AI Agent Harnesses Are the New GPT Wrappers

GPT wrappers were enough when the main product advantage was convenient access to a capable language model. They placed an interface, prompt library, or specialized workflow around an API, then returned the model’s answer to the user.

An agent harness is a more substantial system. It keeps the model working across multiple steps, connects it to controlled tools, preserves state outside the model’s context window, and decides when the software can act autonomously or must ask for human approval.

That changes the product from an interface for generating answers into an operating system for completing work. The model remains important, but the application’s lasting value increasingly lives in its workflow logic, integrations, permissions, evaluation data, and accumulated knowledge about exceptions.

An Agent Harness Turns a Model Into a Work System

“Agent harness” does not yet have one universally accepted technical definition. Framework developers use the term somewhat differently, but the common architecture has four essential parts.

It Runs the Model in a Loop

A normal LLM call receives input, generates a response, and stops. A harness interprets the response, executes any requested action, returns the result to the model, and asks it to determine the next step.

The loop continues until the harness reaches a completion condition, encounters a limit, or escalates the job to a human. OpenAI’s Agents API describes this as a managed runtime that handles model calls, context, tools, subagents, and long-running sessions rather than leaving every orchestration detail to the developer.

It Gives the Model Controlled Tools

A harness can let an agent read documents, search databases, update business systems, execute code, operate a browser, send messages, or call external APIs.

The important word is controlled. The LLM proposes an action, but the surrounding runtime determines whether that action is permitted, which credentials it may use, where its code runs, and whether approval is required.

It Preserves State Across Long Jobs

LLM context is not the same as durable memory. A context window is temporary input supplied to a model call. Durable state lives outside the model in session logs, databases, files, checkpoints, plans, and generated artifacts.

A production harness can store what happened, compact older history, retrieve the relevant details, and resume after a process or execution environment fails. Anthropic’s managed-agent architecture uses an external append-only session log so the harness and its execution containers can be replaced without losing the job’s history.

It Enforces Boundaries and Stop Conditions

The harness decides which files, systems, tools, and network destinations the agent may access. It can impose time, token, cost, and iteration limits while requiring human approval for sensitive actions.

That gives us a practical distinction:

A production harness also needs observability. If developers cannot inspect tool calls, replay failures, measure completion, and compare versions, they cannot tell whether the agent is becoming more reliable or merely more active.

The Harness Can Outlast the Model Beneath It

A thin wrapper is often tightly coupled to a particular model, prompt format, or provider-specific API. A well-designed harness puts more of the job knowledge into model-independent components:

• Tool definitions and integrations
• Process stages and completion criteria
• Permission and escalation policies
• Domain-specific rules
• Stored examples and templates
• Evaluation cases
• Exception categories
• Customer-specific configuration

The harness can then route different steps to different models. A low-cost model might classify documents, a stronger reasoning model might investigate an exception, and an open-weight model such as Gemma, Qwen, or DeepSeek might process sensitive material in a private environment.

Frameworks are being designed around this separation. Vercel describes eve as provider-neutral, while LangChain’s standard model interface allows developers to switch providers without rebuilding the entire agent application.

Model independence should not be confused with model equivalence. Moving a harness from GPT to Claude or to a locally hosted model does not guarantee the same accuracy, latency, tool-use behavior, or operating cost. Prompts and evaluations will still need adjustment.

Portability is an architectural property, not a performance guarantee. The useful part is that a model migration does not have to erase the company’s workflow knowledge, integrations, historical corrections, or acceptance tests.

Job Knowledge Compounds Through Corrections

The strongest agent harnesses can become materially better after hundreds of completed jobs, but that improvement is not automatic.

Correcting an agent’s output does not update the underlying model’s weights. A harness needs a deliberate feedback process that turns the correction into an appropriate product change. Depending on the failure, that could be:

• A deterministic validation rule
• A revised instruction or policy
• A new example for retrieval
• A change to a tool or integration
• A new routing condition
• A regression test in the evaluation suite
• A new category of exception requiring human review

Suppose a freight-claims agent incorrectly treats one carrier’s documentation rule as universal. The correction should not merely become another sentence in an ever-growing prompt. The team might encode the rule in a carrier-specific policy table, add the failed claim to an evaluation set, and require document verification before the agent submits similar claims.

