Agent Techniques Weekly

Issue 12 · Week 28 of 2026.

July 11, 2026/From Chat to Cowork to Build to Automate/Public sources only

Big Read

The harness beat the model: two hard benchmarks proved the wrapper drives cost and much of quality — the same week the labs bundled their harnesses into suite defaults.

W28 settled an argument that has run all year: how much of agent performance is the model, and how much is the harness around it? Databricks answered with the most decision-grade benchmark yet published — tasks reconstructed from its own merged PRs against a multi-million-line codebase, graded by held-out test suites rather than LLM judges. The findings invert procurement instinct: the same model at the same thinking effort cost over 2x more per task in Claude Code or Codex than in the simpler Pi harness (which sends ~3x less context per turn) with no quality difference, and open-weight GLM 5.2 landed statistically tied with Opus 4.8 at $1.28 versus $1.94 per task. LangChain and NVIDIA proved the constructive direction: tuning only the harness — system prompts, tool descriptions, middleware — lifted Nemotron 3 Ultra to near-Opus quality at roughly 10x lower cost, and shipped the result as a registrable HarnessProfile artifact. The strategic context makes the timing pointed: OpenAI generalized the Codex harness into ChatGPT Work and merged it into a desktop app on every plan including Free — 1M+ of Codex's 5M weekly users already work outside software — so the industry's biggest vendors are bundling exactly the layer the benchmarks just proved decisive. The security counterweight arrived on schedule: Noma Labs' GitLost disclosure showed an unauthenticated attacker exfiltrating private-repo data from GitHub Agentic Workflows via a crafted public issue, with guardrails bypassed by a single word. What to do differently this week: benchmark your harness as an independent variable before renegotiating any model contract; adopt or build harness profiles for the models you route to; and treat the agent's context window as attack surface — least-privilege scoping is not optional once agents read public inputs.

Technique of the Week

build/Databricks Engineering; LangChain Blog; NVIDIA Blog

Harness Profile Engineering

Treat the harness — system prompts, tool descriptions, middleware, subagent policies — as a tunable, versioned artifact per model: baseline the model in a generic harness, mine the failure patterns, override only the harness layers, and re-score at matched quality until cost and reliability converge.

Two independent studies this week showed the harness now swings agent economics more than model choice: over 2x per-task cost differences at equal quality (Databricks), and near-Opus quality from an open model at ~10x lower cost via harness tuning alone (LangChain/NVIDIA). That makes harness engineering the highest-ROI optimization available to agent operators — no retraining, no model migration, just disciplined iteration on the wrapper. It also transfers: every finding applies to routing, budgeting, and vendor-lock decisions.

Baseline

Run the target model through a generic harness on a task suite built from your own real work — Databricks reconstructed tasks from merged PRs and graded with held-out test suites, not LLM judges — to get an honest cost-and-quality floor.

Mine failures

Read the transcripts for failure patterns specific to the model: tool-call formatting quirks, over-fetching context, premature termination, verbosity. LangChain's profile work started from exactly this transcript audit on Nemotron 3 Ultra.

Override the harness only

Encode fixes as declarative per-model overrides — system prompts, tool descriptions, middleware, subagent and skill policies — leaving model weights and the task suite untouched, so improvements are attributable to the harness alone.

Re-score at matched quality

Compare cost per task at equal quality, not per-token price: Nemotron went from 0.80 baseline to 0.86 best-run (vs Opus 4.8's 0.87) at ~$4.48 vs $43.48 per suite run. Guard against context bloat — the cheap harness in Databricks' data sent ~3x less context per turn.

Ship as a registrable artifact

Package the tuned configuration as a versioned profile applied automatically on model detection (LangChain's HarnessProfile pattern), so routing to a new model means selecting a profile, not rebuilding the stack.

New Agent Capabilities.

