“Teams think in terms of apps, services, pipelines, or bots,” Santos says. Harnesses disappear into code repositories, SaaS products, and vendor configuration screens instead of showing up as discrete assets in security inventories.
Even the terminology is inconsistent.
“One team may call something an agent, another a copilot, another a workflow assistant, another a plugin-based automation,” Santos says, “even though all of them are effectively harnesses.”
His recommendation is to build a live inventory of every production agent, identify its harness, and map every tool and resource it can access. Then reduce those permissions to the minimum required.
Organizations shouldn’t wait for perfect visibility. Santos estimates that 60% to 70% visibility can be achieved relatively quickly by starting with production systems, leaving prototypes and shadow AI for a second phase.
The second problem is controlling everything the harness trusts.
Agents don’t operate in isolation. They ingest instructions and content from tools, plugins, skills, MCP servers, websites, and other systems, often while holding credentials and permissions that let them act on behalf of users.
Attackers therefore don’t need to compromise the model. They need to compromise something the harness is willing to trust.
“You’re sharing your laptop with your agents, and your laptop has everything — has your identity, has your files, has your secrets,” Bargury says.
For organizations without a dedicated AI security budget, he recommends, at minimum, running agents inside open-source containment tooling. “This is not a fix,” he cautions, “but it is helpful.”
The size of the potential supply chain makes the problem qualitatively different from conventional software dependency management.
“Supply chain for software is, what, 10 or 15 package registries?” Bargury says. “Supply chain for agents is any content, any image, any text, any website, any CRM object, any skill, any MCP server, any content on the internet.”
The third problem is assuming a vendor’s security claims transfer to the environment where an agent will actually run.
A vendor claiming it blocks 99% of prompt injections, Bargury says, may be citing “a benchmark that is not attached to reality on the ground.”
Lasso’s findings demonstrate why that matters. Hold the model, prompt, and tools constant and change only the harness, and the security outcome can change dramatically.
That means organizations evaluating agents may be asking the wrong question. It isn’t simply which model is safest. It’s which combination of model, harness, tools, permissions, and external inputs remains safe under the conditions in which the organization will actually deploy it.
Meged distilled the lesson from breaking three vendors’ official automations: “Read the defaults, not the documentation.”
“The product said it was safe,” he said, “and that’s where we started.”
