OpenAI Just Opened Its Agent Harness — And Half the Agent Was Never the Model
胡新宇
Published on 2026-08-23
OpenAI opened the Codex Harness on Aug 19, three days before a benchmark showed the same model scoring 52.4 to 76.2 across different harnesses. The model curve has converged. The harness curve is where vendors will win or lose.
OpenAI Just Opened Its Agent Harness — And Half the Agent Was Never the Model
On August 19, OpenAI shipped Codex-as-a-Platform. CLI, Python and TypeScript SDKs, an app-server that talks WebSocket — all Apache 2.0. The Codex Cloud, the IDE extension, the model weights, the hosted inference: still closed.
That asymmetry is the message. Open the runtime. Hold the weights. That's the playbook.
Three days later, Latent Space published the theoretical scaffolding for that move. The argument: the agent harness — everything around the model, environment, tools, context, guardrails — accounts for roughly half of an agent's effectiveness. Their evidence: Harness-Bench ran the same model on the same 106 tasks across different harnesses and watched scores swing from 52.4 to 76.2. Twenty-three-point-eight spread, zero model change.
Half the agent is the harness.
What a Harness Actually Is
Take the model weights out of the loop and you have a brain in a vat. It can predict the next token. It can't read a file, call a tool, remember what happened two turns ago, or stop itself from running rm -rf.
The harness is what gives the mind a body. It loads context, invokes tools, persists memory, enforces permissions, compacts the conversation when the window fills up, and asks for approval when the action matters. Without it, the model is the most expensive autocomplete in the building.
#OpenAI#AI Agent#Codex#技能#审批工作流
OpenAI Opens Its Agent Harness — Half the Agent Isn't the Model
When OpenAI opened the Codex Harness under Apache 2.0 on August 19, they opened exactly this body — but kept the brain proprietary. codex exec for CI and one-shot scripts. Python and TypeScript SDKs for in-app integration. app-server over a client protocol for the human-facing surfaces: ops dashboards, customer support consoles, internal admin tools. Each surface targets a different audience, but all three share the same agent loop, sandbox policy, tool registry, and approval machinery.
What's missing is just as deliberate. No model weights. No Cloud. No IDE plugin. If you want to use Codex-as-a-Platform, you still pay OpenAI for inference. You get to skip the eighteen months of building the runtime.
The Numbers Don't Lie
Two pieces of evidence make "half the agent is the harness" falsifiable.
First, Harness-Bench (cited in Latent Space). One hundred six tasks. Identical model. The only variable was the harness. The 23.8-point spread isn't noise — it's the floor. If you change one decision in your tool registry, your compaction policy, or your retry strategy, the model behaves like a different model.
Second, OpenAI's own ARC-AGI-3 result on GPT-5.6 Sol. Adding retained reasoning and compaction inside the harness — no model change, no post-training — pushed the score from 13.3% to 38.3%. Nearly three times. The model stayed put. The harness moved.
And then the absorption proof. Thariq Shihipar, who builds Claude Code at Anthropic, posted that the team recently deleted 80% of Claude Code's system prompt. The reason: the capabilities encoded in that prompt have migrated into the model weights themselves. GPT-5.1-Codex-Max launched with the tagline "the first model natively trained to operate across multiple context windows through compaction" — a harness capability now native to the model. You can't prompt your way to it anymore because the model already knows.
You don't win an agent race by training a smarter brain. You win it by giving the brain a body worth operating in.
Two Curves, Braided
The reason OpenAI is opening the runtime now is that two curves — model capability and harness completeness — finally started moving together. They used to diverge badly.
In October 2022, ReAct gave us the agentic loop on paper: reason, act, observe, repeat. Pure prompting. The model wasn't trained for it. The gap between what the harness asked and what the model could deliver was tiny because both were tiny.
By spring 2023, AutoGPT and BabyAGI handed the model full autonomy. The harness curve sprinted ahead of the model curve, and 95% per-step reliability across a twenty-step task compounds to about 36% end-to-end success. The loop amplified errors instead of fixing them. For eighteen months, the gap stayed wide.
Cursor and Copilot pulled the harness back down below the model. Don't give the model the loop; give the human the loop, then speed the human up. The first version of Devin tried to hand autonomy back, and Answer.AI's test put its success rate around 15%. The IDE-era retreat wasn't cowardice. It was the correct move given the gap.
Then in February 2025, the gap inverted. With o1, reasoning became a trained capability rather than a prompted trick. Claude Code shipped the same month and gave the model bash and file access, replacing per-change approval with permission rules. Six months later, roughly $1B ARR. Not because it was first to give the model the loop — Devin was — but because it was first to give the model the loop at the moment the model could handle it.
Now the curves braid. Reinforcement learning has moved inside the harness: codex-1 was trained using RL on real coding tasks in real environments. Tool use is no longer prompted from outside; it's trained from within. The model absorbs harness capabilities into its weights. The harness sheds the scaffold. Anthropic deleted 80% of a system prompt. The loop is train → absorb → shed → repeat.
This is why opening the runtime matters. The model curve is converging across vendors — every frontier lab is within a stone's throw of every other. The harness curve is where the differentiation still lives, and it's where OpenAI chose to plant its flag.
The Attention-Interface
Keep deleting what the model can absorb. What are you left with?
Latent Space's answer: the human-centric capabilities. Permissions. Identity. Trust. Legibility. When the model absorbs permissions into itself, you've dissolved permissions. The model doesn't "have permission" to call Stripe — it just calls Stripe. Which means somebody still has to decide, at the policy layer, who the model is allowed to be.
The harness migrates across the human boundary. It stops being the model's interface to the computer and becomes the model's interface to the human operating it. The next platform isn't a faster agent — it's a human-attention policy surface. When can it interrupt you. When must it keep working. Which decisions can it make alone. Which ones need your eyes. Anthropic's long-running agent progress files and approval queues are early sketches; OpenAI's app-server approval protocol is another.
Every agentic AI company is about to ship an ATTENTION.md the way they shipped AGENTS.md. The pattern is the same: a human-readable policy file the agent loads before it acts. This time, the policy is about you.
When the model absorbs the harness, the harness migrates across the human boundary.
What This Means If You Build Agents
Three moves, in priority order.
Stop betting your moat on the model. Every frontier model is now good enough for most production work. If your differentiation is "we use Claude 4.7" or "we're on GPT-5.6," you have six months of lead time before the next release erases it. The harness is where the lead time compounds.
Instrument the harness with measurements, not vibes. The 23.8-point spread in Harness-Bench wasn't an accident. It came from hundreds of micro-decisions about tool schemas, retry policies, compaction triggers, and approval routing. You need the same instrumentation in your own agent. Per-step success rate. Time to first approval. Compaction efficiency. These are your dashboard.
Design your approval surface now, because that's the next platform. Every vendor — OpenAI with app-server, Anthropic with permission rules, TrueForge with explicit approval, Cloudflare with their Workers integration — is racing to own the human-attention surface. Pick a vendor based on whether their attention model fits your team's working rhythm, not on raw model benchmark numbers. The model is converging. The attention model isn't.
Coda
The agent wars are no longer about who has the smartest model. The models have converged. The wars are about who owns the runtime — the loop, the tools, the permissions, the approval surface, and ultimately, the interface to your attention.
OpenAI opened Codex Harness last week. Anthropic built Claude Code around permission rules. Cloudflare shipped a Workers-based runtime. TrueForge just published a local-first alternative. Every new entrant — from TrueForge to Vercel Labs' fx to SenseTime's unified multimodal — has to decide: do we compete on weights, or do we compete on the body?
Half the agent is the harness. The next half is going to be the human behind it.
