What Is an AI Agent Harness?

An AI agent harness is the code that sits between a language model and the systems it works on. On its own a model only maps text to more text. The harness gives it a job loop: build the prompt, send it, read any tool calls in the reply, run them, return the results, and repeat until the task is finished or a limit ends the run.

The term has moved from research write-ups into vendor documentation. Anthropic’s engineering team calls the Claude Agent SDK a general-purpose agent harness in its post on long-running agents, and the Agent SDK documentation describes Managed Agents as a hosted harness that runs the agent loop inside a sandbox. When people search for an agent harness, they usually mean a ready-made agent application of this kind rather than a library.

Most harnesses share five jobs. The control loop decides when to call the model, when to stop and how to recover from a malformed reply. Tool execution turns a model request into a shell command, a file edit, a browser action or an API call. Context and memory management chooses what goes into each prompt, compacts long sessions and keeps what should survive between them. Permissions and sandboxing sort actions into those that run automatically, those that wait for a human, and those that are refused. Channels and interface connect the agent to wherever people talk to it, from a terminal or IDE to a desktop app or a messaging service.

Because these jobs live outside the model, the same model can behave very differently in two harnesses. One compacts context aggressively and drops a detail; another keeps a durable progress file and resumes cleanly the next day. Anthropic’s long-running-agents write-up is mostly about such choices, including structured progress notes, working on one feature at a time and end-to-end tests before moving on. That discipline is often called harness engineering, and a large share of an agent’s reliability comes from it.

The four terms overlap in marketing copy, so anchor each one to what you do with it. An agent framework is a library you build with: LangGraph or CrewAI hand you primitives and you write the application. An agent runtime is the execution environment that runs agent loops as a service, with state, retries and limits. A harness is a finished agent application you install and point at work, with its loop, tools, permission model and interface already chosen. An agent platform is a multi-tenant, governed system in which many teams build, run and audit many agents under shared identity, policy and evidence.

The edges blur. A harness can be packaged as a library, which is what the Claude Agent SDK does with Claude Code’s loop and tools, and every platform contains a runtime. The practical test is the trust boundary. Harnesses are usually built for one operator or a team whose members trust each other; OpenClaw’s security guide states that each gateway is one trust boundary and not a hostile multi-tenant boundary, and recommends a separate gateway when users do not trust each other. A platform is built for many principals who do not share trust, so identity, tenant separation and audit have to be designed in from the start.

OpenClaw is an MIT-licensed personal assistant maintained by the OpenClaw Foundation, a 501(c)(3) nonprofit. A local Gateway acts as its control plane for sessions, tools, events and channel connections, and people reach it through messaging apps including WhatsApp, Telegram, Slack, Discord, iMessage and Microsoft Teams. It works with hosted and local model providers and is extended with skills and plugins, many of them shared through the ClawHub registry.

Hermes Agent from Nous Research is also MIT-licensed. Its defining feature is a learning loop that writes new skills after complex tasks and refines them in use, and its documentation says its skills are compatible with the agentskills.io format. It keeps agent-curated memory with full-text session search, talks through Telegram, Discord, Slack, WhatsApp, Signal, email or the CLI, and can execute commands locally, in Docker, over SSH or in hosted sandboxes such as Modal and Daytona.

Claude Code is Anthropic’s coding agent. Its built-in tools, hooks, subagents, MCP connections, sessions and permission rules are also exposed as the Claude Agent SDK, so the same harness can be embedded in another application that its owner operates.

OpenAI Codex CLI is an Apache-2.0 coding agent that runs in the terminal. It confines commands with operating-system mechanisms, Seatbelt on macOS and bubblewrap on Linux, and offers three sandbox modes: read-only, workspace-write (the default for local work) and danger-full-access, which removes the filesystem and network boundaries.

OpenCode is an MIT-licensed coding agent with a terminal UI, a desktop app and an IDE extension. It can use more than 75 model providers, including local models served by Ollama, LM Studio or llama.cpp, and its permission settings mark each tool as allow, ask or deny, with most tools set to allow unless configured otherwise.

Start with the trust boundary. A harness acts with the credentials of whoever started it, on the machine where it runs. If several people can message one instance, all of them borrow that authority. Establish whether the tool assumes a single trusted operator, and whether your deployment actually has one.

Next come tool permissions. Defaults vary widely between projects: Codex CLI starts local work in a workspace-write sandbox, OpenCode allows most tools unless told otherwise, and OpenClaw runs tools on the host unless sandboxing is configured, with exec approvals available for shell commands. Those defaults suit individual productivity. An organization needs the restrictive setting to be the one that ships, with approvals for writes, deletes and network egress.

The skill and plugin supply chain is the newest exposure. Skills are instructions and scripts an agent loads and follows, so a malicious skill behaves like code running with the agent’s permissions. In February 2026 Koi Security reported 341 malicious skills among 2,857 it audited on ClawHub, 335 of them from one campaign that used fake prerequisites to install the Atomic Stealer macOS infostealer (coverage of the Koi findings). The lesson applies to any harness with a public registry: pin, review and allowlist skills as you would software packages.

Audit and patching close the loop. Harnesses increasingly keep their own records; OpenClaw’s audit ledger, for example, stores metadata only, is capped at 100,000 activity rows and returns records from the last 30 days. Compare that depth and retention with what your auditors need to reconstruct a decision. The owner of each installation also applies security fixes; OpenClaw’s advisory GHSA-g8p2-7wf7-98mq, a high-severity token-exfiltration flaw in the Control UI, was fixed in v2026.1.29, and every running copy needed that upgrade.

Vendors are also shipping isolation layers around harnesses. NVIDIA announced NemoClaw on 16 March 2026 as a stack for OpenClaw users that installs Nemotron models together with OpenShell, a runtime that places agents in an isolated sandbox.

A harness is often the right tool for a developer or a small team working on its own code with its own credentials. The calculation changes once the agent touches shared systems, regulated data or customers. The open questions then concern identity, separation of duties and evidence, and those belong to a governed agent platform rather than to one workstation.

A workable rule of thumb: if the deployment is one person, one machine and one set of keys, a well-configured harness with a sandbox and an allowlisted skill set may be enough. If the answer involves several teams, a service account or a regulator, plan for agent governance controls that sit outside the agent itself, such as per-role tool grants, approval gates and an audit trail kept where the agent’s operator cannot edit it.

Four layers that are often confused. The right-hand column is where most enterprise controls end up.