KULDEEP LUVANI

The Harness · Bibliography

All sources

Every claim in the book traces back to one of these. Each was opened and checked during research. Where a primary source was unreachable, the citation says so.

Prologue · Agent = Model + Harness

  1. 00·1Snorkel AI, “Terminal-Bench 2.1 leaderboard,” Snorkel AI, accessed Oct 2026. snorkel.ai/leaderboard/terminal-bench-2-1
  2. 00·2Anthropic, “Claude 3.7 Sonnet and Claude Code,” Anthropic, Feb 2025. anthropic.com/news/claude-3-7-sonnet
  3. 00·3Future AGI, “Coding Agent Harness Benchmarks” (secondary aggregator), Future AGI, checked Oct 2026. futureagi.com/blog/coding-agent-harness-benchmark
  4. 00·4Sydney Lewis, “Same Model, Different Harness: Different Coding-Agent Results,” arXiv, Aug 2026. arxiv.org/abs/2608.26218
  5. 00·5Liu, Liu, Sun, Luo, Guo, “Coding Agents Have Converged,” arXiv, Sep 2026. arxiv.org/abs/2609.17394
  6. 00·6Jason Starace, “Scaffold Effects on GAIA: A Controlled Comparison,” arXiv, Jun 2026. arxiv.org/abs/2606.08529
  7. 00·7Zhang, Wang, Ge, Xu, Hamm, Reddy, “Stop Comparing LLM Agents Without Disclosing the Harness,” arXiv, May 2026. arxiv.org/abs/2605.23950
  8. 00·8Vivek Trivedy, “The Anatomy of an Agent Harness,” LangChain, Mar 2026. langchain.com/blog/the-anatomy-of-an-agent-harness
  9. 00·9Birgitta Böckeler, “Harness Engineering for Coding Agent Users,” martinfowler.com / Thoughtworks, Apr 2026. martinfowler.com/articles/exploring-gen-ai/harness-engineering
  10. 00·10Mitchell Hashimoto, “My AI Adoption Journey,” mitchellh.com, Feb 2026. mitchellh.com/writing/my-ai-adoption-journey
  11. 00·11Wikipedia, “Agent harness,” Wikipedia, accessed Oct 2026. en.wikipedia.org/wiki/Agent_harness
  12. 00·12OpenAI, “Codex as a platform: build on the open agent harness,” OpenAI Developers, Aug 2026. developers.openai.com/blog/codex-as-a-platform
  13. 00·13Barbaste, Darrigol, Vu, Wiltberger, “Harness Engineering: Anatomy, Architecture, and Evolution of Coding Agents,” arXiv, Jul 2026. arxiv.org/abs/2609.00006
  14. 00·14InfoQ, “OpenAI Introduces Harness Engineering” (secondary; primary at openai.com/index/harness-engineering), InfoQ, Feb 2026. infoq.com/news/2026/02/openai-harness-engineering-codex
  15. 00·15Yao et al., “ReAct: Synergizing Reasoning and Acting in Language Models,” arXiv, Oct 2022. arxiv.org/abs/2210.03629
  16. 00·16Significant-Gravitas, “AutoGPT,” GitHub, accessed Oct 2026. github.com/Significant-Gravitas/AutoGPT
  17. 00·17Cognition, “Introducing Devin,” Cognition, Mar 2024. cognition.com/blog/introducing-devin
  18. 00·18Yang, Jimenez, Wettig, Lieret, Yao, Narasimhan, Press, “SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering,” arXiv, May 2024. arxiv.org/abs/2405.15793
  19. 00·19Anthropic, “Building effective agents,” Anthropic Engineering, Dec 2024. anthropic.com/engineering/building-effective-agents
  20. 00·20Anthropic, “Best practices for Claude Code,” Claude Code docs, accessed Oct 2026. code.claude.com/docs/en/best-practices
  21. 00·21Anthropic, “Effective harnesses for long-running agents,” Anthropic Engineering, Nov 2025. anthropic.com/engineering/effective-harnesses-for-long-running-agents
  22. 00·22Prithvi Rajasekaran, “Harness design for long-running apps,” Anthropic Engineering, Mar 2026. anthropic.com/engineering/harness-design-long-running-apps
  23. 00·23Anthropic, “Effective context engineering for AI agents,” Anthropic Engineering, Sep 2025. anthropic.com/engineering/effective-context-engineering-for-ai-agents
  24. 00·24RCR Wireless, “Gartner: more than 40% of agentic AI projects will fail by 2027” (secondary; Gartner press release, Jun 2025), RCR Wireless, Jun 2025. rcrwireless.com/20250627/business/agentic-ai-gartner
  25. 00·25Fortune, “MIT report: 95% of generative AI pilots at companies are failing” (secondary; MIT NANDA, The GenAI Divide), Fortune, Aug 2025. fortune.com/2025/08/18/mit-report-95-percent-generative-ai-pilots
  26. 00·26Challapally, Pease, Raskar (MIT NANDA), “The GenAI Divide: State of AI in Business 2025,” MIT NANDA, July 2025. mlq.ai/media/quarterly_decks/…State_of_AI_in_Business_2025…
  27. 00·27Fast Company, “Postings for this AI job are up 800%” (secondary; reports Financial Times / Indeed data), November 2025. fastcompany.com/91435680
  28. 00·28OpenAI, “Forward Deployed Engineer (FDE),” OpenAI Careers, accessed October 2026. openai.com/careers/forward-deployed-engineer
  29. 00·29Anthropic, “Forward Deployed Engineer, Applied AI,” job posting (Greenhouse), accessed October 2026. job-boards.greenhouse.io/anthropic/jobs/5391021008
  30. 00·30Ted Mabrey, “Sorry, that isn’t an FDE,” Substack, September 2024. tedmabrey.substack.com/p/sorry-that-isnt-an-fde

