Own your harness, folks.
I feel like System One models take custom agent harnesses to a whole different level.
It's not a surprise.
This comes down to needs that haven't been met with System Two models alone.
A need to be in control of your intelligence stack.
A need for more reliable agents. Combining System One and System Two models is way better than just relying on one alone.
A need for richer agent experiences (more personal and proactive agents).
A need to squeeze out more value per token used.
You can check my most recent guide on building a custom harness with Pi and Jev to learn more: academy.dair.ai/resources/jev-…
But let's not stop here.
I expect a new wave from frontier labs pushing decision models further.
And even better tools to build even more customized decision models on top. There are more layers to this.
This is great news for us builders and an incredible opportunity for those who specifically build custom harnesses.
Pay attention to this new wave of System One models if you are building custom harnesses.
First Jev. Now, Contrastive Language Model (CLM).
CLM is 9x faster than Jev.
CLM seems to be a better verifier than Jev, particularly at long-horizon tasks.
How do Jev and CLM differ?
I've spent the past few months building a coding agent from scratch.
Here's the tech stack I ended up with:
Agent framework → Pydantic AI
I wanted the agent loop to stay simple.
Pydantic AI manages the model/tool interface, while we built the harness on top of the loop ourselves.
LLMs → Gemini, OpenRouter + @modal
Gemini and OpenRouter give Decode access to hosted models.
With @modal, I can serve open-weight models like Qwen myself using SGLang on an H200.
Sandboxing → seatbelt/bubblewrap + @modal
Seatbelt/bubblewrap handles local isolation.
For stronger separation, Decode can execute bash, read, write, and edit inside remote @modal sandboxes.
Observability + Evals → Opik by @Cometml
Every agent session can be traced, while the same infrastructure supports benchmarks, regression tests, and online evals.
Recording + Replays → Kitaru by ZenML
Super useful for optimizing your agent or finding edge cases.
Kitaru lets me record an agent run, then replay it with a different model or prompt while reusing the original tool outputs.
Deployment → @modal
The same headless harness can run as serverless functions triggered through:
• CLI
• Webhooks
• Cron jobs
This lets me launch N independent coding agents in parallel without maintaining servers.
If you want to understand how coding agents work under the hood…
You can explore the entire stack and build Decode yourself in my open-source here: github.com/decodingai-mag…
@automater_ai@TraycerAI@composio Agreed - lazy startup, not lazy discovery. The plan: a cached, repo/config-scoped tool catalog up front, validated against the live server before execution. Each harness gets its own repo-local instance on demand.
Nine models got root inside an agent sandbox with one goal: reach a blocked URL.
No VM escape in 108 runs. Four models still reached it by chaining the sandbox's own PyPI allowlist with two services nobody hacked.
Details: dennysentinel.com/blog/2026-09-2…#AIAgents#Security
If I had 6 months to become a GenAI Engineer in 2026.
I’d do this.
Stage 1: Speak the model
Streaming, tokens, structured outputs, failure logs.
Ship: a chatbot that tells you WHEN it breaks not just answers.
Stage 2: Decide before you generate
System-One router → escalate only low-confidence work to a big LLM.
Ship: a triage layer that’s 10x cheaper on boring requests.
Stage 3: Tools with receipts
Schemas, retries, idempotency, typed errors.
Ship: an agent that uses 3+ tools and never “hallucinates” a call.
Stage 4: Context is the product
Hybrid search, rerank, query rewrite, citations.
Ship: RAG on YOUR docs that a skeptic would trust.
Stage 5: Budget the window like money
Memory vs tools vs retrieval. Compress. Evict. Allocate.
Ship: an orchestrator that never blows context mid-task.
Stage 6: MCP + Skills (not just tools)
Expose capabilities AND the playbook (SKILL.md).
Ship: a server hosts can discover, load and reuse.
Stage 7: Agents that survive reality
Durable workflows, checkpoints, HITL gates, resume-after-crash.