That creates a real data advantage. After 500 jobs, the system may contain hundreds of tested rules, known failure patterns, document mappings, and escalation criteria that did not exist after the first five jobs.

Vercel’s eve, for example, records session traces and supports evaluation suites that can run locally or in continuous integration. Those capabilities are important because an agent’s accumulated knowledge is valuable only if teams can test whether a change fixes one failure without reintroducing several others.

A harness that simply remembers every correction will eventually collect contradictions and irrelevant history. The compounding product is not raw memory. It is structured, versioned, and tested operational knowledge.

Selling Completed Work Changes the AI Market

The economic argument for agent harnesses is more consequential than the technical terminology.

A conventional SaaS product usually charges for access: per user, per month, per feature tier, or according to consumption. A harness can potentially charge for a completed unit of work:

• A resolved support request
• A processed claim
• A reviewed contract
• A submitted filing
• A reconciled account
• A cleared operational exception
• A completed month-end close

This moves the vendor closer to budgets previously spent on employees, outsourcing firms, and professional services. It also makes the product easier to evaluate. Customers can compare the price and quality of a completed result against their existing cost per result.

The frequently cited “$800 billion of software versus $5 trillion of work” comparison is better treated as a strategy lens than a formal market calculation. The categories use different boundaries, and Gartner’s July 2025 forecast already placed worldwide software spending at approximately $1.23 trillion. The defensible claim is that work budgets are broader than software subscriptions, not that one pair of headline figures establishes the addressable market.

Outcome pricing is already appearing in agent products. Intercom’s Fin pricing charges $0.99 per outcome rather than pricing only by seat or generated token.

Charging for work creates harder engineering requirements, however. The harness needs a clear definition of completion, a reliable acceptance test, an audit trail, a process for disputed results, and a limit on how much inference or tool usage it can spend on one outcome.

A system that charges per resolved exception must distinguish a genuinely resolved exception from one it has incorrectly closed. Otherwise, outcome pricing rewards the agent for manipulating the metric rather than completing the job.

The Startup Opportunity Is in Workflows, Not Jobs

The US Bureau of Labor Statistics lists 867 detailed occupations in its 2018 Standard Occupational Classification system. That does not translate into 867 occupations ready for end-to-end automation.

Jobs are bundles of tasks. Some tasks involve repeatable decisions and digital tools, while others require physical work, negotiation, accountability, empathy, or judgment that cannot be reduced to a reliable decision tree.

Anthropic’s fourth Economic Index report, based on Claude usage data from November 2025, found that only about 3% of occupations showed AI use across at least three-quarters of their tasks. More than 90% of occupations still contained tasks that the report did not consider fully automatable. The dataset reflects one provider’s usage rather than the entire labor market, but it cautions against treating occupations as indivisible automation targets.

The better startup unit is a narrow workflow inside an occupation. Strong candidates generally have:

• High transaction volume
• Mostly digital inputs and outputs
• A limited set of tools
• Repeated decision patterns
• Verifiable completion criteria
• Expensive but manageable exceptions

Prior authorization illustrates the distinction. “Replace the prior-authorization specialist” is too broad. A narrower harness might collect the required clinical documents, check payer-specific criteria, populate a portal, detect missing information, and route uncertain submissions to a specialist.

The defensible knowledge is hidden in the exceptions: which payer rejects which evidence, which portal field causes a denial, which document supersedes another, and when a case requires clinical judgment. That knowledge emerges from doing the work, not from asking a general-purpose model to understand the industry.

Almost every occupation may contain harnessable workflows. That is a more credible and useful claim than saying almost every occupation can become one autonomous agent.

Frontier Labs Will Supply the Primitives

The claim that frontier AI labs will not enter agent harnesses is already too absolute. OpenAI and Anthropic are building managed agent infrastructure, and application platforms such as Vercel and LangChain are packaging the same primitives for developers.

