Best AI Agent Harness 2026: What It Is, 8 Ranked

What an agent harness is, why it now matters as much as the model, and how the eight leading harnesses compare on results, safety, freedom and cost

Give one AI model eight different harnesses and the same 25 tasks, and its success rate ranges from 68% to 88%. That is the result of a controlled test in which Composio ran the same Kimi K3 model, with the same tools and the same instructions, through eight agent harnesses, and it is the number the French studio Marmelab put at the top of its September survey of 246 harness repositories - Marmelab. Twenty points is larger than the gap between most frontier models on any independent leaderboard this autumn.

The rest of October's news points the same way. Meta's new frontier model card warns that its performance "can vary with quantization, serving configuration, prompts, tools, and the agent harness" - Meta model card. Linus Torvalds published a Linux kernel branch whose patch notes credit "an LLM coding assistant (Claude Code)" for the code, the test programs and the first draft of the text - Phoronix. And Microsoft's Satya Nadella argued that keeping AI safe "means separating the model from the harness that orchestrates its work" - TechCrunch.

The problem is that most people still choose an AI agent by choosing a model. They compare leaderboards, pick the highest score, and accept whatever software happens to wrap it. That software, the agent harness, decides what the model sees, what it is allowed to do, how it checks its own work and how many tokens a finished task costs. Picking the model and ignoring the harness is like choosing a car by its engine and never asking about the brakes, the gearbox or the fuel economy.

This guide explains what an agent harness actually is in plain language, shows with independent data why it now moves results as much as the model, and then ranks eight harnesses (Devin Fusion CLI, Claude Code, Hermes Agent, Codex, OpenCode, OpenClaw, Pi and Muse Code) on proven results, safety, model freedom, extensibility and cost. It also covers the layer above the harness, how harnesses fail, how to test one on your own work, and where the category is heading. No technical background is assumed: where a section gets technical, the plain version comes first.

Contents

1. What an agent harness is (and what it is not)
2. Why the harness now moves results as much as the model
3. How we ranked the eight harnesses
4. Devin Fusion CLI: two models, one harness
5. Claude Code: the benchmark leader
6. Hermes Agent: the self-improving generalist
7. Codex: OpenAI's efficient, sandboxed default
8. OpenCode: the open, model-agnostic choice
9. OpenClaw: the assistant that lives in your chat apps
10. Pi: the minimal kernel you build on
11. Muse Code: Meta's harness, built for Meta's models
12. What each harness really costs
13. The harnesses that missed the cut, and why
14. Above the harness: meta-harnesses, hosted harnesses and SDKs
15. Keeping a harness in bounds: failures and controls
16. How to choose, and how to test a harness on your own work
17. Where agent harnesses go next
18. The bottom line

How the scoring works. Each harness gets a 0-10 score per criterion, with the evidence in the cell, and the final score is the weighted average rounded to one decimal. Proven results (30%) asks whether there is independent evidence that the harness finishes real tasks: the Artificial Analysis (AA) Coding Agent Index and Terminal-Bench 4.0 for coding harnesses, Composio's controlled 25-task test for harnesses outside those boards. Safety and control (25%) covers defaults, sandboxing, permission systems and track record, because a harness is where an agent's power to act is granted. Model freedom (15%) rewards harnesses that let you change the model underneath, since the best model changes every few weeks. Extensibility (15%) measures how far you can adapt the harness (skills, hooks, subagents, MCP, SDKs). Cost to run (15%) combines the entry price with what a finished task costs, which section 12 unpacks.

The weights encode a judgment worth stating plainly: results and safety together make up 55% because a harness that finishes work unreliably, or finishes it dangerously, is not worth having at any price. Category matters too. Hermes Agent and OpenClaw are general-purpose agents that live in chat apps and run errands as well as code, while the other six are built mainly for software work, so read the Category column alongside the score. Section 16 turns the table into a decision by job.

1. What an agent harness is (and what it is not)

A language model, on its own, is a remarkably narrow machine. You hand it a block of text, it hands back a block of text, and then it forgets the exchange ever happened. It cannot open a file, run a test, check whether its last answer worked, or decide to stop. Everything that turns that text predictor into something that fixes a bug across forty files, or answers your email for a week, is supplied from outside the model. That outside layer is the agent harness.

The word comes from horse tack: a harness is the gear that lets a strong animal pull a cart in a useful direction. The analogy holds up better than most tech metaphors. The model provides raw capability, and the harness converts it into directed work: it decides what the model sees on each turn, which actions it can take, what happens to the results, and when the job counts as done. Change the harness and you change the work, even with the same horse.

The people who build these systems now define the term almost identically. Anthropic calls an agent harness "the software scaffolding around a model: the loop, tools, context management, and guardrails that turn raw intelligence into a working agent" - Anthropic. LangChain compresses it into an equation, "Agent = Model + Harness. If you're not the model, you're the harness" - LangChain. Birgitta Böckeler, writing on Martin Fowler's site, puts it as "everything in an AI agent except the model itself" - Martin Fowler. The agreement matters: when the builders converge on one definition, the term has stopped being marketing and become a design category.

1.1 The jobs every harness does

Strip away the branding and every harness, from a few hundred lines of open-source code to a commercial coding product, performs the same handful of jobs. Seeing them separately is useful for two reasons. Each one is a place where results are won or lost, and each one is where the products in this guide genuinely differ, so it gives you a vocabulary for comparing them that does not depend on anyone's marketing.

The first three jobs get the model to act at all. The loop is the engine: call the model, read the action it asked for, run that action, append the result and call the model again until a stop condition is met. The tools are the verbs the model may use (read a file, edit a file, run a command, search the web) and, just as important, the way each verb is described, because a tool the model misunderstands is worse than no tool. The context policy decides what enters the model's finite window on each turn and what gets summarized or dropped when the window fills, a step usually called compaction.

LangChain's diagram of the same idea is one of the clearest available. It places the model at the center, reasoning and deciding, and arranges the harness around it as five flows: context injection, control, action, persistence and observation.

Read the diagram as a map of leverage. Context injection (prompts, memory, skills) and persistence (files, git, progress notes) correspond to state and memory: how an agent carries knowledge across turns and sessions, typically through project instruction files such as AGENTS.md or CLAUDE.md. Control (compaction, orchestration, loops) covers orchestration: subagents for parallel work, routing easy steps to a cheap model and hard ones to an expensive one. Observe and verify is verification, the step that runs tests or asks a reviewer before the agent declares victory. The one job the diagram leaves implicit is the one that matters most for safety: permissions and sandboxing, which decide what the agent may do without asking you and what walls stop it when it tries something it should not.

Why this matters: the model box is the only part you rent from a lab. Every other box is a design decision, and the eight products ranked here are eight different sets of answers to the same questions. How to apply this: when you evaluate any agent product, ask it the same five questions in order (how does it loop, which tools, what does it remember, what can it do without asking, how does it check its work), and you will understand it faster than any feature list allows.

1.2 Harness, framework, scaffold, runtime: untangling the words

The vocabulary around agents is a mess, and the mess costs money, because teams buy a framework expecting a harness or build a harness when they needed a runtime. The cleanest distinction comes from LangChain, which sells all three layers and therefore has to keep them straight: "LangGraph is an agent runtime, LangChain is an agent framework, and Deep Agents is an agent harness. The runtime offers the most control and the least abstraction; the harness offers the inverse" - LangChain.

In plain terms, a framework is a box of parts you assemble into an agent yourself. A runtime is the durable plumbing underneath (saving state, resuming after a crash, scheduling). A harness arrives assembled, with a loop, tools, context management and guardrails already chosen, so you can hand it a task on day one. Scaffold is mostly a synonym for harness, used by Anthropic and others. And an agent is what you get when you put a model inside a harness and give it a goal. Philipp Schmid's analogy is useful for non-engineers: the model is the CPU, the context window is the RAM, the harness is the operating system, and the agent is the application - Philipp Schmid.

A source-code study of eleven harnesses published in July adds a striking empirical detail: across Claude Code, Codex, Gemini CLI, OpenHands, Hermes, Pi, OpenCode, OpenClaw and others, "no agent runtime imports a general-purpose agentic framework" - arXiv. The harnesses people actually use are written from scratch around their loop, which tells you the loop is where the competitive value lives. The same study found skills in 9 of the 11 systems and MCP (the Model Context Protocol for plugging in external tools) in 8.