Ship: a run that lives through a 3-day approval.
Stage 8: Multi-agent without a circus
One router. Specialist skills. Shared memory rules. Kill loops.
Ship: a small system that finishes doesn’t debate forever.
Stage 9: Eval the path not the vibe
Golden sets, trajectory grading, CI gates on regressions.
Ship: a harness that blocks PRs when step 4 quietly got worse.
Stage 10: Latency & $ as product features
KV-cache, shadow routing, TTFT, per-request cost, kill-switches.
Ship: a gateway with a dashboard finance won’t hate.
Stage 11: Enterprise won’t “try later”
PII proxy, scoped permissions, SSO, tenancy, audit logs.
Computer-use fallback when the API doesn’t exist.
Ship: one ugly real integration a customer would sign off on.
Stage 12: Proof > portfolio of tutorials
Public teardown: architecture, failures, metrics, one open-source piece.
Apply to GenAI / FDE / Internal AI roles with receipts.
Certificates show you watched.
Stages show you shipped.
Bookmark this. Revisit in 180 days.
The bottleneck in agentic engineering moved again. It is no longer prompting the model, it is building the harness around it.
elvis at DAIR.AI just published a piece on building a custom harness with Pi and Jev, walking through gates, routing, and verifiers as the building blocks of a serious agent loop. His framing: an agent is a language model in a loop, reading a task, calling a tool, checking the result, and deciding whether to keep going. The harness is everything that makes that loop reliable instead of a coin flip.
The frameworks are splitting along exactly this line. LangGraph gives engineers explicit control through conditional edges, checkpointing, and approval gates, which is why it keeps winning production workflows with retries and human-in-the-loop steps. CrewAI optimizes for developer speed with a role-based mental model, but it has no built-in checkpointing for long-running work and limited control over agent-to-agent communication. Mastra shipped an AgentController class this year that wraps the loop with persistent sessions, switchable modes, and tool-approval policies, productizing the harness as its own layer.
Researchers are formalizing this too. A recent paper calls 2026 the year of the agent harness, arguing the wrapper around the model now matters more for reliability than the next point of benchmark accuracy.
I have seen this exact shift before, in DevOps. Nobody cares which container runtime you use once Kubernetes standardizes the orchestration layer. The orchestration layer is where the real engineering work went, and that is exactly where agent harnesses are now.
The gap most teams are missing is verification, not generation. Everyone can get an agent to attempt a task. Very few teams have built the gate that catches it when the attempt is wrong.
My take: the agent framework you pick matters less than whether you have actually built gates and verifiers into the loop. Most teams ship the happy path and call it done.
x.com/omarsar0/statu…
here's a prompt to improve your agent harness based on what we've learned at cursor. enjoy
# Improve this agent harness's token efficiency
You're working on an LLM agent harness: the system prompt, tool definitions, request assembly, context caching, compaction, and retrieval, and how work is split across agents. Make the agent's runs cheaper without making it worse at its job.
- Objective: lower price-weighted token cost per completed task.
- Constraint: no measurable drop in task quality.
Measure per task, not per request. Every turn resends the prefix (tools, instructions, setup, and the conversation so far), so a change that shrinks each request but adds turns can cost more. Weight tokens by billing type: output, uncached input, and cached input are priced very differently.
Work in this order: map the harness and measure the baseline, rank the opportunities, make the changes that are safe to make directly, put the rest behind flags or in proposals, then report.
Figures below come from one team's production coding agent and its multi-agent experiments. Use them to gauge magnitude, not as targets. One round of these changes (prompt trimming, tool offloading, cache layout, sparse line numbers, subagent tuning) cut that team's overall token cost about 7% with no loss in quality. The larger percentages apply only to the part of the request each change touched.
## Principles
1. Change what the harness sends, not how hard the model tries. Don't ask the model to conserve tokens. A harness that told its model to "take care to preserve tokens and not be wasteful" found it grew reluctant to take on ambitious tasks and sometimes quit, saying it wasn't supposed to waste tokens.
