Harness engineering: the software layer that turns a model into an agent

The clearest thing anyone has written about agent architecture in 2026 is an equation, and it fits on one line: an agent is a model plus a harness. The model is the part you rent, it is probabilistic, and its behaviour is not yours to guarantee. The harness is every piece of code, configuration and execution logic that is not the model, and it is the part you own, version, test and answer for. This article sets out what is actually in a harness, using the sources that can be checked, and names the two widely quoted figures about agent failure that cannot.

• A conceptual analysis published in June 2026 gives four necessary and sufficient conditions for a system to be a harness: an agent loop, a tool interface, context management and control mechanisms [1].
• A source-code audit of eleven production coding harnesses, across roughly four million lines of Python, TypeScript and Rust, found that none imports a general-purpose agentic framework and none retrieves code with vector embeddings [2].
• Reflexion reached 91% pass@1 on HumanEval against 80% for the same underlying GPT-4 baseline, which is the cleanest published case of a harness change beating a model change [3].
• The two figures most often quoted to justify harness work, “88% of agent initiatives fail” and “65% of failures are infrastructure”, have no traceable source, while the figures that do have one say something narrower.

1. An agent is a model plus a harness

The term settled into a usable definition over six months in 2026, and it is worth recording who said what, because the vocabulary is young enough that misattribution is already circulating.

• Mitchell Hashimoto named the practice in February 2026, without claiming the term was established: “I don’t know if there is a broad industry-accepted term for this yet, but I’ve grown to calling this ‘harness engineering.’ It is the idea that anytime you find an agent makes a mistake, you take the time to engineer a solution such that the agent never makes that mistake again” [4].
• Vivek Trivedy, who leads applied research at LangChain, published the equation in March 2026 with a definition that does the work: “A harness is every piece of code, configuration, and execution logic that isn’t the model itself” [5].
• Birgitta Böckeler set out the engineering discipline in April 2026 and made a distinction that matters commercially, between the builder harness shipped by whoever built the agent and the user harness an engineering team assembles on top for its own system and codebase [6].
• OpenAI put a figure on the stakes in the same month, reporting an internal five-month build of roughly one million lines of code across about 1,500 pull requests by seven engineers, with, in its own words, “0 lines of manually-written code”, and summarising the division of labour as “Humans steer. Agents execute.” [7]. It is a company statement about its own tooling, not an audited result.
• The idea is older than the word. The UK AI Safety Institute described the same layer in October 2024 and called it scaffolding: “a model is provided with a ‘scaffolding’, which consists of a set of tools, a prompting procedure, and error handling” [8].

The strongest definition available is a constitutive one, published in June 2026, which states what a system must have to count as a harness at all.

• The four conditions are an agent loop that interleaves reasoning, action and observation; a tool interface that lets the model perceive and alter the environment; context management that decides what enters and leaves the window; and control mechanisms, meaning limits, verification and deterministic actions [1].
• Each is argued from what its absence produces: “Without an agent loop, the system answers once and stops; it is a generator, not an agent”, and “Without control mechanisms, the system acts, but no one can tell whether it did what it claims, nor is there a way to contain it” [1].
• The definition also excludes, deliberately, an agent framework, an agent SDK, an IDE plugin, an evaluation harness and an orchestrator, which is what makes it usable as a test rather than as a slogan.
• The same paper reconstructs the genealogy of the word, from Old French harneis through the fourteenth-century sense of the straps that connect a draught animal to a cart, to the software test harness with its scripts, mocks and stubs, and then to the machine-learning evaluation harness [1].

The three tiers of intervention are usually presented as a progression, and the useful way to tell them apart is to ask what you are allowed to change.

• Prompt engineering changes the wording of a directive and nothing else, which is why it stops working as soon as the failure is structural. We set out that limit when the practice was still being sold as a job title, in designing reliable context for AI.
• Context engineering changes what enters and leaves the attention window: selection, ordering, compression, retrieval. The arithmetic of that tier, including KV cache and prompt caching, is in our guide to sizing the context window.
• Harness engineering changes the environment itself: which tools exist, where code runs, what the agent may read, what stops it. A harness problem is recognisable because no rewording fixes it.
• A pairing between “harness engineering” and “loop engineering” circulates widely in 2026 commentary, the first said to build the environment and the second the iteration dynamics. It is a serviceable teaching device, but none of the authors above frames the discipline that way, and it should be read as blog vocabulary rather than as a settled distinction.

