Key Takeaways
- Amazon Bedrock AgentCore Harness reached general availability on June 18, 2026, at AWS Summit New York.
- Agent construction collapses to two API calls: CreateHarness defines the agent, and InvokeHarness runs it.
- The service runs on Strands Agents, an open-source agent framework AWS released in 2026.
- Each session executes inside an ephemeral Firecracker microVM, isolating agent state per user.
- AWS reported 15x growth in tasks performed by agents on AgentCore between December 2025 and June 2026.
- Production users include Nasdaq, Visa, Experian, Sony, FUJISOFT, and Twilio, per AWS (June 2026).
AgentCore Harness is AWS's managed agent loop. You describe the model, tools, memory, and identity as a configuration, then AWS runs the orchestration. It is the first major cloud agent service to make the harness itself the product, and the first to be model-agnostic at the orchestration layer.
What is Amazon Bedrock AgentCore Harness?
Amazon Bedrock AgentCore Harness is a managed service that runs an agent's think-act-observe loop on the customer's behalf.
The model, tools, memory stores, and identity policies are submitted as configuration rather than written as code. AWS handles session lifecycle, tool dispatch, retry logic, and state.
The product is structured around two API calls.
CreateHarness registers the agent definition, including its system prompt, tool list, memory references, and guardrails. InvokeHarness runs a session, returning streamed events to the caller. That is the entire surface area for most teams.
Under the hood, the orchestration engine is Strands Agents, an open-source framework AWS published in 2026. Strands is the runtime; Harness is the managed wrapper around it. The same agent definition can run locally against Strands for testing and on Harness for production, with no code changes.
Crucially, AWS has decoupled the harness from the model. A Harness agent can call Bedrock, OpenAI, Gemini, or any LiteLLM-compatible endpoint, and it can switch providers mid-session without rewriting the agent.
AWS framed the design choice this way: "We decoupled the harness from the model, so you can choose any model and switch between them mid-session without touching your agent logic."
The closest mental model is the early Lambda pitch. Writing EC2 user-data scripts meant owning the bootstrap, the runtime, and the patching. Lambda took the bootstrap and patching off the table.
Harness takes the agent loop, session state, and tool dispatch off the table. The trade-off is the same: less control, less glue code, and a thinner bill of materials.
How does AgentCore Harness compare to similar agent services?
- AgentCore Harness (AWS)
- What it is: Managed agent harness, config-driven, two-API
- Isolation: Per-session microVM
- Model choice: Bedrock / OpenAI / Gemini / LiteLLM
- Best fit: Enterprises wanting config over code with governance
- AgentCore Runtime (AWS)
- What it is: Serverless hosting for agent code
- Isolation: Per-session microVM
- Model choice: Any
- Best fit: Teams that need custom orchestration logic
- OpenAI Frontier / Managed Agents
- What it is: Hosted agent runtime, OpenAI models only
- Isolation: Tenant-level
- Model choice: OpenAI only
- Best fit: Builders standardizing on GPT-class models
- Claude Managed Agents (Anthropic)
- What it is: Managed loop, opinionated tool set
- Isolation: Tenant-level
- Model choice: Claude only
- Best fit: Teams committed to the Claude ecosystem
AWS is the only vendor in this group that separates the harness from the model. OpenAI and Anthropic bundle their managed agent loops with their own frontier models, which simplifies procurement but ties the agent to a single provider.
For regulated buyers, the model-agnostic posture is the headline differentiator. For everyone else, it is also an open question: decoupling the harness is genuinely useful, and genuinely an AWS-shaped lock-in one layer down.
What problem does AgentCore Harness solve?
A single developer can get an agent prototype running in an afternoon. The work multiplies once that agent has to serve more than one user, and the failure modes compound fast.
Janakiram MSV framed the cliff in Forbes: concurrency, isolation, identity, state, and scaling all arrive at once the moment an agent leaves the laptop. AWS is betting the durable enterprise hold sits in that operational layer, not in the foundation model itself.
Usage data backs the bet. According to AWS, tasks performed by agents on AgentCore grew 15x in the 6 months ending July 2025, the kind of growth curve that signals platform gravity, not novelty.
AWS is targeting 5 core problems behind why any project doesn't move away from its PoC stage. Enterprises in 2026 have started to reject services that won’t move the needle and instead have started to focus more on the services that do.
The four pain points AWS is absorbing into Harness are concrete: per-session isolation, a live browser sandbox, safe code execution, and observability across long-running tasks. In a typical build, each one is a separate service to procure and stitch.
The model itself stays portable. Swap Bedrock for OpenAI, Gemini, or anything behind LiteLLM. The memory layer, gateway, identity vault, and observability pipeline, however, are AWS services. Lock-in cuts both ways. The escape hatch is a single CLI command that exports a Harness to portable Strands code, useful insurance for teams that want a clean exit ramp.
