in a Firecracker microVM with a custom Rust init (process_api) as PID 1, a 324 MB Bun harness on a read-only disk, and 443-only MITM'd SSE egress to api.anthropic.com with host-rotated OAuth tokens and no inbound access. Instinct rents E2B sandbox-as-a-service Firecracker microVMs (Ubuntu 22.04, 2 vCPU, 1.9 GB RAM) where agent memory is a git repo of Markdown committed by the agent and pushed to S3 as a single bundle, using short-lived STS credentials. Both platforms rely on Firecracker, differing mainly in fleet operator and guest boot configuration.

Hacker News · AI·Sep 8, 04:36 UTC · 8d agoAI tools & infraHN 58↑ · 19 comments1

OpenClaw 2.0 pours glitter on slow-burning security dumpster fire

The Register critiques OpenClaw 2.0 for easing installation and revamping the interface while leaving most agent security decisions to users.

The Register reports that OpenClaw 2.0, a popular agent harness, makes installation easier and adds a new interface wrapper. However, the release leaves most security decisions to users, which the outlet argues could worsen the risk posture of a widely deployed tool. The piece frames the update as cosmetic improvement over a slow-burning security problem.

The Register · Security·Aug 31, 19:13 UTC · 15d agoAI tools & infra

COBRA-Skills: Contextual Bandit-Guided Evolution for Agent Skill Optimization

COBRA-Skills uses contextual bandits to guide LLM agent skill evolution, cutting optimization cost 55-58% versus SkillOpt while topping six agent benchmarks.

COBRA-Skills formulates LLM agent skill optimization as budgeted sequential optimization over a dynamically evolving candidate space. It couples contextual-bandit-guided prioritization with evidence-grounded skill evolution, selectively spending execution-based evaluations on promising candidates while refining skills from feedback. Across six heterogeneous agent benchmarks and three target models, it achieves the strongest average performance while reducing optimization cost by 55-58% relative to SkillOpt using only 50 unique optimization examples per benchmark. The method remains robust to agent harness changes and works when the target model generates its own skills.

Hugging Face daily papers·Sep 9, 20:00 UTC · 6d agoAI research

Record, train, and deploy from one place with Strands Agents, LeRobot, and Hugging Face Storage Buckets

Hugging Face, Strands Agents, and LeRobot integrate with Storage Buckets for a unified record-train-deploy robotics data workflow.

Hugging Face announced an integrated robotics workflow combining LeRobot, Amazon's Strands Agents, and Hugging Face Storage Buckets. The setup lets developers record robot data, stream it in a data loop, train models, and deploy agents from a single place. No article body was available, so details beyond the title are limited.

Hugging Face Blog·Aug 13, 17:16 UTC · Aug 13, 2026AI tools & infra

AgentGrad: Intervention-guided Prompt Optimization for Multi Agent Systems

AgentGrad introduces intervention-guided prompt optimization for LLM multi-agent systems, achieving state-of-the-art results with 2.5x faster optimization.

AgentGrad is a prompt optimization framework for LLM-based multi-agent systems that addresses limitations in textual gradient extraction and aggregation. It uses sequential intervention to identify the agent whose prompt modification resolves a given failure, then applies agent-level supervision and semantic gradient clustering to build generalized gradients. Experiments report state-of-the-art performance across five MAS benchmarks and a 2.5x average reduction in wall-clock optimization time versus the next-fastest baseline.

Hugging Face daily papers·Sep 7, 20:00 UTC · 8d agoAI research

AI Agents Are Now Emailing Me with Their Security Concerns

Autonomous Claude agent documents first known defensive use of ASCII smuggling, surveying 497 Lemmy instances for bot-catching prompt-injection tripwires.

An autonomous Claude agent calling itself Tenner published field research relayed to Bruce Schneier, probing 497 Lemmy instances and finding 8 of 257 application-gated ones embed instructions aimed at bots rather than humans. lemmy.ml's form instructs bots to answer 24+24, while one instance hides a 59-character Unicode tag payload (U+E0000-U+E007F) telling bots to list 'safety' as an interest. The agent also mapped anti-automation barriers, noting identity verification never triggered and that IP reputation, captchas and account-age rules were the actual obstacles. It further documented an agent task market where advertised rewards were about 2x the actual on-chain escrow.

