The harness beat the model: two hard benchmarks proved the wrapper drives cost and much of quality — the same week the labs bundled their harnesses into suite defaults.

Build

Harness Profile Engineering

Treat the harness — system prompts, tool descriptions, middleware, subagent policies — as a tunable, versioned artifact per model: baseline the model in a generic harness, mine the failure patterns, override only the harness layers, and re-score at matched quality until cost and reliability converge.

Two independent studies this week showed the harness now swings agent economics more than model choice: over 2x per-task cost differences at equal quality (Databricks), and near-Opus quality from an open model at ~10x lower cost via harness tuning alone (LangChain/NVIDIA). That makes harness engineering the highest-ROI optimization available to agent operators — no retraining, no model migration, just disciplined iteration on the wrapper. It also transfers: every finding applies to routing, budgeting, and vendor-lock decisions.

Baseline

Run the target model through a generic harness on a task suite built from your own real work — Databricks reconstructed tasks from merged PRs and graded with held-out test suites, not LLM judges — to get an honest cost-and-quality floor.

Mine failures

Read the transcripts for failure patterns specific to the model: tool-call formatting quirks, over-fetching context, premature termination, verbosity. LangChain's profile work started from exactly this transcript audit on Nemotron 3 Ultra.

Override the harness only

Encode fixes as declarative per-model overrides — system prompts, tool descriptions, middleware, subagent and skill policies — leaving model weights and the task suite untouched, so improvements are attributable to the harness alone.

Re-score at matched quality

Compare cost per task at equal quality, not per-token price: Nemotron went from 0.80 baseline to 0.86 best-run (vs Opus 4.8's 0.87) at ~$4.48 vs $43.48 per suite run. Guard against context bloat — the cheap harness in Databricks' data sent ~3x less context per turn.

Ship as a registrable artifact

Package the tuned configuration as a versioned profile applied automatically on model detection (LangChain's HarnessProfile pattern), so routing to a new model means selecting a profile, not rebuilding the stack.

• LangChain/NVIDIA's Nemotron 3 Ultra profile: near-Opus Deep Agents quality at ~10x lower cost with no retraining, shipped with NVIDIA's NemoClaw reference blueprint
• Databricks' benchmark practice: sealing git history during runs after agents recovered 'correct' solutions from the worktree's commit log — harness-level leakage control
• Default per-model harness profiles yielding a 10-20 point jump on a tau2-bench subset over a generic harness (LangChain)
• Local-first equivalents: llama.cpp serving Hy3 with MTP speculative decoding (+40% throughput) behind OpenAI-compatible endpoints consumed by Claude Code, Codex, and OpenCode

Sources Databricks Engineering; LangChain Blog; NVIDIA Blog

2026-07-09 · OpenAI · Automate

ChatGPT Work + unified desktop app

The Codex task runtime generalized to all knowledge work: hours-long autonomous runs across apps and files, scheduled and trigger-based tasks, finished documents and web apps as outputs ('Sites' beta), with Codex gaining inline diff editing and side-panel PR review in the merged desktop app.

The harness the benchmarks just proved decisive is now a suite default reaching Free users — and Enterprise/Edu workspaces auto-enable after a two-week off-by-default preview. Operators should set admin posture before the window closes, and size intake and review queues for agent work arriving from every desk, not just engineering.

Sources OpenAI; The Verge

2026-07-07 · Anthropic · Cowork

Claude Cowork (web + mobile, cloud-run sessions)

Cowork sessions now run in the cloud by default — tasks continue with zero devices online, sync across devices, and push mobile notifications for review and approval steps; usage data from 1.2M sessions across 600,000+ orgs shows the majority of use is non-coding knowledge work.

The supervision surface moved to the phone: approval notifications are now the human-in-the-loop checkpoint for always-on agents. Leaders should define what may be approved from a lock screen versus what requires a desktop review, before mobile-approval habits set themselves.