What the frontier labs are less likely to encode is every customer’s narrow operating procedure. A general model provider does not automatically possess a freight broker’s exception history, a hospital’s payer rules, an accounting firm’s review policy, or a manufacturer’s supplier escalation process.

That leaves vertical companies room to own the application layer, but small market size alone is not a moat. A model provider, incumbent SaaS vendor, or business-process outsourcer could still target a profitable category.

The durable defenses sit outside the base model:

• Deep integrations with systems of record
• Proprietary evaluation and exception datasets
• Customer-specific workflow configuration
• Compliance and audit infrastructure
• Distribution within a particular industry
• Historical outcome data
• Contracts tied to measurable performance

As frontier models improve, they will make more harnesses possible while simultaneously making basic harnesses easier to copy. A startup that owns only a prompt and a list of tools remains vulnerable. A startup that owns the accepted process for completing and verifying the work has a stronger position.

The Tooling Has Finally Caught Up With the Idea

Agent harnesses are becoming practical because developers no longer need to build every runtime component themselves.

• OpenAI introduced its real-time Agents API on September 1, 2026. It manages long-running sessions, context compaction, tool calls, subagents, files, shell execution, web access, computer use, and Model Context Protocol connections. Sessions can persist for up to 30 days.
• Anthropic’s Claude Agent SDK, formerly called the Claude Code SDK, packages an agent loop with built-in file and shell tools, permission controls, context management, session continuity, and subagents. Anthropic’s managed-agent work also demonstrates how the harness, durable session, and execution environment can operate as separate components.
• Vercel’s open-source eve framework combines durable state, model routing, tools, skills, subagents, approval controls, sandboxed execution, tracing, and evaluations. It stores session state independently of the running process, allowing an agent to resume when new input arrives.
• LangChain’s Deep Agents provides a configurable harness with planning, file-based state, subagents, context summarization, persistent memory, human approval, and sandbox integrations. It is built on LangGraph rather than being tied to one fixed agent configuration.

These products do not remove the difficult work of understanding a job. They reduce the amount of undifferentiated infrastructure required before a team can begin encoding that understanding.

That distinction matters. Building an agent loop is becoming a framework feature. Building a trustworthy claims examiner, compliance reviewer, or financial-close operator is still a domain problem.

Security and Reliability Live Outside the Prompt

A system prompt cannot be the primary security boundary for an agent that can run code, access customer records, or submit transactions.

Production controls must sit in the harness and surrounding infrastructure. Credentials should remain outside model context. Tools should receive narrowly scoped permissions. Code should execute in an isolated environment. Network access should be restricted, and high-impact actions should require approval.

OpenAI’s agent safety guidance specifically recommends approvals for tool operations, structured outputs between workflow stages, input guardrails, and trace-based evaluations to reduce prompt-injection and data-handling risks.

Anthropic’s managed-agent design separates the reasoning process from the execution container, while Vercel’s eve can pause individual tools for approval and resume the session after a decision. Those are stronger controls than asking the model to remember that it should be careful.

Reliability also requires explicit stopping rules. A harness should know when it has completed the work, when further attempts are unlikely to help, and when the expected cost or risk has exceeded a threshold.

Without those boundaries, an agent loop is merely an LLM that can continue making mistakes for longer.

Final Thoughts

Agent harnesses are the new GPT wrappers because the center of application value is moving away from the individual model response. The valuable system is the one that can plan, act, remember, verify, recover, and escalate within the constraints of a real job.

The opportunity is larger than another generation of AI interfaces, but the winning companies will not be those that attach the most tools to a model. They will be those that identify a narrow unit of work, encode its exception-heavy operating knowledge, and prove that the result meets a measurable standard.

Frameworks will commoditize the loop, memory, sandbox, and tool plumbing. Frontier models will commoditize more of the reasoning. The durable company will be the one whose process knowledge survives each model cycle and converts that knowledge into verified work.