Ask what an AI agent can touch, not only what it can write

Theo, host of the t3.gg show, argued in an episode called Are Harnesses Dead? that an AI agent is more than a model. It is a model plus a harness, the software that gives the model its tools.

What was said

Theo started from a plain fact. "All an LLM can do is make text." A large language model takes text in and produces more text. It cannot touch anything else.

The harness changes that. Theo described it as almost misleadingly simple. It tells the model about a special syntax. If the model replies in that syntax, the harness will read a file, edit a file, push code to GitHub, run a command, or access memory. He added that it could also run up a large bill on some paid service.

He used a kitchen to make the point. A chef in an empty kitchen can describe a meal but cannot cook it. Tools in the kitchen are what let the chef act. Then he defined the word at the centre of the debate: "An agent is a combo of a harness and an LLM."

Harnesses differ in how much they hand over. Theo said one called Pi has almost no tools, basically just a command line. Claude Code and the Claude Agent SDK come with many more. A plugin could add computer-control tools such as screenshot, click and type. These would let an agent trigger things on your computer.

Why it matters

Our reading: the usual question is whether the model can be trusted to write the right words. Theo's account suggests a better one. What can the harness do with those words?

Two agents on the same model can have very different reach. One may only read files. Another may run commands, publish code or control a screen. Adding a tool, in his image, is putting something in the kitchen.

For people who build or buy agent software, that points to concrete questions. Which tools does the harness include? Which plugins are installed? What can each one change, and what can it cost? Those answers describe the exposure more directly than the model's name does.

The other side

Theo was explaining a definition, not setting out a safety method. In the excerpts he did not say how permissions should be limited or checked. He did not claim that tools are the only source of risk.

He also described a softer kind of access. Outside information arrives through MCP, a way of connecting an agent to outside data, which he likened to a cookbook left in the kitchen. The model may read it or ignore it. The excerpts do not say what stops a model from acting on that material in harmful ways.

Theo also has a stake. He talked about his own product, T3 Code, and the episode was sponsored by Vercel. Near the end, a speaker on the show said, "If I do have to talk about harnesses again, chances are it's cuz somebody really screwed something up." That hints at failures, but the excerpts give no examples.