Evolution of Agentic Surfaces: The Harness Becomes Infrastructure (#AI4SDLC)
I watched a talk by Anthropic’s Applied AI team—Gagan Bhat and Isabella Kai He—on the evolution of agentic surfaces from Messages API to Claude Managed Agents. My main takeaway is that a harness encodes assumptions about what a model cannot yet do, making it the most perishable layer of the agent stack. The talk neatly connects several recent themes from the channel: Claude Code’s 80% prompt reduction, discussed by Boris Cherny, Cursor’s cloud agents, and Konstantin Krestnikov’s harness approach.
The story spans three generations of surfaces 1️⃣ First, the Messages API: tokens in, tokens out, with everyone writing their own agent loop 2️⃣ Then the Claude Agent SDK, which packaged the Claude Code harness as a library: the loop, tools, and file system come in the box, but hosting, isolation, credentials, and observability remain your responsibility 3️⃣ Now Claude Managed Agents: Anthropic takes over the entire production harness, leaving you with the task, context, and domain expertise. The boundary of “what is mine” keeps shrinking—the same shift Josh Ma described for Cursor, viewed from the other side of the counter.
The best illustration of perishable assumptions is Sonnet 4.5’s context anxiety. As the model approached the context limit, it became anxious and wrapped up work too early—Cognition observed the same behavior—so the team built context resets into the harness. Opus 4.5 no longer exhibited the behavior, turning the workaround into pure overhead: extra latency and an incorrectly reset cache. When the model moves and the harness does not, the harness begins to degrade the agent. It is the same phenomenon Boris Cherny described with the system prompt, but at the architecture level rather than the text level.
The most interesting engineering choice is the separation of the “brain” and the “hands.” While the agent loop and sandbox lived in one container, the model could not start reasoning until the environment had finished provisioning, and a failure in either half killed the entire agent. Once they were separated, reasoning could begin immediately while the container came up in parallel. According to the team’s measurements, time to first token fell by 60% at the median and by more than 90% at P95. Failures became recoverable: a dead sandbox can be recreated, while a dead “brain” can resume from the durable session log. That log serves three purposes: observability, retrieval of material dropped from context, and a periodic dreaming batch process that rewrites the agent’s memory so later sessions can start smarter.
After the OpenAI and Hugging Face incident, I paid particular attention to security. Credentials live in a vault and are decrypted only when a tool executes, so the model never sees them. The environment’s network is restricted to an allowed-host list. Strict deployments can use self-hosted sandboxes in their own VPC and MCP tunnels so that an MCP server never has to face the public internet. Another interesting feature is outcomes: you define a success rubric, and a separate grader agent reruns the primary agent until the criteria are met. This is essentially production-grade evals embedded directly in the runtime.
The authors’ closing claim—that the harness has become the limiting factor in what models can do—should be read as a company describing its own product. My conclusion is stronger: the harness is ceasing to be a competitive advantage and becoming perishable infrastructure that is sensible to rent. The task, context, domain knowledge, and evals should remain yours—the layers where your value lives.
#AI4SDLC #AI #Agents #Architecture #PlatformEngineering #Evals #Engineering