# Coding agent harnesses

AA-Robotics v0.1 puts frontier language models inside coding agent harnesses and gives them direct control of a 6-axis robot arm (5 joints and a gripper) across eight tabletop tasks scored out of 100. Where direct arm control previously lacked a common comparison, five models now run the same zero-shot task set: GPT-6 Astra leads at 69.4, GPT-6.1 Sol scores 64.6, Gemini 4 Argon 55.3, Claude Opus 5.5 48.8 and Claude Fable 5.1 46.3. Models average about 30 minutes per task, roughly 100 times slower than the human baseline, while cost ranges from $1.93 per task for GPT-6.1 Sol to $16.36 for GPT-6 Astra.

AA-Robotics v0.1 puts frontier language models inside coding agent harnesses and gives them direct control of a 6-axis robot arm (5 joints and a gripper) across eight tabletop tasks scored out of 100. Where direct arm control previously lacked a common comparison, five models now run the same zero-shot task set: GPT-6 Astra leads at 69.4, GPT-6.1 Sol scores 64.6, Gemini 4 Argon 55.3, Claude Opus 5.5 48.8 and Claude Fable 5.1 46.3. Models average about 30 minutes per task, roughly 100 times slower than the human baseline, while cost ranges from $1.93 per task for GPT-6.1 Sol to $16.36 for GPT-6 Astra.

The work builds a ten-mechanism taxonomy across 40 coding agent harnesses and rates 400 harness–mechanism cells (205 confirmed implemented, 83 confirmed absent, 112 unresolved), then introduces HarnessSecurity-Bench, which runs 2,500 trials under GLM-5.2 on 23 tasks across five attack surfaces with separate deterministic oracles for six harnesses, finding that enabling auto-approve raises attack success from 29.2% to 95.6%, that network isolation and read-only mode cut attack success from 57.1% and 8.3% to 0.8% at utility losses of 24.5 and 34.0 percentage points, and that command allowlisting and denylisting reduce attack effects with a small utility loss and a utility gain respectively.

The work builds a ten-mechanism taxonomy across 40 coding agent harnesses and rates 400 harness–mechanism cells (205 confirmed implemented, 83 confirmed absent, 112 unresolved), then introduces HarnessSecurity-Bench, which runs 2,500 trials under GLM-5.2 on 23 tasks across five attack surfaces with separate deterministic oracles for six harnesses, finding that enabling auto-approve raises attack success from 29.2% to 95.6%, that network isolation and read-only mode cut attack success from 57.1% and 8.3% to 0.8% at utility losses of 24.5 and 34.0 percentage points, and that command allowlisting and denylisting reduce attack effects with a small utility loss and a utility gain respectively.