An agent's model makes every decision, but it can only decide based on what's in front of it at that moment. On a short task, that's mostly your request. On a long one, it's mostly the agent's own work: every file it opened, every search result, and every dead end. As that history piles up, agents start repeating themselves, clinging to wrong ideas, or wrapping up too early, and a bigger context window doesn't cure it.

Around the model sits the harness, the software that runs the loop, hands over the tools, decides what the model sees, and enforces the rules and limits. Good harnesses fight forgetting with summaries and with notes kept outside the model's view, and they stop runaway loops with caps on turns, time, and spending. The harness also draws a line that's easy to miss: an instruction in a file is a request the model usually follows, while a rule enforced in code can't be talked around.

That's why 2 products running the same model can behave like very different agents. In one experiment, the same model built a broken game on its own and a playable one inside a fuller harness. Comparing agents always means comparing a model and its harness together, so the fair test is your actual task, not a leaderboard.

What the agent knows right now

An AI model works only with its context, the text it can see at a given moment. For an agent, that context is much more than the person's request. The harness, the software running the agent, rebuilds it before every step, and most of it comes from somewhere else.

At each step, an agent's context usually holds:

  • The product's system prompt, hidden instructions written by the product's maker
  • Descriptions of every tool the agent can use
  • Instruction files from the project, such as AGENTS.md
  • The person's request
  • A record of every action taken and every result returned so far

The last item grows fastest. Anthropic's documentation for its agent toolkit puts it plainly: "Everything accumulates." [1] Manus, a general-purpose agent, reported in July 2025 that a typical task took about 50 tool calls, and that its agent read about 100 times more text than it wrote [2]. Most of that reading was its own tool results.

This explains a common surprise. Connecting an agent to a drive or inbox gives it the ability to look, not the knowledge. Agents usually hold only pointers, like file names and links, and pull in the content when a step needs it [3]. Until the agent opens a file, it doesn't know what's inside.

When long tasks forget

Models get worse at using their context as it grows, a problem Intro to Vibe Coding covers as context rot. Agents feel it more because they fill their own context. Every tool result, failed attempt, and old summary stays in view, and over a long task that history starts to crowd out the goal.

Symptoms seen in long agent runs include:

  • Repeating itself. When Gemini 2.5 Pro played Pokémon Blue, Google DeepMind reported that past about 100,000 tokens, the word fragments models count text in, the agent tended toward "repeating actions from its vast history rather than synthesizing novel plans." [4]
  • Clinging to a wrong belief. In the same run, a false idea about the game got written into the agent's goals and summaries, and it spent many hours hunting for an item that existed only in a remake [5].
  • Wrapping up early. Anthropic observed what it calls "context anxiety" in some models, which start finishing work prematurely as they near what they believe is their context limit [6].

Each new session adds a separate problem: it starts with no memory of the last one. In Anthropic's long-running coding experiments, a fresh session would see that progress had been made and declare the whole job done [7]. A bigger context window doesn't cure any of this. Gemini's window held more than 1,000,000 tokens, and the repetition began at a tenth of that [8].

Compaction and notes

Harnesses fight forgetting in 2 ways. The first is compaction: when the context nears its limit, the harness summarizes the history and continues in a fresh context with just the summary [9]. Claude Code clears old tool results first, then summarizes, keeping the person's requests and key code while "detailed instructions from early in the conversation may be lost." [10] Some models are now trained for it: OpenAI says GPT-5.1-Codex-Max, from late 2025, can compact its own history and keep working on one task across many context windows [11].

The second is notes kept outside the context, which no summary can erase. Anthropic compares a long project to "engineers working in shifts, where each new engineer arrives with no memory of what happened on the previous shift." [12] Its fix was a handover system: a first session wrote a progress file and a list of over 200 features, each marked as failing until tested, and every later session read them before starting work [13]. Manus had its agent rewrite a to-do file as it went, which kept the overall plan fresh in the model's attention [14].

Compaction trades detail for room, while notes keep the essentials safe. When delegating a long task, it's reasonable to ask the agent to keep a progress file or a running to-do list, so the next step or the next session can pick up where the last one left off.

Pro Tip! Rules that must hold for the whole task belong in the project's instruction file, which gets reloaded after compaction, not in a one-time chat message.