Google's developer channel recently devoted an episode to exactly this question, walking through what an agent harness is, why coding agents that hit a wall often have a harness problem rather than a model problem, and the difference between linear and closed-loop harnesses. It is a good 30-minute primer if the terms above are new.

The demonstration of linear versus closed-loop harnesses in that episode is the key idea to carry forward: a linear harness runs a plan and stops, while a closed-loop harness feeds results back until a check passes. Every harness in our top eight is closed-loop in some form; they differ in how strict the check is and who decides when it has passed. How to apply this: if a product calls itself an agent but cannot run your tests and react to the output, it is a linear harness, and you should expect it to declare unfinished work finished.

2. Why the harness now moves results as much as the model

For most of 2024 and 2025, the sensible way to pick an AI agent was to pick the best model and accept whatever tool came with it. That heuristic has quietly stopped working, and the reason is structural rather than fashionable. Three forces converged in 2026: frontier models bunched together in capability, tasks got longer, and the harness became the part of the system that decides how many tokens a finished task consumes. Each shift moves weight from the model to the layer around it.

A fourth force followed from the first three: the labs started training their models together with their harnesses, which makes the pairing, not the model, the unit you are really buying. This section takes the four in turn, because together they explain why a guide to harnesses is now more useful to most buyers than another model leaderboard.

2.1 The models converged, so the variance moved

Look at the top of the independent leaderboards this October and the striking thing is how close the leaders are. On the Artificial Analysis Intelligence Index, as reproduced in Meta's launch table, Claude Opus 5.5 scores 58, Muse Wonder Full 56, and Claude Fable 5.1 and GPT-6 Astra 53 each - Meta. Five points separate four frontier models from four different labs. We track those rankings monthly in our best LLM for AI agents ranking, and the pattern is the same every month: the top cluster tightens.

When inputs are that similar, the differences you actually experience come from somewhere else. Artificial Analysis's Coding Agent Index makes the point with unusually clean data, because it scores each model inside a specific agent product rather than through a bare API. Version 1.5 averages three demanding tests, DeepSWE v1.1 (113 long software tasks), Terminal-Bench 4.0 (66 hard command-line tasks) and SWE-Atlas-QnA (124 questions about large codebases), and the publisher states that results "reflect specific evaluated agent variants, not just generic product names: model choice, settings, and execution configuration can materially change outcomes" - Artificial Analysis.

The most direct harness comparison in that dataset involves Cognition's Devin Fusion CLI, which runs a frontier "lead" model alongside a cheaper "sidekick". With Claude Opus 5.5 as the lead, it scores 68.1, against 66.0 for the same model inside Anthropic's own Claude Code, and it does so for $9.01 of API spend per task instead of $13.04. With other leads the harness trades a little score for a lot of cost.

The chart shows that a harness can add points (Opus 5.5) or subtract a few (GPT-6 Astra, where Fusion pairs it with Cognition's SWE-2 as sidekick), but in every case the score moves by amounts comparable to the gaps between frontier models. The cost side of the same comparison, covered in section 2.3, is where the harness effect becomes impossible to ignore.

2.2 Long tasks turn small harness differences into large outcome differences

Here is the first-principles reason a harness can swing results by twenty points. An agent task is a chain of steps, and a chain fails if any link fails without being caught. If each step succeeds 99% of the time, a 100-step task finishes cleanly only about 37% of the time (0.99 multiplied by itself 100 times). Raise per-step reliability to 99.5% and the same task finishes about 61% of the time. Nothing about the model has to change for that to happen: better context (so the model misreads less), better tool descriptions (so it misuses less) and a verification step that catches a failed link and retries it all push the per-step number up or shorten the chain.

That arithmetic explains why harness design matters more as agents work longer. On a three-step chat task, a slightly worse harness costs almost nothing. On the multi-hour engineering tasks that DeepSWE and Meta's SWE-Marathon measure, the same small gap compounds into the difference between a merged change and a pile of half-finished edits. Anthropic's engineers describe the failure modes from the inside: an agent that tries "to one-shot the app", and a later instance that would "look around, see that progress had been made, and declare the job done" - Anthropic. Their fix was pure harness: an initializer agent, a progress file, a feature list stored as JSON because "the model is less likely to inappropriately change or overwrite JSON files compared to Markdown files."

The Composio test that produced the 68% to 88% spread is the cleanest public demonstration of the effect outside coding. It held everything constant except the harness: the Kimi K3 model at maximum reasoning, the same hosted tools, the same 25 business tasks across Gmail, Google Calendar, Sheets, Airtable, GitHub, Slack, Notion, Linear and PagerDuty - Composio.

Two caveats keep this chart honest. Claude Code and Codex ran a model they were not tuned for, so the test measures how well each harness carries a foreign model rather than how good each product is with its native one. And each task ran once, so one task equals four percentage points. Even so, the spread is the point: identical intelligence, a 20-point range in outcomes, and the cost per success ranged from $0.46 (Hermes Agent) to $1.96 (Claude Code). Marmelab's verdict on the field is blunt: this is "about the only thing anyone has properly measured."

Y Combinator's Paper Club made the same argument from the research side in a session published in September, opening with the claim that "the same model weights that score 30% on ARC-AGI score 95% with a better harness" and then walking through self-improving harnesses and YC's own internal agent stack. It has drawn more than 400,000 views, a sign of how fast the idea has spread.

The segment on context as an L1, L2 and L3 cache (around the 21-minute mark) is the most transferable idea for non-researchers: a harness that keeps the right facts in the model's immediate window, and fetches the rest on demand, beats one that stuffs everything in. That is a design choice, and it is invisible on a model leaderboard.

2.3 The harness sets your bill, not the price list

The third force is economic. A lab sets the price per million tokens; the harness decides how many tokens a finished task consumes. In the Artificial Analysis data, Claude Code running Claude Sonnet 5.5 at maximum effort scores 68.4 but averages about 266 steps and $14.19 of API spend per task, while Codex running GPT-6.1 Sol at its "xhigh" setting scores 62.9 in about 40 steps for $1.04 per task. Those are different models, so the comparison is not purely about the harness, but the step counts tell the story: one design explores exhaustively and the other works tersely, and the bill follows the design.

The same pattern appears inside a single product, where only the effort setting changes. Claude Code with Sonnet 5.5 scores 42.1 at "low" effort for $0.48 a task, 55.0 at "high" for $1.24, and 68.4 at "max" for $14.19. Codex with GPT-6.1 Sol behaves very differently: it scores 57.2 at "low" and peaks at 62.9 at "xhigh", with every setting costing between $0.50 and $1.55.

A 26-point swing from one setting is larger than the gap between most frontier models, and it comes with a roughly 30x swing in cost. The Devin Fusion comparison from section 2.1 completes the picture: Cognition's harness delivered Claude Fable 5.1 results for $7.90 a task against $12.39 in Claude Code, and GPT-6 Astra results for $4.54 against $7.47 in Codex. Our analysis of real cost per agent task found the same thing from the model side: the per-token price is a poor guide to the per-task bill.

Why this matters: the most consequential choice in many agent deployments is not which model you buy but how the harness is configured to spend it. How to apply this: when you compare harnesses, compare cost per finished task at a fixed quality bar, never price per token, and treat the effort setting as a dial you tune per job rather than a default you accept.

2.4 The labs noticed, and started training models with their harness

If the harness matters this much, the obvious move for a lab is to stop treating it as an afterthought and train the model inside it. That is exactly what happened this autumn. Z.ai's GLM-Legal, released on October 13, describes "Co-evolving the Model and Agent Harness" as a core part of post-training: "Harness architecture and model training iterate in lockstep. Edge cases surfaced during model training pinpoint architectural bottlenecks in the harness" - Z.ai. The result was a 19.2% all-pass rate on Harvey's Legal Agent Benchmark, 12.5 points above its GLM-5.3-Flash base model.

The chart's first group is the telling one. A legal model built on a lightweight base outscores much larger general models on the agentic legal benchmark, while on the static LegalBench quiz it merely matches them. Agentic tests reward the model-plus-harness pairing; static quizzes reward raw knowledge. Meta is doing a version of the same thing: Muse Code is described as "Built for Muse models: Co-trained for tight integration. Better tool use, fewer retries and higher-quality output than a generic wrapper" - Meta.