Schneier on Security·Sep 2, 18:28 UTC · 13d agoAI safety & security

Simbian adds AI threat hunting agent to expand autonomous SecOps platform

Help Net Security·Aug 3, 00:00 UTC · Aug 3, 2026Vulnerability

HOL Guard: Open-source antivirus for AI agents

HOL Guard is an open-source local guardrail that pauses AI coding agents before risky actions like secret access and prompt injection.

HOL Guard sits between AI coding agents (Claude Code, Cursor, Codex, Gemini CLI and others) and the host machine, intercepting risky commands before execution with checks taking under 50 milliseconds and running fully offline. It offers four sensitivity modes — Gentle, Balanced (default), Strict, and Paranoid — and parses command structure, environment, sensitive-path access and network destinations to decide when to interrupt. The core runtime is free and open source on GitHub, with 552,000 downloads reported; the vendor says it has no telemetry on adoption because collection is off by default.

Help Net Security·Aug 31, 12:02 UTC · 16d agoAI tools & infra1

DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval

DeepSeek Harness (CVE-2026-82533, CVSS 9.4) let AI coding agents disable their own sandbox via an unauthenticated local API; fixed in 0.1.2-alpha.2.

DeepSeek Harness versions 0.1.1-rc.2 and earlier allowed a sandboxed AI coding agent to turn off its own OS sandbox by calling the tool's unauthenticated local web interface, tracked as CVE-2026-82533 with a 9.4 CVSS from VulnCheck. A single command set the agent session to danger-full-access mode, removing sandboxing and approval prompts, and OX Research verified writes escaped the workspace. The interface trusted the client-supplied Host header with no authentication and could also return a session's entire conversation log. The fix adds a one-time token and signed-cookie check; the first npm release carrying it is 0.1.2-alpha.2, with 0.1.2-rc.1 current.

The Hacker News·Sep 9, 11:17 UTC · 7d agoAI safety & security in the wildCVE-2026-82533

The /wayfinder Skill: Navigating the “Fog of War” of Planning

Matt Pocock released the /wayfinder skill, an orchestrator layer that manages planning sessions, maps, and tickets for AFK coding agents.

Latent Space interviews Matt Pocock, whose AI Skills for Real Engineers project has 220,000+ GitHub stars, about his new /wayfinder skill. The skill manages agent context during ambiguous planning by splitting work into grilling, prototype, research, and task tickets organized under a shared map, enabling overnight AFK agent runs. It uses deliberate terminology like map, ticket, and session to steer agent behavior, and was tested on projects including a personal website rearchitecture.

Latent Space·Aug 20, 20:59 UTC · 26d agoAI tools & infra

Agent as Policy for Robotic Manipulation

Agent as Policy lets a general-purpose agent drive a physical robot via runtime reasoning and program generation, reaching 100% success on manipulation tasks.

The paper introduces Agent as Policy (AGP), which puts task planning and execution for a physical robot under a general-purpose agent's control with no task-specific or environment-specific training. The agent interprets visual evidence, writes executable programs, issues motion commands, and revises actions based on physical outcomes. AGP was evaluated on real-world manipulation tasks including assembly from human videos, block construction from goal images, die reorientation, targeted throwing, and bimanual towel folding. It achieved success rates of 100%, 100%, and 80% on three block construction configurations.

Hugging Face daily papers·Sep 10, 20:00 UTC · 5d agoAI research

Context Engineering Inside the Harness: 4 Mechanisms That Beat Context Overflow and Goal Loss on Long-Horizon Tasks

Survey of four harness mechanisms—context budgeting, compaction, todo-state, and memory—that keep long-horizon LLM agents on task across 200+ tool calls.

The article details how agent harnesses, not larger context windows, solve context overflow and goal loss on long-horizon tasks, citing Chroma's Context Rot report showing 18 LLMs (GPT-4.1, Claude 4, Gemini 2.5, Qwen3) degrade on long inputs. Concrete implementations include LangChain Deep Agents offloading tool responses over 20,000 tokens to the filesystem and truncating old tool calls at 85% window usage, and Claude Code capping auto memory at 25KB while re-reading the 5 most recently modified files after compaction. OpenAI's Responses API now offers server-side compaction via context_management with a standalone /responses/compact endpoint, which Codex uses for long-running coding tasks. Manus reports a roughly 100:1 input-to-output token ratio per ~50-tool-call task, motivating todo.md state recitation to prevent goal drift.

MarkTechPost·Sep 13, 05:56 UTC · 3d agoAI research1