The IT Nerd

Harness today released The State of Agent DLC 2026, a new report showing that enterprise confidence in AI agents exceeds the controls organizations have in place to test, secure, and govern them. This lack of control presents a significant risk for enterprises deploying AI agents. 

AI agents don’t behave like deterministic software — the same agent can produce different outputs from one run to the next. That means they need controls built for that variability. Most organizations are still relying on controls built for deterministic software, and the report finds that gap is already showing up in production incidents, security breaches, and blown budgets.

Most Enterprises Trust Their AI Agents, Few Can Control Them

Ask organizations if they trust their AI agents, and most say yes. Ask a more specific question — do you have a tool that tells you every agent running in your environment, or a way to shut one off the moment it misbehaves — and the answer is often no. That gap holds across every domain the survey covered: testing, security, inventory, cost, and rollback. Confidence lands in the mid-70s of those surveyed in each case, but the control that would back it up is in place for less than half of organizations, and in some cases fewer than one in five.

• Organizations don’t have full visibility into what’s actually running. 77% are confident they have a complete inventory of every agent, MCP server, and LLM in their environment, but only 44% run active discovery tooling to verify it.
• Most can’t confirm testing would catch a failure before it ships. 74% are confident their testing would catch a production-impacting failure, but only 19% have a gate that automatically blocks every bad release.
• If something does go wrong, most organizations couldn’t stop it fast enough. 76% believe they could disable a misbehaving agent in under 15 minutes, but only 33% have an instant kill switch in place.
• Confidence in agent security has almost no relationship to actual resilience. 75% say their agents are secure end to end, but that group had security incidents at almost the same rate (88%) as the overall respondent population (87%).
• Visibility into the budget isn’t helping spend control. 74% say they have a complete picture of true spend per agent, while 60% still overran their budget last quarter.

What the Confidence Gap Is Already Costing Organizations

The confidence gap shows up fastest in how changes actually get shipped. Most organizations are routing AI agent changes through pipelines built for code, without adjusting how those changes get tested, approved, or tracked.

• There’s no real system for managing agent changes. 42% run prompt edits through the same pipeline as a code change, while just 34% have a dedicated configuration system for AI behavior.
• Without dedicated tooling, organizations default to routing agent changes through code pipelines, inconsistently. Just 53% of agent-related changes go through any standard pipeline before production, and 37% run less than half of theirs through one.
• With no consistent pipeline in place, whether to trust a given change comes down to judgment. More than 4 in 10 organizations decide case by case whether to trust a change, and among those that do promote agent changes to production, only 58% check every change against a fixed, repeatable standard.
• Incidents are only climbing in number as agents scale. 58% of organizations report an increase in production incidents per 100 changes since deploying AI agents, and roughly 7 in 8 had at least one tangible agent-related issue this year.

How Organizations Are Closing the Confidence Gap

The report points to a consistent pattern among organizations closing this gap, and Harness recommends the same sequence to the teams it works with directly:

• Treat the agent lifecycle as its own discipline. Build evals, security, inventory, and rollback specifically for agent behavior, rather than routing agent changes through the same pipeline built for non-deterministic software. 
• Replace ad hoc reviews with a fixed, repeatable standard. Every change promoted to production should be checked against the same standard, whether that check is automated or manual.
• Adopt progressive rollout for agents, not just manual gates. Techniques like canary and blue/green deployment limit exposure, but remain far less common for agent changes than for code changes.

To learn more, download the full State of Agent DLC 2026 report here: https://www.harness.io/state-of-agent-dlc-2026. 

Harness today released the 2026 State of AI in FinOps, a new report revealing that enterprise AI spend has outgrown the ownership, visibility, and governance needed to manage it. We surveyed 700 engineering leaders and practitioners across five countries to ask about their organization’s FinOps practices. The report finds that AI costs are climbing across every LLM provider and spend category, including infrastructure, software, and models. But basic questions go unanswered: who owns the bill, why it spiked, and whether the spend is paying off.

