For Coding Agents, Harness Alignment Matters More Than Model Alignment

In July 2025, a Replit coding agent deleted a production database holding records on 1,206 executives and 1,196 companies. The deletion happened nine days into a public build, during a code freeze the user had declared with one instruction: no more changes without explicit permission. In late November 2025, a user asked Google’s Antigravity IDE to clear a project cache. The agent ran a delete against the root of his D: drive instead, skipping the Recycle Bin. He had turned on Turbo mode, which lets the agent run commands without asking.

Both agents ran on frontier models with extensive safety training. Both models, when the users confronted them, wrote articulate apologies and correct descriptions of what they should have done. The models knew the rule. No code between the model and the shell checked it. Everything in that gap is the harness, and for coding agents the harness decides more of the outcome than the model inside it.

What a harness is

A harness is every part of a coding agent that is not the model: the system prompt, the tool set, the context assembly, the loop control, the permission checks, the sandbox, the approval flow, and the audit trail. OpenAI gave the clearest definition on record in its August 19, 2026 Codex platform announcement. The harness “gathers context, invokes tools, enforces sandbox and approval boundaries, streams execution progress, and carries work across multi-turn sessions.”

For security, one part of that sentence carries the weight: enforces sandbox and approval boundaries. A model emits a tool call as text, a JSON object that says run this command or write this file. The model cannot reach a filesystem on its own. The harness takes that JSON and executes it, and at that moment a rule either holds or fails.

The harness already dominates capability

Benchmark authors have started separating the model from the scaffold around it, and the scaffold keeps accounting for the larger share of the score.

• Same model, different scaffold, 8 points. Epoch AI’s SWE-bench Verified analysis found a single model moving from 62.3% to 70.2% by scaffold choice alone.
• Same model, four harnesses, 6 points. On SWE-bench Pro, Claude Opus 4.5 scores 45.9% under Scale’s standardized SEAL scaffold and between 49.8% and 51.8% under Claude Code, Cursor, and Auggie.
• Same model, harness swap, 21 points. A May 2026 comparison reported Claude Opus 4.8 moving from 0.921 to 0.712 Pass@1 when moved between two agent harnesses. Papers treat a 2 to 4 point gain as a meaningful model advance.
• Rankings reverse. The May 2026 paper Stop Comparing LLM Agents Without Disclosing the Harness documents cases where the ordering of two frontier models flips with the harness configuration. The authors argue the harness “is often a stronger determinant of agent performance than the model it wraps.”
• Harness fixes transfer across models. The authors of Adapting the Interface, Not the Model built harness adaptations against a 4B-parameter model, transferred them to 17 other backbones, and improved 116 of 126 model-environment settings without changing a weight.

Anthropic reached the same conclusion from the inside. Its November 2025 engineering post on long-running agents states that context compaction “isn’t sufficient,” and ships an initializer agent, a claude-progress.txt file, a JSON feature list with tests the agent is told it is “unacceptable” to edit, and one git commit per feature. OpenAI reported that three engineers driving Codex through a purpose-built harness of linters, documentation structure, and lifecycle rules merged about 1,500 pull requests and around a million lines of code in five months. Both companies got those results by engineering the layer around the model.

Why model alignment cannot carry the security load

If the harness moves capability by double digits, it moves safety by at least as much. Safety is the case where the model works against you or someone has turned it against you. Three results from the labs set the ceiling on what model-level alignment can promise.

• Instructions reduce misbehavior. They do not remove it. Anthropic’s June 2025 agentic misalignment study put 16 models from six developers in a simulated corporate role with email access and a replacement threat. Claude Opus 4 and Gemini 2.5 Flash chose blackmail 96% of the time, GPT-4.1 and Grok 3 Beta 80%, DeepSeek-R1 79%. An explicit written prohibition cut Claude’s rate to 37%. The authors wrote that “naive attempts to simply instruct the model not to engage in harmful behaviors are not sufficient.”
• Prompt injection will not train out. OpenAI wrote on December 22, 2025, while hardening the Atlas browser agent, that prompt injection “much like scams and social engineering on the web, is unlikely to ever be fully solved.” Every mitigation OpenAI listed lives in the harness: confirmation before payments and messages, narrower autonomy, a logged-out mode, and an automated attacker that hunts for new injections before the public finds them.
• A coding agent reads more untrusted text than any other agent. Repository files, dependency READMEs, CI logs, issue threads, MCP tool results, and the output of each command all land in context. Each one can carry an instruction you never wrote. A model that follows instructions well follows those too.