1 · The Loop

  1. 01·1SWE-agent team (Princeton/Stanford), “mini-swe-agent,” GitHub, 2025. github.com/SWE-agent/mini-swe-agent
  2. 01·2Anthropic, “How Claude Code works,” Claude Code docs, accessed Oct 2026. code.claude.com/docs/en/how-claude-code-works
  3. 01·3Yao, Zhao, Yu, Du, Shafran, Narasimhan, Cao, “ReAct: Synergizing Reasoning and Acting in Language Models,” arXiv, Oct 2022. arxiv.org/abs/2210.03629 also cited earlier
  4. 01·4Shinn et al., “Reflexion: Language Agents with Verbal Reinforcement Learning,” arXiv, Mar 2023. arxiv.org/abs/2303.11366
  5. 01·5Yao et al., “Tree of Thoughts: Deliberate Problem Solving with Large Language Models,” NeurIPS / arXiv, May 2023. arxiv.org/abs/2305.10601
  6. 01·6Jimenez, Yang et al., “SWE-bench: Can Language Models Resolve Real-World GitHub Issues?,” arXiv, Oct 2023. arxiv.org/abs/2310.06770
  7. 01·7Yang, Jimenez et al., “SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering,” arXiv, May 2024. arxiv.org/abs/2405.15793 also cited earlier
  8. 01·8Schluntz, Zhang, “Building effective agents,” Anthropic, Dec 2024. anthropic.com/engineering/building-effective-agents also cited earlier
  9. 01·9Google, “Loop agents,” Agent Development Kit docs, accessed Oct 2026. adk.dev/agents/workflow-agents/loop-agents
  10. 01·10Anthropic, “Claude Code best practices,” Claude Code docs, accessed Oct 2026. code.claude.com/docs/en/best-practices also cited earlier
  11. 01·11Anthropic, “Hooks reference,” Claude Code docs, accessed Oct 2026. code.claude.com/docs/en/hooks
  12. 01·12Anthropic, “ralph-wiggum plugin and stop-hook.sh,” anthropics/claude-code on GitHub, 2025. github.com/anthropics/claude-code/…/ralph-wiggum
  13. 01·13Geoffrey Huntley, “Ralph Wiggum,” ghuntley.com, Jul 2025. ghuntley.com/ralph
  14. 01·14Anthropic, “CLI reference,” Claude Code docs, accessed Oct 2026. code.claude.com/docs/en/cli-reference
  15. 01·15Anthropic, “Permission modes,” Claude Code docs, accessed Oct 2026. code.claude.com/docs/en/permission-modes
  16. 01·16Anthropic, “How we built our multi-agent research system,” Anthropic, Jun 2025. anthropic.com/engineering/multi-agent-research-system
  17. 01·17Walden Yan, “Don't Build Multi-Agents,” Cognition, Jun 2025. cognition.com/blog/dont-build-multi-agents
  18. 01·18Anthropic, “Effective context engineering for AI agents,” Anthropic, Sep 2025. anthropic.com/engineering/effective-context-engineering-for-ai-agents also cited earlier
  19. 01·19Cursor, “Cursor 2.0,” Cursor changelog, Oct 2025. cursor.com/changelog/2-0
  20. 01·20Anthropic, “How the agent loop works,” Claude Agent SDK docs, accessed Oct 2026. code.claude.com/docs/en/agent-sdk/agent-loop
  21. 01·21Cemri et al. (UC Berkeley), “Why Do Multi-Agent LLM Systems Fail?,” arXiv, Mar 2025. arxiv.org/abs/2503.13657
  22. 01·22Anthropic, “Claude API errors,” Claude Platform docs, accessed Oct 2026. platform.claude.com/docs/en/api/errors
  23. 01·23Anthropic, “Handle tool calls,” Claude Platform docs, accessed Oct 2026. platform.claude.com/docs/…/handle-tool-calls
  24. 01·24Stripe, “Idempotent requests,” Stripe API reference, accessed Oct 2026. docs.stripe.com/api/idempotent_requests
  25. 01·25Anthropic, “Environment variables,” Claude Code docs, accessed Oct 2026. code.claude.com/docs/en/env-vars
  26. 01·26Anthropic, “Checkpointing,” Claude Code docs, accessed Oct 2026. code.claude.com/docs/en/checkpointing
  27. 01·27Ken Aizawa, “Writing effective tools for agents — with agents,” Anthropic, Sep 2025. anthropic.com/engineering/writing-tools-for-agents
  28. 01·28Justin Young, “Effective harnesses for long-running agents,” Anthropic, Nov 2025. anthropic.com/engineering/effective-harnesses-for-long-running-agents also cited earlier
  29. 01·29Cognition, “What We Learned Building Cloud Agents,” Cognition, Apr 2026. cognition.com/blog/what-we-learned-building-cloud-agents
  30. 01·30OpenAI, “Codex cloud,” OpenAI docs, accessed Oct 2026. learn.chatgpt.com/docs/cloud

