Agent Harness Security

Over the past two posts, we’ve argued that the security conversation around coding agents needs to change.

First, we explored how the attack surface has expanded beyond the language model itself. Modern coding agents operate inside an agent harness: the execution environment that connects models with context, tools, skills, memory, and orchestration logic. That harness enables agents to reason, retrieve information, invoke tools, execute commands, and complete increasingly complex development tasks. It also introduces new trust relationships and, with them, new opportunities for attackers.

We then introduced a practical framework for securing those systems. Visibility, control, validation, monitoring, and governance provide the foundation organizations need to defend coding agents throughout their lifecycle, not just the models that power them.

Those ideas emerged from the work our research team has been doing to understand how modern coding agents and agentic harnesses actually behave, where they fail, and how organizations can safely adopt them at scale.

That research ultimately led us to build HiddenLayer Agent Harness Security, a runtime security capability designed to secure the agent harness that powers modern AI coding agents.

Research Revealed a Consistent Pattern

Over the past year, HiddenLayer researchers have examined how AI coding agents operate through their agent harnesses, the orchestration layer that retrieves information, consumes instructions, invokes tools, executes commands, manages memory, and connects agents to increasingly complex development environments. Along the way, we’ve published research into prompt injection, AI skills, Cursor memory manipulation, MCP security, CopyPasta, and other techniques that demonstrate how attackers can influence agent behavior without ever directly attacking the underlying model.

Although each attack took a different path, they all converged on the same architectural weakness. The common point of exploitation wasn’t the language model itself. It was the agent harness that enables coding agents to interact with code, tools, and enterprise systems.

Modern coding agents and agentic harnesses continuously combine information from repositories, documentation, external websites, tools, MCP servers, skills, shell commands, and persistent memory before deciding what to do next. Every one of those interactions becomes another trust relationship and another opportunity for malicious influence.

As a result, attacks rarely begin and end with a single prompt. They unfold across the entire agent workflow, with seemingly benign inputs accumulating into unsafe behavior. The challenge is no longer identifying a suspicious prompt, but understanding how trust propagates through the agent harness.

Existing Security Controls Weren’t Built for This

Traditional security models were built around predictable software. However, coding agents make decisions based on changing contexts, making their behavior far less predictable than that of traditional software.

Now,  observing the final action is no longer enough. Security teams also need to understand what influenced that action, what information the agent consumed, what tools it used, and how the entire sequence unfolded.

Existing controls can often identify that a shell command was executed or that a network connection occurred. What they cannot easily explain is why the agent chose that action, whether its reasoning was influenced by untrusted content, or whether seemingly unrelated events combined into a larger attack.

That distinction matters because many of the most important attacks against coding agents are indirect. A prompt injection hidden in source code may not become dangerous until the agent later executes a command. A compromised tool may quietly introduce instructions that influence future decisions. A single event rarely tells the whole story.

Security has to move closer to where the agent actually works.

Building Agent Harness Security

That realization shaped how we approached securing coding agents.

Rather than building controls around the workflow, we focused on the execution layer itself. We wanted security to operate where agents retrieve context, call tools, read files, execute commands, and interact with developer systems.

The result is HiddenLayer Agent Harness Security, a new capability within the HiddenLayer AI Security Platform's Runtime Security module that protects AI coding agents by securing the agent harness at runtime.

At launch, Agent Harness Security provides runtime visibility, threat detection, and inline enforcement for supported AI coding agents by integrating directly with their native hook surfaces. This allows security controls to observe and influence agent behavior as it happens, before unsafe actions can impact source code, secrets, or development infrastructure.

Rather than evaluating prompts or events in isolation, Agent Harness Security analyzes behavior across the entire agent session. By correlating interactions with repositories, files, shell commands, tools, dependencies, and external services, it identifies AI-native attacks that only become apparent when viewed in the context of a broader workflow, without disrupting the developer experience.

Applying Agent Harness Security in Practice

Agent Harness Security applies the five security principles we introduced in our previous post through runtime visibility, inline enforcement, behavioral monitoring, and platform-aware governance.

Visibility begins with understanding what agents actually do. Agent Harness Security provides runtime visibility into prompts, tool calls, shell commands, file reads, repository interactions, and other agent activity, allowing security teams to investigate not only what happened but also how an agent reached a particular decision. This creates a comprehensive audit trail for security investigations, governance, and compliance while helping organizations understand how trust flows through the agent harness.

Control means applying security policies where they have the greatest impact. Rather than relying solely on controls outside the workflow, Agent Harness Security operates inline, allowing organizations to detect, block, or redact unsafe actions where the underlying coding agent platform supports those capabilities. Security policies can prevent unsafe commands and tool calls, sanitize sensitive content, redact confidential information, and reduce the impact of prompt injection attacks without disrupting developer productivity.

Validation remains essential before deployment, but runtime introduces new variables that static validation alone cannot address. As agents consume new information, invoke additional tools, and interact with changing environments, runtime security continuously evaluates behavior as it unfolds.

Monitoring extends beyond individual prompts. Agent Harness Security evaluates behavior across the full runtime session, recognizing the combinations of events that transform otherwise benign actions into multi-step attacks such as prompt injection, sensitive data exposure, or unsafe command execution. This behavioral approach enables the detection of AI-native threats before they become security incidents, rather than relying on individual prompts or events in isolation.

Finally, governance requires understanding not only which policies were configured but also what was actually enforced. Because coding agent platforms expose different runtime capabilities, Agent Harness Security adapts to each platform while clearly reporting what actions were enforced, monitored, or limited by the underlying platform. This platform-aware enforcement eliminates ambiguity by distinguishing between policy decisions, deployment choices, and limitations of the underlying coding agent platform, providing organizations with auditable evidence of monitoring, enforcement, and policy compliance.

Together, these capabilities provide organizations with the visibility and runtime controls needed to confidently adopt AI coding agents while preserving the productivity gains they were designed to deliver.

Looking Ahead

Coding agents are among the fastest-growing use cases for agent harness security because they interact directly with source code, developer tools, repositories, credentials, and production infrastructure, making them a natural place to start.

They also provide an early look at the security challenges that will emerge across the broader agent ecosystem.

The same architectural patterns that define coding agents are increasingly appearing across enterprise AI systems. As organizations deploy agents across the enterprise, the central challenge won't change. Security teams will need to understand not only what an agent is capable of, but how it reaches its decisions and what influences them.

That's why securing AI can no longer stop at the language model. It must extend to the agent harness, where context is gathered, tools are invoked, actions are executed, and trust is established.

HiddenLayer Agent Harness Security was built around that principle. Designed specifically for the agent harness, it provides visibility into agent activity, detects AI-native threats across multi-step workflows, and applies inline protections where supported by the coding agent platform. By embedding security directly within supported coding agent platforms, organizations can secure AI-assisted software development without disrupting developer workflows while giving security teams the visibility and enforcement needed to manage risk.

‍