The AI harness is the new attack surface

Ask a security researcher what makes an AI agent dangerous, and the instinct is to talk about the model — what it will and won’t refuse, how easily it can be jailbroken, whether its weights can be trusted.

That instinct is increasingly out of date. A growing body of security research — exploit demonstrations, independent red-teaming, and assessments by security researchers— points to the code sitting between the model and the world instead.

That code, increasingly called the harness, wraps the model, gives it tools, and turns its token-by-token output into a shell command, a file write, an API call. It is also under-inventoried, under-tested, and frequently under-owned inside enterprises.

Elad Meged , founding engineer and security researcher at Novee Security, broke into the official automation repositories of Anthropic, Google, and OpenAI using nothing more than GitHub issues.