AI Spend Is Rising Fast and Running Blind

AI spend is no longer isolated to a single team, tool, or budget line. It is climbing across infrastructure, software, and models at once, faster than most organizations can keep up with. The report finds that when the bill spikes, most have no way to explain why:

• Nobody is clearly accountable for AI cost. 52% say there’s no clear owner, with responsibility split across engineering, FinOps, finance, and IT; so when spend increases, there’s no single person well-positioned to answer for it.
• That ownership gap shows up as recurring surprises. 72% have experienced an unexpected AI cost spike or bill in the past year, and a third of organizations (33%) have been caught off guard more than once.
• Even after the surprise hits, most can’t trace it back to a cause. If spend were to double overnight, only 20% could identify the reason within hours.
• The result is money wasted with no owner or explanation. Organizations estimate 26% of all AI spend is wasted. For organizations spending $1M/month, the reality for 1 in 5 respondents, that’s $260,000 a month with no measurable return.

This mirrors what Harness found earlier in 2026. The State of Engineering Excellence 2026 report showed engineering teams measure AI’s productivity gains with instruments that miss what matters. The same blind spot now shows up in finance: spend is moving faster than any organization’s ability to see it, attribute it, or explain it.

The Problem Starts When Engineers Build the Features

Here’s how it plays out:

• Most engineers have no idea what the features they create actually cost. Less than half (45%) say they understand the cost of the AI features they build.
• Planning ahead becomes total guesswork. More than half (56%) say anticipating AI spend is based on guesswork, not data.
• The incentives in place reward more usage. 57% of engineers say their organization actively encourages “tokenmaxxing,” maximizing AI usage regardless of tangible value.
• Organizations can’t enforce spend policies without data.  73% have AI cost policies in place, yet only 13% have basic visibility into their AI spend.
• As a result, most organizations can’t tell if their spend is even paying off. Only 26% have a robust method for measuring the business value of their AI spend.

What Mature Organizations Do Differently

The report finds that organizations that have reached full AI cost maturity follow a consistent sequence: 

• Name a single, accountable owner for AI cost before adding new tools or providers.
• Build one unified view of AI spend across infrastructure, software, and models before attempting to optimize it.
• Push cost data into engineering workflows at the point of model selection, prompt design, and deployment, rather than treating it as a finance-only concern.
• Tie AI spend to business outcomes, establishing unit economics before measuring ROI.

To learn more, download the full 2026 State of AI in FinOps report here: http://www.harness.io/state-of-ai-in-finops-2026 

About the Research

This report is based on an online survey of 700 engineering leaders and practitioners, asking about their organization’s FinOps practices, conducted in May and June 2026 by Sapio Research. All respondents work at organizations that actively use AI/LLM services and are employed in software engineering/development, DevOps, IT operations, or executive leadership roles. The sample included 300 respondents in the United States and 100 each in the United Kingdom, France, Germany, and India.

Harness today announced it is extending its platform to cover the full AI Agent Development Lifecycle (DLC), giving enterprises a single set of pipelines and controls to build, test, deploy, and run agents the same way they already ship everything else.

Every enterprise is building AI agents, but most can’t get them past internal pilots or proofs of concept. According to Gartner®, “Only 8% of organizations have agentic AI in production.” The software delivery lifecycle enterprises’ trust for shipping application code hasn’t extended to agents yet, trapping the ROI of internal AI investments. Real innovation arrives once a company can run an agent live with the same trust and confidence it has in the rest of its software.

Why AI agents break the traditional software delivery lifecycle

Traditional software works because it’s predictable. Application code is deterministic. Run the same test against the same code twice, and it produces the same result both times.

Agents don’t work that way: an agent’s underlying language model decides how to complete a task, and the same agent, given the same input, can choose a different tool or take a different action from one run to the next. A test that passes once offers no guarantee it will pass the next time. Incidents stop being reproducible on demand, which means the standard playbook for catching and fixing bugs doesn’t transfer either.

The stakes rise with the size of the business. A rogue agent can expose customer data, violate a compliance policy, or take an action nobody approved. Enterprises need a way to answer for what their agents are doing, and the traditional software delivery lifecycle was never built to give them one.