2. Capable models need definitions, not commands. Lists of "DO NOT", "You must", and "Important", and guards against older models' habits, can usually be replaced with plain descriptions of what each tool does. One team cut about two-thirds of its system prompt this way, and the shorter prompt worked across model families. Instruct only on what the model can't know (the product, the environment, the user's processes) and on quirks you've seen in transcripts.
3. Static context is for what most turns need. Everything else should be discoverable when needed. Less up-front context also means less confusing or contradictory information.
4. Expect removals to win. Guardrails written for weaker models, coordination steps that became bottlenecks, and prompting for behavior the model now does on its own all cost tokens.
5. Real usage decides. Evals are a fast proxy, but they skew toward hard problems and miss the real mix of requests.
## 1. Map the harness and measure the baseline
Find:
- Where requests are assembled, the system prompt, and tool schemas. If a framework or SDK builds requests, find its hooks for message order, cache control, and tool loading.
- How tool results are formatted, and how history is kept, trimmed, or summarized.
- How subagents or parallel agents are spawned, if any.
- Which models and provider APIs are used. From the provider's docs, get the prompt caching behavior (automatic or explicit breakpoints, TTL, minimum cacheable length) and the prices for output, uncached input, and cached input.
- Existing logging, token accounting, and evals.
If the harness doesn't record per-request token usage by billing type and cache hits, add that first. Everything later depends on it.
Then render a few real requests (from logs, or by running representative tasks) and count tokens per section with the model's tokenizer or the API's usage fields. Produce:
- Cost share by source × billing type. Sources: system prompt, tool definitions, skill/rule/integration descriptions, user messages, file reads, search results, command and other tool output, history, summaries, subagents.
- Static tokens per request, cache hit rate, and turns per task.
- Per tool: the share of runs that call it at least once, and its error rate.
Read the rendered requests, not just the templates. Duplication, leaked volatile values, and misordered blocks only show up there.
Rank opportunities by share of spend × fraction removable ÷ quality risk.
## 2. System prompt and injected context
Label every instruction:
- Keep: product or environment knowledge the model can't infer, fixes for quirks seen in this model's transcripts, and rules a mode depends on.
- Rewrite: commands and emphasis into plain descriptions. Reminders into constraints: "No TODOs, no partial implementations" works better than "remember to finish implementations." Vague quantities into ranges: "generate 20–100 tasks" gets far more ambitious behavior than "generate many tasks."
- Delete: things capable models do by default, guards against behavior you haven't seen from this model, text that repeats tool descriptions, and lines that could contradict a user request. Models trained to rank system instructions above user messages will side with the system prompt.
- Move: anything per-user or per-request (date, environment, repo state, lists of skills or subagents, user rules) into a user-role setup message after the cache boundary.
Audit other injected context the same way. As models improved, the team behind these figures dropped directory trees, pre-retrieved snippets, compressed copies of attached files, lint errors injected after every edit, forced expansion of short file reads, and caps on tool calls per turn. They kept small, high-value facts: OS, repo status, and open or recently viewed files.
Skip checklists for open-ended work. The model optimizes the listed items and deprioritizes everything else.
## 3. Tool definitions
Tool schemas ride along on every request. Most tools beyond the core set were each needed in under 20% of conversations, and moving them out of static context cut tool-description tokens 60%. Doing the same for integration tools (such as MCP servers), with names in context and full schemas in one folder per server that the agent can search with grep or jq, cut total tokens 46.9% in sessions that used them.
- Keep in static context: high-frequency tools (for a coding agent: read, search, edit, shell), tools the model tries to call even when they're absent, and tools a mode depends on.
- Offload the rest: leave a name or one-line pointer and make the full schema discoverable on demand. Group related tools so they load together, and put status (such as "needs re-authentication") where the agent will see it.
- Tighten what remains: describe behavior and arguments, and drop usage lectures.
