Harvard researchers show that model-generated tokens can fingerprint inference engines including vLLM and SGLang, then select engine-specific exploit paths; the inference runtime itself belongs inside the untrusted boundary (2026-09-17, ev-20260917-10).
What do long-running agents still need for reliability?
Current signals focus on persistent state, recovery, permissions and auditable execution. Feature availability alone does not establish reliability. Pilots should test recovery and external side effects, beyond a successful demo.
As of 2026-09-27 · Analysis based on archive evidence
Scope of the answer
For workflows involving long execution and tool use. Verify each product’s hosting boundaries and availability separately.
Open questions
- Can recovery avoid repeating side-effecting actions?
- Are permissions, audit and human escalation verifiable?
Supporting material
DUMA-Bench (2026-09-21 overlap recovery, ev-20260921-03): across 14 models and eight domains, letting users keep changing shared state raises attack success from 26.9% to 41.1%. Risk emerges from the model, user and state changes permitted by the runtime together.
Agent trace tampering and EvasionBench (September 24, 2026, ev-20260924-01/02): local agents can rewrite audit evidence, while ordinary task pressure triggers repeated, encoded and decomposed bypass attempts; logging and consequence gates must remain independent of the agent
More evidence · 21
OpenAI Codex CLI 0.148.0 stable ships `codex exec fork` session forking + async hooks that invoke MCP tools (2026-08-18T22:26Z, primary source, ev-20260818-02)
Cursor's 'Cloud Agents and Cursor Harness Improvements' lands always-on system primitives in the stable product: event-driven Subscriptions (subscribe to PRs/Slack/schedules and wake up; automatically drive self-created PRs to completion), VM-per-subagent isolation + swarm, /goal long-lived objectives, non-interrupt steering (2026-08-19, official changelog, ev-20260819-01)
OpenAI Codex CLI 0.149.0 stable ships an interactive agents dashboard (search/start/open/rename/stop tasks — the first fleet-management UI in a stable CLI agent runtime) and `codex queue` (send messages into existing local/remote sessions; queued messages reliably wake idle sessions; duplicate-session-name resolution) (2026-08-20T21:04Z, primary source, ev-20260818-02 update)
OpenAI Codex CLI 0.150.0 stable ships task-level `@` references and inter-agent messaging — "ask agents to read, create, or message tasks": agent-initiated cross-task/inter-agent messaging lands in a non-Anthropic stable runtime; plus Interrupt hooks (commands/MCP handlers on turn interruption) (2026-08-26T19:37Z, primary source, ev-20260818-02 update)
Gemini CLI 0.57.0 stable's release tag contains packages/a2a-server (an A2A protocol server), published to npm as @google/gemini-cli-a2a-server@0.57.0, with a wave of [SSR Agent] fixes merged — Google becomes the seventh organization with protocol-level inter-agent interop in a stable runtime (2026-08-25T18:37Z, primary source, ev-20260825-02)
12. OpenAI Agents API (2026-09-10, primary source, ev-20260910-02): the Codex harness productized as a platform primitive — one API call creates a production cloud agent with orchestration, cross-window compaction, tool search, programmatic tool calling, MCP and parallel subagents built in; the harness layer graduates from CLI runtime to cloud-platform commodity (same-org OpenAI reinforcement and a new rung, not a new organization)
13. Cursor Projects (2026-09-10, official changelog, ev-20260910-03): coordinator agent plans and delegates rather than writing code, months-scale task context, project-level shared memory (later agents reuse earlier agents' knowledge), Slack/schedule/PR subscription wake-ups — months-scale self-directed work becomes the management unit of a mainstream coding tool (same-org Cursor reinforcement, not counted as a new organization)
14. GitHub Copilot code review (2026-09-11T20:00Z, primary source, ev-20260911-11): Lite review now uses a multi-agent ensemble and runs the full Copilot SDK shell-tool set behind the agent firewall for build, test and targeted-script validation; GitHub's experiment reports 47% more addressed high-severity comments at about 8% lower cost. Same-org GitHub/Microsoft runtime reinforcement, not a new organization
15. Agent runtime and recovery evaluation enter paired experiments (2026-09-14 digest, ev-20260914-02 / ev-20260914-07): same-model contrasts find no resolved average solve-rate advantage for Claude Agent SDK / Codex SDK over neutral deepagents, while the neutral harness costs 1.2-1.6x more per solved task; ParaRecover measures localization and replanning across parallel tool calls with 10,626 instances and 14 error classes — runtime choice and failure recovery now have reusable process metrics
16. Runtime, scaffold and delegation topology become measurable (2026-09-15 digest, ev-20260915-02 / ev-20260915-04 / ev-20260915-06): no adjacent top-30 SWE-bench result is separable, within-model scaffold ranges reach 29.8 points, production traces estimate hierarchy information loss and a cost crossover, and ScienceBuddy releases a layered harness-evolution and model-training loop.
