On September 20, Google Cloud AI Research released an open-source framework for training AI agents, Apache 2.0, code and RL implementation on GitHub. It is called EnvHarness. Not EnvGen, not TaskForge, not AutoCurriculum. The largest AI research organization on the planet looked at how agents learn and named its training infrastructure after the runtime concept this blog has been hammering for a year: the harness.
The name is not a coincidence, and the paper is explicit about the lineage. An agent harness makes a frozen model capable by wrapping it in plug-in components — skills, memory, tools — without touching its weights. EnvHarness applies the same move to the other side of the interaction: it wraps a frozen environment in plug-in components that make it dynamically controllable, without touching its internal code. Same architecture, mirrored. The harness idea didn't just win at runtime. It colonized training.
But the name isn't the most interesting part. The most interesting part is a number buried in the results tables: on SpreadsheetBench, skills extracted from the original, unmodified environments scored below the no-skills baseline. Practicing in a static environment didn't just fail to help. It made the agent worse. That finding restructures how you should think about every training pipeline and every skill library you've ever built.
Practice Makes You Worse
The setup: the Google team, with academic collaborators, evaluated agents across five benchmarks in four domains — ALFWorld (embodied tasks), WebArena (web navigation), SWE-bench Verified (software engineering), OfficeQA and SpreadsheetBench (office work). They compared three conditions: the frozen agent with no skills, skills extracted from trajectories in the original environments, and skills extracted from trajectories in EnvHarness-reshaped environments.
The control condition — practicing in the original environments and mining skills from those trajectories — was supposed to be the safe baseline. It wasn't:
- SpreadsheetBench: skills from original environments scored 45.88 Pass@1 versus 46.44 for no skills at all. Practice: negative return.
- SWE-bench Verified: original-environment skills lengthened trajectories — 55.01 steps average versus 53.58 with no skills. The agent learned to do more of the wrong things.
- WebArena: original-environment skills averaged 38.5 across four sub-tasks versus 38.7 for no skills. Statistically indistinguishable from zero.
Read that list again. In three of five domains, practicing in the environment as-built produced skills that were worthless or actively harmful. The reason is structural, not incidental: a static environment lets the agent rehearse behaviors it already executes, so the skills it extracts are redundant at best. At worst, it encodes its own bad habits — the wasteful directory listings, the repetitive file reads, the premature submissions — into reusable form. You become what you practice, and a static environment is a mirror, not a teacher.
Most people think the bottleneck in agent training is data volume or compute. The EnvHarness data says otherwise: the environment is the curriculum, and a curriculum that never changes is one that stops teaching the moment the student stops failing — which, for a frozen environment and an improving agent, is almost immediately.
Reshape Everything but the Verifier
EnvHarness is a programmable layer around an existing environment, assembled from three plug-in component types that operate strictly at the standard reset() / step() interface:
- Setup — reshape the initial state: where the agent starts, what's already done, what's broken.
- Rule — reshape the interaction: which actions are allowed, what they do, what the agent observes.
- Link — compose another environment's tasks into this one.
Because each component preserves the interface, they stack freely — E″ = w₂(w₁(E)) — and because nothing reaches into environment-specific code, the same system works across embodied tasks, web browsing, and real software repositories. Adding a benchmark means implementing one interface (ActionableEnv); the entire downstream pipeline is benchmark-agnostic.
Here is the design decision that matters more than any benchmark number: the components can change what the agent observes, what it may do, and where it starts — but the goal predicate that decides success is untouchable. Every reshaped environment inherits the original benchmark's human-built verifier, unchanged.
If you've engineered production harnesses, you'll recognize this instantly. It's the same contract that governs runtime harness engineering: you may reshape the scaffolding arbitrarily — rewrite prompts, swap tools, restructure context — as long as verification stays honest. The moment your verification layer becomes as malleable as your scaffolding, you have a system that grades its own homework. Google's training stack and a disciplined runtime harness converge on the identical invariant, from opposite ends of the pipeline. That is not a coincidence; it's the field discovering that verification integrity is the only load-bearing wall, on both sides of the model.
The Loop That Writes Itself
The plug-ins would be an interesting API and nothing more if a human had to write them. The second half of the framework, EnvRigger, automates it — and the automation is itself an agent harness in miniature.
EnvRigger is an LLM designer agent that treats the target policy as a black box. Its loop: Observe → Diagnose → Write → Validate. It rolls the agent out in the current environment, reads successful and failed trajectories to find a recurring failure pattern, writes a component that reshapes the environment to target that specific weakness, then tests the candidate on fresh rollouts. Five rollouts of the original task, five fresh rollouts of the modified one, up to five write-and-validate iterations. If the reshaped environment isn't both solvable and instructive, it's revised or discarded. Only what survives validation gets committed.
The paper's examples are exactly the failure modes any harness engineer sees in production traces. A coding agent takes the shortcut of submitting a patch without running the tests — EnvRigger writes a rule that intercepts the premature submission and returns a warning, forcing a proper test run before the episode can end. A web agent answers questions without scrolling past the fold — a rule blocks retrieval actions until the agent has scrolled, and the resulting trajectories teach it to inspect the full page before answering.
