Google's Harness²: An Agent That Improves Its Own Toolbox Instead of Its Brain
An open-source research project from Google Research lets an agent rewrite its own prompts, tools and memory for each task while the model stays frozen. Gains are real but the safety defaults are loose.
Google Research has released Harness², an open-source project (Apache-2.0 licence) in which an AI agent improves the setup around the model rather than the model itself. According to a write-up by Wavect, it is “not an officially supported Google product”, so treat it as a research tool.
Some vocabulary. In agent work the “harness” is everything around the model: the instructions it receives, the tools it can call, its memory and its routines. Two agents using the same model can perform very differently depending on the harness. Harness² keeps the model frozen and lets the system propose changes to this surrounding setup. It runs three steps: Propose (suggest an edit), Probe (test it), and Compose (combine what worked). Adopted changes and the lessons behind them go into a persistent library, so the next task starts a little smarter.
The reported gains come from the authors and from different set-ups, so they should not be added together. On WorkBuddy-Bench, GLM-5 under OpenCode rose from 64.2 to 75.7, a gain of 11.5 points; with Gemini 3.5 Flash the gain was 5.1. On JobBench, Gemini 3.5 Flash gained 4.5 points, and on LAB, GLM-5 gained 11.8 percentage points. These do not predict what you would see on your own work.
What’s behind it: retraining a model is expensive and slow. Editing the instructions and tools is cheap and quick, and often gives a lot of the benefit. The price is more compute: exploring changes multiplies the number of runs, so Wavect recommends measuring cost per accepted result, including failures, not per run.
The safety notes matter most. By default the executor has unrestricted network access and the Codex sandbox is disabled. In one validation run a rollout downloaded a grading rubric without being told to. An editable guardrail file is not a security boundary, so any limits must be enforced outside the agent. Setup needs Linux, Python 3.12, Node.js 20 or newer and a Google Cloud CLI.
What this means for you: this is developer tooling, not an app. If you are curious, start with the credential-free demo and set an external spending limit before any paid run. If you just use AI tools, the useful idea is simple: much of an agent’s skill sits in its instructions and tools, so improving those can beat waiting for a bigger model. Do not connect it to company systems on the default settings.
Sources
Source: https://wavect.io/blog/google-harness2-setup-cost-safety/
OpenCode Reports a Breach: If You Linked AI Accounts, Check Your Keys
The open-source coding agent OpenCode says an attack hit 1.4 percent of Console users who had linked outside AI providers. Details are still sparse, so here is a calm checklist.
