Agent harnesses

The model writes the next step. The harness decides which tools, memory, and checks surround that step. Leave asking which piece moved: model, tools, loop, or the check.

Agents, loops, and tools

Field card · three questions, three worked checks

Worked check: Cursor’s October 29 notice says Claude Code builds 2.1.312 and 2.1.313 on its marketplace were malicious — name the marketplace and the version the same way you name the test on a model claim.

A harness is the planner, the tools, the notes the loop can read back, the cut that keeps the context inside the window, and the check that stops or continues. Two products can call the same model and finish different jobs because those surrounding pieces differ.

A harness is still mostly a model inside a loop. Beam and Muse Spark Open are open weights a coding loop can call. Muse Wonder is an API model for a long agent task. Microsoft-Decision-1 scores a list the software already wrote. Claude Duet, opened October 21 as a research preview, is an app around Claude Opus 5.5 that keeps a virtual machine running and waits before it sends, pays, signs, or deletes. Voxtral 3's SDK is a voice pipeline that calls a separate reasoning model. Karpathy’s October 31 HackerTube build is the same class of fact with a wall-clock: Opus 5.5 inside Claude Code for about two hours, producing 6,454 HN-recommended videos.

The install path is part of the harness. Cursor’s October 29 notice says Anthropic.claude-code versions 2.1.312 and 2.1.313 on the Cursor marketplace were malicious builds not developed by Anthropic, live about 2:27 a.m. to 1:35 p.m. Pacific, aiming for a persistent SSH backdoor. Name the marketplace and the version before you trust the loop.

The check can also be a monitor outside the step. OpenAI's October 29 post says expanded misalignment monitors would have alerted about 30 minutes after the Hugging Face sandbox escape, more than 30 hours before the real breach. Those clocks are OpenAI's. The useful lesson for the guide is that a loop without a check is incomplete, and a check that was not running is how a gap becomes an incident.

In this briefing