IBM open-sources CUGA agent harness, outperforms Hermes and Deep Agents on multi-app tasks

IBM Research has released CUGA (ConfigUrable Generalist Agent), an open-source agent harness designed for enterprise deployments where business rules must be enforced regardless of model behavior. In a controlled benchmark using the same open-weight GLM-5.3-flash model across 90 AppWorld tasks spanning 457 APIs across nine applications, CUGA achieved 81.1% task completion compared to 46.7% for Nous Research's Hermes harness and 30.0% for LangChain's Deep Agents. The scenario-level consistency metric was even more pronounced: CUGA completed all variants in 20 of 30 scenarios versus 8 for Hermes and 2 for Deep Agents. CUGA is built for deployment inside organizational boundaries, including sovereign clouds and air-gapped environments, and separates policy enforcement from system prompts to prevent model override or injection attacks.

The harness implements a compact execution loop with task decomposition, focused tool selection per step, CodeAct Python generation with sandboxed execution, pre-execution verification for data-changing operations, and automatic reflection with pagination auditing. These features reduce the decision surface for the underlying model and create explicit enforcement points for business policies. IBM's governance approach, described in an ACM CAIS 2026 paper, moves rules from easily circumvented prompts into the harness architecture itself, with policy checks at user intent, planning, execution, and verification stages.

CUGA harness architecture and enterprise policy enforcement

• Task decomposition and focused tooling: CUGA splits multi-app tasks into single-app steps and restricts each step to only its target app's tools plus a small shared set, rather than exposing all 469 available tools, reducing context confusion and incorrect API selection.
• CodeAct with sandboxed execution: The model generates Python code to call APIs rather than using direct tool invocation, with execution confined to a restricted environment with time limits, providing isolation and auditability for automated actions.
• Pre-execution verification: A dedicated check reviews any code block that would change data before it runs, creating a hard gate that can enforce business rules independently of model compliance or prompt manipulation.
• Automatic reflection and pagination auditing: Post-execution review catches errors and allows plan correction, with specific detection of incomplete list traversals where a full result page was returned but no subsequent page was requested.
• Policy layer with four enforcement points: CUGA's governance framework places Intent Guard, planning, execution, and verification policies outside the system prompt, making rules enforceable rather than advisory and resistant to user override or prompt injection.

Why it matters

For enterprises building on open-weight models, CUGA offers a deployable alternative to vendor-hosted agent platforms that cannot run inside regulated or air-gapped environments. The Apache-2.0 license and explicit support for sovereign cloud deployment address a gap in the current agent harness landscape, which skews toward consumer assistants or research tools rather than governed business automation. Independent developers and systems integrators can evaluate CUGA against their own workloads using IBM's published Harbor fork and benchmark configuration, though the single-benchmark, single-model scope of IBM's published results means broader validation across models and domains remains community work.