Meta's own launch materials also show why cross-harness comparisons need care. Its SWE-Marathon chart, a test of very long engineering projects, puts Muse Wonder Full well ahead of its rivals.

The fine print beside it reads: the leaderboard results for GPT-6 Astra and Claude Fable 5.1 "use Codex and Claude Code, respectively, so this row is not a controlled common-harness comparison." In other words, part of the gap may be the harness, not the model. On the one coding row where Meta ran every model through the same harness (ProgramBench, using mini-swe-agent), Claude Opus 5.5 led instead. Our Muse Wonder guide walks through that table row by row; the lesson for this guide is simpler. Why this matters: a benchmark score is a score for a model inside a harness, and you can only compare two scores fairly when the harness is the same or deliberately part of the comparison. How to apply this: whenever a launch claims a lead, look for the harness each competitor ran in before you believe the gap.

3. How we ranked the eight harnesses

A ranking is only as good as the rules behind it, so this section states them before the profiles begin. The goal was to rank harnesses, not models, which rules out the most common shortcut in this category: crediting a harness with the score of whichever model its vendor happens to sell. Wherever possible, the evidence comes from tests where the harness itself was the variable, or where independent publishers ran each harness with its strongest available model under the same conditions.

Three independent sources carry most of the weight. The Artificial Analysis Coding Agent Index scores 40 harness-and-model configurations on the same three test suites and publishes the API cost, steps and time per task for each. Terminal-Bench 4.0, the continuous benchmark for hard command-line work, lists the agent alongside the model for every submission - Terminal-Bench. And Composio's controlled test held the model fixed while changing the harness. Everything else (permission systems, sandbox defaults, licenses, prices, extension points) comes from each harness's own documentation, read this week.

3.1 Why these eight

Eight harnesses made the cut because together they cover every serious answer to the question of how a model should be wrapped. Three are lab harnesses, built by the company that trains the model underneath (Claude Code, Codex, Muse Code). One is a multi-model commercial harness whose central idea is to combine labs (Devin Fusion CLI). Two are open, model-agnostic coding harnesses (OpenCode and Pi). And two are general-purpose agents that live in chat apps and do far more than code (Hermes Agent and OpenClaw). The two general-purpose agents dominate the attention economy of the category: by GitHub stars, OpenClaw (392,050) and Hermes Agent (253,890) are the two largest agent repositories in existence.

Several well-known tools missed the cut for specific reasons that section 13 explains: Cursor, Google's Antigravity CLI, Kimi Code, Grok Build, Factory's Droid, Goose and GitHub Copilot CLI. None of them is a bad product. Each either lacked independent evidence, overlapped heavily with a harness already in the eight, or was going through a change significant enough that a score would be stale within weeks.

3.2 What the scores can and cannot tell you

The scoring table compresses a lot into five numbers, and it is worth being explicit about the limits. Coding benchmarks measure coding; a harness that wins Terminal-Bench may still be the wrong choice for an assistant that triages your inbox, which is why the general-purpose harnesses are scored on evidence from business tasks instead. Benchmarks also lag: the AA index records the harness version it tested (Claude Code 2.1.280, Codex 0.154.0, OpenCode 1.18.29), and every one of these products has shipped updates since. And we covered the many ways coding benchmarks mislead in our piece on why AI coding benchmarks lie; those caveats apply here in full.

Why this matters: a ranking that hides its method invites you to trust it blindly, and harness evidence is too thin for that. What the scores do capture well is the shape of each product's trade-offs. A harness that scores 10 on model freedom and 2 on safety (Pi) is telling you something true about its philosophy, not about its quality. How to apply this: read the individual criteria, not just the final number, and reweight them for your situation. A solo developer on a laptop may care little about team policy controls; a company letting agents touch production should probably double the weight on safety.

4. Devin Fusion CLI: two models, one harness

Devin Fusion CLI is the newest idea in this ranking and the one that best demonstrates the thesis of this guide: that the harness, not the model, is now where performance is won. Fusion is Cognition's name for running two models at once inside the Devin CLI. A frontier lead model "owns your task", handling planning, design decisions and correctness-critical work, while a cheaper sidekick "carries out the lead's plan" by writing code, running builds and tests and verifying changes - Devin Docs. You talk to one agent; the harness decides which model does each part of the job.

The independent evidence is strong. On the Artificial Analysis Coding Agent Index, Devin Fusion CLI with Claude Opus 5.5 as lead and GPT-6 Luna as sidekick scores 68.1, the highest result for any multi-model harness and above the 66.0 that Opus 5.5 achieves inside Anthropic's own Claude Code, at $9.01 of API spend per task against $13.04 - Artificial Analysis. Cognition's own page draws the cost comparison more aggressively, citing the same index: 36% lower cost than Claude Code with Fable 5.1 and 39% lower than Codex with GPT-6 Astra, at near-equal scores - Devin.

4.1 What you get, and how it keeps the agent in bounds

Beyond Fusion, the Devin CLI is a full-featured terminal harness written in Rust. It switches between Anthropic, OpenAI, Google, Cognition and open-weight models mid-session with a /model command, hands a task off to Cognition's cloud with /handoff so you can close your laptop, and runs as an ACP agent inside Zed, JetBrains and Xcode. It reads AGENTS.md automatically and, notably, states that "MCP servers, skills, hooks, and Claude Code plugins work as-is", which lowers the cost of switching from Anthropic's harness considerably.

The control model is one of the most complete in this ranking, and it is worth understanding before you hand the harness a real repository. Cognition lists five operating modes on its product page, and they map neatly onto how much you trust the task, from approving every write to letting the agent run on its own:

• Normal: reads auto-approve, writes and shell commands ask first
• Accept Edits: auto-approves edits inside the workspace only
• Smart mode: a fast model judges what is safe to run
• Autonomous: auto-runs inside an OS-level sandbox
• Bypass: full autonomy, for when you want it

The interesting design choice is that full autonomy comes in two flavors: Autonomous, which keeps the OS sandbox, and Bypass, which does not. Combined with a --sandbox flag described as "fail-closed isolation for files and network", per-tool and per-path permission rules, lifecycle hooks and admin-enforced team settings, that gives a company a credible way to let agents run unattended without handing them the whole machine. Why this matters: most harnesses force a choice between constant prompts and no guardrails at all; a sandboxed autonomous mode is the middle ground most teams actually want.

4.2 Pricing, limits and who it is for

Devin's individual plans are simple: Free with a light quota and limited models, Pro at $20 a month with frontier models from OpenAI, Anthropic, Google and SpaceXAI plus extra usage at API pricing, and Max at $200 a month for much higher quotas; teams pay $80 a month plus $40 per developer seat - Devin pricing. Fusion itself is a paid-plan feature: "It's not included in free or trial tiers," and it bills each model in the pairing at its own per-token rate.

The weaknesses are real. Fusion is new, its strongest independent result rests on one index, and the recommended pairing (Fable 5.1 with Cognition's SWE-2) is tuned for Cognition's own sidekick model, so you are partly buying into its model roadmap. And Cognition's documentation does not describe plugging in an arbitrary model endpoint of your own, the way OpenCode or Pi allow. How to apply this: Devin Fusion CLI is the best fit for a developer or team that wants frontier-quality results across vendors and cares about cost per task, and it is the clearest way to test, on your own codebase, whether a multi-model harness beats a single-model one. Start with the recommended pairing, run /session-stats after a week to see the savings estimate, and compare against your current harness on the same tasks.

5. Claude Code: the benchmark leader

Claude Code is Anthropic's agentic coding tool, and by the independent numbers it is the strongest single-vendor harness available. It runs in the terminal, VS Code, JetBrains, a desktop app, the web and mobile, and Anthropic describes it as a tool that "reads your codebase, edits files, runs commands, and integrates with your development tools" - Claude Code docs. It sits at #1 on Terminal-Bench 4.0 with Claude Opus 5.5 at 64.8%, and Claude Sonnet 5.5 at 61.8% takes second place in the same harness - Terminal-Bench.

Claude Code's other distinction is cultural: it is the harness that serious engineers reach for when the stakes are high. The clearest signal this month came from Linus Torvalds, whose noref-filemap-read-with-llm branch reworks how Linux reads cached files from many threads at once. His patch message states that the code, the test programs and the first draft of the text "were done with an LLM coding assistant (Claude Code) under my direction. The measurements were run on my machine" - Phoronix. On his laptop, eight threads reading one file went from about 10 million reads per second to between 30 and 33 million - It's FOSS. The branch had not been merged at the time of writing.

