The software wrapper around your AI agent is the real security risk

Key points

• Security researchers broke into official automation repositories belonging to Anthropic and two other major AI labs using nothing more than GitHub issues, a common code-hosting platform.
• Swapping one piece of AI plumbing for another moved an identical AI model's attack success rate from 1% to 24%, according to Lasso Security research.
• Malicious files disguised as helpful AI tools accumulated roughly 1.7 million downloads before the campaign was shut down.
• None of the attacks required the AI to malfunction or behave unexpectedly: the vulnerable code sat around the model, not inside it.
• Most organisations have no inventory of this code and no one formally responsible for its security.

Everyone worries about the AI model itself. Criminals tricking it, making it say or do something it shouldn't. Those are real questions, but a growing pile of security research suggests they are the wrong place to look.

The real risk is the software wrapper.

What is a "harness" and why does it matter?

Every AI agent, a digital assistant that can take actions on your behalf like booking meetings or querying a database, needs a layer of ordinary software connecting it to the world. Researchers call this layer the harness. It receives the AI's output and turns it into real actions: running a command, reading a file, calling an external service.

Omar Santos, a distinguished engineer at Cisco, defines it plainly: it is "the layer that surrounds a model and makes it useful," covering the tools the agent can use, what instructions it starts with, and what it is actually allowed to do. Michael Bargury, co-founder and CTO of AI security firm Zenity, calls it the model's "hands and legs and eyes."

Think of the AI model as the engine and this layer as the steering and wiring around it. A faulty engine is obvious. Faulty wiring can go unnoticed until something catches fire.

This layer is where an agent's real power lives. It sits between an AI's reasoning and a live filesystem or API key, and it is frequently untested and owned by nobody in particular.

How did the researchers break in?

Three separate research efforts, each finding a different problem, all pointed at the same layer.

Elad Meged, a security researcher at Novee Security, broke into official automation repositories run by Anthropic, Google, and OpenAI. His tool was GitHub issues: public comment threads used to report bugs or suggest changes on a code-hosting platform. No exotic techniques. The pattern across all three vendors was consistent: one part of the system made a security decision, and a more powerful part downstream trusted that decision without checking it again. An instruction planted early got carried forward and acted on with greater authority than it deserved.

Researcher / Organisation	What they found	Impact
Elad Meged, Novee Security	Trust-boundary flaws in Anthropic, Google, OpenAI automations	Code execution and credential leaks
Lasso Security	Swapping harness frameworks changed attack success rate	1% to 24% on identical model
Michael Bargury, Zenity	Malicious "skills" survived deletion and replaced legitimate tools	~1.7 million downloads of credential-stealing files

Lasso Security found a quieter problem. They kept the same AI model and the same tasks but swapped the framework underneath. Attack success rate: up from 1% to 24%. On 43 out of 100 test pairings, the outcome flipped entirely. The model itself was unchanged.

Bargury's team at Zenity looked at "skills," small files that teach an agent how to perform new tasks, the same way a browser extension adds new features to a web browser. Malicious skills could write themselves into the agent's memory so that even after deletion, the agent would reinstall the malware the next time it started. One fake skill masqueraded as a legitimate Anthropic tool, deleted the real one, and quietly replaced it. A separate campaign cloned popular open-source tools, stuffed them with credential-stealing code, and published them publicly, accumulating roughly 1.7 million downloads before anyone stopped them.

Should ordinary users or employees be worried?

Yes, in a practical sense. If your company uses any AI assistant that can take actions, sending emails or managing files, then the software connecting that assistant to those systems may never have been formally reviewed for security. This is not a hypothetical threat: Meged presented his findings at Black Hat.

For employees the point is simple: treat AI-powered tools the same way you would treat any third-party software. Avoid installing unofficial skills or extensions for AI agents without IT approval. If an AI tool starts behaving unexpectedly, report it rather than assuming it's a quirk.

For security and IT teams, the immediate questions are: do you know which framework is running inside your organisation? Do you know what that framework is permitted to access? Has anyone tested whether the guardrails actually hold?

We first wrote about agents operating outside their intended boundaries on 5 August, and the Australian gym-booking incident we reported on 12 August showed exactly what happens when the layer around a model is given authority without oversight. This research is the same problem named more precisely.

Most organisations don't yet have a category in their security inventory called "AI agent framework." Until they do, the attack surface stays invisible. That's the part nobody owns, and that's what attackers are already using.

Keep your AI tools updated through official channels, and treat any unexpected permission request from an AI assistant as a reason to pause.