The harness became the product
In 2025, AI coding tools were still competing largely on model choice and basic autonomy: could an agent understand a repository, edit files, run commands, and complete a task with limited supervision? Through 2026, the competitive center moved outward. The consequential differences became the harness around the model: how instructions are discovered, work is delegated, actions are approved, commands are sandboxed, lifecycle events trigger automation, extensions are packaged, and execution is hosted.
That shift is visible across OpenAI Codex, Anthropic Claude Code, and GitHub Copilot. All three now expose similar building blocks. They assemble them into different operating models: Codex is rooted in a local, open-source terminal agent; Claude Code emphasizes composable CLI customization; Copilot spans a terminal, GitHub-hosted cloud agents, IDEs, mobile, and external work-management systems.
Three arcs toward the same architecture
Codex: a governed local runtime
Codex began with a clear execution identity: an open-source Apache 2.0 terminal coding agent, with its core rewritten in Rust by late 2025. Its harness was inseparable from the local machine. On macOS it used Apple Seatbelt; on Linux, Landlock and seccomp, with Bubblewrap for filesystem namespacing. Its relevant instruction convention was AGENTS.md, a plain-Markdown, tool-neutral way to keep repository guidance outside the prompt.
The major 2026 changes made that local runtime programmable and governable. On March 11, Codex CLI v0.114.0 added SessionStart and Stop hooks. On March 16, v0.115.0 made subagents generally available, with up to six concurrent subagents, built-in explorer, worker, and default roles, and custom agents configured in TOML. The same release added Smart Approvals: a guardian subagent could silently approve, escalate, or block pending actions in full-auto mode. On March 19, v0.116.0 added a UserPromptSubmit hook, followed by PostToolUse in v0.117.0 alpha. These changes are recorded in the official Codex changelog.
Late in March, Codex could read integrated terminal state, while Automations supported local or worktree execution and custom reasoning levels per task. The harness was no longer simply “agent plus shell”; it had become an orchestration layer around sessions, tools, approvals, and parallel workers.
July tightened that layer. On July 9, v0.144.0 added an app-approval writes mode that permits declared read-only actions while prompting for writes, and moved MCP authentication beyond an experimental flag. On July 13, v0.144.2 restored Guardian auto-review. On July 16, v0.144.5 strengthened dangerous-command detection for rm. On July 21, v0.145.0 added paginated thread history with resume, search, persisted names, subagent support, and memories, while stabilizing Multi-agent V2 with configurable subagent models, reasoning levels, concurrency, and restored roles. Codex also became an agent provider inside JetBrains IDEs on July 7.
Its distinctive harness remains local-first: operating-system sandboxing, explicit write approvals, worktrees, and a guardian governing actions close to the developer’s machine.
Claude Code: customization became packaging
Claude Code’s arc is clearest through its customization primitives. Agent Skills were announced on October 16, 2025. A Skill is a folder containing a SKILL.md file, plus optional scripts and resources; frontmatter tells Claude when to load it. On December 18, Anthropic published Agent Skills as an open standard for cross-platform portability. Anthropic’s engineering write-up describes Skills as reusable expertise loaded when relevant.
By 2026, Skills sat beside Hooks and Subagents. Hooks run deterministic shell commands at lifecycle points including SessionStart, UserPromptSubmit, PostToolUse, and Stop. Subagents are forked Claude instances with separate context windows. A Plugin packages skills, subagents, slash commands, hooks, and MCP server definitions into one versioned bundle.
The Claude Code changelog shows the harness becoming more composable. v2.1.178 added Tool(param:value) permission rules and directory-scoped loading from nested .claude/skills. v2.1.186 added CLI-based MCP login and logout, a Skills section in the installed-plugins interface, and reminders to compact MEMORY.md. v2.1.191 made /rewind able to resume from before /clear.
Delegation then became more durable. In v2.1.196, background agents interrupted by a daemon restart resumed where they stopped. In v2.1.198, subagents began running in the background by default, and agents launched from claude agents could commit, push, and open draft pull requests after finishing code work. v2.1.212 added a per-session spawn cap, defaulting to 200. v2.1.220 allowed nested subagents to depth three, moved MCP calls longer than two minutes into the background, and added a DirectoryAdded hook.
Sandbox controls evolved in parallel. v2.1.214 made Bash permission checks fail closed on file-descriptor redirects. v2.1.216 added sandbox.filesystem.disabled, which can skip filesystem isolation while retaining network egress control. v2.1.220 added sandbox.network.strictAllowlist, denying non-allowlisted hosts without prompting.
Claude Code’s July 2026 changes focused on hardening: the Agent tool was protected against indirect prompt injection through content read by a subagent; auto mode blocked tampering with session transcript files; and subagents inherited the parent session’s permission mode by default. Claude converged on the same concerns as Codex, but packaged them as a modular customization system.
Copilot: one harness across local and hosted agents
GitHub Copilot’s arc was broader because it was not confined to one execution surface. Copilot CLI entered public preview in September 2025. On October 28, GitHub announced Agent HQ, a central interface for agents across GitHub, VS Code, mobile, and the Copilot CLI, including third-party agents. Teams could encode standards in AGENTS.md custom-agent files.
On January 14, 2026, GitHub shipped enhanced CLI agents: Explore for codebase analysis, Task for commands such as tests and builds, and Code-review. On February 25, Copilot CLI reached general availability with Plan mode, Autopilot mode, and dynamic delegation. After planning, users could approve sequential execution, parallelize with a fleet, run in Autopilot, or reject the plan.