New Harness Agent DLC products and capabilities

Agent DLC closes the gap between building an agent and delivering it safely to production. Today’s launch includes five new products and capabilities spanning testing, deployment, operations, and governance: 

• Harness AI Evals makes agent quality measurable, letting teams define eval datasets, wire up scoring functions, and set quality gates that automatically catch regressions whenever an agent or model changes.
• Agent Deployments extend the canary releases, approvals, and OPA guardrails that Harness already applies to Kubernetes deployments to managed agent runtimes like Amazon Bedrock AgentCore and Google’s Agent Runtime. Agents now ship through existing pipelines instead of a separate cloud-specific workflow.
• AI Configs support the release and management of prompts and model changes at runtime, backed by the same feature flagging infrastructure that already manages code releases. Teams can test what performs best and roll back instantly, without redeploying.
• AI Asset Catalog automatically discovers every agent, skill, and plugin built across an organization’s repositories and links each to an owner, so nothing ships or runs unaccounted for.
• Harness AgentTrace records what happens during a single agent run and across a full multi-step session, showing which path an agent took, where it slowed down, and how different models or prompts affect the outcome. Harness is also open-sourcing the foundational components behind AgentTrace, including harness-sdk and harness-evals, so developers can bring the same tracing primitives into their own AI applications.

In addition, existing Harness products already extend to agents without requiring any changes: Continuous Integration builds them like any other service, Artifact Registry tracks their versions and dependencies, AI Test Automation validates their responses in plain English criteria, and AI Cost Management extends spend visibility to every agent and model. 

Securing the Agent DLC

Agents choose their own approach and path to get there, so their behavior is hard to predict and just as hard to secure. They expand their own attack surface by connecting to tools and APIs, spawning sub-agents, and inheriting trust from every model they touch. Static scans were never designed for this kind of risk. Harness is launching new security capabilities to close that gap.  

Shift-left: constrain what agents can do before they ship.

• Primitive Scanning flags misconfigurations in agent skills, prompts, and models.
• AIBOM captures every model, tool, and dependency an agent was built with.
• AI Testing runs agents against adversarial inputs and the OWASP Top 10 LLM and Agentic AI risks.

Shield-right: enforce policy and maintain visibility once they’re live.

• Agent Discovery and Posture Management continuously maps agents as they spin up and how they connect across the organization.
• AI Firewall enforces policy in real time against prompt injection, tool misuse, and data exfiltration.

Together, these capabilities give Agent DLC a single audit trail from development to production. 

Built on the Harness platform

Harness built context and intelligence directly into the platform with the Software Delivery Knowledge Graph, which captures and connects data from every stage of the delivery lifecycle, now spanning both applications and agents. Organizations relying on siloed tools don’t have that same connected view.

In June 2026, Harness introduced Autonomous Worker Agents, a platform for building and safely running AI agents inside software delivery pipelines. Worker Agents run as governed steps within those pipelines, covered by the same controls Harness already applies to every deployment.

Agent DLC extends that same context and governance across the full agent lifecycle. The pipelines, policies, approvals, and evidence that already apply to an organization’s code now apply to its agents too, so eval gates, deployment approvals, and security checks run as stages within a single pipeline, from the moment an agent is created through everything it does afterward.

Availability

Harness Agent DLC capabilities are rolling out now to Harness customers. For a full breakdown of what’s included at each stage of the lifecycle, visit this blog page. 

Harness, the AI Software Delivery Platform company, today launched Autonomous Worker Agents for software delivery: the platform for enterprises to build and safely run AI agents that handle the work between writing code and shipping it to production. 

Software delivery has moved through phases. First, people did the work by hand. Then they wrote scripts for individual jobs like deployment. Most recently, they connected those jobs into automated pipelines that follow fixed instructions, which is what Harness has run for large enterprises for years. Worker Agents are the next phase. Every step in the pipeline can now run as a reasoning agent rather than a fixed script, with the context, governance, sandboxing, and audit trails that enterprises need to trust agents in production.