2. What eleven production harnesses actually contain

The most useful empirical work on harnesses reads their source code rather than their marketing, and it was published in 2026 as an audit of eleven production coding agents plus one meta-harness as a contrast point [2].

• The systems audited are Claude Code, Codex CLI, Gemini CLI, Mistral Vibe, OpenHands, Aider, Mini-SWE-Agent, Hermes, Pi, OpenCode and OpenClaw, across roughly four million lines of Python, TypeScript and Rust.
• The paper maps seven canonical subsystems: the agent loop, LLM integration, tools and actions, memory and context, safety and permissions, orchestration, and extensibility, each with its minimal and maximal implementation.
• It yields thirteen cross-cutting observations and a catalogue of twenty-nine recurring design patterns, and closes with a ninety-line minimum viable harness.
• Its definition matches the constitutive one: “The harness is everything except the model: the runtime that couples an LLM to the world, its loop, its tools, its context, its safety controls, its orchestration, and its extension surfaces” [2].

Two findings survived an expansion of the corpus, and both cut against what the tooling market says about itself.

• No agent runtime in the sample imports a general-purpose agentic framework. LangChain, AutoGen and LangGraph are absent from all eleven systems, which run on hand-rolled asynchronous loops.
• None retrieves code with vector embeddings. Retrieval is deterministic: ripgrep, tree-sitter, glob patterns and auto-discovered Markdown context files.
• Agent skills lead the Model Context Protocol in adoption, nine systems against eight, and the Agent Client Protocol ships in six.
• Read together, those numbers describe a field that has quietly abandoned two of the architectures most confidently recommended to enterprises between 2023 and 2025.

The equestrian metaphor buried in the word turns out to be a serviceable map of those subsystems, provided each piece of tack is cashed out as a real component rather than left as an image.

Piece of tack	Harness subsystem	What it does deterministically
Bit and reins	Typed tool contracts, schemas, protocol servers	Constrains free text into calls that either validate or fail
Blinkers	Context assembly, domain instructions, skills	Decides what the model sees before it decides anything
Fences	Sandboxes, permissions, policy checks between proposal and execution	Bounds what an action can reach, including under compromise
Saddle and stirrups	Persistent filesystem, checkpoints, working documents	Holds state outside the attention window, and allows rollback
Saddlebags	External memory stores and retrieval	Recalls facts without carrying them in working memory
Reins held short	Step limits, timeouts, stop conditions	Ends a run that is consuming budget without converging

3. The reins: typed contracts, not a shell prompt

The link between what the model emits and what the machine does is the place where a harness either holds or does not, and the research framing for it is the agent-computer interface.

• The term comes from SWE-agent, whose premise is that agents are a new category of end user: “we posit that LM agents represent a new category of end users with their own needs and abilities, and would benefit from specially-built interfaces to the software they use” [9].
• The paper’s contribution is that interface design changes measured performance, and it closes by giving “insight on how the design of the ACI can impact agents’ behavior and performance”, which is the empirical claim underneath every tool-schema recommendation since.
• In practice this means functions with declared types and documented failure modes, not a shell the model may type into freely, because an invalid call should fail at the boundary rather than halfway through a side effect.
• The Model Context Protocol has become the common carrier for that boundary. Anthropic donated it to the Agentic AI Foundation, a directed fund under the Linux Foundation, in December 2025, and a substantial specification revision followed in July 2026 [10].

One design rule deserves stating plainly, because it is widely practised and has no established name: the final answer of an agent should be split, so that the narrative part is written by the model and the quantitative part is passed through from the system of record without the model retyping it.

• Totals, identifiers, dates and account states are copied by the harness from the query result into the response payload, and the model is given the prose around them.
• The failure this prevents is specific and expensive: a model that reformats a correct table and silently alters one figure produces an error no schema validator will catch, because the output is still well formed.
• Describing this as a named industry pattern would be overclaiming. It is an application convention, and we present it as one.