2 · Context

  1. 02·1Modarressi et al. (Adobe Research, LMU Munich), “NoLiMa: Long-Context Evaluation Beyond Literal Matching,” ICML 2025 / arXiv, February 2025. arxiv.org/abs/2502.05167
  2. 02·2Pure AI, “Karpathy Puts Context at the Core of AI Coding (secondary report of Karpathy’s June 2025 post),” Pure AI, September 2025. pureai.com/articles/2025/09/23/karpathy-puts-c…
  3. 02·3Lance Martin, “Context Engineering for Agents,” rlancemartin.github.io, June 2025. rlancemartin.github.io/2025/06/23/context_engi…
  4. 02·4Walden Yan, “Don’t Build Multi-Agents,” Cognition, June 2025. cognition.com/blog/dont-build-multi-agents also cited earlier
  5. 02·5Yichao “Peak” Ji, “Context Engineering for AI Agents: Lessons from Building Manus,” Manus, July 2025. manus.im/blog/Context-Engineering-for-AI-Agent…
  6. 02·6Rajasekaran, Dixon, Ryan, Hadfield (Anthropic), “Effective context engineering for AI agents,” Anthropic Engineering, September 2025. anthropic.com/engineering/effective-context-en… also cited earlier
  7. 02·7Anthropic, “How Claude Code works,” Claude Code docs, accessed October 2026. code.claude.com/docs/en/how-claude-code-works also cited earlier
  8. 02·8Hsieh et al. (NVIDIA), “RULER: What’s the Real Context Size of Your Long-Context Language Models?,” arXiv, April 2024. arxiv.org/abs/2404.06654
  9. 02·9Leng, Portes, Havens, Zaharia, Carbin (Databricks), “Long Context RAG Performance of Large Language Models,” Databricks / arXiv, November 2024. arxiv.org/abs/2411.03538
  10. 02·10Hong, Troynikov, Huber (Chroma), “Context Rot: How Increasing Input Tokens Impacts LLM Performance,” Chroma, July 2025. trychroma.com/research/context-rot
  11. 02·11Liu, Lin, Hewitt, Paranjape, Bevilacqua, Petroni, Liang, “Lost in the Middle: How Language Models Use Long Contexts,” TACL / arXiv, July 2023. arxiv.org/abs/2307.03172
  12. 02·12Anthropic, “Explore the context window,” Claude Code docs, accessed October 2026. code.claude.com/docs/en/context-window
  13. 02·13Anthropic, “Model configuration” (Default auto-compact thresholds), Claude Code docs, accessed October 2026. code.claude.com/docs/en/model-config
  14. 02·14Drew Breunig, “How Long Contexts Fail,” dbreunig.com, June 2025. dbreunig.com/2025/06/22/how-contexts-fail-and-…
  15. 02·15Packer et al. (UC Berkeley), “MemGPT: Towards LLMs as Operating Systems,” arXiv, October 2023. arxiv.org/abs/2310.08560
  16. 02·16Anthropic, “Connect Claude Code to tools via MCP” (Scale with MCP tool search), Claude Code docs, accessed October 2026. code.claude.com/docs/en/mcp
  17. 02·17Anthropic, “Equipping agents for the real world with Agent Skills,” Anthropic Engineering, October 2025. anthropic.com/engineering/equipping-agents-for…
  18. 02·18Anthropic, “Claude Code best practices,” Claude Code docs, accessed October 2026. code.claude.com/docs/en/best-practices also cited earlier
  19. 02·19Anthropic, “Context editing,” Claude Developer Platform docs, accessed October 2026. platform.claude.com/docs/en/build-with-claude/…
  20. 02·20Anthropic, “Managing context on the Claude Developer Platform,” Claude blog, September 2025. claude.com/blog/context-management
  21. 02·21Anthropic, “Get started with Claude Code hooks” (Re-inject context after compaction), Claude Code docs, accessed October 2026. code.claude.com/docs/en/hooks-guide
  22. 02·22Letta, “Agent Memory: How to Build Agents that Learn and Remember,” Letta blog, July 2025. letta.com/blog/agent-memory
  23. 02·23Chhikara et al., “Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memory,” arXiv, April 2025. arxiv.org/abs/2504.19413
  24. 02·24Boris Cherny, comment on Hacker News, February 2025. news.ycombinator.com/item?id=43164253
  25. 02·25Anthropic, “Prompt caching,” Claude Developer Platform docs, accessed October 2026. platform.claude.com/docs/en/build-with-claude/…

