)
Last updated: October 26, 2026
What is an agent harness? It is everything around an AI model that turns it into an agent: the loop that calls the model, the tools it can use, how its context is handled, the permissions that limit it, and the memory it keeps between sessions. In 2026, model vendors began selling that whole stack as one product, which makes the memory inside it the part worth deciding about early.
TL;DR: Key Takeaways
- An agent is a model plus a harness. Google Cloud (updated October 15, 2026) lists five core parts: the loop, tools, context, memory and permissions.
- One harness can serve many products. OpenAI described the Codex harness as the shared engine behind four surfaces (February 4, 2026).
- Vendors now ship the whole stack. The OpenAI Agents SDK update (April 15, 2026) adds a harness, configurable memory and skills, with seven built-in sandbox providers.
- Memory can be plain files. In Claude Managed Agents, each memory is a text document of up to 100 kB, a store holds up to 10,000, and versions are kept for about 30 days.
- Moving memory is possible but manual. Anthropic's help center documents a four-step import from another assistant and calls imports experimental.
- Memory is also an attack surface. OWASP published its 2026 LLM Top 10 on August 3, 2026, and its Agentic Top 10 lists Memory & Context Poisoning as ASI06.
The Short Version in One Table
| Question | Short answer |
|---|---|
| What is it? | A model plus a loop, tools, context handling, permissions and memory |
| How does it differ from a framework? | A framework helps you build an app; a harness is the runtime the agent runs inside |
| Which part should you own? | The memory |
| Why? | Portability, inspection and no dependence on a single vendor |
)
What an Agent Harness Is, in Plain Words
An agent harness is the software wrapped around a language model so it can work toward a goal on its own. The model reasons. The harness runs the loop, hands the model tools, manages what it sees, enforces permissions and stores state. Google Cloud calls it the runtime and control layer that makes a model a reliable autonomous agent.
On its own, a model answers one prompt at a time. It cannot open a file, call an API or remember earlier steps in a long workflow. The harness supplies all of that.
Birgitta Böckeler of Thoughtworks, writing on martinfowler.com on April 2, 2026, uses an even shorter definition: everything in an agent except the model. She splits it into guides, which steer the agent before it acts, and sensors, such as tests and linters, that let it check its own work afterward.
The five parts
According to Google Cloud (2026), the core of a harness has five parts.
The loop calls the model, runs the tool the model asked for and feeds the result back, over and over until the task ends. Tools are the actions the agent can take, from reading files to calling APIs, and Google Cloud recommends MCP as the way to expose them.
Context handling decides what the model sees on each turn. Tool outputs get appended to the history, and older material is summarized as the window fills. Permissions act as a security checkpoint, with human approval for risky steps.
Memory and state keep what should survive after the conversation ends. That fifth part is the one the rest of this article is about.
Why Vendors Now Ship the Whole Stack
Vendors ship the harness because a model alone cannot finish long tasks. Buyers want an agent that runs, recovers from errors and remembers progress. So in 2026 the big model providers started offering the loop, tools, skills, context management and memory together, as one platform.
The table below shows the pattern. OpenAI explained in February that the Codex harness covers the agent loop, thread persistence, authentication and tool execution for all its surfaces. In April, Anthropic described Managed Agents, a hosted service that splits an agent into a session log, a harness and a sandbox, and a week later OpenAI added sandboxes, configurable memory and skills to its Agents SDK.
| Vendor | Offering (date) | Where state and memory live |
|---|---|---|
| Anthropic | Managed Agents (April 8, 2026) | An append-only session log outside the harness, plus memory stores of text files |
| OpenAI | Agents SDK update (April 15, 2026) | Externalized agent state with snapshots, plus memory developers can configure |
| OpenAI | Codex harness (February 4, 2026) | Thread persistence handled by the App Server, with source in the open-source Codex CLI repo |
How we compared
We read each vendor's own announcement or documentation, all dated 2026, and recorded only what the pages state. We ran no benchmarks, and the descriptions are vendor-reported.
What this means for buyers
The speed is real, and so is the trade. When the loop, the sandbox and the memory all sit in one vendor's runtime, switching later means moving all three. Anthropic's engineers (April 2026) note that harnesses encode assumptions about what a model cannot do alone, and those assumptions go stale as models improve. Harness parts get replaced. Memory should not have to be.
Agent Harness vs Framework
An agent framework helps developers build applications by chaining prompts, models and data sources. An agent harness is the deployment-oriented runtime that an autonomous agent runs inside, with loop, permissions, error recovery and state. Google Cloud draws the line there: frameworks are for building, harnesses are for running.
| Framework | Harness | |
|---|---|---|
| Main job | Helps you build an agent application | Runs an autonomous agent reliably |
| Typical focus | Chaining prompts, models and data sources | Loop, tools, context, permissions and state |
| Orientation | Development | Deployment |
The line is blurry in practice: the OpenAI Agents SDK is a developer toolkit that also ships a harness. Böckeler adds that a coding agent arrives with its builder's inner harness, while you add an outer one of guides and sensors for your project. The useful question is which parts you can inspect and change.