OpenAI / automate

ChatGPT Work + unified desktop app

The Codex task runtime generalized to all knowledge work: hours-long autonomous runs across apps and files, scheduled and trigger-based tasks, finished documents and web apps as outputs ('Sites' beta), with Codex gaining inline diff editing and side-panel PR review in the merged desktop app.

The harness the benchmarks just proved decisive is now a suite default reaching Free users — and Enterprise/Edu workspaces auto-enable after a two-week off-by-default preview. Operators should set admin posture before the window closes, and size intake and review queues for agent work arriving from every desk, not just engineering.

Anthropic / cowork

Claude Cowork (web + mobile, cloud-run sessions)

Cowork sessions now run in the cloud by default — tasks continue with zero devices online, sync across devices, and push mobile notifications for review and approval steps; usage data from 1.2M sessions across 600,000+ orgs shows the majority of use is non-coding knowledge work.

The supervision surface moved to the phone: approval notifications are now the human-in-the-loop checkpoint for always-on agents. Leaders should define what may be approved from a lock screen versus what requires a desktop review, before mobile-approval habits set themselves.

Cursor / build

Cursor 3.11 conversation-level hooks + CLI subagent persistence

Team hooks extended from tool/file/shell events to the conversation itself — beforeSubmitPrompt, afterAgentResponse, afterAgentThought, subagentStart, stop, and compaction hooks — plus durable parallel side chats, local transcript search across thousands of conversations, and CLI subagents that persist checkpoints across resumes.

Conversation-level hooks are the building block for custom self-correcting loops and centralized agent observability — exactly the harness-layer control the week's benchmarks reward. Platform teams should prototype prompt-linting and response-audit hooks now; transcript search makes past agent behavior a queryable asset.

Anthropic / automate

Claude Code v2.1.202-207 (six releases in-window)

Background agents now self-upgrade after updates instead of paying a stale-session penalty; EnterWorktree requires confirmation outside the project's worktrees directory; a plugin-hook shell-injection vector was closed; usage-credit purchases over $1,000 require typed confirmation; and Auto mode became default-available on Bedrock, Vertex AI, and Foundry.

The autonomy expansion (Auto mode in enterprise-managed clouds) shipped in the same window as its guardrails (spend confirmation, worktree boundaries, injection fix) — the pattern to demand from every vendor. Automation owners on Bedrock/Vertex/Foundry should decide their disableAutoMode posture now rather than discovering the default in an audit.

Microsoft Research / cowork

Flint (visualization intermediate language + MCP server)

An open-source chart intermediate language with an MCP server that lets agents produce reliable, schema-validated visualizations instead of hallucinating chart code — surfaced at 344 points on Hacker News before broad coverage.

Deterministic intermediate representations are the transferable pattern: wherever agents produce structured artifacts (charts, diagrams, reports), a validated IR between the model and the output removes a whole failure class. Teams generating agent-built dashboards should evaluate Flint's MCP server before writing another chart-prompt template.

New Skills And Connectors.

harness / LangChain / NVIDIA

HarnessProfile + NemoClaw reference blueprint

A registrable, declarative per-model harness override artifact — prompts, tool descriptions, middleware, subagents, skills — applied automatically on model detection, shipped alongside NVIDIA's NemoClaw blueprint pairing the tuned harness with the OpenShell secure runtime.

This is 'tune the harness, not the model' as a distributable artifact rather than a blog post — the first packaging of harness engineering into something a platform team can version, review, and roll back. Registry-managed harness profiles are the likely shape of multi-model agent operations; adopt the pattern even if you never use these specific profiles.

harness / llama.cpp / local-first

Hy3 MTP speculative decoding (PR #25395)

Native hy_v3 support converting the model's multi-token-prediction head into a speculative-decoding draft: 24.3 vs 17.4 tok/s (+40%) at 91% draft acceptance on consumer hardware — with confidence gating mattering enormously (97.3% acceptance at a 0.75 draft threshold vs 38.6% without).

