Google’s Harness2 lets a weaker AI model beat a stronger one by rewriting its own setup

Google Research has open-sourced Harness2, a framework that makes AI agents better by rewriting everything around the model, such as prompts, tools and memory, while the model itself stays unchanged. The code is under the Apache 2.0 license, and a community post pointed to the release.

Eight editable parts, two loops of improvement

The paper, “Harness^2: Recursive Agent Harnessing for an Open World”, was submitted to arXiv on 9 October 2026 by a team that includes Tomas Pfister and Chen-Yu Lee. It starts from a simple observation: an agent’s results depend on the model and on the harness, the scaffolding that runs it. Harnesses are usually designed once by a person, then reused for every task.

Harness2 works on two levels. At the task level, a step called Propose-Probe-Compose tries edits to the current harness and keeps those that the comparison supports, without needing a ground-truth answer key, which open-ended work usually lacks. At the harnessing level, what was learned from those edits feeds a persistent improvement harness, so later tasks start from better habits. The task-level step can be run in parallel or in sequence.

According to the project README, the framework can modify eight components: system prompt, guardrails, memory, skills, tool guidance, scripts, subagents and a middleware plugin. It supports OpenCode and Codex as executors.

Reported gains of up to 11.8 points

The authors tested three benchmarks: JobBench for professional work, LAB for legal work and WorkBuddy-Bench for office, web and code tasks. Across four model and harness setups, one Harness2 step improved both GLM-5 and Gemini 3.5 Flash over their base harnesses. The reported gains reach 11.5 points on WorkBuddy-Bench, 4.5 points on JobBench and 11.8 percentage points on LAB, and results rise further with a larger recursion budget.

The detail drawing the most attention: on WorkBuddy-Bench, according to a summary of the paper by i-SCOOP, GLM-5 in OpenCode with an improved harness scored 75.7 after one step, above Gemini 3.5 Flash on its original harness at 72.4.

How it stacks up against rival methods

Harness2 is not the first attempt to automate harness design, and the comparison with earlier methods is mixed. According to the same summary, ReasoningBank fell as much as 6.6 points below the base setup on coding tasks, and Harness Scaling underperformed the base harness in seven of twelve combinations. Harness2 did not win everywhere: on LAB, Meta-Harness scored 76.5 against 75.6 for a single Harness2 step with Gemini in Codex.

There are caveats the authors and reviewers flag. The experiments use a frontier model, Claude Opus 4.8, as the editor, so part of the gain may come from a stronger model writing the weaker agent’s environment. The LAB figures use partial credit, so they are not official scores from the benchmark’s owner. Baseline numbers were produced by the Harness2 authors rather than independently. None of this has been replicated by outside groups yet.

What you need to run it, and what it costs

The code is available on GitHub at version 0.1.0. It needs Linux, Python 3.12 and uv. A local demo, harness2-demo, uses deterministic editors and needs no model credentials. Real runs go through Vertex AI on a Google Cloud project, WorkBuddy-Bench needs Docker, and LAB needs Pandoc and Poppler.

The README warns that model-backed runs incur API costs and suggests starting with a small task selection and using --dry-run to preview what will run. Neither the paper nor the README gives dollar figures. The summary by i-SCOOP estimates, from the algorithm, four extra runs per step at k=1 and twenty at k=5, so the price of the gains is several times the cost of a single run.

The README also says this is not an officially supported Google product, and it carries a security warning: executors have unrestricted network access and Codex runs with its sandbox disabled. Public benchmark rubrics may be online, so the authors advise restricting the network before evaluation. Guardrails kept in editable files should not be treated as a security boundary.

What the release leaves open

Harness2 suggests that tuning the environment around a cheaper or open-weights model can close part of the gap to a stronger one, which matters for teams that cannot afford top-tier models. The evidence so far is three benchmarks, two models and the authors’ own measurements. How much of the effect survives with a cheaper editor model, or on tasks outside these benchmarks, is not established in the material Google has published.