Trend Watch: The Harness Is Becoming a Product of Its Own

Yesterday's Trend Watch looked at taking credentials away from agents. Today's theme is the layer around the model. Several sources from October 26 to 29, 2026 treat the harness, meaning the loop, tools, context handling and policies around a model, as something chosen, sold and measured on its own.

Microsoft sells the harness separately

On October 28, Microsoft said the Copilot harness, built by GitHub's engineers and used in Copilot Code, Copilot Studio, the GitHub Copilot app, the CLI and VS Code, is now available through Microsoft Foundry. The post says it works with "20+ frontier models plus bring your own key" and that the runtime was recently ported to Rust. "Microsoft runs the agent loop and sandbox," it says, while customers bring instructions, skills, tools and model choice.

The Foundry documentation, updated October 29, adds the limits. The harness is a preview "without a service-level agreement." It is selected when an agent is created and cannot be switched on for an existing agent. "Bring your own model (BYOM) isn't currently supported." Each conversation gets its own workspace and sandbox, which Foundry "can idle, resume, or replace", so important outputs should go to durable storage. This is different from Copilot Fusion, covered here on October 29, which picks models inside GitHub Copilot. The harness offer exposes the loop itself to outside developers.

Away from the home model, the harness decides

kw-bench (arXiv 2610.36405, submitted October 26) is built from real investigative work: a five-year VAT reconstruction from raw extracts of three generations of SAP systems, graded deterministically. With the same model, DeepSeek v4.1 Flash, and two hours, two model-agnostic harnesses scored 0.542 (OpenCode) and 0.528 (micro-cc), while Claude Code and Codex "delivered nothing (0.00 each)." The authors attribute the failure to "inertia: keeping many weak signals alive across a long session." On Claude Opus 5.5 the task collapsed: micro-cc and Claude Code scored 0.9986 and 1.000 in 22 and 25 minutes. Their conclusion: "below the frontier, the harness decides how far a model gets."

The harness policy changes what gets found

VulnBench 2.0 (arXiv 2610.38617, submitted October 28) compares static analysis with AI security tools on 108 curated vulnerabilities. Snyk Code reached 82.4 percent recall and Claude Code's security review with Opus 5 at xhigh effort reached 79.3 percent, and the two together found 101 of 108. Without Claude Code's built-in review policy, the same model matched 16 instead of 9 of the 20 vulnerabilities in the classes that policy excludes or restricts. The authors write that what an AI engine misses "depends on its harness as much as on its model."

Model catalogs move across clouds

The same pattern shows up in tool releases. Codex 0.166, released October 29, added GPT-6.1 Terra to its bundled, Vertex AI and Amazon Bedrock catalogs. Claude Code 2.1.314 now falls back to an older model when a Microsoft Foundry resource lacks the default one. Coding harnesses are being built to run on several providers' infrastructure.

What remains uncertain. Microsoft's post gives no benchmark for its harness. kw-bench is one task family on one non-frontier model, and the lab harnesses were not designed for that model. VulnBench is authored by a static-analysis vendor, though it publishes its data.

Analysis: If the harness can move a score from zero to half, it deserves the same evaluation as the model. Pin its version, record it next to every result, and re-run your own tasks when either the model or the harness changes. For Belgavi's Book Store, Dinky's evaluation of the returns agent should name the model, the harness and the harness version together, never the model alone. A managed harness saves maintenance, but its policies become your policies, so read what it excludes.

Sources and evidence

Microsoft offered the GitHub-built Copilot harness as a managed Foundry runtime on October 28 (preview, fixed at agent creation, no BYOM), while kw-bench found two lab harnesses scored 0.00 against about 0.53 for model-agnostic harnesses on the same non-frontier model, and VulnBench 2.0 found a built-in review policy changed which vulnerabilities a model reported: evaluate and version the harness as well as the model.