- Pick the split by testing a few configurations and tracking tokens, cost, latency, tool-call errors, and task success.
## 4. Cache layout
Order each request so the reusable prefix is as long as possible:
`tool definitions → system instructions → [breakpoint] → setup message (skills, subagents, rules, environment) → [breakpoint] → conversation`
- Keep the prefix byte-identical across turns. Use deterministic tool order and serialization, put timestamps and IDs after the boundary, and don't rewrite earlier messages except when compacting.
- Use explicit breakpoints if the provider supports them. Otherwise rely on automatic prefix caching with the stable part first. Respect TTL and minimum-length rules.
- Switching models mid-conversation throws away the cache (caches are per model and provider) and hands the new model a history it didn't write. When a different model is needed, run it as a subagent with fresh context.
Explicit breakpoints plus moving per-request setup after them cut cold cache misses 20%.
## 5. Tool results and other context added during a run
- Large outputs (commands, integrations, logs): write them to a file and return the path, size, and a short tail. The agent can tail, grep, or read ranges for more. Truncating loses data, and inlining bloats every later request. Treat long-running terminal sessions the same way.
- High-volume formats: look for overhead repeated on every line or item. Numbering every 10th line of a file read instead of every line cut cache-read tokens 1.6% without hurting citation accuracy. Each number costs 3–5 tokens, and agents read tens of thousands of lines per session. Also check repeated absolute paths, verbose JSON keys, ANSI codes, progress bars, and repeated headers.
- Good retrieval saves exploration turns. Adding semantic search alongside grep raised codebase question-answering accuracy 12.5% on average and cut the iterations users needed.
- Tool errors waste tokens and leave confusing debris in context. Classify expected errors (invalid arguments, unexpected environment, provider error, timeout, user abort), treat unknown errors as harness bugs, and track rates per tool and per model. One focused effort along these lines cut unexpected tool errors 10×.
## 6. Long runs: compaction, subagents, and model mix
- Compaction: keep the summarization prompt short and the summary compact, carry forward plan state and remaining tasks, and save the full history to a file the agent can search for details the summary dropped. A model trained to self-summarize from a one-line prompt wrote ~1k-token summaries with half the compaction error of a multi-thousand-token prompt that produced 5k+ token summaries. Untrained models may need more guidance, so test how short you can go. A more expensive summarization model made a negligible difference.
- Scratchpads and running notes: rewrite them instead of appending. For repeated work in one environment, a small agent-maintained notes file with a line budget, loaded at start, is a promising way to shorten later runs.
- Subagents: fresh context keeps the parent lean, but isolation adds coordination cost (duplicate or stale work). If the model already delegates on its own, remove prompting that pushes it to. Have subagents return short handoffs: what was done, findings, concerns, and deviations. A subagent should use a different model only when the user or harness says so.
- Model mix: in large multi-agent runs, workers used at least 69% of tokens, and over 90% in most runs. A frontier planner with cheap workers matched a frontier model doing everything at about one-eighth the cost. Planner choice still changes worker spend. One planner that cost less on its own saw its workers use several times more tokens, and the run cost more overall. Measure the whole tree.
- Routing and reasoning effort: send simple turns to a cheaper model or lower effort, and upgrade only when a stronger model is clearly better. A router built this way matched or beat single frontier models on user satisfaction at 41–68% lower cost.
- Reasoning continuity: if the API returns reasoning items (including encrypted ones), pass them back on later turns and alert when they go missing. Dropping them cost one reasoning model 30% on a coding benchmark, and it burned tokens reconstructing its plan.
## 7. Fit the harness to each model
Adapt to what each model was trained on instead of forcing one shape on all of them. If you've tuned the harness for a similar model, start from that version.
- Edit format: use the one the model was trained on (for example, patch-style or search-and-replace). An unfamiliar format costs extra reasoning tokens and causes more mistakes.