4. The loop: reason, act, observe, and the problem of the poisoned trace

The loop is the oldest of the four conditions and the best documented, and its characteristic failure is that the agent’s own wrong reasoning stays in the window and is read back as evidence.

• ReAct established the interleaving that almost every runtime still uses, “the use of LLMs to generate both reasoning traces and task-specific actions in an interleaved manner, allowing for greater synergy between the two” [11], and Toolformer showed the complementary half in the same period: a model can teach itself when and how to call an external API from a handful of demonstrations, with no annotation of which calls to make [12].
• The pathology of the naive version is that a failed attempt does not leave the history. The next step reads it, treats it as context, and produces a variation on the same mistake.
• Reflexion separates the roles: the agent attempts, an external signal evaluates, and a critic analyses the gap in words before the next attempt. It reported 91% pass@1 on HumanEval against 80% for the same GPT-4 baseline [3]. The benchmark has since saturated and the model is three generations old, so the architecture is the part that transfers, not the number.
• The Ralph technique answers the other failure, the agent that stops early or drowns in its own transcript, by restarting it with a clean window and nothing but the state it was required to write to disk [13]. It is a shell loop in its original form, and its point is that the continuity of the work lives in the filesystem rather than in the conversation.

5. The fences: the part that thinks must not be the part that acts

An agent that reads untrusted content and holds execution privileges has already lost the argument, because an instruction hidden in a retrieved page arrives at the reasoning step with the same status as the user’s own instruction.

• Simon Willison described the structural answer in April 2023 as the dual LLM pattern: a privileged model that never sees untrusted content, and a quarantined model that does, with no path from the second to any tool [14].
• CaMeL formalised it with a control and data flow model in which a privileged model plans, a quarantined model parses untrusted data, and a custom interpreter enforces capabilities before each tool call [15].
• The 2025 taxonomy of design patterns for securing agents against prompt injection generalises the family, and its central constraint is worth quoting as a design rule: once an agent has ingested untrusted input, its remaining actions must be constrained in advance rather than judged after the fact [16].
• A 2026 preprint proposes the same separation under the name cognitive-executive separation, with an evaluation that deliberately bypasses the reasoning layer to test the architectural boundary under full compromise, reporting 98.9% of 280 adversarial cases blocked across nine attack categories with no false positives in the default configuration [17]. It is a single-author preprint with a self-built benchmark, so the architecture is the transferable part and the percentage is not.

The question of where untrusted content actually enters has a concrete answer, and it is the tool description rather than the tool output.

• The protocol’s own specification says so. “Tools represent arbitrary code execution and must be treated with appropriate caution. In particular, descriptions of tool behavior such as annotations should be considered untrusted, unless obtained from a trusted server” [10]. The same document concedes that “while MCP itself cannot enforce these security principles at the protocol level”, implementors should.
• Luca Beurer-Kellner and Marc Fischer demonstrated the attack in April 2025 and named it tool poisoning: instructions embedded in a tool description, “invisible to users but visible to AI models”, exploiting the fact that the model reads the full description while the interface shows a simplified one [18]. Their second demonstration is the one to remember. A malicious calculator tool silently overrode a trusted email tool, and “the agent willingly sends all emails to the attacker, even if the user explicitly specifies a different recipient”.
• Approval is not durable either. A tool definition can change after it has been trusted, a pattern named a rug pull by the proposal that would fix it with signed, versioned definitions, on the observation that the protocol has no versioning, content hash or re-approval on change [19]. CVE-2025-54136 is the same mechanic in the wild: swapping an approved server configuration in a shared repository for a malicious command, with no new consent prompt.
• The population has been measured, and it does not reassure. A study of 67,057 servers across six public registries found 833 carrying exploitable code weaknesses and 18 advertising suspicious descriptions [20]. A dynamic audit in July 2026 confirmed 640 internet-facing servers in production, tested 414 of them, and reported 91.8% with no OAuth authentication and 41.6% gone within three days between consecutive runs [21].

