--- title: The AI harness is the new attack surface | daily.dev description: Security researchers are shifting focus from AI models to the 'harness' — the orchestration code that wraps models, gives them tools, and translates their... canonical: https://daily.dev/posts/the-ai-harness-is-the-new-attack-surface-mrdtydrbt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The AI harness is the new attack surface | daily.dev og:description: Security researchers are shifting focus from AI models to the 'harness' — the orchestration code that wraps models, gives them tools, and translates their... og:url: https://daily.dev/posts/the-ai-harness-is-the-new-attack-surface-mrdtydrbt og:image: https://api.daily.dev/og/posts/mrDtYDrbT.png og:image:alt: The AI harness is the new attack surface og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The AI harness is the new attack surface **[CSO Online](https://daily.dev/sources/csoonline)** · 9 min read · 0 upvotes · 0 comments ## Summary Security researchers are shifting focus from AI models to the 'harness' — the orchestration code that wraps models, gives them tools, and translates their output into real-world actions like shell commands, file writes, and API calls. Three distinct failure modes have been identified: architectural trust-boundary flaws (demonstrated by breaking into Anthropic, Google, and OpenAI's official automations via GitHub issues), harness design choices (swapping harnesses under an identical model moved attack success rate from 1% to 24%), and supply-chain compromise through malicious 'skills' that evaded all major scanners and accumulated 1.7 million downloads. CISOs are advised to inventory all production harnesses, minimize permissions, apply containment tooling, and benchmark harness security independently rather than relying on vendor claims. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did swapping the agent harness change the attack success rate from 1% to 24% with the same model? Lasso Security tested identical model, prompt, and tools while only changing the harness — the orchestration code wrapping the model — and found the attack success rate jumped from 1% to 24%, flipping outcomes entirely on 43 of 100 model-and-task pairings. This shows harness design, not model alignment, largely determines an agent's real-world security exposure. _Comparing agent harnesses before deployment is easier when daily.dev surfaces the latest security research on AI agent architecture._ ### How did malicious AI skills evade security scanners and steal credentials? Zenity researchers found malicious AI 'skills' that passed every available scanner, including official ones from Anthropic and Cisco, by cloning popular open-source tools and secretly embedding credential-stealing code. One malicious skill wrote itself into an agent's reloaded memory file so it reinstalled itself even after deletion; the cloned tools accumulated roughly 1.7 million downloads before the campaign was disrupted. _Staying ahead of emerging agent supply-chain attacks is easier when daily.dev tracks security research like this._ ### What is an AI agent harness and why does it matter for security? An AI harness is the layer of orchestration code, tool integrations, prompts, context, and workflow logic that surrounds a model and turns its raw output into real actions like shell commands, file writes, or API calls. Because the harness controls what an agent can see and touch, security researchers argue it should be treated as an attack surface distinct from the model itself, since architectural trust-boundary flaws there let attackers compromise agents without ever touching the model. _Understanding harness-level risk helps teams choosing agent frameworks, a topic developers can follow on daily.dev._ ## Similar posts on daily.dev - [Harness Extends AI Security Reach Now Spans Entire DevOps Workflow](https://daily.dev/posts/harness-extends-ai-security-reach-now-spans-entire-devops-workflow-dndldkpbf) · DevOps.com · 0 upvotes · 0 comments - [Harness Engineering](https://daily.dev/posts/harness-engineering-l1sahcwor) · Martin Fowler · 4 upvotes · 0 comments - [The State Of AI Harness Engineering 2026](https://daily.dev/posts/the-state-of-ai-harness-engineering-2026-z2cv9sfcz) · marmelab · 11 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#llm](https://daily.dev/tags/llm), [#ai-agents](https://daily.dev/tags/ai-agents), [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/the-ai-harness-is-the-new-attack-surface-mrdtydrbt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The AI harness is the new attack surface","url":"https://daily.dev/posts/the-ai-harness-is-the-new-attack-surface-mrdtydrbt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-ai-harness-is-the-new-attack-surface-mrdtydrbt"},"datePublished":"2026-08-12T08:29:49.680Z","dateModified":"2026-09-14T09:08:43.355Z","description":"Security researchers are shifting focus from AI models to the 'harness' — the orchestration code that wraps models, gives them tools, and translates their...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/374a87fc3a0a3ff8078356de0a584425?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/374a87fc3a0a3ff8078356de0a584425?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-ai-harness-is-the-new-attack-surface-mrdtydrbt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,llm,ai-agents,ai-security,prompt-injection","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"The AI harness is the new attack surface"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-ai-harness-is-the-new-attack-surface-mrdtydrbt#faq","mainEntity":[{"@type":"Question","name":"Why did swapping the agent harness change the attack success rate from 1% to 24% with the same model?","acceptedAnswer":{"@type":"Answer","text":"Lasso Security tested identical model, prompt, and tools while only changing the harness — the orchestration code wrapping the model — and found the attack success rate jumped from 1% to 24%, flipping outcomes entirely on 43 of 100 model-and-task pairings. This shows harness design, not model alignment, largely determines an agent's real-world security exposure. Comparing agent harnesses before deployment is easier when daily.dev surfaces the latest security research on AI agent architecture."}},{"@type":"Question","name":"How did malicious AI skills evade security scanners and steal credentials?","acceptedAnswer":{"@type":"Answer","text":"Zenity researchers found malicious AI 'skills' that passed every available scanner, including official ones from Anthropic and Cisco, by cloning popular open-source tools and secretly embedding credential-stealing code. One malicious skill wrote itself into an agent's reloaded memory file so it reinstalled itself even after deletion; the cloned tools accumulated roughly 1.7 million downloads before the campaign was disrupted. Staying ahead of emerging agent supply-chain attacks is easier when daily.dev tracks security research like this."}},{"@type":"Question","name":"What is an AI agent harness and why does it matter for security?","acceptedAnswer":{"@type":"Answer","text":"An AI harness is the layer of orchestration code, tool integrations, prompts, context, and workflow logic that surrounds a model and turns its raw output into real actions like shell commands, file writes, or API calls. Because the harness controls what an agent can see and touch, security researchers argue it should be treated as an attack surface distinct from the model itself, since architectural trust-boundary flaws there let attackers compromise agents without ever touching the model. Understanding harness-level risk helps teams choosing agent frameworks, a topic developers can follow on daily.dev."}}]} ```