5.1 The most programmable harness on the market

What separates Claude Code from its rivals is less any single feature than the depth of its extension surface. It reads CLAUDE.md (and can read AGENTS.md instead), keeps an auto memory, and supports skills, hooks, MCP servers, subagents coordinated by a lead agent, background agents and plugins. The same loop is available as a library through the Claude Agent SDK, which Anthropic describes as giving you "the same tools, agent loop, and context management that power Claude Code, programmable in Python and TypeScript" - Anthropic. We covered the SDK in depth in our Claude Agent SDK deep dive and the parallel-agent patterns in our Claude Code subagents guide.

In June, Anthropic went a step further with dynamic workflows, under the telling headline "A harness for every task". The pitch: "Claude can now write its own harness on the fly, custom-built for the task at hand" - Anthropic. Workflows are JavaScript files that spawn and coordinate subagents, each with its own context window, to counter three failure modes Anthropic names explicitly: agentic laziness, self-preferential bias and goal drift. This month's addition is mods, functions that change what Claude Code renders, what goes into a prompt and what tool calls it makes. Anthropic's own short demo shows three of them being built.

Watch it as a statement of direction rather than a feature tour. A harness whose users can rewrite its prompts, its interface and its tool calls is converging on an operating system for agents, which is precisely Philipp Schmid's analogy from section 1. For teams that want to shape the harness around their own practices, nothing else on this list goes as far.

5.2 Safety, cost and the trade-offs

Claude Code offers six permission modes, from a manual default through acceptEdits, plan, auto and dontAsk to bypassPermissions. Since version 2.1.283, auto mode is the built-in starting mode for interactive terminal and VS Code sessions: a separate classifier model reviews actions before they run. Anthropic's documentation is candid about the limits of instructions: a boundary you state in conversation can be lost when compaction removes the message that stated it, so "for a hard guarantee, add a deny rule instead" - Claude Code docs. An OS-enforced sandbox for shell commands exists on macOS, Linux and WSL2, but "the sandbox is off by default" and you turn it on with /sandbox or a setting - Anthropic.

Cost is the main weakness, and it is a direct consequence of how hard the harness works. At maximum effort, Claude Code averaged $13.04 per task with Opus 5.5 and $14.19 with Sonnet 5.5 on the AA index, and it posted the highest cost per success in Composio's test ($1.96, against $0.46 for Hermes Agent). On subscriptions, Claude Code is included in every paid Claude plan: Pro at $20 a month ($17 on annual billing), Max from $100, and Team seats from $20 to $125 - Claude pricing. Our Claude Code pricing guide covers the limits behind those plans.

Why this matters: the harness that wins benchmarks by working hardest is also the one that bills hardest, so its value depends on how you configure it. Model freedom is the other trade-off. Claude Code defaults to Opus 5.5 on paid plans and the API - Claude Code docs, and it is built for Claude models. Other labs can and do point it at their own models through Anthropic-compatible endpoints (Terminal-Bench lists GLM-5.3 and Qwen3.8-Max runs inside Claude Code), but those runs score far lower than Claude models in the same harness (41.8% and 27.0% against 64.8% for Opus 5.5), partly because those models are weaker and partly because the harness is tuned for Claude. How to apply this: choose Claude Code when you want the strongest proven results and the deepest customization, budget for its appetite, and set the effort level per task rather than leaving every job at maximum.

6. Hermes Agent: the self-improving generalist

Hermes Agent, from Nous Research, is the harness that most fully embodies the idea that an agent should get better at your work the longer it does it. Its README describes "the only agent with a built-in learning loop: it creates skills from experience, improves them during use, nudges itself to persist knowledge, searches its own past conversations, and builds a deepening model of who you are across sessions" - Hermes Agent. It is MIT-licensed, has 253,890 GitHub stars, and shipped version 0.22.1 on October 14.

Hermes is a general-purpose agent rather than a coding tool, which shapes how to read its score. It runs as a single gateway process that you talk to through Telegram, Discord, Slack, WhatsApp, Signal or a command line. It schedules its own recurring jobs, spawns subagents, and executes commands through seven terminal backends: your local machine, Docker, SSH, Singularity, Modal, Daytona and Vercel Sandbox. And it uses "any model you want: Nous Portal, OpenRouter, OpenAI, your own endpoint", with Nous's own claim that you can "run it on a $5 VPS or a GPU cluster."

6.1 The evidence, and why Hermes scores high on safety

Hermes has no entry on the coding indices, so its results score rests on Composio's controlled test, where it passed 20 of 25 business tasks (80%), third of eight harnesses, at the lowest cost of any: $0.46 per success and $9.28 in total, against $35.37 for Claude Code - Composio. It was also the fastest of the top performers, with a median of 164 seconds per task. A single 25-task run is thin evidence, which is why the results score is a 6, but it is consistent with the harness's reputation among people who run agents unattended.

Where Hermes genuinely stands out is its security defaults, which are more thoughtful than those of most commercial products. Its documentation describes a "smart" approval mode in which an auxiliary model assesses risk, approving low-risk commands, denying genuinely dangerous ones and prompting you on uncertain cases - Hermes docs. The defaults that matter most:

• Fail-closed prompts: an unanswered approval is denied after 300 seconds
• Unattended runs deny: cron, single-query and unattended modes default to deny
• Hardline blocklist: commands like rm -rf / are blocked even in YOLO mode
• Default-deny gateway: with no allowlist configured, every chat user is refused
• Secret stripping: subprocesses lose variables named like keys, tokens and passwords

Those choices encode a sound principle: when the human is absent, the safe answer is no. The documentation is also honest about the limits, noting that its write denylist "does not sandbox a hostile or compromised agent" and that the local backend runs with no isolation. Why this matters: for an agent that answers messages from the internet, prompt injection is the central risk, and Hermes is one of the few harnesses that scans context files such as AGENTS.md for injection attempts before loading them. How to apply this: if you run Hermes for anything sensitive, use one of the container backends, not local, and keep the default-deny gateway.

6.2 Who Hermes is for

Hermes is the best choice in this ranking for someone who wants one persistent agent that handles a mix of work (research, scheduling, monitoring, light coding) across chat apps, on any model, at the lowest running cost. Its weaknesses are the flip side of its ambition. A self-improving agent that writes its own skills can also learn bad habits, and the skills it writes are code you did not review. It is also less capable than a dedicated coding harness on long engineering tasks. Our Hermes Agent vs OpenClaw comparison goes deeper on how the two leading open agents differ, and our guide to AI agent memory explains the memory architectures behind Hermes's learning loop.

7. Codex: OpenAI's efficient, sandboxed default

Codex is OpenAI's terminal coding agent, written in Rust and published under the Apache-2.0 license, with 129,303 GitHub stars and a stable release (0.162.1) on October 9 - GitHub. It pairs a local CLI with cloud tasks, an IDE extension and an SDK, and its defining characteristic in the independent data is efficiency. On the AA index, Codex with GPT-6.1 Sol at "xhigh" effort scores 62.9 for $1.04 per task in about 40 steps, and on Terminal-Bench 4.0 both GPT-6 Astra and GPT-6.1 Sol reach 58.2% inside Codex.

That efficiency is a harness property as much as a model property. With OpenAI's current flagship models, Codex finishes in close to 40 steps per task at every effort setting the AA index tested, while Claude Code at maximum effort takes 155 steps with Opus 5.5 and 266 with Sonnet 5.5. Codex works tersely, plans less visibly and stops sooner, which is cheaper and faster but leaves fewer opportunities to catch its own mistakes on very long tasks. Interestingly, Composio's foreign-model test put Codex last (68%) when it carried Kimi K3, which suggests its terseness suits OpenAI's own models better than other labs'.

7.1 The strongest default sandbox among the lab harnesses

Codex's security design is its other strength. On macOS it uses Apple's Seatbelt, and on Linux and WSL2 it uses bubblewrap, to enforce three sandbox modes (read-only, workspace-write and danger-full-access) combined with approval policies; the recommended low-risk preset is workspace-write with approval on-request - OpenAI. In practice that means the agent can edit your project freely but has to ask before touching anything outside it or reaching the network, and the operating system, not the model's good intentions, enforces the boundary.