3 · Tools & Environment

  1. 03·1Yang, Jimenez, Wettig, Lieret, Yao, Narasimhan, Press (Princeton), “SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering,” arXiv 2405.15793, May 2024. arxiv.org/abs/2405.15793 also cited earlier
  2. 03·2Ken Aizawa, “Writing effective tools for agents — with agents,” Anthropic Engineering, September 2025. anthropic.com/engineering/writing-tools-for-agents also cited earlier
  3. 03·3Anthropic, “Define tools,” Claude Platform Docs. platform.claude.com/…/define-tools
  4. 03·4Speakeasy, “MCP vs CLI: a framework for choosing the right tool interface,” Speakeasy blog (vendor measurement, secondary), March 2026. speakeasy.com/blog/mcp-vs-cli
  5. 03·5Anthropic, “Connect Claude Code to tools via MCP: Scale with MCP tool search,” Claude Code Docs, accessed October 2026. code.claude.com/docs/en/mcp also cited earlier
  6. 03·6Anthropic, “Code execution with MCP: building more efficient agents,” Anthropic Engineering, November 2025. anthropic.com/engineering/code-execution-with-mcp
  7. 03·7Anthropic, “Effective context engineering for AI agents,” Anthropic Engineering, September 2025. anthropic.com/engineering/effective-context-engineering-for-ai-agents also cited earlier
  8. 03·8Tiantian Gan, Qiyao Sun, “RAG-MCP: Mitigating Prompt Bloat in LLM Tool Selection via RAG,” arXiv 2505.03275, May 2025. arxiv.org/abs/2505.03275
  9. 03·9Kellen Gillespie, Robyn Perry, “Scaling Enterprise Agent Routing: Degradation, Diagnosis, and Recovery,” arXiv 2606.17519, June 2026. arxiv.org/abs/2606.17519
  10. 03·10Paramanayakam, Karatzas, Anagnostopoulos, Stamoulis, “Less is More: Optimizing Function Calling for LLM Execution on Edge Devices,” arXiv 2411.15399, November 2024. arxiv.org/abs/2411.15399
  11. 03·11Yichao “Peak” Ji, “Context Engineering for AI Agents: Lessons from Building Manus,” Manus, July 2025. manus.im/blog/Context-Engineering-…-Manus also cited earlier
  12. 03·12Anthropic, “Implement tool use: forcing tool use (tool_choice),” Claude Platform Docs, accessed October 2026. platform.claude.com/…/implement-tool-use
  13. 03·13Model Context Protocol, “Specification,” revision 2026-07-28 (schema 2026-07-28), modelcontextprotocol.io; earlier revision 2025-06-18 for the historical design. modelcontextprotocol.io/specification/2026-07-28 · …/2025-06-18
  14. 03·14Anthropic, “Tool search tool,” Claude Platform Docs, accessed October 2026. platform.claude.com/…/tool-search-tool
  15. 03·15Invariant Labs, “MCP Security Notification: Tool Poisoning Attacks,” Invariant Labs, April 2025. invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks
  16. 03·16Kenton Varda, Sunil Pai, “Code Mode: the better way to use MCP,” Cloudflare Blog, September 2025. blog.cloudflare.com/code-mode
  17. 03·17Google, “gVisor documentation,” gvisor.dev. gvisor.dev/docs
  18. 03·18AWS, “Firecracker,” GitHub; Agache, Brooker, et al., NSDI ’20. github.com/firecracker-microvm/firecracker · usenix.org/…/agache
  19. 03·19E2B, “E2B documentation,” e2b.dev. e2b.dev · docs.e2b.dev
  20. 03·20Daytona, “Daytona documentation,” daytona.io. daytona.io/docs
  21. 03·21Anthropic, “Claude Code: Best practices,” Claude Code Docs. code.claude.com/docs/en/best-practices also cited earlier
  22. 03·22Anthropic, “Equipping agents for the real world with Agent Skills,” Anthropic Engineering, October 2025. anthropic.com/engineering/equipping-agents-…-agent-skills also cited earlier
  23. 03·23Anthropic, “Claude Code: Hooks reference,” Claude Code Docs. code.claude.com/docs/en/hooks also cited earlier
  24. 03·24Anthropic, “Introducing computer use, a new Claude 3.5 Sonnet,” Anthropic, October 2024. anthropic.com/news/3-5-models-and-computer-use