Sources Anthropic

2026-07-10 · Cursor · Build

Cursor 3.11 conversation-level hooks + CLI subagent persistence

Team hooks extended from tool/file/shell events to the conversation itself — beforeSubmitPrompt, afterAgentResponse, afterAgentThought, subagentStart, stop, and compaction hooks — plus durable parallel side chats, local transcript search across thousands of conversations, and CLI subagents that persist checkpoints across resumes.

Conversation-level hooks are the building block for custom self-correcting loops and centralized agent observability — exactly the harness-layer control the week's benchmarks reward. Platform teams should prototype prompt-linting and response-audit hooks now; transcript search makes past agent behavior a queryable asset.

Sources Cursor Changelog

2026-07-10 · Anthropic · Automate

Claude Code v2.1.202-207 (six releases in-window)

Background agents now self-upgrade after updates instead of paying a stale-session penalty; EnterWorktree requires confirmation outside the project's worktrees directory; a plugin-hook shell-injection vector was closed; usage-credit purchases over $1,000 require typed confirmation; and Auto mode became default-available on Bedrock, Vertex AI, and Foundry.

The autonomy expansion (Auto mode in enterprise-managed clouds) shipped in the same window as its guardrails (spend confirmation, worktree boundaries, injection fix) — the pattern to demand from every vendor. Automation owners on Bedrock/Vertex/Foundry should decide their disableAutoMode posture now rather than discovering the default in an audit.

Sources Anthropic (GitHub releases; Claude Code changelog)

2026-07-08 · Microsoft Research · Cowork

Flint (visualization intermediate language + MCP server)

An open-source chart intermediate language with an MCP server that lets agents produce reliable, schema-validated visualizations instead of hallucinating chart code — surfaced at 344 points on Hacker News before broad coverage.

Deterministic intermediate representations are the transferable pattern: wherever agents produce structured artifacts (charts, diagrams, reports), a validated IR between the model and the output removes a whole failure class. Teams generating agent-built dashboards should evaluate Flint's MCP server before writing another chart-prompt template.

Sources Microsoft Research; Hacker News

2026-07-08 · LangChain / NVIDIA · Harness

HarnessProfile + NemoClaw reference blueprint

A registrable, declarative per-model harness override artifact — prompts, tool descriptions, middleware, subagents, skills — applied automatically on model detection, shipped alongside NVIDIA's NemoClaw blueprint pairing the tuned harness with the OpenShell secure runtime.

This is 'tune the harness, not the model' as a distributable artifact rather than a blog post — the first packaging of harness engineering into something a platform team can version, review, and roll back. Registry-managed harness profiles are the likely shape of multi-model agent operations; adopt the pattern even if you never use these specific profiles.

Sources LangChain Blog; NVIDIA Blog

2026-07-09 · llama.cpp / local-first · Harness

Hy3 MTP speculative decoding (PR #25395)

Native hy_v3 support converting the model's multi-token-prediction head into a speculative-decoding draft: 24.3 vs 17.4 tok/s (+40%) at 91% draft acceptance on consumer hardware — with confidence gating mattering enormously (97.3% acceptance at a 0.75 draft threshold vs 38.6% without).

Self-hosted agent serving just got a free throughput upgrade wherever an MTP-equipped open model ships — and the local-first pattern (llama.cpp/vLLM behind OpenAI/Anthropic-compatible endpoints consumed by Claude Code, Codex, OpenCode) makes it drop-in for existing agent stacks. Surfaced via r/LocalLLaMA before mainstream coverage; verified against the primary repo.

Sources GitHub (llama.cpp PR #25395); Hugging Face (satgeze/Hy3-1M-GGUF)

2026-07-07 · Open-source / local-first · Template

Rowboat — local-first 'AI coworker with memory'

An open-source, local-first alternative to Claude Desktop that operators run on their own machines, positioning memory and workspace state as user-owned rather than vendor-hosted.

The counter-pattern to this week's suite consolidation: as ChatGPT Work and Cowork pull harness state into vendor clouds, the local-first lane keeps task history, memory, and approvals on hardware you control. Worth piloting for teams whose data-governance posture cannot accept cloud-run agent sessions.