How does AgentCore Harness work under the hood?
The interface collapses to two API calls. CreateHarness defines the agent (its model, tools, skills, and memory), and InvokeHarness runs it.
Each session runs inside its own Firecracker microVM(below there is a diagram that shows this), isolated by default. Inside that VM, a Strand's reasoning loop picks a tool, calls the model, executes the tool, and feeds the result back. The model is swappable mid-session without losing context.
Memory splits cleanly: short-term lives in the session, long-term persists across sessions through AgentCore Memory. AWS-curated Skills toggle on with a single switch, no custom glue code required. The browser and Code Interpreter each run in their own isolated microVM per session, which is where most of the safety story lives.
What are the advantages and trade-offs?
Advantages are about compression.
- 15x growth in agent tasks on AgentCore over 6 months
- 2 API calls replace 3-6 months of glue work.
- Any model: Bedrock, OpenAI, Gemini, LiteLLM. 1 escape hatch via Strands export.
Trade-offs are real.
- Memory, identity, and observability stay on AWS, so portability stops at the model.
- Pricing is multi-meter. Runtime, memory, gateway, browser, and code interpreter are each billed separately, and consumption-based pricing is harder to forecast than a flat per-seat license.
- Memory is the component to watch: it grows more useful and harder to migrate with every passing quarter.
What does this mean for enterprises?
The durable hold sits in the operational layer, not the model. As of June 18, 2026, the AgentCore Harness is the control plane that decides how an agent plans, calls tools, retains memory, and explains itself, and that layer is what compounds over time.
Sony is already feeling that compounding effect. "By combining the Managed Knowledge Base with Web Search in AgentCore Harness, we are unifying enterprise knowledge across SharePoint, Confluence, and S3 into a single, queryable surface for our agents," said Masahiro Oba, Senior General Manager at Sony Group Corporation.
FUJISOFT reports a similar shift on the development side. "We moved from trial and error to a continuous loop grounded in data, which shortens the path from prototype to production," said Kazumi Matsuda, Senior Manager, AI Promotion Department at FUJISOFT.
Pick AgentCore Harness when governance and auditability matter. Skip it when a hard hybrid-cloud or multi-cloud mandate exists.
How can enterprises get started with AgentCore Harness?
Three steps move a team from evaluation to a running agent.
- First, open the AgentCore console in us-west-2 or us-east-1.
- run the AgentCore CLI quickstart.
- Take the free 45-minute AWS Skill Builder course titled "Introduction to AgentCore Harness."
A minimal harness definition looks like this:
# harness.yaml — minimal AgentCore Harness definition
apiVersion: bedrock-agentcore.aws/v1
kind: Harness
metadata:
name: research-analyst-agent
spec:
model:
provider: bedrock
id: anthropic.claude-sonnet-4-6
tools:
- browser
- code_interpreter
memory:
shortTerm: true
longTerm:
strategies: [semantic, user-preferences]
limits:
maxIterations: 25
timeoutSeconds: 900
Frequently Asked Questions
Is AgentCore Harness generally available?
- Yes. AWS made AgentCore Harness generally available on June 18, 2026 at the AWS Summit in New York. At GA it runs in us-west-2 and us-east-1, with additional regions on the public road map. Customers including Nasdaq, Visa, and Experian are already running production workloads on it.
How is AgentCore Harness different from AgentCore Runtime?
- Runtime is the lower-level primitive. You bring your own agent code and container, and Runtime isolates and scales it. Harness is the managed layer on top, where you declare model, tools, and memory in configuration and AWS runs the orchestration loop. Most teams start on Harness and export to Runtime when they need custom orchestration.
Can I switch models mid-session?
- Yes. AgentCore Harness is decoupled from the model. You can plan with one model, execute code with another, and summarize with a third in the same session, without losing context. The model becomes a per-call field, not a session-level commitment.
How is AgentCore Harness priced?
- There is no separate charge for the harness itself. You pay only for the underlying AgentCore primitives you use, including runtime, memory, gateway, browser, code interpreter, and observability. Each primitive bills independently, and Runtime charges by CPU and memory per second, so idle and I/O wait time is free.
What is the lock-in risk with AgentCore Harness?
- The model layer is portable across providers. The memory, gateway, skills catalog, identity vault, and observability are AWS-managed services. A single CLI command exports a harness to Strands code, so you can leave, but the exported agent still runs on the same AWS computer and primitives.
Is AgentCore Harness secure enough for regulated workloads?
- Yes. Every session runs in an isolated Firecracker microVM, and identity is gated by IAM and OAuth. Bedrock Guardrails integrates at the gateway layer and evaluates every agent action for prompt injection, harmful content, and sensitive data exposure, outside the agent's context, where it cannot reason around them.