4 · Guardrails & Trust

  1. 04·1heise online, “Vibe coding service Replit deletes production database,” heise online, July 2025. heise.de/en/news/…replit-deletes-production-database
  2. 04·2Safeguard, “Replit agent deleted a production database: what happened,” safeguard.sh, July 2025. safeguard.sh/resources/blog/replit-agent…
  3. 04·3Simon Willison, “The lethal trifecta for AI agents,” simonwillison.net, June 2025. simonwillison.net/2025/Jun/16/the-lethal-trifecta
  4. 04·4Invariant Labs, “GitHub MCP Exploited: Accessing private repositories via MCP,” Invariant Labs, May 2025. invariantlabs.ai/blog/mcp-github-vulnerability
  5. 04·5BleepingComputer, “Amazon AI coding agent hacked to inject data-wiping commands,” BleepingComputer, July 2025. bleepingcomputer.com/news/security/amazon-ai-coding-agent…
  6. 04·6The Hacker News (reporting Koi Security), “First malicious MCP server found stealing emails in rogue postmark-mcp package,” The Hacker News, September 2025. thehackernews.com/2025/09/first-malicious-mcp-server-found
  7. 04·7Snyk, “ToxicSkills: malicious AI agent skills on ClawHub,” Snyk, February 2026. snyk.io/blog/toxicskills…
  8. 04·8OWASP GenAI Security Project, “OWASP Top 10 for LLM Applications 2025,” OWASP, 2025. genai.owasp.org/llm-top-10
  9. 04·9OWASP GenAI Security Project, “OWASP Top 10 for Agentic Applications for 2026,” OWASP, December 2025. genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026
  10. 04·10Anthropic, “Configure permissions,” Claude Code docs, accessed October 2026. code.claude.com/docs/en/permissions
  11. 04·11Anthropic, “Permission modes,” Claude Code docs, accessed October 2026. code.claude.com/docs/en/permission-modes also cited earlier
  12. 04·12OpenAI, “Sandbox,” Codex docs, accessed October 2026. learn.chatgpt.com/docs/sandboxing
  13. 04·13OpenAI, “Agent approvals & security,” Codex docs, accessed October 2026. learn.chatgpt.com/docs/agent-approvals-security
  14. 04·14Cursor, “Run Modes,” Cursor docs, accessed October 2026. cursor.com/docs/agent/security/run-modes
  15. 04·15Cognition, “Permissions,” Devin CLI docs, accessed October 2026. docs.devin.ai/cli/reference/permissions
  16. 04·16Backslash Research Team, “The Denylist Delusion: Cursor’s Auto-Run Leaves Agentic AI Wide Open,” Backslash Security, July 2025. backslash.security/blog/cursor-ai-security-flaw-autorun-denylist
  17. 04·17Anthropic, “Hooks reference,” Claude Code docs, accessed October 2026. code.claude.com/docs/en/hooks also cited earlier
  18. 04·18Anthropic, “Sandboxing,” Claude Code docs, accessed October 2026. code.claude.com/docs/en/sandboxing
  19. 04·19OpenAI, “A practical guide to building agents,” OpenAI, April 2025. cdn.openai.com/…/a-practical-guide-to-building-agents.pdf
  20. 04·20Luca Beurer-Kellner, Edoardo Debenedetti, Florian Tramèr et al., “Design Patterns for Securing LLM Agents against Prompt Injections,” arXiv 2506.08837, June 2025. arxiv.org/abs/2506.08837
