/AI-SECURITY · 2026-07-11
From prompts to loops
How the center of gravity in AI engineering moved four times in six years, and what each move did to the attack surface.
2020–2022 · Prompt engineering
The first era treated the model as the whole product. If output was wrong, you rewrote the input: few-shot examples, role instructions, output templates. Chain-of-thought prompting (Wei et al., 2022) showed that a phrase like “think step by step” could unlock reasoning the model already had. That made the input text a genuine engineering surface, worth documenting the way vendors now do in their prompt-engineering guides.
The limit was structural: a prompt runs once. The model reads text and writes text, holds no state, and touches nothing. Every task that needed a second step needed a human to paste the output back in.
2023 · Agent engineering
ReAct (Yao et al., 2022) interleaved reasoning traces with tool calls, and the pattern escaped the lab within months. Lilian Weng's widely-cited survey framed the anatomy that stuck: planning, memory, and tool use around an LLM core. The engineering unit was no longer the prompt but the toolset: schemas, routing, and the workflow that chained calls together.
Anthropic's “Building effective agents” (Dec 2024) closed the era with a field report: the teams that shipped weren't the ones with the most elaborate frameworks.
Consistently, the most successful implementations weren't using complex frameworks or specialized libraries. Instead, they were building with simple, composable patterns. — Building effective agents, Anthropic
2024–2025 · The harness
Once agents ran for hours instead of seconds, everything around the model (tool execution, memory, sandboxes, permissions, state that survives a crash) mattered more than another point of benchmark. That layer got a name: the agent harness, summarized as Agent = Model + Harness. The same model behaves differently in different products because the harness differs; Claude Code and Codex CLI are harnesses before they are anything else.
Harness engineering also changed how failures are read: a bad run stops being a prompt to retry and becomes a system defect to fix permanently in the loop, the tool contract, or the permission policy.
2025– · The loop
The definitions kept shrinking until one survived. Anthropic's context-engineering post states the convergence plainly:
We've gravitated towards a simple definition for agents: LLMs autonomously using tools in a loop. — Effective context engineering for AI agents, Anthropic
In the loop era the craft is curation: what enters the context each iteration, what gets verified before the next one, and when the loop is allowed to stop. As models improve, the same loop carries more autonomy. The harness stays; the leash lengthens.
Why we care
Each era moved the trust boundary. Prompt injection attacked the input; agent-era attacks abused tools; harness-era attacks target policy: who may call what, with which arguments, inside whose sandbox. A loop that acts, observes, and acts again is a control system, and control systems are audited, not prompted. That audit is our job: it is what /agents engagements exist for.
- Wei et al. — Chain-of-Thought Prompting Elicits Reasoning in LLMs (2022)
- Yao et al. — ReAct: Synergizing Reasoning and Acting in Language Models (2022)
- Lilian Weng — LLM Powered Autonomous Agents (2023)
- Anthropic — Building effective agents (2024)
- Anthropic — Effective context engineering for AI agents (2025)
- Wikipedia — Agent harness