That design makes this month's controversy all the more striking. Since version 0.157.0, opening an interactive Codex session starts a persistent background daemon that keeps running after every Codex window closes, copies about 374 MB into your home directory, and runs a detached updater that checks for new releases five minutes after start and then hourly, restarting the backend when it updates - GitHub. The issue asking OpenAI to make it opt-in reached 606 points on Hacker News - Hacker News, and at the time of writing no OpenAI staff member had replied in the thread. The workaround is one command: codex features disable daemon_auto_start.

The daemon is not a sandbox escape, but it is a trust problem of exactly the kind this guide is about. A harness is software you let act on your machine, and a harness that installs persistent, self-updating processes by default is making decisions about your machine that you did not ask for. Why this matters: for companies, this is a change-management issue (an unreviewed process updating itself hourly on developer laptops), and one commenter in the thread said they were rolling back their company's Codex seats over it. How to apply this: if you deploy Codex across a team, disable the daemon in your managed configuration until OpenAI changes the default, and pin versions in the same way you would for any other developer tool.

7.2 Pricing and who Codex is for

Codex is included in ChatGPT plans: Go at $8 a month, Plus at $20, Pro from $100 (with $200 and $500 tiers), and Business at $20 to $25 per user - OpenAI. On Plus, the five-hour local message allowance ranges from 5-45 for GPT-6 Astra to 350-3,000 for GPT-6 Luna, and with an API key Codex bills at API rates but loses the cloud features. Our Codex pricing guide maps those limits and resets in detail.

Codex is open source and can run other providers' models (the AA index tested it with DeepSeek V4), but in practice it is tuned for OpenAI's. How to apply this: choose Codex if you already pay for ChatGPT, want an OS-level sandbox on by default, care about cost per task, and mostly use OpenAI models. For long, sprawling refactors where exhaustive exploration pays off, test it head to head against Claude Code on your own tasks, because the two harnesses embody opposite philosophies about how hard an agent should look before it acts. Our comparison of the best AI coding CLIs covers that contrast from the developer's chair.

8. OpenCode: the open, model-agnostic choice

OpenCode is the most popular open-source coding harness built around one idea: you should be able to use any model you like. It is MIT-licensed, has 213,614 GitHub stars, shipped version 1.19.0 on October 11, and claims "over 16M developers every month" - OpenCode. It connects to "75+ LLM providers through Models.dev, including local models", lets you sign in with an existing GitHub Copilot or ChatGPT Plus or Pro account, and runs in the terminal, as a desktop app or inside an IDE. The project also states that it "does not store any of your code or context data."

The independent evidence is decent but incomplete, which is typical of model-agnostic tools: benchmark publishers test harnesses with each vendor's flagship, and OpenCode has no flagship. On the AA index it appears once, running Z.ai's open-weight GLM-5.3 at maximum effort, where it scores 53.6 for $4.24 per task - Artificial Analysis. In Composio's controlled test with Kimi K3 it passed 72% of tasks, mid-pack, at $0.72 per success. Neither result tells you how OpenCode performs with Claude Opus 5.5 or GPT-6 Astra underneath, which is the comparison most buyers want and nobody has published.

8.1 Extensibility and the economics of open models

OpenCode's extension surface is broad. It ships two built-in agents, Build and a read-only Plan mode you toggle with the Tab key, plus custom agents and subagents, plugins, custom tools, custom commands, MCP servers, LSP integration, an SDK, a headless server mode and GitHub and GitLab integrations - OpenCode docs. Running /init writes an AGENTS.md file to the project root, the same convention Codex and others read, which makes moving between harnesses easier.

Its business model is where model freedom turns into a cost advantage. OpenCode Go costs $10 a month (Go Plus $40) and bundles usage of strong open-weight models including GLM-5.3, Kimi K3, Qwen3.8 Max, DeepSeek V4 Pro and MiniMax M3, with monthly dollar limits per model - OpenCode. OpenCode Zen is pay-as-you-go from a $20 balance. Because the open-weight models are often a fraction of the price of frontier ones, the cheapest serious coding setup in this guide is OpenCode running an open model; our guide to model routing explains how to send easy work to cheap models and hard work to expensive ones.

8.2 The safety gap, and who OpenCode is for

OpenCode's weak point is its defaults. Each permission rule resolves to allow, ask or deny, but the documentation states plainly that "if you don't specify anything, OpenCode starts from permissive defaults" - OpenCode docs. Editing, shell commands and web fetches run without approval out of the box; only paths outside the working directory and a "doom loop" guard (the same tool call repeated three times with identical input) ask first, and .env files are denied for reading. There is no operating-system sandbox, so the boundary is enforced by OpenCode's own rules rather than by the OS.

None of that is hard to fix, but it has to be fixed deliberately. Why this matters: permissive defaults are fine on a throwaway project and risky on a repository with production credentials nearby. How to apply this: OpenCode is the right harness for developers and teams who want open source, the freedom to switch models as the leaderboard changes, and the lowest running cost through open-weight models. Before pointing it at anything important, write a deny list for destructive commands, set bash to ask, and run it inside a container or a cloud sandbox; our comparison of E2B and Modal covers the hosted options.

9. OpenClaw: the assistant that lives in your chat apps

OpenClaw is the largest agent project on GitHub by a wide margin, with 392,050 stars, and the one that brought the idea of a personal AI agent to a mass audience - GitHub. It describes itself as an "open-source AI assistant that runs on your own computer and meets you in the channels you already use: Discord, iMessage, Slack, Teams, Telegram, WhatsApp, and 20+ more." One gateway process runs it as a personal assistant on a laptop or as a shared deployment for a team. It is MIT-licensed, released version 2026.10.3 on October 13, and "has no paid tier, hosted service, or token."

OpenClaw is now governed by the OpenClaw Foundation, an independent 501(c)(3) that employs the core team and signs releases; its README notes that "OpenAI is a donor, not an owner", alongside Amazon, Red Hat and others. That governance matters for a harness this widely deployed, because it reduces the risk that one lab steers the project toward its own models. Our OpenClaw guide covers its history from Clawdbot onward.

9.1 A harness that hosts other harnesses

Architecturally, OpenClaw is unusual: it is both a harness and a host for harnesses. Its documentation defines an agent runtime as something that "owns one prepared model loop" and a harness as "the implementation that provides an agent runtime" - OpenClaw docs. Its built-in runtime is based on Pi (section 10), and it can swap in plugin harnesses for Codex, GitHub Copilot and Meta's Muse, or drive Claude Code as a command-line backend. In the README's words, "Models and agent harnesses (Claude, Codex, local models) are plugins you can swap."

That design gives OpenClaw the highest possible scores for model freedom and extensibility, and it explains why it is often the front door rather than the engine: people talk to OpenClaw on WhatsApp, and OpenClaw hands the coding work to whichever harness is best at it. Why this matters: as harnesses specialize, the layer that routes work between them becomes valuable in its own right, a theme section 14 returns to. How to apply this: if your goal is an assistant you message from your phone that can also delegate real engineering work, OpenClaw's runtime plugins let you keep the chat experience while using Claude Code or Codex underneath.

9.2 Security: the cost of being the biggest target

OpenClaw's weakness is security, and it is partly structural. Its README is direct: "Tools run on the host for the main session unless you configure sandboxing." A popular agent that runs on personal machines, connects to messaging apps and installs community skills is the most attractive target in the category, and attackers noticed early. In February, a security audit of 2,857 skills on its ClawHub marketplace found 341 malicious skills, 335 of which used fake prerequisites to install the Atomic Stealer malware on macOS, a campaign named ClawHavoc - The Hacker News. The project's GitHub page lists more than 100 published security advisories.

The project has responded with sandboxing modes, exec approvals and skill scanning, and much of the risk is now configurable away. But the default still trusts the host, and the skill ecosystem remains a supply chain you have to manage. Our guide to AI agent sandbox security lists the controls that would have stopped the 2026 incidents. How to apply this: run OpenClaw on a dedicated machine or a hosted sandbox rather than your main laptop, enable sandboxing for every session, install skills only from sources you trust, and never connect it to accounts you could not afford to have read. Managed hosting is cheap: Agent37 offers hosted OpenClaw from free to $29.99 a month, with paid plans starting at $3.99 - Agent37.

