Why Model Wrappers Win or Lose: Inside AI Agent Harnesses and Policies
Reports of Anysphere's $60B valuation highlight that in AI coding tools, the model is rented—the actual product is the execution policy, tool boundaries, and context control.
Reports of SpaceX’s $60 billion all-stock acquisition of Cursor maker Anysphere have sparked renewed debate over where real value is created in AI software. While external observers often question whether developer tools are merely thin wrappers over rented intelligence, the engineering reality shows a different picture. Products like Cursor may route queries to models from OpenAI, Anthropic, Google, and xAI alongside first-party offerings like Composer and Grok, but identical foundation models behave completely differently depending on the surrounding scaffolding. The true asset is not the rented model itself, but the operational policy governing each turn: what the system is allowed to see, which actions are reachable, and how completion is verified.
Architectural Guardrails Over Prompting
Failures in AI agents rarely trace back to phrasing flaws inside system prompts. Instead, they typically stem from brittle tool architectures. For example, a customer support agent might repeatedly urge a user to replace a valid API key after a failed verification check returns a string such as “could not verify the credential.” When that string enters the context window without clear partitioning, the model treats the diagnostic message as a direct instruction and executes the replacement path. To prevent this, tool returns require structured separation: an explicit observation, a record of what could not be verified, and targeted next steps that only appear when a test specifically covers that condition.
Similarly, writing negative rules like “never delete user data” into a prompt fails to establish true safety. If a destructive tool remains accessible in the function list, an agent can still call it. True safety requires structural gating where dangerous states are unreachable until prerequisites are satisfied outside the prompt. A single model invocation frequently attempts to manage five distinct responsibilities at once: instructions, state tracking, verification, scope enforcement, and session handoffs. When developer harnesses overload prompts with these responsibilities, prompt length turns into an active failure variable.
The Limits of System Prompts and Repository Rules
Developer reliance on large rule sets often degrades agent performance. According to the AGENTS.md benchmark (arXiv:2602.11988), adding context files across various models and agents did not generally increase task success rates, yet it drove up inference costs by more than 20 percent on average. While specific instructions were followed, broad repository overviews proved unhelpful. The research indicates that rule files should focus strictly on non-standard conventions, concrete commands, and known production issues, as operators note a performance cliff near roughly 500 lines. Excessive context regularly introduces four specific failure modes: data poisoning, distraction, confusion, and rule clashes.
Furthermore, tool definitions behave as strict API contracts tied to a specific model’s priors. Changing the underlying model can cause previously stable tool calls to fail. In one notable failure pattern documented on the OpenAI developer forum, combining a function tool with a JSON response format led a model to call a weather tool repeatedly on every turn in an unbroken loop.
What it means for developers
For engineers building AI-native applications, copying leaked system prompts does not recreate an integrated product. Leaked prompts reveal runtime variables—such as linter diagnostics, open files, cursor positions, and file histories—but they omit the underlying retrieval systems, subagent routines, and diff-application loops. The real differentiation lives in the execution environment rather than the text wrapper.
Because model behavior varies significantly across identical harnesses, developers must treat tool descriptions as formal contracts and continually test implementations across providers. For teams benchmarking system performance and tool calling across Claude, GPT, Grok, and other architectures, developers can test these top AI models cheaply through one API at https://apixoai.online.
Engineers must also navigate product constraints around custom configurations. While Cursor employs an Auto router to select between models, staff notes confirm that proprietary models such as Composer run exclusively on Cursor’s internal infrastructure and reject proxy configurations or custom keys. Furthermore, operators report that bringing a personal API key disables Composer and diff-apply features. Ultimately, engineering success depends on defining explicit boundaries: splitting large edits into smaller modules, verifying states with automated tests rather than visual inspection, and keeping persistent context tightly scoped.
Source: The Model Is Rented. The Policy Is the Product. — Towards AI. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