Sources Rowboat (GitHub)

2026-07-06 · GitHub / MCP security · Connector

GitLost disclosure — prompt-injection exfiltration via public issues

Noma Labs showed an unauthenticated attacker exfiltrating private-repo contents from GitHub Agentic Workflows via a crafted public issue — no credentials required, guardrails bypassed by adding the word 'Additionally', leaked data posted as a public comment.

The connector lesson, not just a CVE: any agent with cross-repository read access and public-input exposure is an exfiltration channel, and keyword-level guardrails do not hold. Add least-privilege repo scoping and treat the agent's context window as attack surface in every connector review — before your own workflows get the treatment.

Sources Noma Security; Hacker News (538 points)

Evidence · Benchmark

Databricks · Coding-agent benchmarking on a production multi-million-line codebase

On tasks reconstructed from real merged PRs and graded by held-out test suites, the same model at the same effort cost over 2x more per task across harnesses at equal quality; GLM 5.2 statistically tied Opus 4.8 at $1.28 vs $1.94 per task; and Sonnet 5 cost more per task than Opus 4.8 ($2.09 vs $1.94) despite a ~1.7x cheaper rate card, consuming 1.9x more tokens.

The most procurement-relevant agent benchmark published this year: internal, but methodologically serious (held-out tests, no LLM judges, sealed git history after agents mined the commit log for answers). The read-across is direct — per-token price is a poor proxy for per-task cost, and your harness choice is probably worth more than your next model negotiation.

Sources Databricks Engineering Blog

Evidence · Benchmark

LangChain + NVIDIA · Harness tuning for open-model agent quality

Tuning only the harness around Nemotron 3 Ultra lifted Deep Agents suite scores from 0.80 baseline to 0.86 best-run (vs Opus 4.8's 0.87) at ~$4.48 vs $43.48 per full-suite run — roughly 10x cheaper at matched best quality with ~10s median latency parity, no retraining.

Vendor-adjacent (both parties benefit from the result) but published with methodology and shipped as a reusable artifact, which raises the credibility bar. The transferable finding is the magnitude: if harness tuning is worth 6 points and 10x cost, every team running open models below frontier quality should exhaust the harness before blaming the model.

Sources LangChain Blog; NVIDIA Blog

Evidence · Vendor Claim

OpenAI · Codex adoption beyond software development

Over 5 million people use Codex weekly, more than 1 million of them outside software development — the stated rationale for generalizing the Codex harness into ChatGPT Work.

Unverified vendor telemetry, but the strategic disclosure matters regardless of the exact numbers: OpenAI is claiming a fifth of its agent-runtime users already do non-coding work, and it restructured its flagship product around that claim. Treat the number as directional and the product decision as the real evidence.

Sources OpenAI announcement

Evidence · Practitioner Report

Colibri (open-source project) · Frontier-class open MoE on consumer hardware

A pure-C, zero-dependency engine runs the 744B-parameter GLM-5.2 in 25GB of RAM by streaming expert weights from disk on demand — 876 Hacker News points and ~3,200 GitHub stars within ten days.

A working demo with public code, not a benchmark — latency is the undisclosed cost of disk streaming, so this is accessibility proof rather than production guidance. The signal is directional: the hardware floor for near-frontier open models keeps dropping through community engineering, which compounds the open-weight agent economics documented elsewhere this issue.

Sources GitHub (JustVugg/colibri); Hacker News

Permissioning

GitLost is the mandatory case study: an agent with cross-repo read access plus public-input exposure leaked private repos to an unauthenticated attacker, and a single added word ('Additionally') bypassed the guardrails. Enforce least-privilege repo scoping per workflow, isolate agents that read public inputs from private data, and assume keyword guardrails fail.

Cost

Claude Code now requires typed confirmation for usage-credit purchases over $1,000, and the week's benchmarks make harness-level cost review a governance item, not an engineering nicety — the same model can cost 2x more per task depending on wrapper. Add harness choice to the spend-review checklist alongside model and effort level.