The agent harness

The agent harness

Every agent has a model at its center, the reasoning engine that reads the context and decides the next step. Everything else is the harness: the software that runs the loop, offers the tools, assembles what the model sees each turn, and enforces the rules and limits. Anthropic's documentation describes its own product this way: "Claude Code is the layer around the model that provides the tools and manages the context the model sees. This surrounding layer is what the term agentic harness refers to." [15]

Ethan Mollick, the Wharton professor, offers a plain-language picture: "Harnesses are what let the power of AI models do real work, like a horse harness takes the raw power of the horse and lets it pull a cart or plow." [16] Researchers often say scaffold or scaffolding for the same idea. The split also explains why products and models have different names. Claude Code and OpenAI's Codex are both harnesses, and the model running inside Claude Code can be switched with a single command [17].

Some sources draw the line more narrowly. Anthropic's "Trustworthy agents in practice" (9 April, 2026) splits an agent into model, harness, tools, and environment, with the harness meaning just the instructions and guardrails [18]. The broader sense, everything around the model, is how most products and documentation use the word. Either way, an agent is never just a model.

Instructions and guardrails

Instructions and guardrails

A harness steers an agent with 2 very different kinds of rules. Instructions are text the model reads: the product's system prompt, a project file like AGENTS.md, and the person's brief. AGENTS.md, a shared format for project instructions, is used by more than 60,000 open-source projects [19]. The model usually follows instructions, but nothing forces it to. Claude Code's documentation says there's "no guarantee of strict compliance, especially for vague or conflicting instructions." [20]

Guardrails work differently. They're rules the harness enforces in code, such as blocking a tool, requiring approval before an action, or keeping the agent inside a walled-off workspace. The same documentation draws the line clearly: "Settings rules are enforced by the client regardless of what Claude decides to do. CLAUDE.md instructions shape Claude's behavior but are not a hard enforcement layer." [21] Here, the client is the Claude Code software itself, and CLAUDE.md is its instruction file.

The practical rule follows from the split. A line like "never delete files" in an instruction file is a request. Turning off the delete tool makes deleting impossible. Anything that must never happen needs a guardrail, not a sentence.

Limits on runaway loops

Limits on runaway loops

An agent keeps looping until it decides the work is done. That works for a well-scoped task, but on an open-ended one, or when the agent is stuck, it may never decide to stop. So harnesses add backstops that end the run no matter what the model thinks. Anthropic notes that it's "common to include stopping conditions (such as a maximum number of iterations) to maintain control." [22]

Common limits include:

  • Turn limits: a cap on how many times the loop can run
  • Spending caps: a dollar limit on the run, which in Anthropic's agent toolkit also counts any helper agents it starts [23]
  • Time limits: a deadline after which the run ends
  • Retry limits: a cap on repeated attempts, after which OpenAI's guide advises handing control to a person [24]

For anyone delegating, 2 details matter. First, defaults can be generous: in Anthropic's agent toolkit, both the turn limit and the spending cap default to "No limit," and its documentation warns that open-ended prompts like "improve this codebase" can run long [25]. Second, hitting a limit isn't the same as finishing. The run stops with an error and no final result, so the task may be only partly done [26].

Pro Tip! When an agent works with an account that can spend real money, cap that account too, the way Simon Willison gave a coding agent a hosting account with a $5 budget.

Same model, different agent

An agent's results describe its model and its harness together. Anthropic made the point about SWE-bench, a widely used coding benchmark: "The performance of an agent on SWE-bench can vary significantly based on this scaffolding, even when using the same underlying AI model." [27] Researchers at Princeton and Stanford showed it with GPT-4 Turbo. The same model solved 18.0% of the problems in a coding test with a purpose-built interface, compared with 11.0% using a plain command line [28].

The gap shows up in real output, not just scores. Anthropic reports that in March 2026 it gave the same model the same one-sentence request to build a retro game maker. Working solo, the agent produced a game where "nothing responded to input." Inside a fuller harness with separate planning and testing steps, it produced a playable game, at over 20 times the cost: $200 instead of $9 [29].

A better harness doesn't always help, though. METR, an independent evaluator, found in February 2026 that "neither Claude Code nor Codex outperform the default scaffolds METR uses" when measuring how long a task leading models could complete [30]. Big gains tend to show up against weak harnesses, with smaller ones between good harnesses. The practical takeaway is to compare agents on the actual task, not models on a leaderboard.