The agent harness is production infrastructure now — treat it that way

Six lenses on this week's intelligence, one story underneath: coding agents crossed the production threshold, and the discipline that got them there — call it harness engineering, since OpenAI, Stripe, and Anthropic converged on the same name — is now the thing you either build or fall behind on.

The numbers are the part worth staring at. Three OpenAI engineers, million-line internal product, five months, zero hand-written code, 3.5 PRs per engineer per day. Stripe's internal agents merging over a thousand PRs a week through a sandboxed devbox and 400+ tools exposed via MCP. A solo developer running five to ten agents in parallel, 6,600 commits in a month. These are not benchmarks. They are shipped systems.

And then the ceiling. Anthropic's Opus 4.6 holds 80% task success at one hour and decays to 50% at 14.5 hours. Chain five sub-tasks at 80% each and your end-to-end is 33%. The agents are strong enough to be dangerous and weak enough that unattended multi-hour runs are near-certain failures. The convergent playbook — AGENTS.md as a living failure log, custom linters whose error messages are remediation instructions for the agent, JSON over Markdown for anything the agent needs to preserve, planning separated from execution, sandboxed devboxes, MCP-exposed internal tools — exists because everyone hit the same wall.

Yes, but — every success story is greenfield. Retrofitting harness engineering to a ten-year-old codebase with implicit conventions, patchy tests, and a half-documented deploy pipeline is an open problem nobody has convincingly solved. The counter still doesn't defuse the take. It sharpens it: the compounding advantage goes to whoever starts greenfield now, and the legacy problem is where the next serious tooling company gets built.

The security bill comes due at the same time

MCP is becoming the standard integration layer for agents. It is also being actively probed. Cisco's SVP of AI stated plainly that agents are being hijacked, impersonated, and manipulated to exfiltrate data at machine speed. A Cambridge study found only 4 of 30 top agents have published formal safety evaluations — browser agents, the most autonomous category, are missing 64% of safety disclosures. And Amazon disclosed that a small Russian-speaking group used commercial AI tools to breach 600+ Fortinet firewalls across 55 countries in weeks, using mundane vectors (weak passwords, exposed management ports) at a throughput Amazon called impossible without AI.

That last data point should reset your threat model. Small team, off-the-shelf tools, nation-state-scale impact. If your detection thresholds were calibrated for human-speed credential stuffing, they are miscalibrated by an order of magnitude. And every MCP endpoint your agents connect to is a candidate for the same treatment.

The control gap is specific and fixable. Agents are not first-class identities in most IAM systems. AGENTS.md files control agent behavior across every session and have no integrity controls — a malicious PR to that file poisons every future run. Tool registries granted via OAuth grow monotonically and get audited approximately never. Anthropic itself found agents marking features complete without proper end-to-end testing; the same class of over-confidence applied to a security-adjacent PR is how a subtle authorization bug ships at 1,000 PRs a week.

The economics are the third leg

OpenAI's leaked financials landed the same week. Gross margin collapsed to 33% against a 46% internal forecast. Model costs quadrupled in 2025. Projected cumulative burn through 2030 more than doubled to $111B. The path to profitability rests on training costs dropping roughly $28B in 2030 — a bet on hardware curves and algorithmic wins outside OpenAI's direct control. Simultaneously they cut projected compute spend from $1.4T to $600B, which reads either as expected efficiency gains or as capital-market pushback dressed up as strategy.

Either way, if the best-funded frontier lab misses its own gross margin by 13 points, your 2026 inference cost model is fiction. Anyone quoting five-year AI cost curves is guessing. Wednesday's earnings cluster — Nvidia at $65.7B expected with growth accelerating, Salesforce with Agentforce at $500M+ ARR but EPS down 10%, Snowflake AI revenue at $100M — will move the tape, but the structural signal is already visible: infrastructure is growing fast, application-layer AI is monetizing at margin cost, and the value is migrating to the middle layer that nobody owns yet. Harness engineering, agent security, and inference routing sit in that middle. No dominant vendor.

What to do this week

One concrete move, because everything above collapses to this: pick a greenfield workstream on your roadmap and stand up the minimum harness before you write any product code. AGENTS.md at the repo root with your architectural constraints and every past agent failure encoded as a rule. One custom linter whose error messages tell the agent how to fix the violation. CODEOWNERS protection on AGENTS.md and any MCP configuration file so a poisoned PR can't rewrite your agent's brain. A hard rule that no agent task exceeds one hour without a human checkpoint. An inventory of every OAuth grant and MCP endpoint your agents can already reach, and a decision on which of those should require human approval before invocation.

That is not a strategy deck. It is four files and a policy, and you can ship it before Wednesday's earnings call. The teams that have this in place by end of Q1 are the ones whose next twelve months look like OpenAI's three-person team. The teams that don't are the ones whose next incident report starts with an unreviewed agent PR.