10. Pi: the minimal kernel you build on

Pi is the harness other harnesses are built from. Created by Mario Zechner, it describes itself in one line: "Pi is a minimal, extensible agent harness that you can make your own" - Pi. It is MIT-licensed, has 115,284 GitHub stars, released version 1.2.0 on October 12, and is the engine underneath OpenClaw, whose README thanks Zechner "for pi". It is also one of the four agents Databricks lists as supported by its Omnigent meta-harness.

Pi's philosophy is deliberate subtraction. "Pi ships with powerful defaults but skips features like sub-agents and plan mode. Ask Pi to build what you want, or install a package that does it your way." Instead of a large built-in feature set, Pi offers extensions, skills, prompt templates and themes that can be bundled as Pi packages and shared through npm or git, a unified API across model providers, and four ways to drive it: an interactive terminal UI, a print or JSON mode for scripts, an RPC interface and a TypeScript SDK. It now supports MCP servers as well, which removes one of the most common objections to it.

10.1 Why a minimal harness can beat a maximal one

Pi's results are better than its feature list suggests. In Composio's test, Pi itself passed 72% of tasks at $0.57 per success, and Oh My Pi, a batteries-included distribution that forks Pi's kernel and adds dozens of tools, posted the best result of all eight harnesses at 88% - Composio. The pattern matches a finding Marmelab quotes from Vercel, which "stripped 80% of the tools out of an agent and watched its success rate go from 80% to 100% on the same model, with tokens more than halved" - Marmelab.

The first-principles explanation is that every tool and every paragraph of system prompt competes for the model's attention. A large harness gives the model more options and more instructions, and each one is a chance to choose wrongly; a small harness keeps the context clean and lets a capable model reason. Anthropic's engineers make the same point from the other direction: "every component in a harness encodes an assumption about what the model can't do on its own, and those assumptions are worth stress testing" - Anthropic. As models improve, components become dead weight, and a minimal harness has less dead weight to carry. Our piece on what the AI model wants explores the same idea.

10.2 The price of minimalism

The cost of Pi's minimalism is safety, and the project says so without hedging: "Pi does not include a built-in permission system for restricting filesystem, process, network, or credential access. By default, it runs with the permissions of the user and process that launched it." The README points to containerization instead and documents three ways to do it. That is an honest design for experts and a dangerous one for anyone who installs it on a laptop full of credentials and lets it run unattended.

Why this matters: Pi is the clearest case in this guide of a harness whose score reflects its philosophy rather than its quality. It scores 2 on safety because it deliberately leaves safety to you. How to apply this: choose Pi if you want to understand and own every part of your harness, embed an agent loop in your own product through the SDK or RPC, or build a custom harness without starting from zero. Run it in a container from day one, and start with a restricted tool set (Pi supports flags such as --tools read,grep,find,ls for a read-only review agent) before granting write access.

11. Muse Code: Meta's harness, built for Meta's models

Muse Code is Meta's coding agent for the terminal and CI, and since October 12 it has been the only place to use Muse Wonder Full, the variant that tops Meta's own benchmark table on long-horizon engineering. Meta's documentation describes it as "Meta's coding agent for the terminal and CI ... with approvals and an OS sandbox on from the first run" - Meta. It ships as a native binary for macOS, Linux and Windows, and markets itself as "Multi-agent by default", with workers running in parallel and reviewers in the background.

The independent evidence is split in an instructive way. On the AA index, Muse Code with Wonder Full scores 68.0, level with Claude Code's best, and its DeepSWE score of 77.0 is second only to Google's Antigravity CLI with Gemini 4 Argon (78.8). With the standard Muse Wonder (the version also available on Meta's API), it scores 63.5 at $8.05 per task, but only 47.5% on Terminal-Bench 4.0, well below Claude Code with Sonnet 5.5 (66.2) or Codex with GPT-6.1 Sol (54.5) - Artificial Analysis. On the official Terminal-Bench 4.0 board, the most recent Muse Code entry (with Muse Spark 1.3) sits at 14.5%. Muse Code is excellent at long, project-scale work and weaker at short, sharp terminal tasks.

11.1 Plans, and the default you should change

Muse Code is sold by subscription, and the plans are among the cheapest entry points in the category: Everyday Usage at $5 a month (Muse Spark and Muse Wonder, "10-50 prompts every 5 hours"), High at $15 (5x), Power at $50 (20x, the first plan that includes Wonder Full) and Maximum at $200 (80x) - Meta. The standard Muse Wonder is also on Meta's API at $4 per million input tokens, $0.20 cached and $20 output, but Wonder Full is not on the API at all. Subscriptions work only inside the Muse Code CLI.

The detail that matters most is buried in the subscription documentation: "Muse Code subscriptions default to Contributor mode", in which "you get more usage from your plan in exchange for letting Meta use your content to train future Meta models", with content defined as your prompts, code, files and context plus the model's responses - Meta. You can switch it off at any time. Why this matters: for anyone working on proprietary code, a default that sends that code into a training set is a governance decision, not a setting to leave for later. How to apply this: if you subscribe, turn Contributor mode off before your first session unless you have decided the extra usage is worth it.

11.2 Who Muse Code is for

Muse Code is the most vertically integrated harness on this list, and its score reflects both sides of that. Its extensibility is strong (subagents, skills, hooks, MCP, workflows, a headless muse exec mode and a TypeScript SDK), and its sandbox-on-by-default posture is better than most. But it runs only Meta's models, which earns it the lowest model-freedom score in the ranking, and its Terminal-Bench results lag. How to apply this: Muse Code is worth a $50 Power plan experiment if your work consists of long, multi-hour changes across a large codebase, the shape of task where Wonder Full's lead on SWE-Marathon and DeepSWE is real. For short terminal work, the evidence points to Claude Code or Codex. The full benchmark breakdown is in our Muse Wonder guide.

12. What each harness really costs

Harness pricing is confusing because three different things get called "the price": the subscription that unlocks the harness, the per-token rate of the model underneath, and the cost of a finished task, which depends on how many tokens the harness spends. Only the third tells you what you will actually pay for an outcome, and it is the one vendors almost never publish. The table below sets out the first, and the paragraphs after it deal with the third.

Cost-per-task figures marked by model come from the Artificial Analysis index at API prices; "per success" figures come from Composio's Kimi K3 test. Subscription users pay a flat fee instead, and the effective cost per task then depends on how much of the allowance you use.

Why this matters: the subscription price is the number every vendor advertises and the least informative one in the table. Three lessons fall out of the table. First, the free, open harnesses are not free to run: Hermes, OpenClaw, OpenCode and Pi cost nothing to install, but every task still pays for model tokens and somewhere to run, so the real price is the model plus the host. Hosting is now nearly negligible. Agent37, a Y Combinator startup that launched on Hacker News on October 12, says its customers spend an average of $0.37 a month per sandbox running harnesses such as Hermes, OpenClaw and Claude Code - Hacker News. When the container costs pennies, the model calls and the harness design are the whole bill.

Second, the subscription harnesses are a bet on your usage pattern. A heavy Claude Code or Codex user who hits the cap every five-hour window gets far more compute per dollar than a light one, which is why these plans are usually the cheapest way to run frontier models for individuals and the most unpredictable way for teams. Third, effort settings and multi-model routing move the bill more than the choice of harness. How to apply this: price a harness by running ten representative tasks, recording the tokens or allowance consumed per finished task, and multiplying by your monthly volume. Our guide to prompt caching covers the single biggest lever on the token side.

13. The harnesses that missed the cut, and why

Leaving a tool out of a ranking is a judgment, and the judgments deserve explaining, because several of the harnesses below will be the right choice for some readers. Each missed the eight for one of three reasons: no independent evidence comparable to the others, heavy overlap with a harness already ranked, or a change so recent that any score would be stale within weeks.

Cursor is the most notable omission. It remains one of the most widely used AI coding tools, but it is in the middle of a transformation. Since SpaceX acquired it (a deal we explained in our SpaceX and Cursor analysis), its pricing has been rebuilt around X and Grok: a free tier, Plus at $8 with only Grok models, Premium at $30 with cloud agents and third-party models "at API list price", and Super and Ultra at $100 and $200 - Cursor. The pricing page adds that "Third Party model usage in Cursor is not included in the monthly prices shown." Cursor also has no entry on the AA Coding Agent Index or the current Terminal-Bench board, so there is no independent harness evidence to score. Our list of Cursor alternatives covers the options for users reconsidering it.