This is the point where the published equation serves an operator least well. Trivedy puts protocol servers inside the harness, next to the hooks you wrote yourself, and Böckeler places them in the user harness, the outer ring a team assembles for its own system. Both are defensible as architecture. Neither records that a third-party server is code you did not write, running where you cannot see it, whose behaviour can change between two runs without a version number. A 2026 governance paper names that class directly, supply-chain attackers “who distribute compromised servers”, and notes that existing frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 “do not yet cover” it in detail [22].

Fences also mean knowing when to stop, and this is the part of the harness where the tooling is genuinely behind the theory.

• Every major runtime ships a hard cap under a different name: max_turns in the Claude Agent SDK and the OpenAI Agents SDK, max_iterations in LangChain, recursion_limit in LangGraph. A cap ends a run; it does not notice that the run stopped making progress two hundred steps ago.
• A 2026 study named the failure class, scanned 6,549 agent repositories with a static analyser, and confirmed 68 infinite-loop failures across 47 projects at 91.9% precision [23].
• Detecting an agent that is looping inside its budget, rather than exceeding it, is an open problem. A LangChain issue proposing progress-aware termination was filed in March 2026 and closed without shipping.
• The practical substitute is an external check: a test suite, a compiler or a diff that must change between iterations, with the harness ending the run when it does not. That is the same logic as the human gate we describe in engineering agentic systems.

6. The saddle: a filesystem against context rot

Long contexts degrade, and the degradation is measured rather than folkloric, which is why serious harnesses treat the attention window as scarce even when the vendor sells it as abundant.

• Chroma’s technical report tested eighteen models on controlled tasks extending needle-in-a-haystack with semantic matching and distractors, and found that models do not process context uniformly: performance falls as input length grows, including on tasks that are trivial at short lengths [24].
• The positional version of the effect was established earlier: relevant information at the start or end of a long context is used more reliably than the same information in the middle [25].
• Anthropic defines compaction as “taking a conversation nearing the context window limit, summarizing its contents, and reinitiating a new context window with the summary”, and names tool result clearing as its lightest form, on the ground that a raw tool result buried deep in history has stopped earning its tokens [26].
• Manus described a complementary practice it calls restorable compression: drop a web page’s content if the URL is preserved, drop a document’s contents if its path in the sandbox remains available [27].

The economics reinforce the architecture, and one ratio has held long enough to plan around it.

• The Manus post priced the difference plainly in July 2025: “With Claude Sonnet, cached input tokens cost $0.30/MTok, while uncached ones cost $3/MTok, a 10x difference” [27].
• Those absolute prices are now stale, and the ratio is not. On Anthropic’s September 2026 price list, Sonnet 5 costs $2 per million input tokens with cache reads at $0.20, the same tenfold gap [28].
• The engineering consequence is that a harness should keep the head of its prompt byte-stable, because a timestamp or a reshuffled tool list at the top of the context invalidates the cache for everything after it.
• Externalising memory produces a comparable order of magnitude: the Mem0 paper reports roughly 90% token savings against full-context approaches on its benchmark, which is a factor of ten and not the factor of one hundred sometimes quoted [29].

Where the raw output still matters, the pattern that has settled in practice is to keep the head and tail of a large tool result in the window, write the whole thing to the filesystem, and let the agent read back the part it needs. It is an implementation convention visible in several runtimes rather than a named contribution of any one of them.

7. Deterministic first: the harness as a regulator

The organising principle that makes all of the above one discipline rather than a list of tricks is control theory, and Böckeler states it with the borrowed law that fits: a regulator must have at least as much variety as the system it governs, and it can only regulate what it has a model of [6] [30].

• An unconstrained language model can produce an unbounded variety of outputs, so the regulator cannot match it by inspection after the fact.
• The move that works is to reduce the variety at the source, with typed interfaces, restricted retrieval and bounded action sets, until what remains is small enough for code to govern.
• Böckeler’s classification sorts every control along two axes, direction and execution: guides that act before the model works (feedforward) against sensors that act after (feedback), and controls that run as computation against those that run as inference [6].
• She also names the property of a codebase that decides how well any of this works, harnessability: “Not every codebase is equally amenable to harnessing. A codebase written in a strongly typed language naturally has type-checking as a sensor; clearly definable module boundaries afford architectural constraint rules.”

