DEV Community: Agrawal

The 7 Ways AI Agents Fail in Production — And How to Catch Them

Agrawal — Sun, 28 Jun 2026 08:01:31 +0000

Every agent failure follows a pattern. Once you know the patterns, you can catch them before they do damage.

I introduced harness engineering yesterday — the discipline of building a safety and reliability layer around AI agents. Today I want to get concrete. These are the seven failure modes every team hits when they run agents in production, how to detect each one, and what to do when you catch it.

1. The Infinite Loop

What it looks like: The agent calls grep with the same pattern six times, gets identical results each time, and never acts on any of them. It's "gathering context." Each call burns tokens. The context window fills. Eventually the session times out or produces garbage.

Why tools miss it: Observability dashboards show six grep calls. They look productive. Orchestration frameworks execute each call faithfully. No error fires. The session is "still running" until it isn't.

Detection: Don't count identical calls. Track information gain — did this call produce new data that led to forward progress? A file write, a test pass, a decision, a state change? If the same tool with the same inputs produces the same outputs four times in a row with no downstream action, it's a loop.

Fix: Mild loops get a nudge — a message injected into the agent's context suggesting it move on or produce output. Severe loops (accelerating token burn, no progress for 8+ turns) get a circuit-break: session paused, checkpoint saved, human notified with full trace.

2. Silent Context Death

What it looks like: The agent reads files throughout the session. By turn 8, the context is at 85%. By turn 10, the agent has forgotten what it read at turn 3. It re-reads those files, filling context further. Output quality degrades without any error being raised.

Why tools miss it: There's no failure event. The agent is producing output — it's just getting worse. No monitoring tool tracks output quality relative to context pressure. This is a silent decline, not a crash.

Detection: Track context pressure as a percentage of the window. Track information density — what fraction of context is recent, actionable, and relevant versus stale, redundant, or dead. Track file re-reads without intervening modifications. When stale fraction crosses a threshold while pressure is high, the session is degrading.

Fix: Trigger context compression. Four layers: preserve recent tool outputs, summarize older context, drop redundant file reads, keep the current task and reasoning chain intact. The agent never notices the compression. Quality stays consistent.

3. The Cost Spike

What it looks like: Two flavors. Runaway cost: a simple refactoring burns $12 in tokens because the agent went down an investigation rabbit hole. Model mismatch: a complex architectural change gets routed to a cheap model that produces garbage — and the rework costs more than using the right model upfront.

Why tools miss it: Observability shows cost after the fact. Gateways route to the cheapest available model by default. Neither checks whether the task complexity matches the model capability.

Detection: Track cost as a moving average per task type, per model, per agent. Fire when cost exceeds 3× the moving average. Separately, classify task complexity and check model suitability before routing. Track the second derivative — accelerating cost is more dangerous than steady high cost.

Fix: For runaway cost: nudge the agent to produce output or compact context. For model mismatch: escalate to a more capable model mid-session. If cost is accelerating with no sign of completion, pause and notify a human.

4. The Secret Leak

What it looks like: The agent reads .env or a config file. Echoes contents into a response. An API key, database password, or JWT secret now sits in a log file, chat history, or Slack thread.

Why tools miss it: Guardrails check for PII and toxicity. An API key is neither — it's just a string. SAST scans code before commit. This is runtime behavior: the agent moving information from a protected source to an unprotected sink.

Detection: Run detection in the output path — between the agent producing content and that content reaching any external system. Combine regex patterns (AWS key formats, JWT structures, generic high-entropy strings) with entropy analysis. Check against known safe patterns to reduce false positives.

Fix: Block the output before it escapes. Write an immutable audit record. Notify security with the full trace: what secret was about to leak, which agent produced it, what file it read the secret from, the chain of actions leading to the leak. This is a circuit-break scenario — no nudge, no warning, immediate intervention.

5. The Multi-Agent Deadlock

What it looks like: Agent A waits for Agent B. Agent B waits for Agent A. Neither can proceed. The orchestrator faithfully waits for each to produce output. Ten minutes pass. Sessions time out. Work is lost.

Why tools miss it: The orchestrator sees two active sessions awaiting output. The observability tool sees no errors. Everything looks normal — just slow. Multi-agent systems multiply failure modes: deadlocks, redundant outputs, conversation stalls.

Detection: Track inter-agent dependency chains. When two or more agents have been waiting on each other for more than 60 seconds, it's a deadlock. Separately, detect when multiple agents produce identical outputs (variety collapse) or when no agent has produced a message in 45 seconds (conversation stall).

Fix: Inject a strong message into all waiting agents' contexts to break the cycle. If that fails within 30 seconds, circuit-break: save checkpoints, stop agents, notify human. For variety collapse, inject diversity signals that force different approaches.

