What's a harness and why does it matter more than the model?

It's all the scaffolding around the LLM: orchestration, verification, sandbox, memory, governance, and interpretability. Mythos proved the gap between a mediocre system and a top-tier one lives there, not in the model's weights. A frontier model without a harness is powerful and unsafe; with one, powerful and trustworthy.

Why isn't Docker enough for the sandbox?

Docker shares the host kernel, so an escape compromises everything else. For untrusted code or exploits you need real isolation: micro-VMs (Firecracker/Kata), gVisor, or WASM, with network isolation by default.

Which layer should I start with?

Verification (deterministic oracles) and sandbox. Without an oracle that separates real results from hallucinations, everything else amplifies noise; without real isolation, a single mistake is catastrophic.

How do I apply the Fable 5 / Mythos 5 lesson to my system?

They're the same model with a different governance layer. The lesson: put safety in the architecture (capabilities, dual control, rerouting to a safeguarded model), not in hoping the model behaves.

Should I still use SWE-bench to measure my agent?

As a frontier signal, no: OpenAI deprecated it in February 2026 for contamination. Use decontaminated, live evals (SWE-bench Pro, SWE-rebench, Cybench/NYU CTF) and, if you saturate, adversarial co-evolution.

Is this only for cybersecurity or for any AI system?

For any. An agent that books appointments, moves money, or touches customer data needs the same layers - verification, permissions, traceability - even if it never touches an exploit. The harness is domain-agnostic.

The Secure Harness Blueprint: 6 Layers to Build with Frontier AI Without It Blowing Up in Your Face

Mythos proved the difference between a mediocre AI system and a top-tier one isn't the model, it's the harness. This blueprint maps the 6 layers - oracles, sandbox, CVD, interpretability - and how to build them.

Replicating Mythos's capability is impossible - it isn't released. Replicating its architectural discipline is not, and that's where you win or lose. The strategic mistake is chasing the biggest model; the right move is building the scaffolding any powerful frontier model needs to be safe and useful.

This is a working document. Map your system against the six layers. Time to map: 45-60 minutes. Result: a blueprint of the harness that separates a probabilistic toy from a system you can trust in critical production.

01 · Layer 1 - Verification (oracles, not trust)

The most transferable principle from the Mythos report: don't trust model output, verify it with a deterministic oracle. Mythos used sanitizers (ASan) as a perfect oracle - zero false positives.

02 · Layer 2 - Sandbox (real isolation)

Running untrusted code or actions without real isolation is playing with fire. Docker shares the kernel: insufficient for the untrusted.

03 · Layer 3 - Context and memory (the scarce resource)

The context window is your most expensive resource. Managing it badly degrades the whole system.

04 · Layer 4 - Governance (who can do what)

An agent with no capability limits is an incident waiting to happen. Governance turns probabilistic instructions into hard guarantees.

05 · Layer 5 - Interpretability (runtime traceability)

It's not enough that it works; you need to know why it acted, especially when it acts strangely.

06 · Layer 6 - Disclosure and lifecycle (CVD)

If your system finds flaws, you need a responsible process to handle them - or you create more risk than you resolve.

Connect the six

Having the six layers isn't the goal. Connecting them is.

Harness Scorecard

Score your system - 6 yes/no questions:

Does every critical output pass a deterministic oracle before acceptance?
Does untrusted code run in a micro-VM (not just Docker) with network isolation?
Do you separate always-on from on-demand memory with progressive disclosure?
Do subagents have minimal capabilities and high-risk actions dual control?
Can you trace why the agent acted and abort if concealment features appear?
Does no vulnerability ship without a coordinated-disclosure gate?

Your score:

0-2 - Fragile harness. Start with verification (Layer 1) and sandbox (Layer 2).
3-4 - Solid base, no hard guarantees. Prioritize governance and interpretability.
5-6 - Top-tier harness. Now move up to formal verification and adversarial co-evolution.

Phased roadmap

Phase 1 (0-3 months): agent loop + typed schemas, ACI with str_replace_editor and repo map; Firecracker/gVisor sandbox with network isolation; layered memory.

Phase 2 (3-9 months): multi-agent orchestration with critic agents and dual control; ASan as oracle; CVD gate with SHA-3; decontaminated evals.

Phase 3 (9-18 months): formal verification (Dafny/Lean + property-based testing); adversarial co-evolution; deterministic replay + concealment monitors; policy-aware execution.