Major frontier AI vendors — including Anthropic, Google, and OpenAI — need to rein in the harnesses they wrap around their large language modules, to limit security weaknesses created by software components that are too trusting of each other.
That’s the word from researchers at AI penetration testing firm Novee Security, who were able to use Google’s AI agent to execute a supply chain attack and write to its own repository on GitHub, says Elad Meged, a founding team and security researcher at the company. The team also found issues in Anthropic’s and OpenAI’s AI agents by exploiting misalignments in the trust between elements to enable attacks.
AI harnesses are the software frameworks that provide tools, memory and guardrails for managing AI models; components can include functions like context management, tool integration, and feedback loops too. When a company adopts an AI agent and makes it part of their infrastructure, they are also adopting the trust assumptions of all of those components as well, Meged explains.
“People aren’t aware of the amount of code and the amount of trust that they are embedding into their own systems when they’re adopting an agent,” he says. “You don’t know what code is in there, you don’t know what it’s able to do, and the more trust people give to the agents, the more vulnerable they can be.”
The warning comes as companies increasingly adopt AI agents to benefit from their complex automation capabilities and concerns over the security and safety of those agents continues to rise. Earlier this month, the testing of a new pre-release OpenAI model resulted in the model escaping its sandboxed environment, finding a vulnerability in the only accessible software — a package management system — and attacking Hugging Face. At the Black Hat USA conference last year, researchers demonstrated ways of completely altering AI agent behavior using prompt injection and vulnerabilities. Since then, the foundational model makers have invested in additional layers of security, most often implemented as part of alignment or in the harness, but also increasingly through isolation such as containers. However, those defensive measures do not necessarily take into account the ability of attackers to co-opt the legitimate software surrounding the AI model as part of the harness.
Trust Boundaries & AI Harnesses
Harnesses consist of software, and often reusable skills or packages from open source projects, which are easily scannable and historically prone to vulnerabilities and misconfigurations. In addition, the harnesses and system prompts encapsulating AI agents are often not transparent, leaving companies that adopt AI agents to tacitly accept many unknown risks, arguably chief among them the lack of visibility into how the software scaffolding around the agent — the “harness” — works.
Overall, the risks are twofold: At one end, AI agents rely on traditional software technology to do things — software that has its own vulnerabilities — while at the other, interactions between harness components may result in losing track of the whether inputs are trusted or not. While vendors have added security around their models and harnesses, how harness components interact have largely been overlooked, according to Novee Security.
“The vendors aren’t careless,” the company said. “Anthropic built dozens of security checks, Google built multiple execution modes with environment sanitization, and OpenAI built a sandbox with protected paths. The defenses are there; they fail at the handoffs between components.”
Companies need to understand that adopting an AI agent means that all the components of the harness becomes part of the infrastructure, the company stated in a yet-to-be-published white paper shared with Dark Reading.
Time to Audit the Agents
Unfortunately, companies are not investing enough resources into securing the agents that they are running. While 80% of companies run AI agents, only 47% have security controls in place to manage their risks, according to a study published in early 2026. Companies should analyze their AI agents and require that vendors be transparent about the code used, says Meged.
“Read the code, understand where the data flow and the code flow are going to, and try to find this mismatch into some sinks or something that can be dangerous,” he says. “It can lead as many places where code execution is possible.”
For now, harness security is still in its infancy. and attackers may have the advantage for a while, Meged says.
“You can raise your detection level, but in my opinion, attackers will always have a way to sneak in — this is the race attackers know well,” he says.
Meged will present details of the security weaknesses in major vendors’ harness during his session at the Black Hat USA conference.
