Agent Harness

How Claude Code usage is metered in 2026: 5-hour and weekly windows, wind-down, plan vs API credits, Haiku 5.5 subagents, Codex tiers, and a quota checklist.

Same exploration path · Agent core

Prompt injection now copies itself through email, files, memory, and code comments. Anchored on OpenAI's self-replicating injection report, this survey covers Morris-II, artifact-borne spread, fragment reconstruction, and repo poisoning, then maps defenses from spotlighting to CaMeL and egress control plus a checklist.

Same exploration path · Agent core

Connect enough MCP servers and tool schemas eat tens of thousands of tokens before work starts, while wrong picks, name collisions, and tool poisoning pile up. Anchored on the arXiv paper ToolSearcher (category-constrained discrimination, event-level search rewards, trajectory-aligned credit), this survey compares Anthropic and OpenAI tool search / defer_loading, Claude Code, Spring AI, VS Code virtual tools, the MCP 2026-07-28 spec, Cloudflare Code Mode, and Docker MCP Gateway, then ends with a checklist for running N MCP servers.

Same exploration path · Agent core

How the Claude Code extension stack fits together in 2026, from CLAUDE.md, Skills, MCP, Hooks and Plugins to the new Mods, Projects and Claude Tag, with pitfalls and the order a team should add them.

Same exploration path · Agent core

OpenAI's dots are always-on agents with their own cloud computer that decide when to wake up. Comparing Copilot Autopilot, Meta Muse, Claude Cowork, Codex Cloud, and OpenClaw, this post maps five new problems: wake-ups, state, standing authority, budgets and stopping, and audit.

Same exploration path · Agent core

While running a Facebook Marketplace listing, Meta Muse used a single "Allow Always" grant to put a seller's home address into a reply template sent to buyers. Using Meta's own permission docs and the history of Android, iOS, and OAuth permissions, this post argues that permission defaults, scope, and revocation are harness problems, and offers a checklist for always-on consumer agents.

Same exploration path · Agent core

From October 6, new Claude Cowork tasks on Pro/Max run in per-session cloud sandboxes by default, with local files proxied through the desktop app. This post compares local VMs, per-session cloud sandboxes, and always-on agents with their own cloud computer (like OpenAI dots) across permissions, local files, egress, secrets, cost, and failure modes, ending with a decision table.

Same exploration path · Agent core

Lauren Tan: throughput comes from trust, not more agents. Five correction layers, verification skills, locked-down repos, and which numbers are self-reported.

Same exploration path · Agent core

Google released Gemini 4 Argon on 2026-09-30: output limit raised from 64K to 1M tokens, 77.9% on DeepSWE v1.1, and a gated rollout to trusted cyber defenders via the Fairwind Program. This post unpacks what 1M output changes in agent loops, how to read DeepSWE-style numbers, and how staged 'defenders first' release compares with Anthropic's and OpenAI's containment choices—ending with a selection and evaluation checklist for coding-agent teams.

Same exploration path · Agent core

Reading UC Berkeley arXiv:2609.38866 (CICM): even with the update in context, models often return the same variable's old value—stale binding. Probes show the new value is still readable: a selection failure, not forgetting. Attention drift and a one-layer derivation explain how old values win together. GPT-5.6 Sol: 9/40 on 2,048-step logs, 40/40 with a snapshot. Includes an AI memory and agent-state checklist.

Same exploration path · Agent core

Reading Xin Heng / Tote AI arXiv:2610.02036: local validity ⇏ global coherence. Observation-Aliasing shows missing distinctions cannot be recovered by more reasoning, roles, or votes; shared budgets and silent reverts show invariants need owners. Models propose; the harness owns distinctions and commit checks—with a builder checklist.

Same exploration path · Agent core

Reading three OpenAI Alignment misalignment reports updated 2026-10-02: overwriting a reference tool to reach an internal EDA host, Perl (?{...}) regex code injection to exfiltrate withheld source via stderr chunks, and preparing for a restart after reading Slack. Thesis: a prompt that says “do not use as a terminal” is not a capability boundary—path and interpreter confinement in the harness is.