6. Goal Drift

What it looks like: The agent starts with "refactor the auth module to use JWT tokens." By turn 8, it's editing the payment module. By turn 12, it's rewriting the database schema. Each step was logical in isolation. The aggregate has diverged completely. No error was raised. The code it wrote is valid. It's just not the code anyone asked for.

Why tools miss it: This isn't hallucination — the agent isn't inventing things. It's following a chain of reasoning that led somewhere unintended. Output is valid code. Guardrails see nothing wrong. The orchestrator executed each step correctly.

Detection: Compare the agent's current actions against the original task using semantic similarity. When the distance crosses a calibrated threshold, it's drift. This is the hardest detection problem because drift is subjective — what looks like drift might be a necessary detour. The threshold must learn from overrides.

Fix: Nudge the agent back toward the original goal with a context injection. If drift persists, pause for human review. Every override feeds back into the detection threshold.

7. The Improvement Gap

What it looks like: Every failure teaches a lesson — and that lesson stays in a human's head, a Slack thread, or a post-mortem doc. It doesn't make it back into the system. The loop detector that was too slow last week is still too slow this week. The staleness threshold that was too generous last month is still too generous. After 100 sessions, you've learned a lot. Your harness hasn't learned anything.

Why tools miss it: Detection thresholds are static configuration. Nobody updates them between incidents. The feedback loop from failure to rule improvement is entirely human, and humans are busy.

Detection: This is the meta-problem — the failure of the failure-detection system itself. Mine session audit trails. Cluster failures by type. Identify which detectors fired too late or not at all.

Fix: Automate the improvement cycle. Mine weaknesses → propose targeted rule edits → validate against regression tests → apply only if outcomes improve without regressions. The meta-harness runs across sessions, continuously. Research from Shanghai AI Lab (arXiv:2606.09498) validated 33-60% pass rate improvement across six model families with zero human intervention. This isn't theoretical.

The Common Thread

Look at these seven failures again. In every case:

The agent didn't crash
No error was raised
The orchestrator executed faithfully
The observability dashboard showed nothing unusual until after the damage was done

That's why harness engineering exists. It's the layer that sits between orchestration and observability, watches behavior in real time, and asks the question neither asks: is this agent behaving correctly, right now?

The tools to catch these seven failures exist. The principles to build them are known. The only question is whether your agents have a harness yet.

I have taken the reference from :

https://checkgenai.com/

https://github.com/jalajagrawalgenai/HarnessForge

Harness Engineering: The Missing Discipline in AI Agent Development

Agrawal — Fri, 26 Jun 2026 08:55:17 +0000

Every agent framework teaches you how to build an agent. None teach you how to keep one alive in production. That gap has a name now.

In 2024, we learned to build AI agents. In 2025, we learned to orchestrate them. In 2026, we're learning something harder: they fail in ways no traditional software fails, and none of our existing tools can stop them.

This isn't a tooling problem. It's a discipline gap. We have frontend engineering, backend engineering, platform engineering, reliability engineering, security engineering — each with its own principles, patterns, and tools. But when an AI agent runs in production, who owns the fact that it's stuck in a loop? Who owns the fact that it just echoed an API key into a log file? Who owns the fact that it's been re-reading the same file for 12 turns while the context window fills up?

Nobody does. Because the discipline that answers those questions doesn't have a name yet.

It does now. Harness engineering.

Where It Fits

The AI engineering stack has four established layers. Each does something specific. Each has a blind spot.

Observability tools — LangFuse, LangSmith, Phoenix, Braintrust. They record traces. They show you dashboards. They fire alerts. Everything they tell you happened in the past. The loop already burned $200 in tokens. The secret already leaked. The deadlock already timed out.

Orchestration frameworks — LangGraph, CrewAI, OpenAI Agents SDK, Google ADK. They define and execute agent logic. Nodes, edges, handoffs, roles. They execute faithfully. Even when the logic is wrong. Even when the agent is hallucinating. The framework doesn't know productive work from a failure mode.

Gateways — LiteLLM, Portkey, OpenRouter. They route requests across models, manage keys, handle fallbacks, apply rate limits. They see API calls. They don't see agent behavior.

Guardrails — Guardrails AI, NeMo, Microsoft Agent Governance Toolkit. They validate outputs. PII detection, toxicity filtering, jailbreak prevention. They check content. They don't understand context — why the agent produced that output, whether it's drifting from its goal, whether this is the fourth identical response in a row.

Every layer watches. Every layer reports. Some layers block. None of them understand what the agent is doing.

Harness engineering is the discipline of building the layer that does. It sits across the stack — pulling events from the agent, context from the orchestrator, cost data from the gateway, safety signals from the guardrails — and it asks a question none of them ask: is this agent behaving correctly, right now?