Self-hosted agent serving just got a free throughput upgrade wherever an MTP-equipped open model ships — and the local-first pattern (llama.cpp/vLLM behind OpenAI/Anthropic-compatible endpoints consumed by Claude Code, Codex, OpenCode) makes it drop-in for existing agent stacks. Surfaced via r/LocalLLaMA before mainstream coverage; verified against the primary repo.

template / Open-source / local-first

Rowboat — local-first 'AI coworker with memory'

An open-source, local-first alternative to Claude Desktop that operators run on their own machines, positioning memory and workspace state as user-owned rather than vendor-hosted.

The counter-pattern to this week's suite consolidation: as ChatGPT Work and Cowork pull harness state into vendor clouds, the local-first lane keeps task history, memory, and approvals on hardware you control. Worth piloting for teams whose data-governance posture cannot accept cloud-run agent sessions.

connector / GitHub / MCP security

GitLost disclosure — prompt-injection exfiltration via public issues

Noma Labs showed an unauthenticated attacker exfiltrating private-repo contents from GitHub Agentic Workflows via a crafted public issue — no credentials required, guardrails bypassed by adding the word 'Additionally', leaked data posted as a public comment.

The connector lesson, not just a CVE: any agent with cross-repository read access and public-input exposure is an exfiltration channel, and keyword-level guardrails do not hold. Add least-privilege repo scoping and treat the agent's context window as attack surface in every connector review — before your own workflows get the treatment.

Proof Of Value.

Evidence: benchmark

Databricks: Coding-agent benchmarking on a production multi-million-line codebase

On tasks reconstructed from real merged PRs and graded by held-out test suites, the same model at the same effort cost over 2x more per task across harnesses at equal quality; GLM 5.2 statistically tied Opus 4.8 at $1.28 vs $1.94 per task; and Sonnet 5 cost more per task than Opus 4.8 ($2.09 vs $1.94) despite a ~1.7x cheaper rate card, consuming 1.9x more tokens.

The most procurement-relevant agent benchmark published this year: internal, but methodologically serious (held-out tests, no LLM judges, sealed git history after agents mined the commit log for answers). The read-across is direct — per-token price is a poor proxy for per-task cost, and your harness choice is probably worth more than your next model negotiation.

Evidence: benchmark

LangChain + NVIDIA: Harness tuning for open-model agent quality

Tuning only the harness around Nemotron 3 Ultra lifted Deep Agents suite scores from 0.80 baseline to 0.86 best-run (vs Opus 4.8's 0.87) at ~$4.48 vs $43.48 per full-suite run — roughly 10x cheaper at matched best quality with ~10s median latency parity, no retraining.

Vendor-adjacent (both parties benefit from the result) but published with methodology and shipped as a reusable artifact, which raises the credibility bar. The transferable finding is the magnitude: if harness tuning is worth 6 points and 10x cost, every team running open models below frontier quality should exhaust the harness before blaming the model.

Evidence: vendor_claim

OpenAI: Codex adoption beyond software development

Over 5 million people use Codex weekly, more than 1 million of them outside software development — the stated rationale for generalizing the Codex harness into ChatGPT Work.

Unverified vendor telemetry, but the strategic disclosure matters regardless of the exact numbers: OpenAI is claiming a fifth of its agent-runtime users already do non-coding work, and it restructured its flagship product around that claim. Treat the number as directional and the product decision as the real evidence.

Evidence: practitioner_report

Colibri (open-source project): Frontier-class open MoE on consumer hardware

A pure-C, zero-dependency engine runs the 744B-parameter GLM-5.2 in 25GB of RAM by streaming expert weights from disk on demand — 876 Hacker News points and ~3,200 GitHub stars within ten days.

A working demo with public code, not a benchmark — latency is the undisclosed cost of disk streaming, so this is accessibility proof rather than production guidance. The signal is directional: the hardware floor for near-frontier open models keeps dropping through community engineering, which compounds the open-weight agent economics documented elsewhere this issue.

