The harness is part of the model
We ran the same models under different agent harnesses against one corpus and one verifier. The wrapper moved the score by as much as the model choice did.
A model does not repair a vulnerability on its own. It runs inside a harness that decides what it sees, how many turns it gets, whether it can run the build, and what happens when a command fails. Benchmarks usually name the model and treat the harness as plumbing. Our corpus lets us hold everything else fixed and vary only the wrapper.
What we measured
5 models in this run appear under more than one harness. Every one of them scores differently depending on the wrapper, and the gaps are not rounding. The widest is claude-opus-4-6, which repairs 61.6% of the corpus under claude and 47.5% under opencode — a gap of 14.1 points from changing nothing but the runner.
The narrowest pair we have, gemini-3.1-pro-preview, still moves 3.8 points between gemini31 and opencode. There is no pairing in this run where the harness is free.
Why it matters for how you read any leaderboard
The gaps here are the same size as the gaps between adjacent models on the headline board. If you compare two models that were run under different harnesses, you are reading the sum of two effects and attributing it to one. That is why every row on our benchmark names the harness alongside the model, and why we do not publish a model-only ranking.
It also suggests where cheap capability is available. A team that already pays for a strong model may recover several points by changing how it is run, at no additional inference cost — which is a different purchasing decision from upgrading the model.
What this does not show
We did not isolate why a harness helps: turn budget, tool access, retry policy and context management all differ between them, and this run cannot separate those. We also compare only the harness-model pairings that exist in this corpus, so a model appearing under a single harness contributes nothing here. And these are repair-stage results: a harness that helps a model fix code may not help it find a weakness in the first place.
The companion note, a quarter of repairs never compiled, shows one concrete mechanism behind part of this gap.
Every figure above is read from the published manifest for corpus cve-bench-136, run February 2026 — 1,864 scored attempts by 15 agent configurations. See the benchmark or pull /benchmarks.json.