The Hidden Weak Spots Inside AI Agents That Major Tech Giants Are Missing

Key points

• Researchers at Novee Security used Google's AI agent to carry out a supply-chain attack, writing unauthorised code to a GitHub repository.
• The same team found exploitable weaknesses in AI agents built by Anthropic and OpenAI.
• A 2026 study found that 80 percent of companies run AI agents, but only 47 percent have security controls in place to manage the risks.
• The vulnerabilities lie not in the AI models themselves, but in the software scaffolding around them, known as a "harness".
• Vendors have built individual security checks, but those checks break down at the handoffs between components.

When people worry about AI security, they tend to picture the AI itself going rogue. The real problem, according to researchers at penetration-testing firm Novee Security, is quieter and less glamorous: it lives in the plumbing.

The team found serious weaknesses in how Google, Anthropic, and OpenAI package their AI agents for companies to deploy. Their findings, shared with Dark Reading ahead of a presentation at Black Hat USA, point to a gap that all three vendors have so far underestimated.

What exactly is an AI "harness"?

An AI agent is not just an AI model. Wrapped around the model is a layer of supporting software: tools that let the agent browse the web or run code, memory that lets it remember earlier instructions, and guardrails that are supposed to keep it on task. That supporting layer is called a harness.

When a company adopts an AI agent, it is also adopting every piece of code in that harness, whether it knows what that code does or not. "People aren't aware of the amount of code and the amount of trust that they are embedding into their own systems when they're adopting an agent," says Elad Meged, a founding researcher at Novee Security.

The harness components often come from open-source projects, meaning anyone can read the code and look for weaknesses. Historically, open-source packages have carried a steady supply of vulnerabilities and misconfigurations.

How did the researchers break in?

The attack was not a brute-force assault on the AI model. Meged's team found mismatches in how different parts of the harness decide what to trust.

Think of it like a building where the front-door security guard is strict, but the internal doors between floors are left unlocked. The researchers entered through a legitimate door, then moved through the unlocked internal passages. In Google's case, that path led all the way to a GitHub repository, where the agent was tricked into writing code it had no business writing. A supply-chain attack, in this context, means inserting malicious code into software that other organisations will later download and run.

All three vendors had built real defences. Anthropic built dozens of security checks. Google built multiple execution modes with environment cleaning. OpenAI built a protected sandbox. "The defences are there," Novee Security wrote in a white paper. "They fail at the handoffs between components."

Should companies using AI agents be worried?

Yes, and most are not doing enough about it. Eighty percent of companies already run AI agents, but only 47 percent have security controls in place to manage the risks, according to a study published in early 2026.

Meged's advice to companies is blunt: read the code in the agents you deploy, trace where data flows, and demand that vendors be transparent about what is actually inside the harness. Waiting for vendors to fix the problem without auditing your own deployment is a gamble.

For employees, the practical lesson is simpler. If an AI tool in your workplace suddenly asks for permissions it has never needed before, or behaves in a way that feels off, report it to your IT team immediately. Unusual behaviour is often the first visible sign of a compromised agent.