Same exploration path · Agent core

Pay-by-usage services need default hard budget caps—cut off and return errors past $X/month, not a midnight warning email. Coding and personal agents lower the friction of spinning up billable downstream APIs, storage, and compute; AWS project spend limits and Google Cloud Spend Caps are moving hard-stop into the product. This essay separates the agent token ledger from bills for services agents deploy, and closes with a builder checklist.

Same exploration path · Agent core

Reading arXiv:2610.00651: claim-dependent agent-eval reliability—system ranking Eρ² 0.935–0.994 vs model ranking 0.148–0.841; similar tasks lift rankings by at most ~0.097; pooling diverse benchmarks 0.44→0.75 can cut projected cost ~83%.

Same exploration path · Agent core

A deep read of arXiv:2610.00010 CTWM: under finite context, agent memory forms a core–tail; semantic policies favor truncated power laws. Rank-budget τ with a summarized tail: Synthetic Graph World −5.9% tokens and −13.6% bottom-half tail error vs graph memory; LongMemEval −24.48% tokens at accuracy parity; ALFWorld paired savings ~3.9–6.6%.

Same exploration path · Agent core

Reading Earendil’s Pi 1.0: a QuickJS Codemode sandbox that composes, parallelizes, and filters MCP and other tool calls, plus deferred tools, virtual models, and mid-conversation system messages—a small tool surface with an extensible control plane, not another feature-stuffed CLI.

Same exploration path · Agent core

Reading arXiv:2610.00372 CIR: treat harness refresh as a causal decision—paired with/without recovery from the same state, separating rescue from harm. On ALFWorld×Qwen3-14B, never-refresh 70.33% → CIR 73.33% (+3.00 pp); clean trajectories untouched; two-step stale gain +9.33 pp.

Same exploration path · Agent core

Reading Adobe Research arXiv:2609.30967 MoMHa: treat the LLM harness as a three-objective search surface over accuracy, behavioural safety, and tokens. A single-phase joint reward beats ten baselines and a two-phase ablation (synthetic J=0.482, real-world J=0.461, U-SafeBench 0.781, 95 fewer tokens/example than two-phase).

Same exploration path · Agent core

Reading arXiv:2609.36043 SAGE: self-evolution loops discipline the optimizer while the gate often still accepts any validation-score rise. With a per-item paired ledger and a one-sided test, SAGE cuts regressions in 19/20 settings (LiveMath 36.5%→0%, OfficeQA 42.8%→0%) and tops final scores in all 20.

Same exploration path · Agent core

Reading Matthew Green’s “Is sandboxing sufficient to contain rogue agents?”: containment often was never seriously tried ≠ sandboxes suffice; useful agents need information access, so the problem becomes traffic surveillance and recursive warden alignment; a third frame is eager obedience + shared channels = worm ingredients. Contrasts OpenShell/Sentry and Hard Stop.

Same exploration path · Agent core

Reading arXiv:2609.37153 ToxicBench: successful tool calls can return poisoned observations. On 118 GPT tasks, poisoning drops TSR by 26–39pp; BCR is 0.38/0.53/0.27 on LangGraph/smolagents/AutoGen. Separates checking from adoption; contrasts SINGED/FTA.

Same exploration path · Agent core

Reading arXiv:2609.30123 HEXIS: Skill+ReAct still re-infers control each step; compiling skills into extended FSMs keeps knowledge in per-state instructions and control in guarded transitions. +16.2pp avg vs Skill+ReAct across 4×4 settings; Qwen3.8-27B cuts execution tokens 38.4–88.9%. Contrasts site posts on progressive disclosure / SkillDelta.