The same logic, taken to its conclusion, demotes the model from conductor to component.

• Cloudflare argued the practical case in September 2025 under the name code mode: give the agent an API and let it write code against it, rather than making it emit one tool call at a time [31].
• Anthropic published the equivalent for protocol servers in November 2025, presenting code execution with MCP as the route to fewer tokens and fewer round trips [32].
• The academic formulation arrived in June 2026 as agentic programming, in which the program owns all control flow and the model is an adaptive component invoked only where a task calls for reasoning or generation. The paper’s claim is that token explosion, control-flow hallucination and unreliable completion are architectural consequences of asking a probabilistic system to do the deterministic work of looping and branching [33].
• This is the same instinct as the gate we apply to code changes in decision-gated development: the plan is approved by something other than the thing that wrote it.

8. The figures doing the rounds that nobody can source

Any article arguing that harnesses matter will be offered two statistics to prove it, and both fail the first check, which is worth documenting because the laundering mechanism is now a feature of this subject.

• “Nearly 88% of autonomous agent initiatives fail to reach production stability” appears across 2026 content-marketing posts with no citation anywhere in the chain. One derives it by subtracting an unrelated adoption figure from 100.
• “65% of those failures come from the surrounding infrastructure rather than the model” has no study behind it either, and the specific triad it is usually paired with does not appear in any published taxonomy.
• The pattern extends to vocabulary. Several harness taxonomies proposed in single 2026 preprints, along with acronyms for component lists, are repeated by aggregator sites as though they were standards, while competing decompositions of the same object are published in parallel.
• The test that survives contact with this literature is the one that costs thirty seconds: follow the citation to a primary source with a date, or drop the number.

The measurements that do exist say something narrower and more useful.

• Gartner predicts that over 40% of agentic AI projects will be cancelled by the end of 2027, “due to escalating costs, unclear business value or inadequate risk controls” [34]. The release presents this as an analyst forecast and attaches no sample to it, and the poll of 3,412 respondents quoted alongside it is supporting context rather than the basis of the number.
• The MIT NANDA report states that “95% of organizations are getting zero return”, on a base of over 300 publicly disclosed initiatives, 52 structured interviews and 153 surveyed leaders [35]. It is a project report carrying an MIT byline rather than an institutional MIT publication, and its own disclaimer says so, which is worth knowing before quoting it as “MIT found”.
• The closest thing to a failure anatomy is the MAST taxonomy, built by annotating execution traces across seven multi-agent frameworks, 1,642 of them in the published version, with an inter-annotator agreement of 0.88: specification and system design issues at about 42%, inter-agent misalignment at about 37%, verification and termination at about 21% [36]. Those three shares are read off the paper’s own chart rather than stated as a sentence, so they are reported here as approximations.
• Those three categories are all harness territory rather than model capability, which supports the argument the invented figures were reaching for. The support is qualitative, and saying so costs nothing.

A last honest note on the direction of travel. The field is starting to automate harness design itself: Self-Harness reports an agent improving its own operating harness through weakness mining, harness proposal and regression-gated validation, with relative pass-rate gains of up to 132% across three benchmarks and three base models [37]. A separate system, Harness-1, moves search state out of the policy and into the environment, and reports a +11.4 point recall gain over the next strongest open search agent [38]. Both are 2026 preprints on their authors’ own evaluations. They are the shape of the next argument, not evidence for the current one.

The part you rent and the part you own

A business leader deciding where to spend the next six months of engineering has one question worth asking, and it is not which model to pick.