  21. 04·21Edoardo Debenedetti, Ilia Shumailov, Nicholas Carlini, Florian Tramèr et al. (Google DeepMind), “Defeating Prompt Injections by Design,” arXiv 2503.18813, March 2025. arxiv.org/abs/2503.18813
  22. 04·22Simon Willison, “CaMeL” (commentary), simonwillison.net, April 2025. simonwillison.net/2025/Apr/11/camel
  23. 04·23MeatballWiki community, “SoftSecurity,” MeatballWiki (presented at O’Reilly P2P, 2001). meatballwiki.org/wiki/SoftSecurity
  24. 04·24Hakan Inan et al. (Meta), “Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations,” arXiv 2312.06674, December 2023. arxiv.org/abs/2312.06674
  25. 04·25Meta, “Llama Prompt Guard 2 (86M),” model card, Hugging Face, accessed October 2026. huggingface.co/meta-llama/Llama-Prompt-Guard-2-86M
  26. 04·26Milad Nasr, Nicholas Carlini, Florian Tramèr et al., “The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses against LLM Jailbreaks and Prompt Injections,” arXiv 2510.09023, October 2025. arxiv.org/abs/2510.09023
  27. 04·27Simon Willison, “New prompt injection papers: Agents Rule of Two and The Attacker Moves Second,” simonwillison.net, November 2025. simonwillison.net/2025/Nov/2
  28. 04·28Meta AI, “Agents Rule of Two: A Practical Approach to AI Agent Security,” Meta AI blog, October 2025. ai.meta.com/blog/practical-ai-agent-security
  29. 04·29Rory Ward, Betsy Beyer (Google), “BeyondCorp: A New Approach to Enterprise Security,” ;login: vol. 39 no. 6, 2014. research.google/pubs/beyondcorp
  30. 04·30Scott Rose, Oliver Borchert, Stu Mitchell, Sean Connelly (NIST), “Zero Trust Architecture,” NIST SP 800-207, August 2020. csrc.nist.gov/pubs/sp/800/207
  31. 04·31OWASP, “AI Agent Security Cheat Sheet,” OWASP Cheat Sheet Series, accessed October 2026. cheatsheetseries.owasp.org/…/AI_Agent_Security
  32. 04·32Model Context Protocol, “Authorization,” MCP Specification 2026-07-28. modelcontextprotocol.io/specification/…/authorization
  33. 04·33Cedar project, “Basic policy construction in Cedar” and “Operators and functions,” and “Authorization” (skip on error), Cedar Policy Language Reference Guide, accessed October 2026. docs.cedarpolicy.com/policies/syntax-policy · docs.cedarpolicy.com/auth/authorization
  34. 04·34Microsoft, “What are agent identities? (Microsoft Entra Agent ID),” Microsoft Learn, November 2025 (updated June 2026). learn.microsoft.com/…/what-is-agent-id
  35. 04·35Ken Huang, “Agentic AI Identity Management Approach,” Cloud Security Alliance, March 2025. cloudsecurityalliance.org/blog/2025/03/11
  36. 04·36SPIFFE project (CNCF), “SPIFFE Overview,” accessed October 2026. spiffe.io/docs/latest/spiffe-about/overview
  37. 04·37Booth, Fisher, Galluzzo, Roberts (NIST NCCoE), “Accelerating the Adoption of Software and AI Agent Identity and Authorization” (concept paper), February 2026. csrc.nist.gov/pubs/other/2026/02/05
  38. 04·38Anthropic, “Our framework for developing safe and trustworthy agents,” Anthropic, August 2025. anthropic.com/news/our-framework-for-developing-safe-and-trustworthy-agents
  39. 04·39Anthropic, “Trustworthy agents in practice,” Anthropic, April 2026. anthropic.com/research/trustworthy-agents