Enterprise Readiness.

permissioning
GitLost is the mandatory case study: an agent with cross-repo read access plus public-input exposure leaked private repos to an unauthenticated attacker, and a single added word ('Additionally') bypassed the guardrails. Enforce least-privilege repo scoping per workflow, isolate agents that read public inputs from private data, and assume keyword guardrails fail.
cost
Claude Code now requires typed confirmation for usage-credit purchases over $1,000, and the week's benchmarks make harness-level cost review a governance item, not an engineering nicety — the same model can cost 2x more per task depending on wrapper. Add harness choice to the spend-review checklist alongside model and effort level.
human approval
ChatGPT Work auto-enables for Enterprise/Edu after a two-week off-by-default preview, and Cowork's mobile push approvals move the human gate to the lock screen. Define now which agent actions may be approved from mobile, which require desktop review, and who owns the suite-default decision before the vendors' defaults decide for you.
auditability
Cursor 3.11's conversation-level hooks (prompt, response, thought, subagent, compaction) plus local transcript search make full agent-session observability buildable in-house — the harness layer now exposes enough events to stream agent behavior into existing audit pipelines. Teams that asked for this capability in W27 should prototype against it now.
reliability
Claude Code's background agents now self-upgrade post-release and require confirmation before entering worktrees outside the project boundary — small changes that close real drift and blast-radius gaps in scheduled-agent fleets. Auto mode defaulting on in Bedrock/Vertex/Foundry means enterprise-managed deployments inherit more autonomy unless explicitly disabled.

Try This.

Benchmark your harness as an independent variable on ten real tasks

Pick ten completed tasks from your own history (merged PRs, finished documents, resolved tickets) and write a one-line verifiable success check for each — the Databricks move of grading against held-out reality instead of judgment (~10 min).
Run the same model at the same effort level through two harnesses you already have access to (e.g., Claude Code vs Cursor CLI, or your platform's generic agent vs a tuned profile), capturing per-task token counts and wall-clock from the session telemetry (~15 min).
Compare cost per completed task at matched quality, then write the result into your routing policy: which harness wins for which task class, and what per-task cost threshold triggers a re-route. If the spread exceeds 1.5x — the published data says it will — schedule a harness-profile tuning pass before your next model contract renewal (~5 min).

Expected outcome: You learn whether the 2x harness cost swing reproduces on your own work, and you leave with a defensible per-task cost baseline that turns the next model-vendor negotiation — and the next 'we need a bigger model' request — into an evidence question.

Watchlist.

Jul 22-23
ChatGPT Work auto-enable window closes for early Enterprise/Edu workspaces
The first mass agent auto-enablement in enterprise software — watch whether admins opt out at scale, and whether OpenAI publishes adoption data that validates the default-is-the-sale distribution model.
July 2026
Harness-profile pattern spreads beyond LangChain
If GitHub, Cursor, or a model vendor ships registrable per-model harness configurations (or per-task cost telemetry — prediction p58), harness engineering becomes a standard platform discipline rather than a benchmark finding.
July-August 2026
GitHub's response to GitLost
The disclosure showed keyword guardrails failing against a one-word bypass; watch for architectural fixes (least-privilege workflow scoping, context-window isolation) versus more filter patches — the answer sets the bar for every agentic-workflow product.
Within weeks
vLLM-class productionization of MTP speculative decoding
The +40% local-throughput result on Hy3's MTP head moving into production serving stacks would cut self-hosted agent serving costs across every MTP-equipped open model — the local-first lane's answer to suite bundling.
Aug 31
Sonnet 5 intro pricing ends with per-task data now public
Databricks showed Sonnet 5 already costs more per task than Opus 4.8 at intro pricing; the step-up to $3/$15 makes harness-level routing review a hard deadline for fleets built on the intro rate.