Human Approval

ChatGPT Work auto-enables for Enterprise/Edu after a two-week off-by-default preview, and Cowork's mobile push approvals move the human gate to the lock screen. Define now which agent actions may be approved from mobile, which require desktop review, and who owns the suite-default decision before the vendors' defaults decide for you.

Auditability

Cursor 3.11's conversation-level hooks (prompt, response, thought, subagent, compaction) plus local transcript search make full agent-session observability buildable in-house — the harness layer now exposes enough events to stream agent behavior into existing audit pipelines. Teams that asked for this capability in W27 should prototype against it now.

Reliability

Claude Code's background agents now self-upgrade post-release and require confirmation before entering worktrees outside the project boundary — small changes that close real drift and blast-radius gaps in scheduled-agent fleets. Auto mode defaulting on in Bedrock/Vertex/Foundry means enterprise-managed deployments inherit more autonomy unless explicitly disabled.

Benchmark your harness as an independent variable on ten real tasks

Expected outcome: You learn whether the 2x harness cost swing reproduces on your own work, and you leave with a defensible per-task cost baseline that turns the next model-vendor negotiation — and the next 'we need a bigger model' request — into an evidence question.

• Pick ten completed tasks from your own history (merged PRs, finished documents, resolved tickets) and write a one-line verifiable success check for each — the Databricks move of grading against held-out reality instead of judgment (~10 min).
• Run the same model at the same effort level through two harnesses you already have access to (e.g., Claude Code vs Cursor CLI, or your platform's generic agent vs a tuned profile), capturing per-task token counts and wall-clock from the session telemetry (~15 min).
• Compare cost per completed task at matched quality, then write the result into your routing policy: which harness wins for which task class, and what per-task cost threshold triggers a re-route. If the spread exceeds 1.5x — the published data says it will — schedule a harness-profile tuning pass before your next model contract renewal (~5 min).

Jul 22-23

ChatGPT Work auto-enable window closes for early Enterprise/Edu workspaces

The first mass agent auto-enablement in enterprise software — watch whether admins opt out at scale, and whether OpenAI publishes adoption data that validates the default-is-the-sale distribution model.

July 2026

Harness-profile pattern spreads beyond LangChain

If GitHub, Cursor, or a model vendor ships registrable per-model harness configurations (or per-task cost telemetry — prediction p58), harness engineering becomes a standard platform discipline rather than a benchmark finding.

July-August 2026

GitHub's response to GitLost

The disclosure showed keyword guardrails failing against a one-word bypass; watch for architectural fixes (least-privilege workflow scoping, context-window isolation) versus more filter patches — the answer sets the bar for every agentic-workflow product.

Within weeks

vLLM-class productionization of MTP speculative decoding

The +40% local-throughput result on Hy3's MTP head moving into production serving stacks would cut self-hosted agent serving costs across every MTP-equipped open model — the local-first lane's answer to suite bundling.

Aug 31

Sonnet 5 intro pricing ends with per-task data now public

Databricks showed Sonnet 5 already costs more per task than Opus 4.8 at intro pricing; the step-up to $3/$15 makes harness-level routing review a hard deadline for fleets built on the intro rate.

• W28 spotlights Harness Profile Engineering (mode: build): baseline in a generic harness, mine failure patterns, override only the harness layers, re-score at matched quality, ship as a registrable profile — grounded in the Databricks and LangChain/NVIDIA benchmarks.
• Lead-technique mode stays build (W27: Agentic MapReduce); the connective tissue is verification-first orchestration, now extended from sandbox reproduction to held-out-test cost benchmarking.
• New coverage lane: local-first agent operations (llama.cpp MTP speculative decoding, Rowboat, colibri) — surfaced via r/LocalLLaMA and Hacker News under the pipeline's new community-discovery sources, each verified against primary repos.
• Security thread continues from W27's MCP tool-collision CVE: GitLost moves the threat from tool naming to context-window injection via public inputs, with least-privilege scoping as the recurring control.