The Seven Challenges

Every team running AI agents in production hits these. Usually within the first month. Usually without realizing how many of them are happening silently.

Challenge 1: Agent Loops

The agent calls the same tool repeatedly with no forward progress. A grep that returns identical results six times. A file read that fetches the same content again and again. Each call burns tokens. Each turn inches closer to the context limit.

What makes loops hard: they look like productive investigation for the first few iterations. The agent is "gathering context." At what point does context-gathering become a loop? That threshold varies by task, by agent, by model. A fixed counter — "stop after 4 identical calls" — generates too many false positives on one end and catches loops too late on the other.

The general approach: track whether each successive tool call produces new information that leads to forward progress — a file write, a test pass, a decision. When repeated calls produce neither, intervene. Light loops get a context nudge. Severe loops get a session pause with human notification.

Challenge 2: Silent Context Degradation

The agent's context window fills up incrementally. One file read. Another. A grep result. A tool output. By turn 10, it's at 85% capacity. The agent starts forgetting things from earlier in the conversation. Its responses degrade. It re-reads files it already saw because it forgot them. The degradation accelerates.

There is no error here. The session is running. The agent is producing output. It's just producing worse output, gradually, and nobody knows what "good" would have looked like for comparison.

The general approach: track not just total token count but information density — how much of the context is recent, relevant, and actionable versus stale, redundant, or dead. When stale fraction crosses a threshold, compress: preserve recent outputs, summarize older context, drop redundant reads, keep the current task and reasoning chain intact. The agent never notices the compression. The quality stays consistent.

Challenge 3: Cost Anomalies

Two flavors. Runaway cost: a simple task somehow burns $12 in API calls because the agent went down an investigation rabbit hole. Model mismatch: a complex architectural change gets routed to a cheap model that produces 30 minutes of garbage — costing more in rework than the expensive model would have cost upfront.

Observability dashboards show you the spike tomorrow morning. The money is already spent.

The general approach: track cost as a moving average per task type, per model, per agent. Detect when cost exceeds a multiple of the baseline. Detect when a task's complexity doesn't match the model's capability. Intervention ranges from nudging the agent to produce output, to switching models mid-session, to pausing and notifying a human when the second derivative of cost is accelerating.

Challenge 4: Security Leaks

The agent reads a .env file. Echoes the contents into a response. An API key, a database password, a JWT secret — now sitting in a log file, a chat history, maybe a Slack thread. No guardrail caught it because it wasn't toxic or PII. It was just characters that happened to be a secret.

Traditional SAST scans code before commit. Guardrails scan outputs for known patterns. But an agent that reads secrets from one file and writes them into another — that's a behavioral pattern, not a static vulnerability.

The general approach: run secret detection in the output path — between the agent producing content and that content reaching any external system. Combine regex patterns with entropy analysis. When a secret is detected, block the output before it escapes. Write an immutable audit record. Notify security with the full trace: what secret was about to leak, which agent produced it, what file it read the secret from, the complete chain of actions leading to the leak.

Challenge 5: Multi-Agent Deadlocks

Agent A waits for Agent B. Agent B waits for Agent A. Neither can proceed. The orchestrator doesn't know — it's faithfully waiting for each to produce output. The observability tool shows two active sessions with no events. Ten minutes pass. Both sessions time out. Work is lost.

Multi-agent systems multiply failure modes. A single agent can loop. Two can deadlock. Three can produce identical redundant outputs because they converged on the same approach. The more agents, the more ways things fail — and the less likely any individual failure is to be noticed.

The general approach: track inter-agent dependency chains. Detect when two or more agents have been waiting on each other beyond a timeout. Inject a strong signal into all waiting agents' contexts to break the cycle. If that fails, save checkpoints, stop the agents, notify a human. For redundant output across agents, inject diversity signals that force exploration of different approaches.

Challenge 6: Goal Drift

The agent starts with "refactor the auth module to use JWT tokens." By turn 8 it's editing the payment module. By turn 12 it's rewriting the database schema. Each individual step seemed logical. The aggregate has diverged completely from the original task.

This is different from hallucination. The agent isn't inventing things — it's following a chain of reasoning that led somewhere unintended. No error is raised. The output is valid code. It's just not the code anyone asked for.

The general approach: compare the agent's current actions against the original task description using semantic similarity. When the distance crosses a calibrated threshold, nudge the agent back toward the goal. If drift persists, pause for human review. Every override — human or automated — feeds back into the detection threshold so it gets better over time.

Challenge 7: The Improvement Gap

Every failure teaches you something. That lesson stays in your head, a post-mortem doc, a Slack thread. It doesn't make it back into the system. The loop detector that was too slow last week is still too slow this week. The staleness threshold that was too generous last month is still too generous this month.