- Shell or tools: shell-first models fall back to `cat` or inline scripts. Name tools after their shell equivalents (such as `rg`), and if needed add: "If a tool exists for an action, prefer to use the tool instead of shell commands (e.g. read_file over `cat`)."
- Literalness: some model families follow instructions literally and others tolerate imprecision. Some spiral on emphasized wording. Strip caps and emphasis for literal models.
- Triggers: some models ignore a tool until told when to use it. A literal trigger works: "After substantive edits, use the to check recently edited files for linter errors. If you've introduced any, fix them if you can easily figure out how."
- Progress updates: if a model reports progress through reasoning summaries, keep them to 1–2 sentences that note new findings or a change of tactic, and remove instructions about messaging mid-turn.
- Quirks worth a targeted line: hedging or refusing as context fills ("context anxiety"), declaring completion early, stopping to ask permission, and calling tools that don't exist.
Tie each added instruction to the transcript behavior it fixes. Re-audit when models change, since guidance one version needed can be dead weight for the next.
## 8. Validate
- Offline: run a fixed set of realistic tasks before and after, ideally drawn from real usage and phrased the way users actually write (short and ambiguous). Compare task success, tokens, cost per task, turns, and tool errors. Don't ship a change that lowers success.
- Online, if you have users: A/B test each change or small bundle. The primary metric is cost per completed task. Guardrails are task success signals, tool-call errors, latency, turns per task, and cache hit rate. For a coding agent, a good success signal is how much agent-written code survives over time. In general, check whether the user's next message moves on or reports a problem.
- Ship only when cost drops and no guardrail regresses beyond noise. Record null results.
## What to change directly and what to propose
- Change directly, each in its own revertible commit: token and cache telemetry, deterministic serialization and tool order, moving volatile content out of the cached prefix, explicit cache breakpoints, writing large outputs to files instead of truncating, passing back reasoning items that are being dropped, and fixes for recurring tool errors.
- Change behind a flag so it can be tested: system prompt edits, tool offloading, output format changes, compaction changes, and subagent prompting.
- Propose only: changes to which models run, routing, reasoning-effort defaults, or how work is split across agents.
## Traps
- Asking the model to use fewer tokens or do less.
- Truncating tool output.
- Dropping reasoning items to save input tokens.
- Volatile content in the cached prefix, or tool order that changes between requests.
- Offloading a tool the model needs on the first turn or tries to call when it's missing.
- Emphasis-heavy prompts (MUST, NEVER, IMPORTANT, all caps), especially with literal models.
- Forcing a terser output format than the model was trained on. Fewer output tokens can mean less thinking and worse results.
- Optimizing raw token counts instead of cost, per request instead of per task, or evals instead of real usage.
- Switching models mid-conversation to save money.
- Adding coordination layers that become bottlenecks.
## Report back with
1. The harness map and baseline: cost by source × billing type, with the biggest sources called out.
2. A ranked list of changes: layer, what changes, estimated savings and how you estimated them, quality risk, how to validate, and how to roll back.
3. The changes you made, including a system prompt diff with a keep, rewrite, delete, or move reason for each line.
4. A test plan for the flagged changes.
5. Gaps: anything you couldn't find or measure.
Banger paper from Stanford and Together AI.
They show why it might be a good idea to let your agent team learn its own way of working together.
(bookmark it)
Three models (o3-mini, Claude Sonnet 4 and DeepSeek-V3) averaged 66.7% across five math and physics benchmarks as a self-organizing team.
Their strongest member alone scored 48.8%, and a perfect router choosing among the members' independent answers scored 59.0%.
On AIME 2026 the team reached 71.2%, 13.4 points above that router.
One member reviews the team's earlier exchanges and rewrites the teamwork strategy, covering roles, the order of discussion phases, who participates and how partial answers are combined. The strategies were learned from only 15 AIME 2024 problems and then applied unchanged to held-out AIME 2024 problems and four new benchmarks.
Paper: academy.dair.ai/papers/self-or…
An AI agent doing work isn’t the hard part anymore.