5 · Evals & Evolution

  1. 05·1METR, “Measuring AI Ability to Complete Long Tasks,” METR, March 2025. metr.org/blog/2025-03-19-measuring-ai-ability…
  2. 05·2Princeton SWE-bench team, “SWE-bench datasets guide,” swebench.com, accessed October 2026. swebench.com/SWE-bench/guides/datasets
  3. 05·3Stanford / Laude Institute, “Terminal-Bench,” ICLR 2026, arXiv, January 2026. arxiv.org/abs/2601.11868
  4. 05·4Yao, Shinn, Razavi, Narasimhan (Sierra), “τ-bench: A Benchmark for Tool-Agent-User Interaction,” arXiv, June 2024. arxiv.org/abs/2406.12045
  5. 05·5Mialon, Fourrier, Swift, Wolf, LeCun, Scialom, “GAIA: a benchmark for General AI Assistants,” arXiv, November 2023. arxiv.org/abs/2311.12983
  6. 05·6METR, “Time Horizons,” METR, last updated September 2026. metr.org/time-horizons
  7. 05·7Liang, Garg, Zilouchian Moghaddam, “The SWE-Bench Illusion: When State-of-the-Art LLMs Remember Instead of Reason,” arXiv, June 2025 (rev. December 2025). arxiv.org/abs/2506.12286
  8. 05·8Stanford / Harbor / Laude Institute, “Terminal-Bench leaderboard,” tbench.ai, accessed October 2026. tbench.ai
  9. 05·9Anthropic Engineering, “Demystifying evals for AI agents,” Anthropic, 2026. anthropic.com/engineering/demystifying-evals-for-ai-agents
  10. 05·10Mitchell Hashimoto, “My AI Adoption Journey,” mitchellh.com, February 2026. mitchellh.com/writing/my-ai-adoption-journey also cited earlier
  11. 05·11Braintrust, “Evals guide,” Braintrust docs, accessed October 2026. braintrust.dev/docs/guides/evals
  12. 05·12LangChain, “LangSmith evaluation,” LangChain docs, accessed October 2026. docs.langchain.com/langsmith/evaluation
  13. 05·13Anthropic, “Run Claude Code programmatically,” Claude Code docs, accessed October 2026. code.claude.com/docs/en/headless
  14. 05·14Langfuse, “Observability overview,” Langfuse docs, accessed October 2026. langfuse.com/docs/observability/overview
  15. 05·15OpenTelemetry, “Semantic conventions for generative AI,” GitHub, accessed October 2026. github.com/open-telemetry/semantic-conventions-genai
  16. 05·16Zheng, Chiang, Sheng et al., “Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena,” NeurIPS 2023, arXiv, June 2023. arxiv.org/abs/2306.05685
  17. 05·17Agrawal, Tan, Soylu et al., “GEPA: Reflective Prompt Evolution Can Outperform RL,” ICLR 2026, arXiv, July 2025. arxiv.org/abs/2507.19457
  18. 05·18Lin, Liu, Pan et al., “Agentic Harness Engineering: Observability-Driven Automatic Evolution of Coding-Agent Harnesses,” arXiv, April 2026. arxiv.org/abs/2604.25850
  19. 05·19Sengupta, Wang, “HARBOR: Automated Harness Optimization,” arXiv, April 2026. arxiv.org/abs/2604.20938
  20. 05·20Wang, Kattakinda, Feizi, “Do Agent Optimizers Compound? A Continual-Learning Evaluation on Terminal-Bench 2.0,” RELAI, arXiv, July 2026. arxiv.org/abs/2607.14004