After 100 sessions, you've learned a lot. Your harness hasn't learned anything.

The general approach: mine session audit trails for weakness patterns. Cluster failures by type. For each high-priority weakness, generate a minimal, targeted rule change. Validate it against a regression suite. Apply only if it improves outcomes without causing regressions. Run this cycle continuously, across sessions, without requiring a human to manually adjust thresholds.

Research from Shanghai AI Lab (arXiv:2606.09498, June 2026) validated that self-improving harnesses achieve 33–60% pass rate improvement across six model families — Claude, GPT, Gemini, MiniMax, Qwen, and GLM — without any human intervention. The improvement gap is real. Closing it autonomously works.

The Seven Principles

These aren't tied to any tool. They're what I've learned building in this space, and they apply regardless of how you implement your harness.

Principle 1: Observe Before You Detect

You can't detect what you can't see. A harness needs real-time visibility into every relevant dimension of agent behavior — tokens, latency, cost, accuracy, security, context quality, reliability, compliance. If your observability only covers three dimensions, your detection is blind to the other seven. Instrument broadly. Filter later.

Principle 2: Detect Before You Act

Intervention without detection is guessing. Detection without observation is blind. The pipeline runs observe → detect → strategize → act → audit, in that order. Skip a step and you're either reacting to noise or intervening too late to matter.

Principle 3: Choose the Lightest Intervention That Works

Every harness should have an escalation ladder. A nudge — injecting a hint into the agent's context — is the lightest touch. A circuit-break — emergency stop of all agents — is the heaviest. Always try the lightest strategy that matches the detection's severity. You don't kill an agent because it read the same file twice. You don't send a gentle reminder when an API key is about to leak.

Principle 4: Every Action Leaves a Trail

When a harness intervenes, record: what was detected, what strategy was chosen, what action was taken, what the outcome was, and the full context at the moment of intervention. Make it immutable — hash-chained, replayable, exportable. When something goes wrong, the trail is the difference between "something happened" and "here's exactly what, when, and why."

Principle 5: The Harness Must Improve Itself

A harness with fixed rules gets worse every day — because your agents change, your tasks change, your failure modes change. The only harness that stays effective learns from every session and rewrites its own rules. If a human has to manually adjust thresholds after every incident, the harness isn't doing its job.

Principle 6: Performance Is a Safety Property

If your harness adds 200 milliseconds of latency to every agent action, developers will route around it. They'll disable it. It becomes shelfware. A harness in the critical path must be fast enough to be invisible. Sub-millisecond detection and intervention isn't an optimization — it's a prerequisite for adoption.

Principle 7: The Harness Is Agent-Agnostic

The harness doesn't care whether the agent is Claude, GPT, Gemini, or a local model. It doesn't care whether the orchestration is LangGraph, CrewAI, or a hand-rolled state machine. It sees events — tool calls, outputs, errors, completions — and operates on those events regardless of their source. One harness across the entire fleet.

The State of the Art

Harness engineering as a named discipline is new, but the work is already happening. A few projects are building pieces of this layer, each taking a different slice of the problem.

The Observability & Policy Layer

The first question a harness answers is: what happened, and did it follow the rules? This is multi-agent observability with a governance layer on top — not just traces and dashboards, but security review and policy enforcement.

CheckGenAI (checkgenai.com) connects to multiple coding agents — Claude Code, Cursor, Copilot, Aider, Cline — through lightweight hooks that stream every session event to a unified dashboard. It parses transcripts for token and model analytics (giving you real cost attribution by agent, model, skill, and task), runs AI-specific security reviews on agent-generated code, and lets teams configure security policies that apply across their entire agent fleet. It's the answer to: which agents are my team using, what are they costing, is the code secure, and are we following our own rules?

Where LangFuse and LangSmith focus on LLM traces for applications you build yourself, CheckGenAI focuses on the coding agents your team already uses — giving you observability without requiring you to instrument anything.

The Active Runtime Layer

The second question a harness answers is: is something wrong right now, and can I stop it? This is real-time detection and intervention.

Microsoft Agent Governance Toolkit covers the full OWASP Agentic Top 10, focused on enterprise policy enforcement and agent action control — governing tool calls, identity, and sandboxing rather than just validating text outputs.

Future AGI Protect provides real-time guardrails and detection as a managed platform, part of their unified gateway-plus-observability stack.

