The software wrapper around your AI agent is the real security risk
Researchers broke into official AI automation tools from Anthropic, Google, and OpenAI, not by tricking the AI itself, but by exploiting the ordinary code that connects it to the real world.
Key points
- Security researchers broke into official automation repositories belonging to Anthropic, Google, and OpenAI using nothing more than GitHub issues, a common code-hosting platform.
- Swapping one piece of AI plumbing for another moved an identical AI model's attack success rate from 1% to 24%, according to Lasso Security research.
- Malicious files disguised as helpful AI tools accumulated roughly 1.7 million downloads before the campaign was shut down.
- None of the attacks required the AI to malfunction or behave unexpectedly, the vulnerable code sat around the model, not inside it.
- Most organisations have no inventory of this code and no one formally responsible for its security.
Everyone worries about the AI model itself. Can criminals trick it? Can they make it say or do something it shouldn't? Those are real questions, but a growing pile of security research suggests they are the wrong place to look.
The real risk is the software wrapper.
What is a "harness" and why does it matter?
Every AI agent, a digital assistant that can take actions on your behalf, like booking meetings, writing code, or querying a database, needs a layer of ordinary software connecting it to the world. Researchers call this the harness. It receives the AI's output and turns it into real actions: running a command, reading a file, calling an external service.
Think of it this way. The AI model is the engine. The harness is everything else: the steering, the brakes, the wiring. A faulty engine is obvious. Faulty wiring can go unnoticed until something catches fire.
Omar Santos, a distinguished engineer at Cisco, puts it plainly: the harness is "the layer that surrounds a model and makes it useful," covering the tools the agent can use, what instructions it starts with, and what it is actually allowed to do. Michael Bargury, co-founder of AI security firm Zenity, calls it the model's "hands and legs and eyes."
The trouble is that this layer is where an agent's real power lives. It sits between an AI's reasoning and a live database, an API key, or a production server. And it is frequently untested, unmapped, and owned by nobody in particular.
How did the researchers break in?
Three separate research efforts, each finding a different problem, all pointed at the same layer.
Elad Meged, a security researcher at Novee Security, broke into official automation repositories run by Anthropic, Google, and OpenAI. His tool was GitHub issues, which are simply public comment threads used to report bugs or suggest changes on a code-hosting platform. No exotic techniques. The pattern he found across all three vendors was the same: one part of the system made a security decision, and a more powerful part downstream trusted that decision without checking it again. An instruction planted early got carried forward and acted on with greater authority than it deserved.
| Researcher / Organisation | What they found | Impact |
|---|---|---|
| Elad Meged, Novee Security | Trust-boundary flaws in Anthropic, Google, OpenAI automations | Code execution and credential leaks |
| Lasso Security | Swapping harness frameworks changed attack success rate | 1% to 24% on identical model |
| Michael Bargury, Zenity | Malicious "skills" survived deletion and replaced legitimate tools | ~1.7 million downloads of credential-stealing files |
Lasso Security found a quieter problem. They tested what happened when they kept the same AI model and the same tasks but swapped the harness framework underneath. The attack success rate jumped from 1% to 24%. On 43 out of 100 test pairings, the outcome flipped entirely. The model had not changed at all.
Bargury's team at Zenity looked at "skills," which are small files that teach an agent how to perform new tasks, the same way a browser extension adds new features to a web browser. They found malicious skills that could write themselves into the agent's memory so that even after deletion, the agent would reinstall the malware the next time it started. One fake skill masqueraded as a legitimate Anthropic tool, deleted the real one, and quietly replaced it. A separate campaign cloned popular open-source tools, stuffed them with credential-stealing code, and published them publicly. They gathered roughly 1.7 million downloads before anyone stopped them.
Should ordinary users or employees be worried?
Yes, in a practical sense. If your company uses any AI assistant that can take actions, sending emails, querying systems, managing files, then the software connecting that assistant to those systems may never have been formally reviewed for security. First reported in detail by CSO Online, this research shows the risk is not hypothetical.
For employees, the takeaway is simple: treat AI-powered tools the same way you would treat any third-party software. Avoid installing unofficial "skills" or extensions for AI agents without IT approval. If an AI tool starts behaving unexpectedly, report it rather than assuming it is a quirk.
For security and IT teams, the immediate questions are: do you know which harness frameworks are running inside your organisation? Do you know what those frameworks are permitted to access? Has anyone tested whether the guardrails actually hold?
Most organisations, researchers say, do not yet have a category in their security inventory called "AI harness." Until they do, the attack surface stays invisible.
Keep your AI tools updated through official channels, and treat any unexpected permission request from an AI assistant as a reason to pause.