The hosted harness also became more observable and less tied to pull requests. On March 19, the coding agent started work 50% faster and GitHub added more session visibility, including built-in setup steps in logs. On April 1, the Copilot cloud agent expanded beyond pull-request workflows to research, plan, and code. Cloud agents run in ephemeral development environments powered by GitHub Actions.
The CLI acquired the same harness primitives as its peers. Its changelog records workspace MCP auto-loading from .github/mcp.json, PostToolUse hook matchers, sandbox bypass for shell commands, --sandbox and --no-sandbox flags, AGENTS.md imports, hard blocking of workspace-modifying built-in tools in Plan mode, Open Plugin Spec manifests, and subagent timelines.
The new Copilot CLI terminal interface reached general availability on June 23. On July 23, the Copilot cloud agent for Linear became generally available. Copilot’s differentiator is reach: local CLI plus hosted agents exposed through multiple products, with enterprise MCP use governed by GitHub allowlists.
The harnesses compared
| Dimension | OpenAI Codex | Anthropic Claude Code | GitHub Copilot |
|---|---|---|---|
| Instruction file | AGENTS.md as a plain-Markdown, tool-neutral repository convention | SKILL.md folders loaded by relevance; nested .claude/skills scope expertise to directories |
AGENTS.md custom-agent files; imports from AGENTS.md, CLAUDE.md, and Copilot instruction files |
| Subagents / delegation | Up to six concurrent subagents; built-in and TOML-defined roles; Guardian reviews actions | Forked contexts, background execution, restart recovery, spawn caps, nesting to depth three | Explore, Task, and Code-review agents; sequential, fleet-parallel, or Autopilot execution |
| Hooks | SessionStart, Stop, UserPromptSubmit, PostToolUse | SessionStart, UserPromptSubmit, PostToolUse, Stop, DirectoryAdded | PostToolUse matchers and agentStop lifecycle handling |
| Sandbox / permissions | OS-level sandboxing; writes mode; Smart Approvals; dangerous-command detection | Tool rules; fail-closed Bash checks; filesystem toggle; strict network allowlist | Plan-mode write blocking; session sandbox flags; shell bypass; tighter macOS keychain isolation |
| Extensibility | MCP authentication; TOML custom agents | MCP and Skills; Plugins bundle skills, subagents, commands, hooks, and MCP definitions | MCP workspace config; enterprise allowlists; Open Plugin Spec manifests |
| Execution environment | Local terminal and worktrees, with JetBrains integration | Claude Code sessions with background and forked subagents | Local CLI plus ephemeral GitHub Actions environments across GitHub, IDEs, mobile, and Linear |
Convergence and divergence
All three now externalize instructions into repository- or workflow-scoped artifacts rather than relying only on chat history. They delegate work to specialized subagents, expose hooks around sessions and tool calls, connect external tools through MCP, and let users or administrators change isolation or approval behavior. In that architectural sense, AGENTS.md-style instruction artifacts, subagents, hooks, MCP, and sandbox toggles or equivalent permission switches have become baseline harness features.
The convergence stops at implementation.
Where work executes is the clearest divide. Codex remains local-first, with operating-system sandboxes and worktree automation. Claude Code’s distinctive unit is the session: forked contexts, background agents, nested delegation, and resumability. Copilot splits execution between a local CLI and hosted ephemeral environments, then exposes those agents through multiple products.
How approvals are governed also differs. Codex inserts a Guardian into full-auto execution and separates read-only actions from writes. Claude expresses permission through rules, inherited modes, fail-closed parsing, and separate filesystem and network controls. Copilot ties approval to planning modes, sandbox flags, and enterprise policy, including GitHub-managed MCP allowlists.
How extensions are packaged is the third durable difference. Codex uses TOML-defined custom agents and MCP around an open-source CLI. Claude has the most explicit packaging hierarchy: a Skill is a portable expertise unit, while a Plugin versions a bundle of skills, subagents, commands, hooks, and MCP definitions. Copilot combines workspace configuration with Open Plugin Spec manifests and governance attached to GitHub.
What this means for teams
Choose Codex when local execution, inspectable open-source behavior, OS-level sandboxing, worktrees, and explicit write governance are central. Its July changes are especially relevant where teams want stronger dangerous-command detection, resumable multi-agent work, configurable concurrency, and non-experimental MCP authentication.
Choose Claude Code when the priority is packaging organizational expertise and automation into reusable units. Skills, hooks, subagents, and Plugins form a coherent customization stack, while background and nested agents support delegated work. Its July hardening matters when subagents may consume untrusted content or must inherit a parent permission policy.
Choose Copilot when the agent must cross environments and organizational workflows. Its CLI has familiar local harness primitives, but its larger advantage is the hosted control plane: ephemeral GitHub Actions environments, Agent HQ, enterprise MCP policy, and access from GitHub, IDEs, mobile, and Linear.
Combining tools can be rational, but only if the team standardizes above them. Keep repository instructions portable where possible. Define which actions require human approval independently of product defaults. Review hooks and plugins as production automation. Decide whether a task may leave the local machine before selecting the agent. Document which system owns the final branch, commit, pull request, or external ticket when several agents participate.
The practical lesson from 2026 is that model selection is only one decision. The harness defines the operating boundary: what the agent can see, what it can run, who or what approves it, how it delegates, and where the resulting work is recorded.