Where Memory Sits Inside the Harness
Memory sits inside the harness as data the loop reads at the start of a session and writes during or after it. The model keeps nothing between sessions by itself. Google Cloud makes the same point: models do not inherently remember earlier steps, so the harness has to carry state forward.
Three layers are worth keeping apart: the context window (what the model sees now), the session log (what happened in a run) and long-term memory (what should still be true next week).
Anthropic's April 2026 engineering post makes the reason clear: compaction and trimming are irreversible, so information can be lost unless it is stored elsewhere. Its memory tool lets Claude write context to files for that purpose.
In Claude Managed Agents, a memory store is a collection of text documents, each addressed by a path such as /preferences/formatting.md. The store is mounted as a directory in the sandbox, and the agent reads and writes it with ordinary file tools.
Why Memory Is the Part You Should Own
Memory is the part to own because it is the part that grows more valuable and harder to rebuild. Loops and tool wiring can be swapped when a better model arrives. A year of preferences, decisions and corrections cannot be recreated on demand. Ownership gives you portability, inspection and independence from one vendor.
Portability. If memory is readable text, a new model or a new vendor can load it on day one. If it lives in an opaque feature, you start over. The signs today are mixed. Anthropic documents an import flow and an export route, yet its own help page describes the export as asking Claude to write memories out verbatim and saving the text to a file. There is no shared format yet.
Inspection. You cannot govern what you cannot read. Claude Managed Agents creates an immutable version for every change, so a developer can see which agent and session wrote a given memory, roll back, or redact content from history.
Independence. Imports carry caveats. Anthropic says they are experimental and that its memory focuses on work-related topics, so some personal details may not be kept.
What Owning Your AI Memory Looks Like
Owning your AI memory means you can read it, export it, move it and delete it without asking a vendor. In practice, it is a small set of tests rather than a single product. If a memory system fails two or more of the tests below, you are renting it, not owning it.
| Test | What a pass looks like |
|---|---|
| Readable | Plain text or Markdown you can open in any editor |
| Exportable | One export that does not need the vendor's help |
| Versioned | You can see who or what wrote each entry, and when |
| Scoped | Reference material can be set to read-only for an agent |
| Portable | A different model can use it without translation |
| Deletable | You can remove an entry, including from history |
Claude Managed Agents covers several of these. Stores can be attached as read_write or read_only, and read-only is enforced at the filesystem level. Versions can be redacted, and a store can be deleted permanently along with its versions. Anthropic's launch post (April 23, 2026) adds that memory files can be exported through the API.
For one person, a start takes about ten minutes: read what your assistant has stored, export it with the vendor's own steps (the Claude help center route is one example), and keep the text in a folder you control. For a team, decide where the agent's notes live, who can edit them and how they get reviewed.
The AI memory product NeuralTrust is launching is built on this idea of owning your AI memory, for you or for your company. It connects the places your knowledge already lives, such as Granola, Fathom, Google Calendar, ChatGPT and Claude history exports, Notion and Google Drive, with Slack, Gmail and Outlook coming soon, so you can ask your brain instead of searching five apps.
Security and Governance: What Harnesses and Memory Add to the Risk Surface
A harness adds risk wherever it reads untrusted input, writes to memory or acts with permissions. OWASP's 2026 LLM Top 10, published August 3, 2026, and its Agentic Top 10 both cover these paths. The Claude documentation itself warns that a writable memory store lets a prompt injection persist into future sessions.
| Risk | OWASP mapping | How it shows up in a harness | Control to ask for |
|---|---|---|---|
| Prompt injection | LLM01:2026, ASI01 Agent Goal Hijack | Tool results and web pages enter the context and steer the loop | Treat tool output as untrusted input |
| Memory poisoning | LLM05:2026 Data and Model Poisoning, ASI06 Memory & Context Poisoning | The agent writes injected text into memory, and it reloads next session | Read-only stores for reference data, review of writes |
| Hidden context exposure | LLM08:2026 | System prompts and loaded context files carry secrets or internal rules | Keep credentials out of memory and context files |
| Excessive agency | LLM03:2026, ASI02 Tool Misuse and Exploitation | The agent holds more permissions than the task needs | Scoped permissions and human approval for risky steps |
| Supply chain | LLM04:2026, ASI04 Agentic Supply Chain Vulnerabilities | Tools, skills and MCP servers are loaded from third parties | An approved list of tools and servers |
| Sensitive information disclosure | LLM02:2026 | Memory holds personal and company facts | Know where it is stored and how it is deleted |
Vendor retention deserves its own question: ask where memory is stored, how long versions are kept and whether you can delete them. Claude Managed Agents keeps versions for about 30 days, and its docs recommend exporting through the API for longer history.
