Your Agent Harness Has More Privilege Than Your Agent

This report argues that the agent harness—not the model—is the true privilege boundary in AI agent stacks, cataloging multiple attack surfaces (e.g., poisoned tool descriptions, dynamic system-prompt injection from repository files, malicious hooks, context compaction loss, permission-parsing weaknesses, session logs as secret stores) and highlighting the critical role of an independent verify step and runtime guardrails to prevent secret exfiltration and silent compromise.