Dozens of Harness Managed Agents are available today, and any team can customize them or build their own. A new Harness Agent Marketplace makes it easy to find, use, and share them.

The controls that keep agents safe in production 

Autonomous Worker Agents run on infrastructure that the customer controls. Code and data never leave the customer’s network, and agents are governed by the same controls enterprises already use for human deployments.

These controls make Autonomous Worker Agents safe to run in production:

• Sandboxing: Agents run in isolated containers with restricted file and network access. An agent that produces a malicious command has nowhere to send data.
• Scoped credentials: Each agent has its own identity and the specific set of permissions assigned to it, the same way an employee does. An agent can only take the actions those permissions allow, no matter who triggers it or what its prompt says.
• Policy enforcement: The same policies that gate human deployments gate agents. A policy can keep agents off non-approved models or out of production pipelines.
• Audit trails: Every agent action is recorded under a distinct AI identity, with full provenance: what triggered the agent, what it did, and the outcome.
• Cost tracking: Token spend is surfaced per agent, per pipeline, with budget caps that stop an agent when it hits its limit.
• Chaining: Agents compose into multi-step workflows, passing output from one to the next.

Easy to build, governed by your policies

Building an Autonomous Worker Agent uses the same agent-file format that has become standard across the industry. Save it to a single file, commit it to your repository, and the agent is live, governed, and available across your organization. Teams that would rather not write the file can use Harness AI to generate the agent for them. Either way, the agent runs as a governed pipeline step with the same controls, audit trail, and policy enforcement as everything else.

Once it runs, the agent has your organization’s full context. It reasons using the Harness Software Delivery Knowledge Graph, a connected map of your services, pipelines, deployments, infrastructure, incidents, and security findings. An agent assessing a vulnerability knows which services are affected and who owns them. A deployment agent knows which services depend on the one being deployed. The result is a response built for your specific environment, not a generic fix that only looks right.

Agents also meet you where you work. Through the Harness MCP Server, a developer in Cursor, Claude Code, or another tool can assign a task to a Worker Agent and have it run in Harness, with the result returned to wherever it was triggered. Wherever an agent runs, it runs under your organization’s policies, governed the same way as every other step in your pipeline.

Harness-built agents, ready to use today

Harness has pre-built Autonomous Worker Agents that handle the repetitive, time-consuming work that slows teams down across the delivery lifecycle. Here are a few of the agents available today, with more added regularly:

• Autofix reads build logs, identifies the root cause of a build failure, commits a fix to the PR branch, and re-triggers builds until it passes.
• Code Review reviews PR diffs for code quality, security issues, and test coverage.
• Code Coverage identifies untested lines and generates tests to close coverage gaps.
• Feature Flag Cleanup detects stale flags and validates safe removal.
• Manifest Remediator analyzes failed Kubernetes deployments and fixes manifest issues.
• IaCM Remediation fixes configuration drift, security findings, and cloud cost issues by editing infrastructure configurations.

The Harness Agent Marketplace

The Harness Agent Marketplace is a shared catalog where Worker Agents are published and reused across an organization and the broader Harness community. Teams can adopt an existing agent rather than build their own, and contribute the agents they build back to the catalog.

It has three tiers:

• Harness Managed: Built, maintained, and SLA-backed by Harness.
• Harness Certified: Built by partners, reviewed and certified by the Harness engineering and security teams.
• Community: Published by the broader Harness community. Organizations can use out-of-the-box policies to control which community agents run in production.

Every agent in the Marketplace can be forked. A team can clone an existing agent and adjust the prompt, tools, or triggers to fit their environment. The agent one team builds to solve a problem becomes the starting point for the next team that hits the same roadblock.

Bring your own model

Autonomous Worker Agents work with any LLM provider. Connect Anthropic, AWS Bedrock, or Google Vertex AI through existing Harness connectors, and switch models per agent, per environment, or per pipeline without rewriting the agent.

Availability

Autonomous Worker Agents and the Harness Agent Marketplace are now generally available to all Harness customers. For more information, visit https://harness.io/platform/worker-agents.