Notice what this is: an agent diagnosing another agent's failures and writing guardrails against them, verified empirically before deployment. That is precisely the discipline of runtime harness engineering — mine the trajectories, find the systematic flaw, install the interception, prove it works — executed at training time, in a loop, without a human in it. The same engineering function is now manufacturable.
It Compounds
The headline numbers are solid. Across the five benchmarks, skills learned in EnvHarness environments beat both controls everywhere: up to +9.0 points on held-out tasks (ALFWorld out-of-distribution, 61.4 → 70.4), +5.9 on ALFWorld average, +3.1 on WebArena average, +2.70 on SWE-bench Verified success rate — and 9.8% fewer execution steps, with average SWE-bench trajectories shrinking from 55.01 to 49.61 steps.
The more damning comparison is against purpose-built pipelines. On SWE-bench Verified, the generic, benchmark-agnostic EnvHarness beat SWE-smith — a system constructed specifically to generate software-engineering training environments — by 2.46 points while requiring 5.11 fewer steps per episode. On ALFWorld, it beat GenEnv by 5.7 points on average and 8.5 out-of-distribution. The specialized tools lost to the general one.
And the gains are not model-specific. The team ran the pipeline across Gemini 3.1 Flash-Lite, Qwen3.6 27B, Gemini 3.5 Flash, and Claude Sonnet 4.6 — three families, open and closed, no-skill baselines spanning 30.7 to 67.2. The EnvHarness gain held at 2.9 to 3.7 points across all of them, with EnvRigger running on the same backbone as the policy, so none of it comes from a stronger model's distillation.
But the scaling curve is the real finding. On SWE-bench Verified, the base agent started at 47.67% and climbed to 54.79% as the EnvHarness environment pool grew to 300 — with three rounds of policy-environment co-evolution taking it from 47.7 to 54.8. The same budget spent on original environments topped out at 52.13 and flattened. SWE-smith-generated environments flattened at 50.37. Static curves saturate because the environment stops producing failures worth teaching from. The adaptive curve keeps climbing because every time the agent improves, the environment moves to target whatever the new weakest link is. Under RL, the same pattern: ALFWorld in-distribution success went from 81.4 to 87.9 training on reshaped versus original environments.
The Harness Goes Full-Stack
Step back and look at the arc. Two years ago, "harness" was a runtime word: the scaffolding around a frozen model. This month alone, Shanghai AI Lab shipped Atria Dawn with skills embedded directly into weights via a Verifiable Experience Pipeline, and Google shipped a training framework that wraps frozen environments in plug-in components. The same idea — capability lives in the wrapper, verification stays sacred, the wrapper adapts to the weakness being corrected — is now operating at three layers simultaneously:
- At runtime: skills, tools, memory, and interception rules around a frozen model.
- At training time: adaptive environments around a frozen benchmark, targeting the policy's diagnosed flaws.
- In the weights: trained-in skills distilled from those verified loops, dissolving the wrapper into the model itself.
The implication for anyone building agent infrastructure is that harness engineering is no longer a runtime discipline — it's a control plane that spans the whole stack. The failure trajectories your production harness collects are no longer just debugging material. They are the diagnosis signal for an EnvRigger-style loop that can turn each systematic flaw into a targeted training environment. The interception rules you write by hand today are a preview of the rules a designer agent will write, validate, and commit automatically. This is the trajectory-mining discipline from Harness Engineering: The Complete Guide to Agent-First Software Development extended past its original border — the book's methods were written for the runtime side of the interface, and the training side turns out to run on the same methods.
What to Do This Week
Stop treating your trajectory logs as exhaust. You already have what EnvRigger consumes: successful and failed runs, in storage, right now. Pull the last hundred failures from your coding agent's sessions and cluster them by failure mode. You will find three to five systematic flaws — premature submission, skipped verification, redundant file reads. That clustering is the highest-leverage hour available to you this week, whether or not you ever touch Google's stack.
Write the interception rule yourself. The paper's coding example — a rule that intercepts patch submission until tests have run — requires no training pipeline. It's a harness check: gate the done-signal on a verified test execution. If your agent's dominant failure mode is answering without looking, block the answer action until the read action has fired. You can implement EnvHarness's most valuable patterns today, at runtime, in your own harness.
Audit your skill library against the static-environment trap. Skills mined from routine, unmodified sessions are the runtime equivalent of original-environment training: they encode what the agent already does, redundant at best, harmful at worst. Test each skill against the task with the skill disabled. If performance doesn't drop, delete it — it's dead weight riding every context window.
Keep the verifier out of the reshape radius. Whatever you adapt — prompts, tools, environments, curricula — the success predicate stays fixed and independent. Every framework that has earned trust this year, Google's included, converged on that rule independently. Treat it as load-bearing, because it is.
The environment got a harness too. The wrapper is now on both sides of the model, and heading into the weights. The engineers who understand all three layers are the ones who'll own the next stack — because from here, the harness isn't a layer you install. It's the discipline the entire pipeline is built from.