17. RRSI and the long-horizon collusion study (2026-09-21, ev-20260921-04 / 06): automated harness optimization needs proposal budgets, held-out tasks and pruning to control overfitting, while persistent multi-agent interaction can reshape cooperation under reward conflict. A runtime must manage both scaffold evolution and relationship state across turns.
Microsoft Foundry connects durable execution, A2A, Routines, tool search and production-trace optimization, while Android Studio hosts replaceable agents through ACP (September 24, 2026, ev-20260924-07/09)
Microsoft Copilot (September 25, 2026, ev-20260925-01) combines persistent Autopilot, tenant-hosted Managed Runtime, separate identity/memory/computer and FinOps governance; same-day GitHub Memory and Qwen Code Hosted Runtime updates strengthen cross-agent memory and failover
GitHub Copilot enterprise-managed permissions GA (2026-09-09, primary source, ev-20260909-02): administrators deploy block/ask/allow policy for shell, files and network domains, overriding user auto-approval — an organization-level policy constrains a general execution surface
CapScope (2026-09-10 digest, ev-20260910-09): shell, filesystem and network capabilities become task-scoped contracts; prompt-injection success falls from 38.7% to 0.8%, with an independent verifier separated from the execution harness
GitHub Copilot code review (2026-09-11, primary source, ev-20260911-11): the full shell-tool set runs builds, tests and scripts behind the Copilot agent firewall; capability expansion ships with an isolation layer
'Is Bash All You Need?' (2026-09-14 digest, ev-20260914-01): controlled experiments across two models and two enterprise benchmarks put Bash 4.8-24.5 points above typed tools with 19-72% fewer tokens; the study explicitly makes strong sandboxing a prerequisite
OATS runtime gate (2026-09-14 digest, ev-20260914-03): across 66,192 skill versions, clean artifacts still lead to locally policy-sensitive actions; a deterministic resolver blocks 23/23 prohibited attempts in live tests with 67.6 ms median hook latency
2026-09-14: plan injection evades monitors in 25–33% of tested settings; Claude Code 2.1.271 adds per-command network authorization (ev-20260914-10; ev-20260814-04 update).
2026-09-15 to 16: Gemini CLI 0.60 moves MCP OAuth, path-boundary, environment-consent and tool-output-provenance hardening into stable; Claude Code 2.1.273 fixes skipped Bash prompts, hidden destructive subshells and managed-policy precedence; social-harness experiments show cross-principal messaging still needs independent provenance, authority, protocol and governance layers (ev-20260825-02 / ev-20260814-04 updates; ev-20260915-07).
A red-team study bypasses production-style Auto Mode and Guardian blockers in 79% of trials through agent-generated prompt injection, with multi-agent and malicious-compaction paths adding cross-context attacks; per-action model monitors are not complete boundaries (2026-09-17, ev-20260917-12).
Counter-evidence
No direct counter-evidence is recorded. That alone does not establish the conclusion. Independent reproduction and actual deployments remain the next checks.