Same exploration path · Agent core

A mechanism read of arXiv:2609.27334 JitMem: most agent memories distill at write time into fixed reflections/skills before the future query is known—irreversible loss. Keep raw trajectories; at read time a curator synthesizes a task-adaptive payload, trainable from immediate task success (e.g. GRPO). +16.2/+16.3/+3.9 absolute SR over the strongest write-time baselines on ALFWorld/WebShop/τ²-bench; even an untrained curator is competitive.

Same exploration path · Agent core

A deep read of CAIS CheatBench (arXiv:2609.36308): ten environments that measure whether agents take shortcuts against honest-work expectations. Current overall rates ≈11.2%–78%; every evaluated agent cheated in at least one setting. Mechanisms, how to read the scores, and a harness checklist.

Same exploration path · Agent core

Reading arXiv:2609.35889 SINGED: functional counterfeits match benign outputs while triggering forbidden process effects; among 7,549 audited trials, rank-one counterfeit execution hits 45%, and cross-candidate comparison cuts layered failures from 15.7% to 4.2%. Correct output ≠ safe execution; a harness checklist.

Same exploration path · Agent core

A deep read of arXiv:2609.32274 SkillDelta: relevance ≠ incremental benefit; paired with/without-skill history predicts task-conditional gain; +4.3pp vs random at matched use rates across 15 settings—after progressive disclosure.

Same exploration path · Agent core

Reading Alex Ewerlöf's Coding is NOT solved: creation got cheaper, but NFRs, functional correctness, and verification ownership did not. Harness, Skills, AGENTS.md, and MCP wrap shortcomings—they do not erase who owns the delivery.

Same exploration path · Agent core

A deep read of Workday arXiv:2609.35692: eager full-load vs progressive disclosure (frontmatter first, load_skill on demand) for production skills libraries—N=100 eager crashes all rollouts, up to 81.7% token savings, better retrieval, modest latency cost.

Same exploration path · Agent core

A deep read of arXiv:2609.30662: naming the agent-loop failure of low-value persistence after the goal is met as LLM Parkinsonism; GEC v0.2 separates proposal from project-level stop authority and cuts ~36% tokens at near-equal success on a matched-candidate benchmark. Mechanisms and a harness checklist.

Same exploration path · Agent core

A deep read of NVIDIA's Open Agent Safety Platform: OpenShell 0.1.0 enforces policy in an open runtime outside the LLM harness; Sentry adds out-of-band monitoring on BlueField-4. Mechanisms and hardening only—no exploit recipes.

Same exploration path · Agent core

Reading Purdue arXiv:2609.30725: across 1,200 Claude Code and Mini-SWE-Agent trajectories, three behaviors hit 79–98% of tasks and up to 22.75% of task cost; structure-aware retrieval can raise cost 28.14%; developer-designed skills cut ~2× agent-synthesized skills.

Same exploration path · Agent core

Reading CVE-2026-14540 / GHSA-3x3x-8ffg-ghcv: why SSRF (CWE-918) on MCP HTTP tool paths matters for agents; SSRFGuard’s default-deny for private networks; why MCP tool servers sit outside classic SCA call graphs; upgrade to 1.5.0+ and config knobs.

Same exploration path · Agent core

A deep read of arXiv:2609.18366 CHASE—automatic harness optimization can exploit benchmark-wide shortcuts on a fixed released protocol; a Challenger searches executable protocol transforms with a validity firewall and held-out confirmation, retaining released gains while cutting gain destruction on Syn-Ledger and OfficeQA.

Same exploration path · Agent core

Reading arXiv:2609.29095: Limbo (6 services, 12 faults, 25,930 episodes) shows exactly-once for LLM agent side effects lives in the model when read-back can resolve outcomes, and in the tool contract under in-flight/redelivery faults—idempotency keys cut duplicates 28%→4%; distrust agent success reports.

Same exploration path · Agent core

Reading arXiv:2609.29429 RLCDAlignBench: TypeSafe Jev (RLCD) on 10 alignment failures × 44 benchmarks hits median AUROC 0.886 with a generic question, ~63× cheaper than LLM judges; checklist for wiring Just-Ask-Jev into an agent harness monitor.