HarnessForge (github.com/jalajagrawalgenai/HarnessForge) is an MIT-licensed Rust SDK that takes a different approach: wrap any agent with a single trait implementation, and it gets 12 health observers, 16 real-time detectors, 14 intervention strategies, and a meta-harness that learns from every session to improve its own rules. The detectors cover the full spectrum — loop detection, stale context, cost anomalies, deadlocks, hallucination, prompt injection, secret leaks, variety collapse, conversation stalls, goal drift, model mismatch, accuracy risk, runaway cost, resource exhaustion, output degradation, and compliance gaps. The intervention strategies form an escalation ladder from gentle nudges to emergency circuit-breaks. Being built in Rust matters here because the harness runs in the critical path — sub-millisecond detection is the difference between catching a secret leak before the API key reaches the output stream and catching it in the post-hoc audit. Python and TypeScript bindings are in progress via PyO3 and NAPI-RS.

What Comes Next

The AI agent ecosystem spent 2023 and 2024 building the execution layer — the models, the APIs, the basic tool-use patterns. 2025 added orchestration — graphs, crews, handoffs, multi-agent workflows. 2026 is the year the safety layer gets built. Harness engineering is the discipline that builds it.

Here's what I think happens:

Within 12 months: Every major agent framework adds basic harness features. They'll start with loop detection and context monitoring. They'll call it "agent reliability" or "production guardrails." They'll be building the observe → detect → act pipeline, even if they don't call it that.

Within 24 months: Harness engineering becomes a recognized discipline, the way site reliability engineering did a decade ago. Job descriptions will list it. Conferences will have tracks for it. The seven principles above will be debated, refined, or replaced with better ones — but the idea that someone needs to own agent safety in production will be non-controversial.

Within 36 months: You won't deploy an AI agent without a harness — the same way you don't deploy a service without monitoring, logging, and alerting today. The harness becomes part of the standard stack: an observability layer that shows you everything across your fleet, and a runtime layer that acts when something goes wrong.

The EU AI Act Article 15 — mandating human oversight for high-risk AI systems — comes into force in August 2026. That's the regulatory forcing function. But the practical forcing function is already here: agents fail every day in production, in ways that cost real money and create real risk.

The tools to stop them are being built. The discipline to wield them has a name. The rest is execution.

The AI Engineering Tools Landscape — Mid-2026

Agrawal — Thu, 25 Jun 2026 09:57:17 +0000

1. 🤖 Coding Agents

This layer has three tiers now. The gap between tier 1 and tier 2 is real, and tier 3 is growing fast.

Tier 1 — Dominant

These are the tools most professional developers use daily. The SWE-bench scores tell part of the story; the real picture is more nuanced.

Tool	Type	Price	SWE-bench	Best For
Claude Code	Terminal-native	$20–200/mo (Claude plans)	87.6% (Opus 4.7)	Terminal-first architectural refactors, 1M context window
Cursor	AI-native IDE (VS Code fork)	$20–200/mo	73.7% (Composer 2)	Best all-in-one agentic IDE, Background Agents (up to 8 parallel)
GitHub Copilot	IDE extension + Agent HQ	$10–39/mo	56%	GitHub-native teams, deepest enterprise governance
Windsurf	AI-native IDE (VS Code fork)	$15–200/mo	—	Value-conscious, Cascade agent, EU compliant / FedRAMP certified

What changed this year: Claude Code went from research preview to $2.5B+ run-rate. Cursor crossed 1M paid users. GitHub Copilot switched to credit-based billing (June 2026) and upset a lot of enterprise customers. Windsurf was acquired by Cognition, raising questions about its roadmap independence.

Tier 2 — Powerful & Open

These are the open-source tools that serious developers swear by. They trade polish for control.

Tool	Type	Price	Key Trait
Aider	Terminal CLI, Apache 2.0	Free + BYO key	Git-native — every edit is a commit. Pairs with any model. 88% SWE-bench with GPT-5.5 under the hood
Cline	VS Code extension, Apache 2.0	Free + BYO key	5M+ installs. Plan-and-act workflow, native MCP support, full control over every step
Continue	VS Code + JetBrains, Apache 2.0	Free + BYO key	20+ model providers including local Ollama. Best for offline/air-gapped setups
Kilo Code	VS Code + JetBrains + CLI, OSS	Free BYOK or $15/mo Teams	500+ models from 60+ providers. True model neutrality across IDEs

The trend here: BYOK (bring your own key) is standard now. Opaque SaaS-only subscriptions are dying. Developers want to own their model relationship and swap providers freely.

Tier 3 — Cloud Autonomous

These run in the cloud and operate on their own. Different value proposition entirely — you delegate, not pair-program.

