When AI agents get compromised, the model usually isn't to blame — the code wrapped around it is, according to new security research compiled by CSO Online. The analysis, drawing on exploit demonstrations, independent red-teaming, and assessments by security researchers, shows that the "harness" — the software layer that connects a model to tools and turns its output into shell commands, file writes, and API calls — has become a major attack surface that most organizations aren't monitoring closely enough. A growing body of evidence points to harness vulnerabilities, not model failures, as the primary security risk in deployed AI agents.
The research documents three major breach categories. Elad Meged, founding engineer at Novee Security, broke into official automation repositories at Anthropic, Google, and OpenAI using only GitHub issues, exploiting architectural trust boundaries where one component made a security decision and a more powerful downstream component trusted it without revalidation. Researchers at Lasso Security discovered that swapping one supposedly neutral piece of agent plumbing for another moved a model's attack success rate from 1% to 24%, using identical models, prompts, and tools, and completely flipped the outcome on 43 of 100 model-and-task pairings. Michael Bargury, co-founder and CTO of AI security firm Zenity, found attackers hiding credential-stealing malware inside AI "skills" that had already passed every scanner on the market, including official ones from Anthropic and Cisco. One malicious skills campaign, consisting of cloned versions of popular open-source tools secretly modified to steal login credentials, accumulated roughly 1.7 million downloads before disruption.
"Security teams should treat the harness as an attack surface because it is where the agent gets its authority, context, and paths to act," Omar Santos, distinguished engineer at Cisco, tells CSO Online. The report notes that harness code has vulnerabilities just like any other software, and a perfectly aligned model can sit inside a harness that trusts a wildcard shell pattern or reuses a workspace across two passes of untrusted content. At that point, the model's alignment is largely beside the point. Michael Sromin, senior ML engineer at Lasso Security, emphasizes that harness selection isn't just an arbitrary choice but "a careful choice" that "can really affect and move the needle in whatever you're doing out there."
The underlying problem is that harnesses determine what a model can see, what it can touch, and what happens when it acts, yet they're under-inventoried, under-tested, and frequently under-owned inside enterprises. Most organizations don't maintain a category called "AI harness," Santos explains — teams think in terms of apps, services, pipelines, or bots, so harnesses disappear into code repositories, SaaS products, and vendor configuration screens instead of showing up as discrete assets in security inventories. The report highlights that agents don't operate in isolation but ingest instructions and content from tools, plugins, skills, MCP servers, websites, and other systems while holding credentials and permissions that let them act on behalf of users. This creates a supply chain problem that's qualitatively different from conventional software dependency management. "Supply chain for software is, what, 10 or 15 package registries?" Bargury notes. "Supply chain for agents is any content, any image, any text, any website, any CRM object, any skill, any MCP server, any content on the internet."
For CISOs, the research points to three immediate actions: building a live inventory of every production agent and identifying its harness, reducing permissions to the minimum required, and independently testing whether security controls actually work under the conditions in which the organization will deploy them. Santos estimates that 60% to 70% visibility can be achieved relatively quickly by starting with production systems, leaving prototypes and shadow AI for a second phase. The report warns that organizations evaluating agents may be asking the wrong question — it isn't simply which model is safest, but which combination of model, harness, tools, permissions, and external inputs remains safe under actual deployment conditions. Meged's lesson from breaking three vendors' official automations is direct: "Read the defaults, not the documentation." Organizations that assume vendor security claims transfer automatically to their own environments are making a critical mistake, especially when a vendor's claimed 99% prompt injection blocking rate may be citing a benchmark disconnected from operational reality. The emerging consensus among AI security researchers is clear: securing the model is not the same thing as securing the agent, and the code layer between reasoning and action demands scrutiny as rigorous as any other critical infrastructure. The shift in attack patterns suggests that organizations relying on model alignment as their primary defense are protecting the wrong layer entirely, while the actual vulnerability sits unmonitored in the orchestration code that grants agents their real-world power.