• The model is rented. Its weights, its safety behaviour, its deprecation date and its price are set elsewhere, and the supplier can change the builder harness underneath it without changing the identifier you test against. We set out the versioning discipline that follows in regaining control of dependencies.
• The harness is owned. The tool contracts, the sandbox boundary, the stop conditions, the working files, the evaluation suite and the policy checks are code in your repository, they survive a model migration, and they are the only part a court, an auditor or a customer can be shown.
• The third-party servers are neither. A protocol server you did not write is not rented, because no one has promised you a term, and it is not owned, because you cannot pin its behaviour. It is the only part of the stack that can change under you with no version number attached, and the measured state of that population is the section above. The published equation folds it into the harness. On the axis that decides who answers when something goes wrong, this article would rather state it separately: a model you rent, a harness you own, and servers that belong to someone else. That is a proposal about accountability, offered as one, and not a correction to anybody’s architecture.
• The work is unglamorous and it is the work: declare the tools, bound the blast radius, allowlist the servers and re-approve them when their definitions change, move every check a compiler can perform into the compiler, write the state to disk, and reserve the model for the steps where judgement is the product. Which brings us back to where agentic processes belong in an organisation, which is inside a process someone owns.
• The horse in the metaphor was never the achievement. Anyone can buy a faster one.

This article describes engineering practice and cites published research and company statements as such. Figures reported by vendors about their own systems, including the OpenAI Codex experiment and the benchmark results of 2026 preprints, are not independently audited, and are presented here with that limit stated.