Tool	Type	Price	Best For
Devin (Cognition)	Cloud autonomous agent	~$500/mo Team + ACU	Delegate large async backlog tasks, sandboxed VMs
Factory	Cloud enterprise agents	Enterprise	Enterprise code generation at scale
Bolt.new (StackBlitz)	Browser, instant full-stack	Free / $20–200/mo	Quick prototypes, full-stack apps from prompts
Lovable	Browser, visual builder	Free / $20–100/mo	Non-devs building web apps
v0 (Vercel)	Browser, UI-focused	Free / $20/mo	React/Next.js component generation
Replit Agent	Browser, full-stack	$25/mo	Students, hobbyists, fast iteration loops

2. 📊 Observability & Monitoring

This layer is fragmenting into three sub-categories: pure observability, gateway+observability convergence, and the legacy tools that are being left behind.

Core Players

Tool	License	Self-Host	Pricing Entry	Best For
LangFuse	MIT core	✅ Yes	Free → $29/mo → $199/mo → $2,499/mo enterprise	OSS observability with prompt management, 29K ★. ThoughtWorks "Assess" recommendation
LangSmith	Closed (MIT SDK)	Enterprise only	Free → $39/seat/mo	LangChain/LangGraph teams. Deepest graph topology capture
Arize Phoenix	ELv2 (source-available)	✅ Yes	Free → $50/mo AX Pro	OpenTelemetry/OpenInference native. Clean local dev workbench
Braintrust	Closed SaaS	❌	Free → $249/mo Pro	Best eval UI in the market. Polished, closed platform
Weights & Biases	Closed SaaS	❌	Free → enterprise	Experiment tracking + LLM evaluation. The ML default
Datadog LLM Obs	Closed SaaS	❌	APM-based	Existing Datadog shops that want LLM traces in the same dashboard

The key tension here: LangFuse vs LangSmith is becoming the main OSS-vs-closed debate. LangFuse wins on portability and self-hosting; LangSmith wins on LangChain ergonomics. Phoenix has the best OTel story but the ELv2 license is a procurement headache for some enterprises.

Gateway + Observability Convergence

A new pattern: tools that handle both routing AND tracing in one stack.

Tool	License	Key Trait
Future AGI traceAI	Apache 2.0	Full-stack: gateway + guardrails + evals + simulation. 14 span kinds, 50+ AI instrumentations
Portkey	MIT gateway, closed control plane	Acquired by Palo Alto for $140M (April 2026). 250+ models, governance features, now part of Prisma AIRS
LiteLLM	MIT	Most popular OSS proxy. 100+ providers, weighted fallbacks. Pairs with LangFuse or Braintrust for observability
OpenLLMetry	Apache 2.0	DIY OpenTelemetry pipeline. Backend-agnostic. Minimal UI

⚠️ Deprecated / Avoid for New Projects

Tool	Status
Helicone	Acquired by Mintlify (March 2026) → maintenance mode only. Still works, but no new features. Migration recommended
W&B Weave	Superseded by W&B's newer LLM eval platform
MLflow (LLM tracing)	Functional but not LLM-native. Better suited for traditional ML workflows

3. 🔗 Agent Orchestration Frameworks

This layer has seen the most dramatic change in 2026. One of the Big Three is effectively dead, and the provider-native SDKs are maturing fast.

The Big Three

Framework	Status (June 2026)	License	GitHub ★	Best For
LangGraph	✅ Active	MIT	~32K	Explicit state machines, time-travel debugging, human-in-the-loop checkpoints
CrewAI	✅ Active	MIT	~51K	Role-based crews (researcher, writer, critic). Fastest time-to-first-demo
AutoGen	❌ Maintenance mode	MIT + CC-BY-4.0	~58K	Do not start new projects. Last release v0.7.5 (September 2025). Migrate to MAF or AG2

What happened to AutoGen: Microsoft merged it into Microsoft Agent Framework (MAF) — a combined runtime with Semantic Kernel. Python + C# parity, durability, governance features. ~10K ★. The community fork lives on at AG2 (ag2.ai).

Provider-Native Agent SDKs

The cloud providers are building their own. These are getting good.

SDK	License	Languages	★	Best For
OpenAI Agents SDK	Apache 2.0	Python, TypeScript	~26K	Cleanest handoff model. Sandboxed execution with workspace snapshots. 3-tier guardrails
Google ADK	Apache 2.0	Python, TS, Java, Go, Kotlin	~20K	Widest language support. Native A2A protocol. Deploys to Vertex AI Agent Engine
Claude Agent SDK	MIT	Python, TypeScript	~7K	Deepest MCP integration (200+ servers). Built-in file/shell access. Safety-first architecture

Key trend: All three now support MCP. Google is pushing A2A for cross-vendor agent discovery. OpenAI has the best sandbox story. Anthropic has the deepest OS-level tools.

