Sber Open-Sources Universal Agent: Same Model, New Harness, 24 Points Better

Open the code of any agent and you will find almost the same thing: the model picks a tool, ordinary code executes it, and the result goes back to the model. The loop repeats until the task is closed. This is ReAct, and in pseudocode it takes ten lines. So why are there so many products built on this loop, and why do they behave so differently?

The GigaCode R&D team at Sber answered with a paper and an open-source Python project, GigaCode Universal Agent. Their thesis: all the engineering work sits in the harness, that is, the execution environment around the loop.

What surrounds the ten lines

Imagine a task: there is a terms-of-reference document and three contractor proposals. Prices cover different periods, conditions are hidden in appendices, and one proposal lacks a mandatory piece of work. The agent must read everything, normalize it to a common denominator and write a memo with sources.

Three things are needed for this. The task describes what to take and what to return. A skill is a reusable procedure, like instructions for a new employee: how to convert prices to a single period, how to mark "not specified" and add a question rather than treating a gap as a free service. Tools provide access to data and actions, and external systems are connected via MCP. Rules live in the skill, access lives in the tools, and the core stays unchanged.

Then come questions that pseudocode does not address. A background task has no observer, so the unit of execution here is a Run with a fixed model, skill version, tools, and limits on time, tokens, steps and calls. When a limit runs out, the run stops, saves what it has done and states the reason. Every run leaves a trace showing where an output came from and why something worked yesterday but not today.

A separate judge, that is, a second model with its own instruction, checks the report and trace against the task. If a requirement was lost or a conclusion has no source, the agent gets remarks and continues. Where verification can be done programmatically (file created, test passed, JSON valid), it is better done in code. For long tasks there is auto-logging: the agent compresses its state into a short record and keeps working beyond a single context window.

Security is also handled by the harness. If the instruction says "send nothing," the agent simply should not have an email-sending tool. Add read and write checks, command moderation by the judge, and container separation.

What the numbers showed

Using the same Qwen3.6-35B-A3B, Universal Agent was compared with OpenCode and Qwen Code. SWE-bench Verified: 69.9% versus 66.4% and 65.0%. Terminal Bench 2.1: 65.5% versus 62.1% and 41.4%. On SWE-bench Pro and Multilingual, results are roughly equal. The authors' conclusion: one model in a different harness yields a different result.

In cybersecurity (CyberGym lvl1, DeepSeek-V4-Flash), a domain skill raised the result from 70.6% to 76.7% with no changes to the core. On cost, the agent on SWE-bench Verified came out about a third cheaper than Qwen Code. The authors count the cost of a successful task: all runs, including failed ones and manual rework, divided by the number of solved tasks. Auto-routing light/default/max moved 50–60% of requests to junior models with quality close to the max level, but this remains an experimental direction.

Limitations and what to do

This is a paper by the developers about their own product, and the comparison was made under their own set of conditions. The judge can be wrong, details are lost when context is compressed, and on hard tasks the agent burns tokens. Scientific search remains modest for all participants in the comparison. For business scenarios such as comparing contractors, you will have to measure quality on your own examples.

The practical takeaway is simple. When choosing or building an agent, do not argue about the model; check the harness: are there limits and traces, is the result verified independently of the model's own words, are tool permissions restricted, and is the price counted per completed task rather than per token. That is where the difference lies today.