Agent runtimes are becoming the product (2026)

The agent runtime is becoming the product

Microsoft has released a stable, batteries-included agent harness for Python and .NET. GitHub is measuring Copilot adoption by how deeply teams use agent features, not just by who has a license. Forcepoint has launched a data-security platform with an agent gateway, while Outtake describes a cyber investigator that runs for hours with code execution, a filesystem, and automated evals. Anthropic's latest Claude Code tutorial turns manual checks into reusable verification loops.

The common thread is practical: the model is increasingly the replaceable part. The runtime, permissions, state, telemetry, and evaluation policy determine whether an agent can be trusted with a real workflow.

Microsoft packages the missing middle layer

Microsoft's Agent Framework Harness release wraps a chat client in a complete agent pipeline. The same release supports Python and .NET and includes function invocation, a configurable iteration limit, per-service-call history persistence, context compaction, todo and plan/execute tracking, file memory, skills, optional web search, tool approval, and OpenTelemetry. 1

That is a meaningful change in the abstraction boundary. A developer supplies a model client, instructions, and tools; the harness supplies the recurring machinery that tends to become an internal platform project: keeping history after each call, preventing context overflow, recording work in a todo list, and deciding when a tool call needs approval.

The release is useful for teams that want a common baseline across Python and .NET. It also comes with a clear adoption limit. Background agents, file access, automatic looping, and shell tooling are opt-in features that Microsoft says are still coming, with warnings when users enable them. The current harness is therefore a packaged runtime, not a declaration that every high-risk capability is production-ready.

A sensible first evaluation is to compare the default harness with the runtime you already operate on four tasks: a tool failure, a long context, an approval refusal, and a crashed process. The questions are concrete: can the run resume from the last service call, can an operator see what was approved, and can the agent stop at a bounded iteration count?

GitHub turns adoption into an operating metric

GitHub's new Copilot metrics impact dashboard groups engaged users into four segments: Phase 1 code-first, Phase 2 agent-first, Phase 3 multi-agent or Copilot app, and Passive users who are licensed but not engaged. Each cohort card shows users, share of users, average pull requests merged per user per month, median pull-request merge velocity, and average lines of code per day per user. The dashboard also compares engaged users with the passive cohort and charts cohort growth and pull-request throughput across six months. 2

The cohort assignment uses a rolling 28-day window. That makes the dashboard useful as an adoption and enablement instrument: an engineering organization can see whether teams are moving from completion assistance toward agent workflows, then target training or access changes at the passive segment.

It does not prove that deeper Copilot use caused faster delivery. The dashboard's measures are activity and throughput proxies, and the cohort labels are GitHub's own classification. Teams should pair them with escaped-defect rate, review rework, incident load, and the share of changes that still meet local quality gates. A rise in lines of code per day can coexist with more code to maintain.

The investor and founder read is similar. Agent adoption is becoming legible as a funnel, but the valuable question is not whether users moved into Phase 3. It is whether the additional autonomy produces verified business outcomes at an acceptable cost.

Data security is moving into the agent path

Forcepoint's July 22 AI Data Security launch combines oversight and protection for autonomous agents, sanctioned AI applications, and shadow AI. Its announced AI Agent Gateway applies least-privilege, field-level protection when agents access systems such as Salesforce, Microsoft 365, and Jira, with the stated goal of preventing agents from holding direct application credentials. The platform also includes identity attribution, inline prompt and response controls, AI data-loss prevention, and a unified dashboard for agents and AI applications. 3

The product direction matters more than the category label. If an agent can retrieve a record, summarize it, and update a system, data policy has to follow the specific fields and action path rather than stop at the model endpoint. The useful design test is whether the gateway can answer three questions for every consequential call: which human or agent identity initiated it, which fields were exposed, and which policy allowed the action.

Forcepoint says policy management can fall by up to 90% and operating costs by 31% for its customers. Those are vendor-reported figures, and the announcement says the agentic gateway and shadow-AI controls will roll out over the next quarter. Treat them as a product claim to validate in a controlled deployment, not as a general benchmark.

Outtake shows what a long-running agent needs

Outtake's Recon Agent investigates the infrastructure behind an impersonation rather than stopping at a cloned login page. It can classify evidence, follow links to connected infrastructure such as a fake Telegram support account, map the adversarial network as a graph, and produce a report with an investigation trail, threat-actor profile, and reconstructed timeline. The agent can read, write, and run code, and can interact with malicious login pages to determine where credentials are sent. 4

The sessions are long by software-agent standards: a median of 16 minutes, often an hour or more, with a reported maximum of two hours. Outtake first prototyped in Claude Code, then moved to the Claude Agent SDK to gain lower-level control over memory, context, and files. It runs a multi-scenario eval suite, and a separate coding agent can turn a missing capability identified by an investigation into a new tool and test scenario. The company describes this as a way to remove manual review from the middle of the iteration loop, leaving a human to judge the final result. 4

The strongest implementation detail is the division of labor. Outtake hardcodes the steps that must happen for every investigation at the orchestration layer, but leaves low-level judgment open to improvisation. It also assumes prompt injection may succeed, then uses a sandbox or "blastbox" and a checkpoint at the internet boundary to inspect whether the next page is an impersonation, malware, or an injection attempt.

This is a customer case study, not an independent security audit. Its transferable pattern is still clear: long-running agents need a harness that preserves state, a threat boundary around powerful tools, and an eval that runs faster than a human can read every transcript.

Turn manual checks into agent infrastructure

Anthropic's verification-loop tutorial for Claude Code gives builders a small, reusable implementation pattern. A manual check becomes a skill in .claude/skills/, with a plain-English procedure, the tools it may use, and a condition for when it applies. The check can run standalone, inside the producing skill, in a chain, or on every pull request. 5

The example is intentionally mundane: reject a database migration that drops a column without a backfill, or verify that an error log includes a request ID and excludes request payloads. That is exactly why the pattern is useful. These rules are specific to a codebase and often invisible to a generic linter.

For a team building any agent runtime, the migration path is short:

Write down the manual follow-up that recurs after a task.
Express the check as a deterministic rule or a scored rubric.
Run it after the artifact exists, then move it into the producing workflow once the result is stable.
Record failures and rework as first-class telemetry instead of hiding them in the final response.

What to prioritize

Building a platform: start with Microsoft’s harness if Python/.NET parity, compaction, approvals, and OpenTelemetry are more valuable than assembling those pieces yourself. Test the opt-in features separately.
Measuring rollout: use GitHub's cohorts as adoption telemetry, then add quality and business-outcome measures before treating higher agent usage as productivity.
Protecting enterprise data: evaluate whether an agent gateway enforces field-level policy and identity attribution at the tool boundary, not only at the model API.
Deploying a long-running specialist: copy Outtake's sequence: define what good looks like, prototype quickly, graduate to lower-level runtime controls, automate evals, and contain internet-facing tools.

The current product race is therefore less about who can call a model and more about who can package the surrounding decisions. A model can generate the next step. The runtime decides whether that step is bounded, observable, reversible, and allowed.

Agent runtimes are becoming the product