Sources

1. Sanderson Oliveira de Macedo, ‘What makes a harness a harness: necessary and sufficient conditions for an agent harness’, arXiv:2606.10106, 8 June 2026.
2. Paul Barbaste, Tristan Darrigol, Germain Vu and Tom Wiltberger, ‘Harness Engineering: Anatomy, Architecture, and Evolution of Coding Agents. A Source-Code Study of Eleven Systems’, arXiv:2609.00006, 2026.
3. Noah Shinn, Federico Cassano, Edward Berman, Ashwin Gopinath, Karthik Narasimhan and Shunyu Yao, ‘Reflexion: Language Agents with Verbal Reinforcement Learning’, arXiv:2303.11366, NeurIPS 2023.
4. Mitchell Hashimoto, ‘My AI Adoption Journey’, mitchellh.com, 5 February 2026.
5. Vivek Trivedy, ‘The Anatomy of an Agent Harness’, LangChain blog, 10 March 2026.
6. Birgitta Böckeler, ‘Harness engineering for coding agent users’, martinfowler.com, 2 April 2026.
7. Ryan Lopopolo, ‘Harness engineering: leveraging Codex in an agent-first world’, OpenAI, 11 February 2026. Figures reported by OpenAI about its own internal project.
8. UK AI Safety Institute, ‘Early lessons from evaluating frontier AI systems’, 24 October 2024. The institute was renamed the AI Security Institute in February 2025.
9. John Yang, Carlos E. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan and Ofir Press, ‘SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering’, arXiv:2405.15793, NeurIPS 2024.
10. Model Context Protocol, ‘MCP joins the Agentic AI Foundation’, 9 December 2025; specification of 28 July 2026 and its changelog.
11. Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan and Yuan Cao, ‘ReAct: Synergizing Reasoning and Acting in Language Models’, arXiv:2210.03629, 6 October 2022; ICLR 2023.
12. Timo Schick, Jane Dwivedi-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Luke Zettlemoyer, Nicola Cancedda and Thomas Scialom, ‘Toolformer: Language Models Can Teach Themselves to Use Tools’, arXiv:2302.04761, 2023.
13. Geoffrey Huntley, ‘Ralph Wiggum as a “software engineer”’, ghuntley.com, 14 July 2025.
14. Simon Willison, ‘The Dual LLM pattern for building AI assistants that can resist prompt injection’, simonwillison.net, 25 April 2023.
15. Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis and Florian Tramèr, ‘Defeating Prompt Injections by Design’, arXiv:2503.18813, 24 March 2025.
16. Luca Beurer-Kellner, Beat Buesser, Ana-Maria Crețu, Edoardo Debenedetti, Daniel Dobos, Daniel Fabian, Marc Fischer, David Froelicher, Kathrin Grosse, Daniel Naeff, Ezinwanne Ozoani, Andrew Paverd, Florian Tramèr and Václav Volhejn, ‘Design Patterns for Securing LLM Agents against Prompt Injections’, arXiv:2506.08837, 10 June 2025.
17. Joel Fokou, ‘Parallax: Why AI Agents That Think Must Never Act’, arXiv:2604.12986, 14 April 2026. Single-author preprint; the evaluation uses a benchmark built by the author.
18. Luca Beurer-Kellner and Marc Fischer, ‘MCP Security Notification: Tool Poisoning Attacks’, Invariant Labs, 1 April 2025.
19. Manish Bhatt, Vineeth Sai Narajala and Idan Habler, ‘ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control’, arXiv:2506.01333, 2 June 2025; CVE-2025-54136, NVD, 2 August 2025.
20. Xiaofan Li and Xing Gao, ‘A First Look at the Security Issues in the Model Context Protocol Ecosystem’, arXiv:2510.16558, 18 October 2025; DSN 2026.
21. Nicolás Padilla, ‘Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale’, arXiv:2608.00150, 31 July 2026.
22. Herman Errico, Jiquan Ngiam and Shanita Sojan, ‘Securing the Model Context Protocol (MCP): Risks, Controls, and Governance’, arXiv:2511.20920, 25 November 2025.
23. Xinyi Hou, Shenao Wang, Yanjie Zhao and Haoyu Wang, ‘When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agents’, arXiv:2607.01641, 2 July 2026.
24. Kelly Hong, Anton Troynikov and Jeff Huber, ‘Context Rot: How Increasing Input Tokens Impacts LLM Performance’, Chroma technical report, 14 July 2025.
25. Nelson F. Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni and Percy Liang, ‘Lost in the Middle: How Language Models Use Long Contexts’, arXiv:2307.03172, 2023; Transactions of the Association for Computational Linguistics.
26. Anthropic, ‘Effective context engineering for AI agents’, Anthropic Engineering, 29 September 2025.
27. Yichao ‘Peak’ Ji, ‘Context Engineering for AI Agents: Lessons from Building Manus’, Manus blog, 18 July 2025.
28. Anthropic, pricing page, consulted 20 September 2026.
29. Prateek Chhikara, Dev Khant, Saket Aryan, Taranjeet Singh and Deshraj Yadav, ‘Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memory’, arXiv:2504.19413, 28 April 2025.
30. W. Ross Ashby, An Introduction to Cybernetics, Chapman and Hall, London, 1956. The law of requisite variety is quoted here in the paraphrase used by [6].
31. Kenton Varda and Sunil Pai, ‘Code Mode: the better way to use MCP’, Cloudflare Blog, 26 September 2025.
32. Anthropic, ‘Code execution with MCP: Building more efficient agents’, Anthropic Engineering, 4 November 2025.
33. Junjia Qi, Wenlin Zhang, Zichuan Fu, Hanyu Yan, Xiangyu Zhao, Jingtong Gao and Xian Wu, ‘LLM-as-Code: Agentic Programming for Agent Harness’, arXiv:2606.15874, 2026; KDD 2026 Workshop on Agentic Software Engineering.
34. Gartner, ‘Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027’, press release, 25 June 2025.
35. Aditya Challapally, Chris Pease, Ramesh Raskar and Pradyumna Chari, ‘The GenAI Divide: State of AI in Business 2025’, MIT NANDA, July 2025. The report is not hosted by MIT and states that the views are those of the authors alone.
36. Mert Cemri, Melissa Z. Pan, Shuyi Yang, Lakshya A. Agrawal, Bhavya Chopra, Rishabh Tiwari, Kurt Keutzer, Aditya Parameswaran, Dan Klein, Kannan Ramchandran, Matei Zaharia, Joseph E. Gonzalez and Ion Stoica, ‘Why Do Multi-Agent LLM Systems Fail?’, arXiv:2503.13657, 17 March 2025; NeurIPS 2025.
37. Hangfan Zhang, Shao Zhang, Kangcong Li, Chen Zhang, Yang Chen, Yiqun Zhang, Lei Bai and Shuyue Hu, ‘Self-Harness: Harnesses That Improve Themselves’, arXiv:2606.09498, 8 June 2026.
38. Pengcheng Jiang, Zhiyi Shi, Kelly Hong, Xueqiang Xu, Jiashuo Sun, Jimeng Sun, Hammad Bashir and Jiawei Han, ‘Harness-1: Reinforcement Learning for Search Agents with State-Externalizing Harnesses’, arXiv:2606.02373, 1 June 2026.