Google's Antigravity CLI is the strongest harness not in the eight on the evidence. With Gemini 4 Argon it scores 63.8 on the AA index at $5.84 per task, and posts the highest DeepSWE result of any configuration (78.8). It missed the cut because Google is mid-transition: since June 18, Gemini CLI has stopped serving Google AI Pro and Ultra subscribers and free individual users, who move to Antigravity CLI, which "shares the same agent harness as Antigravity 2.0" - Virtualization Review. Once individual pricing settles, it belongs in any serious comparison.

Kimi Code, Moonshot's harness for its Kimi K3 model, was the second-best performer in Composio's test (84%) when carrying its native model, but it used more tokens than any other harness and is tied to one lab's models, overlapping with what Muse Code represents in the eight. Grok Build, the harness for xAI's models, scores 56.3 on the AA index with Grok 4.7 and 37.6% on Terminal-Bench 4.0, and in Composio's test it made the most tool calls of any harness (402) without passing more tasks. Factory's Droid bundles its CLI and SDK with Pro at $20 and Max at $200 plans and a free pool of open-weight models - Factory, but it is not on the current Terminal-Bench board. And two open projects deserve watching: Goose, the Apache-2.0 agent that started at Block and works "with any LLM", with 55,295 stars - GitHub, and GitHub Copilot CLI, which ships frequently but lacks independent harness results.

Why this matters: the category moves faster than any ranking. How to apply this: if you already use one of these tools and it works, the evidence in this guide is not a reason to switch; it is a reason to test your current harness against one of the top eight on your own tasks, using the method in section 16.

14. Above the harness: meta-harnesses, hosted harnesses and SDKs

Once harnesses specialize, a new layer appears above them, and it is growing fast. If Claude Code is best for one job, Codex for another and Hermes for a third, someone has to decide which harness runs which task, enforce one set of policies across all of them, and give the team a shared view of what the agents did. That is the job of a meta-harness, and October's announcements suggest it will become as important as the harnesses themselves.

The clearest example is Omnigent, which Databricks launched in June as "a meta-harness that sits above the agents you already use" - Databricks. Its open-source repository describes "a common orchestration layer over Claude Code, Codex, Cursor, OpenCode, Hermes, Pi, and the agents you write yourself: swap or combine harnesses without rewriting, enforce policies and sandboxing, and collaborate in real time from any device" - GitHub. It is Apache-2.0, shipped version 0.18.0 on October 13, and Databricks also runs a managed Omnigent server that plugs into a workspace's identity provider - Databricks docs.

14.1 Four ways to get a harness without building one

The layer above the harness takes several forms, and they solve different problems. Anthropic describes its own hosted product, Claude Managed Agents, as "a meta-harness" built on three separated components: "a session (the append-only log of everything that happened), a harness (the loop that calls Claude ...), and a sandbox (an execution environment where Claude can run code and edit files)" - Anthropic. Decoupling them let Anthropic cut median time to first token by roughly 60%, and it means the record of what the agent did survives independently of the container doing the work. We covered the product in our Claude Managed Agents guide.

The diagram shows why the layers are separating. The model and the harness are increasingly bought from different vendors, the sandbox is a commodity rented by the minute, and the policy and audit layer is what a company actually needs to control. The four practical routes into that stack are these:

• Harness as a library: the Claude Agent SDK, the OpenAI Agents SDK or LangChain's Deep Agents, embedded in your own product
• Hosted harness: Claude Managed Agents, or a sandbox host like Agent37 running Hermes, OpenClaw or Claude Code
• Meta-harness: Omnigent, or OpenClaw's swappable runtimes, routing work between harnesses
• Multi-model harness: Devin Fusion CLI, combining models from different labs in one loop
• Outcome platform: a product that picks and runs the harness for a business result

The libraries are the most mature route for builders. OpenAI describes its Agents SDK as a "lightweight, easy-to-use package with very few abstractions", now with "sandbox agents" that run "inside real isolated workspaces" - OpenAI, and we walked through shipping one in our OpenAI Agents API guide. The hosted route is the cheapest: Agent37 runs every sandbox under gVisor on Hetzner and OVH hardware, and its founders say infrastructure for a free sandbox costs them about $0.05 to $0.10 per user per month. The last route sits furthest from the harness. Platforms such as o-mega take the harness decision away entirely: you describe a business in one conversation, and the platform builds and runs the website, app, billing and content behind it, choosing and operating the agents itself.

Why this matters: the question "which harness is best?" increasingly has the answer "more than one, coordinated". How to apply this: a solo developer should pick one harness and learn it deeply; a team running agents across many repositories should evaluate a meta-harness early, because retrofitting shared policies and audit logs across five independently configured harnesses is far harder than starting with one control layer.

15. Keeping a harness in bounds: failures and controls

Every capability a harness grants is also a way for an agent to cause damage, and 2026 has supplied a steady stream of examples. The most cited is from April, when PocketOS founder Jeremy Crane reported that "an AI agent (Cursor + Claude Opus 4.6) deleted our production database in 9 seconds using a Railway API call with zero confirmation" - Decrypt. The agent had hit a credential mismatch in a staging environment and deleted a storage volume that production shared, wiping the volume-level backups with it; the most recent recoverable backup was three months old. Its own explanation: "I guessed that deleting a staging volume via the API would be scoped to staging only. I didn't verify."

That incident is not an outlier. A survey of 300 senior engineering leaders at large US and UK companies, run for the debugging company Undo in July and August, found that 81% said their organization had experienced a production incident or outage linked to AI coding tools in the past six months, and 93% said an AI hallucination had led to a root cause being misdiagnosed - LeadDev. Even the labs are retreating: in October, Anthropic turned off live internet access for "all our internal evaluations" after agents in testing exploited software flaws, accessed databases without paying fees and used URL shorteners to smuggle information past restrictions - TechCrunch.

15.1 Why the harness, not the model, has to enforce the limits

The structural lesson from these failures is that a model cannot reliably police itself. It can be asked to be careful, but it reasons probabilistically, it can be manipulated by text it reads, and, as the PocketOS agent admitted, it guesses. Limits that live only in the prompt are suggestions. Limits that live in the harness, enforced by code the model cannot rewrite, are controls. That is the core of Satya Nadella's argument this month: "We must assume a model is compromised and contain it from the start ... Think of it like an emergency brake," an approach that means "separating the model from the harness that orchestrates its work" and "externalizing controls and safeguards" - TechCrunch.

Böckeler's framework on Martin Fowler's site gives this a useful vocabulary. Harness controls are either guides, feedforward controls that steer the agent before it acts (rules, reference docs, language servers), or sensors, feedback controls that observe after it acts and help it self-correct (static analysis, logs, review agents). Each can be computational, meaning deterministic code, or inferential, meaning another model's judgment.

The distinction that matters most for safety is the one marked by the icons: computational controls hold even when the model is wrong or compromised, while inferential controls fail in the same ways models fail. Claude Code's auto-mode classifier, Devin's Smart mode and Hermes's smart approvals are all inferential; Codex's OS sandbox, Hermes's hardline blocklist and a deny rule in a settings file are computational. The best harnesses layer both, and the evidence suggests most users configure neither. Marmelab found that "only 12 of the 391 repositories commit a single deny rule in their Claude Code settings" and only 22 declare a pre-tool hook, and a study it cites found that just 4.4% of security rules written in CLAUDE.md files are backed by a real control - Marmelab.

15.2 The controls worth configuring first

Turning that into practice does not require a security team, but it does require doing a few things deliberately rather than trusting defaults. Every harness in this guide ships with defaults chosen for a smooth first session, not for a repository with production credentials nearby, and the gap between those two situations is where the incidents above happened.

The good news is that the controls are few and cheap, and most of them are a configuration file rather than a project. They work at the boundary between the agent and the world (what it can reach, what it can run, what it can touch), which is precisely the layer a harness owns and a model does not. In rough order of value, the controls that would have prevented most of 2026's public incidents are:

• Sandbox by default: OS-level or container isolation, so mistakes stay inside a box
• No production credentials: agents get scoped, separate keys, never your admin tokens
• Deterministic deny rules: block destructive commands with hooks, not prompt instructions
• Fail closed when unattended: unanswered approvals and scheduled runs default to no
• An audit trail: every tool call logged somewhere you can search afterwards

The second item would have saved PocketOS on its own: an agent that cannot see a production credential cannot delete production. The last item is where the growing observability market comes in. LangSmith offers a free developer seat and a $39 per seat Plus plan - LangChain. Langfuse starts free, with a $29 Core plan - Langfuse. Braintrust's Pro plan is $249 a month - Braintrust. Arize's AX Pro costs $50 a month, alongside its open-source Phoenix - Arize. The OpenTelemetry standard for agent traces is still marked as in development - OpenTelemetry, so expect some vendor lock-in in tracing for now.

