AI Research: Prompt Fragility, Harness Bias, Agent Locks

Three papers landed this week that all chip away at the same uncomfortable idea: the numbers we use to judge AI systems measure less than we think. One shows LLMs quietly flip answers when you rephrase the question. Another shows a coding agent's benchmark score depends more on the harness wrapped around it than the model inside it. The third comes from production, not a lab, and describes what it actually takes to let AI agents touch critical infrastructure without anyone regretting it.

Same Question, Different Answers: Evaluating LLM Reliability Beyond Accuracy

Researchers Kazem Faghih, Yize Cheng, Shoumik Saha, Mobina Pournemat, Armin Gerami, and Soheil Feizi set out to test something most benchmark reports never check: what happens when you ask a model the exact same question twice, worded differently but meaning the same thing.

Across four benchmarks spanning factual QA and math reasoning, tested on 13 models, they found that aggregate accuracy holds up fine under paraphrasing. It moves by a few points at most. Instance-level behavior tells a different story. For a large share of questions, the model gets it right under one phrasing and wrong under another, with mismatch rates exceeding 23%. Narrow the analysis to questions the model already answers correctly in their original form, and the flip rate gets worse, not better.

That second finding matters more than it sounds. A model passing a benchmark question once tells you almost nothing about whether it'll pass the same question phrased differently in production, where users never type the canonical wording researchers used to build the eval set.

There's a silver lining buried in the data. Models frequently produce a correct answer for at least one paraphrase of a question, which means the right answer is sitting somewhere in the weights. It's just not reliably retrieved. The authors test a simple fix: have the model paraphrase its own prompt before answering, then aggregate across variants. This self-paraphrasing step recovers a meaningful chunk of that latent knowledge at inference time, no retraining needed.

For anyone building on top of frontier models, the takeaway is blunt. Single-prompt accuracy is a weak proxy for reliability. If your product depends on consistent answers to semantically similar user inputs (support bots, search assistants, anything customer-facing), you're better served by testing paraphrase stability directly than by trusting a benchmark leaderboard number.

A coding agent mid-task, asking whether to create a new file. How that interaction loop is built, not just which model powers it, turns out to swing benchmark scores dramatically. Source: unsplash.com

The Scaffold Effect in Coding Agents: Harness Choice as a Hidden Variable

Naman Vats and Oleg Golev looked at a different kind of instability, one baked into how we evaluate coding agents rather than how models answer questions.

Public leaderboards rank coding agents by model name and pass rate. The harness around the model, the code that issues tool calls, manages context, and decides when the agent has finished, is usually treated as an implementation detail. Vats and Golev treat it as the variable it actually is.

They ran Qwen 3.6 Plus and MiniMax M2.5 through three open-source harnesses (Goose, OpenCode, and OpenHands-SDK) on a stratified 50-task subset of Terminal-Bench Pro. Within-model pass-rate differences across harnesses stayed modest, 0 to 8 percentage points, with paired bootstrap confidence intervals mostly including zero. Token consumption told a completely different story: harness choice alone produced up to a 40x difference in tokens spent per solved task.

Each harness also failed in its own characteristic way, independent of which model was driving it. Goose's failures cluster around REASON timeouts. OpenHands-SDK trips on VERIFY and MAX_TURNS. OpenCode gets stuck in idle loops that eat the clock without producing output. The authors call this a "wait tax": turns where the agent burns budget without acting, which look identical to a slow model but are really a harness quirk.

"Harness choice induces up to a 40x difference in tokens per solved task, while paired within-model pass-rate differences remain 0-8 percentage points."

This lands with a related finding from Anthropic's own engineering team, who recently showed that infrastructure configuration alone, not harness or model, can swing Terminal-Bench 2.0 scores by several percentage points. Running the same Claude model and harness across six resource configurations on GKE produced a 6-point pass-rate gap, with 5.8% of tasks failing outright from transient memory spikes under the tightest resourcing. Together, the two papers point at the same blind spot from different angles: leaderboards report a number as if it belongs to the model, when it actually belongs to the model plus everything wrapped around it.

The practical fix the authors propose is unglamorous but correct: report token consumption and latency with pass rate, and specify the full harness stack, not just the model name, whenever a comparison is published. If you're choosing a coding agent stack for your own team, a model's spot on the Terminal-Bench leaderboard tells you less than the harness it was tested with.

Decentralized Granular Access Control for Agentic AI Systems in Critical Infrastructure

The third paper, from Arun Malik, Deepal Jayasinghe, Bradley Klemick, Prachi Shah, Nitish Talasu, and Vineet Tushar Trivedi, is the rare AI security paper that reports on a live production system instead of a lab prototype.

Their starting premise: role-based access control, the standard model for deciding what a piece of software is allowed to touch, assumes deterministic behavior. AI agents don't behave deterministically, which means RBAC's usual guarantees don't transfer. The paper's report number (MSFT-AZURE-NET-2026-03) points to Microsoft Azure, though the authors don't name the cloud provider directly in the abstract.

The architecture rests on four pieces:

1. A compound identity model that ties every agent action back to a specific human's delegated authority, so nothing an agent does is untraceable to a person
2. A five-level permission hierarchy, running from global platform access down to per-parameter constraints on individual API calls
3. Decentralized policy ownership, where each tool team sets and enforces its own authorization boundaries instead of a central team owning every rule
4. Progressive trust escalation with safety interlocks that block autonomous agents from executing high-risk operations without an extra checkpoint

The design is explicitly grounded in the OWASP Top 10 for LLM Applications (2025) threat taxonomy, and the authors walk through how each architectural choice maps to a specific category in that list, Excessive Agency chief among them.

The results are the actual news here. Deployed against network infrastructure spanning hundreds of datacenters, the system has governed 20+ specialized AI agents and 60+ deterministic playbooks processing thousands of operations a day, with zero unauthorized write operations over eight months of production use.

Layered, granular access control, the physical-world version of what this paper builds for AI agents touching production infrastructure. Source: unsplash.com

Eight months and zero unauthorized writes is a genuinely strong result, and it's worth reading against recent industry incidents involving agent credentials and identity, the kind of gap Cisco paid $400 million to acquire Astrix Security to help close. What the paper doesn't fully resolve is how much of that record comes from the architecture itself versus the narrow, well-scoped task domain (network operations playbooks) the agents were confined to. Granular access control is necessary infrastructure for agentic AI in production. It's not yet clear how the same four-part design holds up once agents are given more open-ended goals instead of a fixed playbook library.

The common thread

Line these three papers up and a pattern appears that has nothing to do with any single model release. Accuracy numbers, benchmark leaderboards, and access-control claims all describe a system under one specific set of conditions, and all three papers show how badly that description degrades once conditions shift by even a small amount. Rephrase the question and accuracy claims wobble. Swap the harness and the leaderboard position moves without the model changing at all. Widen the scope of what an agent is allowed to do and the safety story that held for eight months of narrow operations is untested territory.

None of this argues against rolling out LLMs or agents. It argues against reading a single number, whether it's a benchmark score or an uptime record, as if it transfers cleanly to a different phrasing, a different harness, or a different task scope than the one it was measured under.

Sources:

• Same Question, Different Answers: Evaluating LLM Reliability Beyond Accuracy
• The Scaffold Effect in Coding Agents: Harness Choice as a Hidden Variable in Coding-Agent Evaluation
• Decentralized Granular Access Control for Agentic AI Systems in Critical Infrastructure
• Anthropic: Quantifying infrastructure noise in agentic coding evals
• OWASP Top 10 for LLM Applications (2025)
• Terminal-Bench