Model alignment is a probability distribution over behaviors. Training shifts the distribution. It cannot zero out a tail, and a coding agent that makes a few thousand tool calls a day samples that tail on a schedule. The Replit freeze held for nine days and then failed once. A 37% residual in the lab looks like that in production.

What harness alignment means

A harness is aligned when the set of actions the agent can take matches the set of actions you intended to allow, whatever the model decides. You check it at the tool-call boundary, after the model has produced its intent and before anything executes. The major harnesses have converged on the same five layers, and their documentation reads the same way side by side.

• Permission rules. Claude Code’s allow, ask, and deny lists, where a broad deny beats a narrow allow and a matching ask prompts even when an allow also matches. Codex has an equivalent approval policy. Code evaluates these declarative rules, so a persuasive tool-call description cannot change the verdict.
• OS sandboxing. Codex enforces filesystem boundaries through operating-system sandboxes on Linux, macOS, and Windows. Claude Code’s sandbox restricts what a Bash command can reach, which the docs describe as protection “even if a prompt injection bypasses Claude’s decision-making.” The people who train the model wrote that sentence.
• Approval for irreversible actions. Anthropic’s first recommendation from the misalignment study is “requiring human oversight and approval of any model actions with irreversible consequences.” Put production deletes, force pushes, payment calls, and outbound messages behind a gate the model cannot open by itself.
• Runtime monitors. The study’s second recommendation: scan for concerning reasoning or misaligned behavior while the agent runs. In a coding harness that means a hook on each tool call that sees the command, the arguments, and the session so far.
• Least privilege on information and power together. Anthropic’s third recommendation warns against giving a model “both large amounts of information and also the power to take important, unmonitored actions.” Only the harness sees what the agent read and what it is about to write in the same session, so only the harness can measure that combination.

None of those five layers depends on a property of the model. Each works the same way with a better model, a worse model, or a jailbroken one. An aligned harness contains the damage when the model is wrong. An aligned model inside an unaligned harness produces the incident writeups above.

Why the industry keeps looking at the model

Model alignment gets the attention because the labs compete on it and the public conversation lives there. You also cannot change it. You cannot retrain the weights your IDE ships with. You can change the harness this afternoon.

Harness failures also look like user error. Turbo mode was a setting. The code freeze was a sentence in a prompt. Both are true, and both miss that the default harness let a single text instruction stand between a routine cache clear and a drive wipe. A harness that treats a delete against a path outside the workspace as an approval event, in any mode, would have stopped it with no change to the model. Vendors have since added checks of that shape. Each one patched the harness.

What teams should do

Treat the harness as the security boundary and the model as an untrusted component inside it. Six steps follow from that.

• Write the freeze as a rule. If an action must not happen, put it in a deny rule or a sandbox mount the harness evaluates. A sentence in CLAUDE.md or AGENTS.md is advice to the model. A deny rule is a constraint on the harness.
• Keep autonomous modes away from production credentials. Turbo, YOLO, and bypass-permissions modes remove the approval layer. Use them inside a sandbox whose blast radius you have already accepted.
• Gate irreversible actions on a second decision-maker. Destructive shell commands, writes outside the workspace, outbound network to new hosts, and anything that spends money should require a human or an independent policy engine, never the model that proposed them.
• Log each tool call with its arguments. Both users reconstructed their 2025 incidents from chat transcripts because nothing else recorded what executed. An audit trail at the tool-call boundary costs little and survives a model that, as in the Replit case, misreports what it did.
• Benchmark your harness. Run the same model through your production harness against a set of injected repositories and a set of benign tasks. Count what it blocked and what got through. If you cannot answer that, model choice is the least of your uncertainties.
• Make the harness portable across agents. Most teams run Claude Code, Codex, Cursor, and two or three SDK-built agents at once. If each carries its own permission model, the weakest one sets the floor. Prismor’s open-source runtime hooks one policy engine into each harness at the tool-call boundary, so the deny rule that stops a production delete in one agent stops it in all of them.

Models will keep getting better at understanding what you meant. They will stay probabilistic, and they will keep reading text you did not write. You rent the model. You own the harness, and the harness is where your alignment work compounds.