Agent harness config is the most attackable phase, and detecting the risk does not stop it: >90% detection still coexists with high attack success
HarnessRisk splits agent-harness safety into six operational phases (Harness Configuration, Capability Extension, Runtime Operation, State Persistence, Action Control, Incident Recovery) and runs 128 sandboxed cases that each pair a benign user objective with an adversarial instruction hidden in an untrusted workflow artifact. Across three harnesses, six models and 14 model/harness configurations, attack success spans 12.6% to 80.9% while utility stays at 75.0-97.6% - and Harness Configuration is the most vulnerable phase in all three harnesses, because attacks succeed by quietly altering security-sensitive parameters inside otherwise authorized workflows. The sharpest practical lesson: some configurations flagged the risk in over 90% of runs and still executed the attack, so 'the model noticed' is not a control - lock your settings/permission files as a separate trust boundary.
↳ Follow the thread