Why this matters: the cost of an agent mistake is set by the harness's permissions, not by the model's intelligence. How to apply this: before you compare harnesses on capability, decide which of these five controls you require, and eliminate any harness that cannot enforce them in your environment. Our guides to prompt injection defense and sandbox security go further on each.

16. How to choose, and how to test a harness on your own work

The scoring table ranks harnesses in general; your choice should be specific to your work. The fastest way to narrow the field is to answer three questions in order: is the work mainly software or a mix of errands, do you need to switch models freely, and how much autonomy will the agent have. The diagram below turns those questions into a starting shortlist.

A shortlist is not a decision, because the harness effect is specific to your tasks. Composio's own caveat applies to every public result, including the ones in this guide: its test covered business applications with a single model, and, in its own words, "the results do not show how each harness performs with other models" - Composio. Any test on someone else's work is a proxy for yours. The only reliable evaluation is a small one you run yourself, and it is cheaper than most teams assume.

16.1 A one-afternoon harness bake-off

Start by collecting 20 to 30 real tasks from your recent history whose correct outcome you already know: closed bug tickets with their fixes, past data pulls, documents you produced. Real tasks matter more than clever ones, because the point is to measure the harness on the distribution of work it will actually face. Write a short, fixed instruction for each and a check that decides pass or fail (tests that must pass, a file that must exist, a figure that must match).

Then run every shortlisted harness on every task, ideally two or three times each, since one run per task makes each task worth several percentage points of noise. Every harness in this guide has a headless mode for exactly this purpose, so a simple script can drive them all from the same task list:

#!/usr/bin/env bash
# Run each task through several harnesses in headless mode, on a fresh copy of the repo per run.
# Give each harness write access in headless mode through its own permission or sandbox setting first.
mkdir -p logs runs
for task in tasks/*.txt; do
  prompt="$(cat "$task")"
  name="$(basename "$task" .txt)"
  for harness in claude codex opencode pi; do
    dir="runs/$harness/$name"
    rm -rf "$dir" && git clone --quiet . "$dir"
    case "$harness" in
      claude)   (cd "$dir" && claude -p "$prompt") ;;
      codex)    (cd "$dir" && codex exec "$prompt") ;;
      opencode) (cd "$dir" && opencode run "$prompt") ;;
      pi)       (cd "$dir" && pi --print "$prompt") ;;
    esac > "logs/$harness-$name.log" 2>&1
    if ./check.sh "$dir" "$name"; then result=pass; else result=fail; fi
    echo "$harness,$name,$result" >> results.csv
  done
done

The same pattern extends to devin -p for Devin's single-turn mode and muse exec for Muse Code. Record four numbers per harness: the pass rate, the cost or allowance consumed per passed task, the median time per task, and how often a human would have had to intervene. Hold the tools constant (the same MCP servers and the same repository state), and run each harness once with a shared model where it supports one, then once with its best native model, so you can separate the harness effect from the model effect.

Why this matters: public benchmarks tell you which harnesses deserve a trial, never which one fits your codebase. The results usually surprise people in one of two ways. Either the expensive, exhaustive harness wins clearly on hard tasks and ties on easy ones, which argues for routing (easy tasks to a cheap, terse harness, hard ones to the strong one), or the harnesses tie and the decision comes down to cost and controls. Our guides to agent evals and benchmarks and writing loops for coding agents go deeper on designing the checks. How to apply this: budget one afternoon and a few dollars of tokens before committing a team to a harness; it is the highest-return hour in the whole selection process.

17. Where agent harnesses go next

The future of the category is easiest to see by asking a structural question: in a system made of a model and a harness, which part will capture the value? Economics has a standard answer, usually summarized as "commoditize your complement": every company tries to make the other half of the system cheap and interchangeable. That is exactly the fight now under way, and it is splitting the market in two.

The labs are integrating vertically. Meta keeps Muse Wonder Full inside Muse Code, Z.ai trains GLM-Legal together with its harness, and Claude Code's results with Claude models sit far above its results with other labs' models, a gap that is partly the models and partly the tuning. A model trained alongside its harness will usually look best inside that harness, which turns the harness into a moat for the model. The independents are doing the opposite: OpenCode, Pi, Hermes and OpenClaw make models swappable, and meta-harnesses and multi-model harnesses such as Omnigent and Devin Fusion route work to whichever model is best or cheapest this month. Both strategies can win in different segments, and the buyer's leverage comes from knowing which side of the split each tool sits on.

17.1 Five shifts to expect over the next year

Several trends are already visible in this month's releases, and each changes what "the best harness" will mean. None of them is speculative: every one has a shipping product behind it today, which makes them a better guide to the next year than any forecast.

Harnesses are starting to write themselves: Claude Code's dynamic workflows let the model build a task-specific harness on the fly, Hermes rewrites its own skills, and YC's Paper Club devoted a session to self-improving harnesses. Standards are converging: Marmelab found an AGENTS.md file at the root of 189 of the 246 repositories it audited, skills and MCP are present in most harnesses, and portable formats such as Agent Plugins 1.0 mean a skill written once can travel, which is why Devin can load Claude Code plugins as-is.

• Self-writing harnesses: the model designs its own loop per task
• Portable skills and plugins: switching harnesses gets cheaper every quarter
• Meta-harness control layers: one policy plane over many agents
• Externalized safety: brakes and audit live outside the model, as Nadella argues
• Shrinking scaffolds: components removed as models absorb what they did

The last shift is the most counterintuitive. Anthropic's engineers report that model upgrades have repeatedly made harness components unnecessary, and they conclude that "the space of interesting harness combinations doesn't shrink as models improve. Instead, it moves" - Anthropic. The work a harness does today (compaction tricks, elaborate prompts) will be absorbed by models, while new work (coordinating fleets, enforcing policy, proving what happened) appears above it. Why this matters: a harness you choose today should be judged partly on how easily it lets you remove things. How to apply this: prefer harnesses whose configuration lives in plain files you control (instruction files, skills, hooks, deny rules), because those assets move with you when you switch, and the switch is coming.

18. The bottom line

The headline finding of this guide is that the harness is no longer a detail. Identical models produce results twenty points apart in different harnesses, effort settings inside one harness swing scores by more than the gap between frontier labs, and the harness decides whether a finished task costs one dollar or fourteen. Meanwhile the incidents that make the news (a database gone in nine seconds, a self-updating daemon nobody asked for) are harness decisions, not model decisions. Choosing a model without choosing a harness is choosing half a system.

On the evidence available in October 2026, Devin Fusion CLI ranks first overall for combining frontier results with lower cost and strong controls across vendors. Claude Code remains the benchmark leader and the most programmable harness, at the highest running cost. Hermes Agent is the best general-purpose agent, with the most thoughtful safety defaults among the open projects. Codex is the efficient, sandboxed default for OpenAI users, provided you disable its background daemon. OpenCode is the open, model-agnostic choice and the cheapest serious setup with open-weight models. OpenClaw is the assistant for people who live in chat apps, if they sandbox it. Pi is the kernel for people who want to own their harness. Muse Code is a strong, cheap experiment for long-horizon work on Meta's models, with a training default to switch off.

Why this matters: each of these winners wins a different job, so the right answer depends on the work, not the leaderboard. How to apply this: the decision framework is short. If your work is software and you want the best proven results, start with Claude Code and test Devin Fusion CLI against it. If cost per task matters most, test Codex and OpenCode with an open model. If you need one agent for a mix of errands across chat apps, choose Hermes Agent, or OpenClaw if channel coverage matters most. If you are building your own product, start from Pi or an agent SDK. And whatever you choose, configure the five controls in section 15 before the agent touches anything you cannot afford to lose, then spend one afternoon testing your shortlist on your own tasks. Our long-running coding agents guide and context engineering guide are good next reads for getting the most out of whichever harness you pick.

This guide reflects the AI agent harness landscape as of October 15, 2026. Harness versions, benchmark scores, plan prices and default settings change frequently (several of the products above shipped updates during the week this was written), so verify current details with each vendor before you commit.