AI Harnesses Burst With Potential Exploit Opps

Researchers at Novee Security discovered significant security vulnerabilities in AI agent harnesses used by major vendors like Anthropic, Google, and OpenAI. These vulnerabilities stem from the complex, interconnected nature of these harnesses, which rely on numerous open-source components and introduce a lack of visibility into the underlying code and trust assumptions. Despite vendor efforts to add security layers, attackers can exploit these vulnerabilities by co-opting legitimate software components within the harness, leading to potential code execution and system compromise. The study highlights a critical gap in AI agent security, with only a small percentage of companies actively investing in securing their AI agent deployments.