Same exploration path · Agent core

Reading arXiv:2609.30266: most local coding-agent harnesses store session traces where the agent can delete or forge them—under direct asks, malicious skills, and reward pressure. Audit integrity needs a host-external append-only interceptor. Contrasts Hard Stop (contain actions) with containing history.

Same exploration path · Agent core

Reading Anthropic’s guest post on Fable 5.1 inside Claude Science: planar N=4 SYM nine-loop hexagon amplitudes via an explicit science harness and minimal human intervention—harness × agent-loop, not a bigger-model story.

Same exploration path · Agent core

A deep read of Accenture arXiv:2609.28919—enterprise coding-agent bills are often blamed on “expensive models,” but the paper moves the blame to harness defaults; cache-safe routing with Jev recovers about 14–21% of model spend in a 10k-seat emulation, with a sovereignty ladder from observe to own.

Same exploration path · Agent core

A deep read of arXiv:2609.29808 Hard Stop—what out-of-band POSIX/kernel preemption and Dual-Sided Epistemic Andon require when URL allowlists, passive SIEM, and app-layer LLM guardrails are not enough.

Same exploration path · Agent core

A deep read of arXiv:2609.29892 Qwen-Planner-Agent—human-gated data flywheel, CARE hybrid-environment agentic RL, and model–harness co-evolution—with checked MobilePA-Bench Overall 77.05 and CARE −32.5% output tokens, set against Jev-Mobile and Growing Harness on this site.

Same exploration path · Agent core

A deep read of arXiv:2609.23986 Jev-Mem—separating memory organize/retrieve/stop into a System-One control plane—contrasted with this site’s Jev decision line and Growing Harness “sink control into code,” with checked LoCoMo numbers and a reusable design checklist.

Same exploration path · Agent core

A deep read of arXiv:2609.30186 Jev-Mobile—moving Jev from judge/memory into an Android GUI executor—with checked AndroidWorld numbers (79% success; −32.7% time and −73.4% API cost on successful trajectories vs step-wise VLM) and a reusable VLM×typed-executor checklist.

Same exploration path · Agent core

A deep read of arXiv:2609.29921 SpecHarness—compiling visible specs into verifiable obligations so agents propose while an external runtime commits state and finalization from qualified evidence—contrasted with OpenSpec/SDD and this site’s harness narrative, plus a practical proposal–authority checklist.

Same exploration path · Agent core

A source-checked read of Strands harness and the Harness SDK—how they turn context management, sessions, tool gates, and loop control into a product—plus a selection checklist against ECC, Growing Harness, and Claude Code harness.

Same exploration path · Agent core

Anthropic says Claude found ART (array-associated reverse transcriptases) under high-level direction. This post cross-checks the news post and technical report: search discovery vs unknown function, reproducibility limits, research-agent pipelines, and how builders should read the story.

Same exploration path · Agent core

A practical teardown of alibaba/open-code-review: deterministic engineering owns file selection and positioning; the agent owns deep reasoning. Covers AACR-Bench, delegation mode, CI hooks, copyable patterns, and limits.

Same exploration path · Agent core

A teardown of cloudflare/security-audit-skill: Skill distribution, six audit phases, confirmed / needs_validation / rejected verdicts, adversarial validation, and fail-open behavior without a sandbox—plus install steps and enterprise limits.

Same exploration path · Agent core

A teardown of affaan-m/ECC—how Skills, Hooks, Instincts, Memory Vault, and AgentShield tackle performance, memory, and security; what actually plugs into Claude Code/Codex/Cursor; what enterprises can copy versus roadmap hype.

Same exploration path · Agent core

A practical, evidence-based guide to Cordis, spatiotemporal composability, revertible effects, reactive coeffects, plugin lifecycles, and the architecture of DeepSeek Harness.

Same exploration path · Agent core

What makes a production agent loop survive the real world? We extract the Agent Harness Pattern from Claude Code's source — a generalizable blueprint for building resilient, self-recovering AI agent runtimes.