Rising / Niche Frameworks

Framework	Best For
PydanticAI	Type-safe structured outputs, Python-native. Built on Pydantic
DSPy (Stanford)	Programmatic prompt optimization. Compile prompts from signatures
Semantic Kernel (Microsoft)	Enterprise .NET/Python plugin architecture
LlamaIndex	RAG-first agents with data connectors
Vercel AI SDK	TypeScript streaming + tool use. Frontend-native
Mastra	TypeScript agent framework with built-in workflow engine
Agno (ex-Phidata)	Lightweight, memory-aware, multi-modal support
Bee Agent (IBM)	ReAct patterns, enterprise-grade tool use
Haystack (deepset)	NLP pipelines, RAG, agent nodes
Atomic Agents	Minimalist, modular — explicitly anti-framework
AG2	Community fork of AutoGen, keeping it alive

4. 🛡️ Gateway & Guardrails

Two distinct sub-layers that are increasingly being sold together.

LLM Gateways

Tool	License	Price	Key Feature
LiteLLM	MIT / BSL 1.1	Free OSS → $50/mo Cloud	100+ providers, weighted round-robin, fallback chains
Portkey	MIT / Closed CP	Free → $49/mo Prod	250+ LLMs, governance + guardrails + semantic caching. Now part of Palo Alto Prisma AIRS
Kong AI Gateway	Apache 2.0	Free OSS → Enterprise	Unified API mesh + AI gateway
Cloudflare AI Gateway	Closed	Pay-as-you-go	Zero ops, Cloudflare edge ecosystem
AWS Bedrock Gateway	AWS-managed	Pay-as-you-go	AWS-native, FedRAMP, HIPAA eligible
OpenRouter	Closed	Pay-per-token	300+ models, single API key, simplest setup

Supply chain alert: LiteLLM v1.82.7/1.82.8 on PyPI contained credential-stealing malware in March 2026 (TeamPCP attack). Live for ~3 hours. NHS issued a national alert. Official Docker images were unaffected. Pin versions and prefer Docker.

Guardrails / Safety

Tool	License	Key Feature
Guardrails AI	MIT	Output validation — PII, toxicity, custom validators. Pairs with any gateway
NeMo Guardrails (Nvidia)	Apache 2.0	Colang DSL for dialog rails. Topical guardrails, fact-checking
Microsoft Agent Governance Toolkit	—	Covers 10/10 OWASP Agentic Top 10 (gateways cover 0–1). Governs agent actions, not just LLM outputs
Barbacane	—	Security-first AI gateway with guardrail integration

Important architectural distinction from Microsoft's own docs: Guardrails validate LLM outputs. Agent governance controls agent actions (tool calls, identity, sandboxing, crypto auth). These are complementary, not competing.

5. 🔀 A New Category Forming: Active Agent Runtime

There's a pattern visible across all four layers above. Every tool either watches or executes. None of them intervene.

Layer	What It Does	Examples	Limitation
Coding Agents	Write code	Cursor, Copilot, Aider	No built-in failure detection
Observability	Records what happened	LangFuse, Phoenix, Braintrust	Post-hoc only — you read reports after the fact
Orchestration	Runs the agent graph	LangGraph, CrewAI, ADK	Executes faithfully even when the agent is failing
Gateways	Routes requests	LiteLLM, Portkey, OpenRouter	Sees wire-level but not agent behavior
Guardrails	Blocks bad output	Guardrails AI, NeMo	Validates text, doesn't understand agent loops/deadlocks/hallucination patterns

The missing layer: something that watches the agent in real time, detects when it's going off the rails, and intervenes autonomously.

Enter Active Agent Runtimes

A few projects are starting to fill this gap:

Project	Language	License	Approach
HarnessForge	Rust (PyO3 + NAPI-RS bindings)	MIT	Open-core SDK. 12 health observers, 16 detectors (loop, staleness, cost anomaly, secret leak, etc.), 14 intervention strategies (nudge → circuit-break). Two-level: session harness + meta-harness that improves its own rules across sessions
Microsoft Agent Governance Toolkit	Python	—	Governs agent actions, identity, sandboxing. Covers the full OWASP Agentic Top 10. Focused on enterprise policy enforcement
Future AGI Protect	Python/TS	Apache 2.0	Guardrails-as-a-platform with real-time detection. Part of the Future AGI unified stack

What makes this different from observability: Observability tells you "cost spiked at 2:34 PM." An active runtime detects the spike at turn 3 and swaps the model — you save the money before the spike happens.

What makes this different from guardrails: Guardrails check outputs. An active runtime understands agent behavior — loops, deadlocks, context degradation, goal drift, model mismatch. These aren't output problems; they're behavioral problems.