The hard part is keeping the objective, progress, and human decisions in one place.
I self-hosted Octo and tested the workflow locally. Octo was the workspace. OpenClaw was the third-party agent runtime I used. Here’s what happened 🧵
Into agentic AI? Here's the distinction I wish I understood earlier:
> Agent: model + loop + tools
> Multi-agent: multiple agents coordinating
> Harness: the runtime that makes all of this reliable
The interesting work now isn't just adding more agents.
It's building the environment around them:
- Context engineering
- Memory + state
- Tool permissions
- Planning + orchestration
- Verification + evals
- Checkpoints + recovery
- Observability
- Human handoffs
The shift is:
Don't just make the model smarter.
Make the system around the model better.
That's where agent harness engineering gets interesting.
The AI moat isn't the model. Everyone has the model.
It's the boring eval harness nobody screenshots.
Does your eval framework matter more than your weights?
We're sharing new research on our post‑training approach, which teaches the Perplexity Computer agent to learn from real user sessions by imitating good trajectories and explicitly correcting avoidable mistakes like bad tool calls (even when the overall trajectory was successful). The method combines rejection sampling fine‑tuning (RFT) with hint‑guided self‑distillation, and it cuts tool call failures by about 21% in live A/B tests
New research: We post-trained a Computer model to learn from its own errors using hint-guided self-distillation.
In a live A/B test, a later trained checkpoint reduced tool-call failures by 21.2% relative to an earlier checkpoint.
We just launched Dstl8, the runtime feedback loop for AI-speed engineering - powered by Telemetry Distillation - remember, observability without feedback is just watching controltheory.com/blog/dstl8-gen…
arXiv AI Security: Mapping Political-Elite Networks in Europe with a Multilingual Joint Entity-Relation Extraction Pipeline
Treat agent tools like a control plane: least privilege, auditable calls, and fast rollback.
NVIDIA wants coding agents to stop wasting tokens on repeated work.
Its open-source project, SoL-Pi, is an extension for the Pi coding agent that tackles a familiar problem: reading the same outputs again, carrying old context, and searching huge logs for a few useful lines.
It can combine file edits with follow-up checks, keep large outputs available without repeatedly sending them to the model, and shorten logs while preserving access to the originals. It also compacts context as parts of the task are completed.
The goal is lower token costs while keeping the checks and information needed to finish the job. Every feature is optional and off by default.
A 4B coding agent reached 61.5% on SWE-bench Verified without frontier-model distillation by combining a simpler tool interface with synthetic tasks that keep adapting to what the model can currently learn.
FrogNano starts from Qwen3.5-4B and is trained with RL on about 1,500 synthetic software-engineering tasks.
The important part is how those tasks are chosen.
As the model improves, the system generates fresh problems that are challenging but still learnable, so the curriculum improves with the agent.
The interface matters just as much.
Switching to a simpler 5-tool setup moved the base model from 8.3% to 37.2% on SWE-bench Verified.
After 5 rounds, FrogNano reached 61.5%.
– arxiv. org/abs/2609.07925
Title: "FrogNano: Training a 4B Coding Agent via Online Task Synthesis"
1.1M Followers 64 Followinghttps://t.co/A9eTFq6Xbx
https://t.co/3RHK5vqQo7
Posts are not investment advice or an advertisement for investment services. See https://t.co/nX2FtaLE06.
5.5M Followers 4 FollowingOpenAI’s mission is to ensure that artificial general intelligence benefits all of humanity. We’re hiring: https://t.co/dJGr6LgzPA
193K Followers 8 FollowingMakers of Devin, the first AI software engineer. We are an applied AI lab building end-to-end software agents. Join us: https://t.co/4Ss9hvpjRG
2.0M Followers 2 FollowingClaude is an AI assistant built by @anthropicai to be safe, accurate, and secure. Talk to Claude on https://t.co/ZhTwG8d1e5 or download the app.