For the poisoning path in depth, read What is Memory & Context Poisoning?.
NeuralTrust is a Barcelona-based AI agent security company. Its Agent Runtime Security (TrustGuard) covers agents running in production, and its AI Red Teaming (TrustTest) tests agents before they ship. These are separate from the memory product described above.
Which Setup Fits You?
Pick by how much of the harness you need to control. Most people should use a vendor's harness and keep control of memory. Teams building agents can add their own guides and sensors on top. Regulated teams should add review, scoping and deletion rules before agents write to memory.
| Situation | Start here | Own this |
|---|---|---|
| One person using several AI assistants | The vendor's built-in harness | An export of your memory in plain text |
| Developer building an agent | A vendor SDK or hosted platform | Your own guides, sensors and memory store |
| Team that wants shared company knowledge | A hosted platform with scoped stores | Review rules for who can write to memory |
| Person or company using ChatGPT, Claude and meeting notes together | The AI memory product NeuralTrust is launching | Your connected sources and what you ask your brain |
Conclusion
An agent harness is the loop, tools, context handling, permissions and memory that turn a model into an agent. Vendors now offer all of it as one platform, which is convenient and worth using. The memory is the piece to keep readable, exportable and yours. Decide that before the first session starts, because a harness can be swapped later, but a memory you cannot move cannot.
Want to Own Your AI Memory? Let's Talk
NeuralTrust is a Barcelona-based AI agent security company, and we are launching an AI memory product for people and companies who want to own their AI memory. Book a demo and tell us what your agents remember today.
Related Reads
FAQs about Agent Harness
1. What is an agent harness in simple terms?
An agent harness is the software around an AI model that lets it act as an agent. It runs the loop that calls the model, gives it tools, manages context, enforces permissions and stores memory. The model does the reasoning, and the harness does everything else that keeps a long task on track.
2. Is an agent harness the same as an agent framework?
No. According to Google Cloud (2026), an orchestration framework helps developers build applications by chaining prompts and data sources, while a harness is a runtime for autonomous agents. In practice the two overlap, and some SDKs include both, so check which parts a product actually provides.
3. What is harness engineering?
Harness engineering is the practice of shaping the environment around a coding agent so it does better work. Birgitta Böckeler (April 2, 2026) describes guides that steer the agent before it acts and sensors, such as tests and linters, that let it correct itself afterward. You build this outer harness on top of the vendor's inner one.
4. Where does an agent harness store memory?
It depends on the product. In Claude Managed Agents, memory is a store of text documents mounted as a directory in the sandbox, with an immutable version for every change. In the OpenAI Agents SDK, memory is configurable and agent state is externalized.
5. Why should I own my AI memory?
Your memory grows more valuable with use and is the hardest part to rebuild. Owning it means you can read it, export it, move it to another model and delete it. That keeps you independent from any one vendor and lets you govern what your agents remember about you or your company.
6. Can I move my memory between AI assistants?
Sometimes. Anthropic's help center documents a four-step import from another assistant and an export route for Claude, but calls imports experimental. There is no shared format yet, so check your current assistant's export options and test an import before you depend on it.
7. Is agent memory a security risk?
It can be. If an agent can write to memory after reading untrusted content, an injected instruction can persist into later sessions. OWASP lists this as ASI06 Memory & Context Poisoning in its Agentic Top 10. Use read-only stores for reference data, review what gets written, and scope permissions tightly.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- Google Cloud, "What is an agent harness?" (last updated October 15, 2026): https://cloud.google.com/discover/agent-harness
- Anthropic Engineering, "Scaling Managed Agents with stable interfaces" (April 8, 2026): https://www.anthropic.com/engineering/managed-agents
- OpenAI, the Codex harness and App Server write-up (February 4, 2026): https://openai.com/index/unlocking-the-codex-harness/
- OpenAI, "The next evolution of the Agents SDK" (April 15, 2026): https://openai.com/index/the-next-evolution-of-the-agents-sdk/
- Birgitta Böckeler, "Harness engineering for coding agent users," martinfowler.com (April 2, 2026): https://martinfowler.com/articles/harness-engineering.html
- Claude Platform Docs, "Using agent memory" (accessed October 26, 2026): https://platform.claude.com/docs/en/managed-agents/memory
- Anthropic, "Memory for Claude Managed Agents" (April 23, 2026): https://claude.com/blog/claude-managed-agents-memory
- Claude Help Center, "Importing and exporting your memory" (accessed October 26, 2026): https://support.claude.com/en/articles/12123587-importing-and-exporting-your-memory
- OWASP GenAI Security Project, Top 10 for LLM Applications 2026 (August 3, 2026): https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
- OWASP GenAI Security Project, Top 10 for Agentic Applications (December 2025): https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
)
)
)
)