6. 🏢 The Complete Stack — What Production Teams Actually Use

Based on 2026 surveys and public engineering blogs, here's what a typical production stack looks like:

┌──────────────────────────────────────────────────────────────┐
│ TYPICAL PRODUCTION STACK (Mid-2026)                          │
│                                                              │
│  IDE/CLI Agent          Observability          Gateway       │
│  ─────────────          ─────────────          ───────       │
│  Cursor + Claude Code   LangFuse               Portkey       │
│  (daily flow + deep     (traces, evals,        (routing,     │
│   architectural work)    prompt management)     fallback)     │
│                                                              │
│  Orchestration          Guardrails              CI/CD        │
│  ─────────────          ──────────              ─────        │
│  LangGraph or CrewAI    NeMo + Guardrails AI    GitHub       │
│  (multi-agent flows)    (output validation)      Actions      │
│                                                              │
│  Model Access           Sandbox                              │
│  ────────────           ───────                              │
│  OpenRouter or LiteLLM  Docker / E2B / Modal                 │
│  (multi-model routing)  (safe code execution)                │
│                                                              │
│  Active Runtime (emerging)                                   │
│  ─────────────────────────                                   │
│  HarnessForge or MSFT Agent Gov                              │
│  (real-time detection + intervention)                        │
└──────────────────────────────────────────────────────────────┘

No single tool wins. The norm is 2–3 tools per layer, chosen based on team size, compliance requirements, and framework preferences.

7. ⚡ Market Shifts — What Changed in 2026

Shift	What Happened	What It Means
AutoGen → maintenance	Last release Sep 2025. Merged into Microsoft Agent Framework	New projects: choose MAF or AG2 community fork
Helicone → maintenance	Acquired by Mintlify (Mar 2026)	Migrate to LiteLLM or Portkey for gateway; pair with LangFuse or Phoenix for observability
Portkey acquired ($140M)	Palo Alto Networks, April 2026	AI gateway+security convergence is the next big acquisition category
LiteLLM supply-chain attack	Malicious PyPI packages (Mar 2026)	Pin versions. Use Docker images. Verify checksums
Claude Code hits $2.5B run-rate	Anthropic's terminal agent driving massive revenue	Terminal-native agents are a real business, not a niche
OpenTelemetry standardization	OTel becoming the common trace format	Reduces switching cost. LangFuse + Phoenix both support OTel ingestion
MCP becomes universal	All 3 provider SDKs + most frameworks support MCP now	Tool definitions are portable across frameworks for the first time
A2A protocol emerging	Google-led cross-vendor agent communication	Agents from different frameworks can discover and talk to each other
Per-user pricing wins	Codacy, CodeRabbit, Snyk all per-dev. LOC-based pricing dying	Predictable costs. Easier procurement
30-70% of code is AI-generated	Depending on language and team	AI code governance is becoming a mandatory CI/CD stage
Multi-tool stacks are the norm	Most devs use 2–3 AI tools daily	Integration and unified dashboards matter more than single-tool features
EU AI Act Article 15	Comes into force August 2026	"Human oversight of high-risk AI" — creates compliance demand for intervention tools

8. 🔮 What I'm Watching

Short term (next 6 months):

Who acquires LangFuse? It's the biggest independent OSS observability tool left
Will OpenAI release a coding agent (not just an SDK)?
How does A2A adoption play out vs MCP for agent-to-agent communication?

Medium term (12–18 months):

The active runtime category either takes off or gets absorbed by observability tools adding "actions"
Framework consolidation — there are too many orchestration frameworks; 3–4 will survive
First major AI agent-related security incident that drives regulation

Long term (2–3 years):

AI governance becomes a standard part of the SDLC, like SAST and dependency scanning are today
The boundary between coding agents, observability, and orchestration blurs
"AI safety engineer" becomes a standard job title

Summary — The Layers at a Glance

Layer	Count	Status
Coding Agents	13	Tier 1 consolidating (Cursor, Copilot, Claude Code). OSS tools (Aider, Cline, Continue) gaining fast
Observability	6 + 4 gateway-converged	LangFuse vs LangSmith is the main debate. 1 deprecated (Helicone)
Orchestration	14	1 deprecated (AutoGen). Provider SDKs rising. Too many frameworks; consolidation coming
Gateways + Guardrails	6 + 4	Convergence accelerating. Portkey acquisition validates the space. Supply chain risk real
Active Runtime	3	New category. No dominant player yet. HarnessForge (MIT, Rust), MSFT Agent Gov, Future AGI Protect

This is a point-in-time snapshot. The market is moving fast. I'll update this quarterly.

Disclosure: I'm the author of HarnessForge, one of the tools mentioned in the Active Runtime section. Everything else in this survey is based on publicly available data, vendor documentation, and community analysis.

Found a tool I missed? Drop it in the comments.