6 · Operating the Harness

  1. 06·1LangChain, “State of Agent Engineering,” LangChain, survey Nov–Dec 2025 (page dated June 2026). langchain.com/state-of-agent-engineering
  2. 06·2Challapally, Pease, Raskar (MIT NANDA), “The GenAI Divide: State of AI in Business 2025,” MIT NANDA, July 2025. mlq.ai/media/quarterly_decks/…State_of_AI_in_Business_2025… also cited earlier
  3. 06·3The Register, “McKinsey says enterprise AI is finally ‘on the road to ROI’,” The Register, August 2026 (secondary report of McKinsey, The State of AI in 2026). theregister.com/ai-and-ml/2026/08/25/mckinsey…
  4. 06·4Wang, Xu, Kahl, Erten (a16z), “How 100 Enterprise CIOs Are Building and Buying Gen AI in 2025,” Andreessen Horowitz, June 2025. a16z.com/ai-enterprise-2025
  5. 06·5Birgitta Böckeler, “Harness Engineering for Coding Agent Users,” Thoughtworks / martinfowler.com, April 2026. martinfowler.com/articles/exploring-gen-ai/harness-engineering also cited earlier
  6. 06·6Matthew Skelton, “What is a Thinnest Viable Platform?,” Team Topologies, accessed October 2026. teamtopologies.com/key-concepts-content/what-is-a-thinnest-viable-platform-tvp
  7. 06·7OpenAI, “AI in the Enterprise: Lessons from seven frontier companies,” OpenAI, 2025. cdn.openai.com/…/ai-in-the-enterprise.pdf
  8. 06·8Thoughtworks, “Technology Radar Vol. 34” (press release), Thoughtworks, April 2026. thoughtworks.com/about-us/news/2026/combat-ai-cognitive-debt-radar-v34
  9. 06·9Feng, McDonald, Zhang, “Levels of Autonomy for AI Agents,” Knight First Amendment Institute, July 2025. knightcolumbia.org/content/levels-of-autonomy-for-ai-agents-1
  10. 06·10Josh Woodruff, “The Agentic Trust Framework: Zero Trust Governance for AI Agents,” Cloud Security Alliance, February 2026. cloudsecurityalliance.org/blog/2026/02/02/the-agentic-trust-framework…
  11. 06·11METR, “Measuring AI Ability to Complete Long Tasks,” METR, March 2025. metr.org/blog/2025-03-19-measuring-ai-ability… also cited earlier
  12. 06·12Erik Schluntz, Barry Zhang, “Building effective agents,” Anthropic, December 2024. anthropic.com/engineering/building-effective-agents also cited earlier
  13. 06·13OpenAI, “A practical guide to building agents,” OpenAI, April 2025. cdn.openai.com/…/a-practical-guide-to-building-agents.pdf also cited earlier
  14. 06·14NIST, “AI Risk Management Framework,” National Institute of Standards and Technology, accessed October 2026. nist.gov/itl/ai-risk-management-framework
  15. 06·15OWASP GenAI Security Project, “OWASP Top 10 for Agentic Applications (2026),” OWASP, December 2025. genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications…
  16. 06·16Anthropic, “Prompt caching,” Claude Developer Platform docs, accessed October 2026. platform.claude.com/docs/en/build-with-claude/prompt-caching also cited earlier
  17. 06·17Anthropic, “Pricing,” Claude Developer Platform docs, accessed October 2026. platform.claude.com/docs/en/about-claude/pricing
  18. 06·18Cursor, “Run Modes,” Cursor docs, accessed October 2026. cursor.com/docs/agent/security/run-modes also cited earlier
  19. 06·19Anthropic, “Effort,” Claude Developer Platform docs, accessed October 2026. platform.claude.com/docs/en/build-with-claude/effort
  20. 06·20NIST CAISI, “Announcing the AI Agent Standards Initiative,” NIST, February 2026. nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative…
  21. 06·21ISO, “ISO/IEC 42001:2023 AI management systems,” ISO, December 2023 (details confirmed from ISO and KPMG summaries). iso.org/standard/42001
  22. 06·22Future of Life Institute, “Digital Omnibus on AI,” AI Act Explorer, artificialintelligenceact.eu, accessed October 2026 (secondary tracker). artificialintelligenceact.eu/ai-act-explorer/digital-omnibus
  23. 06·23European Union, “Regulation (EU) 2026/1744 (Digital Omnibus on AI),” Official Journal of the EU, EUR-Lex, July 2026. eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744
  24. 06·24OpenTelemetry, “Semantic conventions for generative AI,” GitHub, accessed October 2026. github.com/open-telemetry/semantic-conventions-genai also cited earlier
  25. 06·25Klarna, “Klarna AI assistant handles two-thirds of customer service chats in its first month,” Klarna press release, February 2024. klarna.com/international/press/klarna-ai-assistant…
  26. 06·26Irina Ivanova, “As Klarna flips from AI-first to hiring people again, a new landmark survey reveals most AI projects fail to deliver,” Fortune, May 2025 (secondary; quotes a Bloomberg interview). fortune.com/2025/05/09/klarna-ai-humans-return-on-investment
  27. 06·27Intercom, “From resolutions to outcomes: Evolving how Fin delivers value,” Intercom blog, 2026. intercom.com/blog/from-resolutions-to-outcomes…
  28. 06·28Yao, Shinn, Razavi, Narasimhan (Sierra), “τ-bench: A Benchmark for Tool-Agent-User Interaction,” arXiv, June 2024. arxiv.org/abs/2406.12045 also cited earlier
  29. 06·29Vivek Trivedy, “The Anatomy of an Agent Harness,” LangChain blog, March 2026. langchain.com/blog/the-anatomy-of-an-agent-harness also cited earlier