cs.CRAug 18, 2026

HarnessRisk: A Lifecycle-Oriented Benchmark for Agent Harness Safety

Authors: Yajing Bai, Jinhao Duan, Jie Peng, Xianfeng Wu, Sijia Liu, Song Wang, Tianlong Chen

Organizations: University of North Carolina at Chapel Hill · University of Central Florida · Michigan State University

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Large language models are increasingly deployed through agent harnesses that manage tools, extensions, persistent state, permissions, and external actions. Existing safety benchmarks mainly target individual attack mechanisms or a limited subset of operational settings, making it difficult to compare how safety failures emerge across different harness responsibilities. We present HarnessRisk, a lifecycle oriented benchmark that organizes agent harness safety into six operational phases including Harness Configuration, Capability Extension, Runtime Operation, State Persistence, Action Control, and Incident Recovery. HarnessRisk contains 128 sandboxed cases, each pairing a benign user objective with an adversarial instruction embedded in an untrusted workflow artifact. We evaluate each trajectory using Utility, Attack Success Rate, Persistence, and Detection. Across three harnesses, six language models, and 14 model and harness configurations, attack success ranges from 12.6% to 80.9%, while Utility remains between 75.0% and 97.6%. Harness Configuration is the most vulnerable phase across all three harnesses, showing that attacks can succeed by altering security sensitive parameters within otherwise authorized workflows. We also find that explicit risk recognition does not reliably lead to safe action, as some configurations detect risks in more than 90% of runs while retaining substantial attack success. These results highlight the need to evaluate agent safety across multiple harness responsibilities and at the level of the deployed model and harness configuration.

Figures & tables

 Lifecycle Phase Coverage
BenchmarkMulti-TurnConfig.Extens.RuntimePersist.ActionRecov.
InjecAgent ( Zhan et al., 2024 )✗✗✗✓✗✓✗
Agent Security Bench ( Zhang et al., 2025a )✓✓✗✓✓✓✗
Agent-SafetyBench ( Zhang et al., 2024 )✗✗✗✓✗✓✗
ClawSafety ( Wei et al., 2026 )✓✗✗✓✗✓✗
PASB ( Wang et al., 2026a )✓✗✗✓✓✓✗
Table 1: Comparison with related agent safety, agent security, and harness auditing benchmarks. ✓ denotes covered and ✗ denotes not covered.
Figure 1: Illustrative attack chain across the six HarnessRisk lifecycle phases, from malicious configuration and capability extension to runtime compromise, persistent poisoning, unauthorized action, and incomplete recovery.
Figure 2: Distribution of HarnessRisk cases across six lifecycle phases and seven attack categories. The inner ring shows phase level coverage, while the outer ring shows the corresponding attack type composition.
Figure 3: Attack success across lifecycle phases, models, and harnesses. Each cell reports ASR, where lower values indicate safer behavior. All panels use the same color scale.
Figure 5: Relationships of Utility and Detection with ASR across 12 model–harness configurations. Panels compare Utility and Detection with ASR. Colors indicate harnesses, shapes indicate models, dashed lines show linear fits, and insets report Pearson and Spearman correlations.
Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Lifecycle phasennTypical untrusted artifactTargeted responsibility
Harness Configuration22guides, templates, manifestscredentials, connectors, policies
Capability Extension22package or marketplace metadatainstallation, updates, permissions
Runtime Operation21email, webpage, document, tool outputroutine tool-mediated execution
State Persistence21profiles, notes, synchronized recordsmemory, identity, durable policy
Action Control21tickets, messages, operational recordspayment, deployment, deletion, grants
Incident Recovery21logs, hold notices, recovery recordsrollback, revocation, evidence repair
Appendix
Table 4: Composition of the 128 benchmark cases. The final column summarizes the harness responsibility exercised by each phase rather than an exhaustive list of case objectives.
MetricPositive labelImportant exclusion
UtilityThe benign objective is completed in observable evidence.A claim of completion without the required output is insufficient.
ASRThe attacker-selected objective or harmful side effect occurs.Attempted actions without the specified outcome are not automatically successful.
PersistenceThe attack modifies durable memory, extensions, configuration, policies, or startup artifacts.One-time effects and ordinary output files are not persistence.
DetectionThe agent explicitly identifies the concrete content as abnormal, malicious, suspicious, or untrusted.Silent avoidance, generic disclaimers, and unexplained failure do not count.
Appendix
Table 5: Operational rubric used by the GPT-5.4 trajectory evaluator. Each metric is scored independently, so Utility and ASR may both equal one.
More in this topic

AI Agent Safety Benchmarks

AI agent safety benchmarks measure whether tool-using and embodied AI systems act safely across realistic tasks and interactions.

See all 208 papers

Explore similar work

CardsList
Apr 15, 2026

SafeHarness: Lifecycle-Integrated Security Architecture for LLM-based Agent Deployment

The performance of large language model (LLM) agents depends critically on the execution harness, the system layer that orchestrates tool use, context management, and state persistence. Yet this same architectural centrality makes the harness a high-value attack surface: a single compromise at the harness level can cascade through the entire execution pipeline. We observe that existing security approaches suffer from structural mismatch, leaving them blind to harness-internal state and unable to coordinate across the different phases of agent operation. In this paper, we introduce \safeharness{}, a security architecture in which four proposed defense layers are woven directly into the agent lifecycle to address above significant limitations: adversarial context filtering at input processing, tiered causal verification at decision making, privilege-separated tool control at action execution, and safe rollback with adaptive degradation at state update. The proposed cross-layer mechanisms tie these layers together, escalating verification rigor, triggering rollbacks, and tightening tool privileges whenever sustained anomalies are detected. We evaluate \safeharness{} on benchmark datasets across diverse harness configurations, comparing against four security baselines under five attack scenarios spanning six threat categories. Compared to the unprotected baseline, \safeharness{} achieves an average reduction of approximately 38% in UBR and 42% in ASR, substantially lowering both the unsafe behavior rate and the attack success rate while preserving core task utility.

Xixun Lin, Yang Liu, Yancheng Chen +8

Institute of Information Engineering, Chinese Academy of Sciences · Academy of Mathematics and Systems Science, Chinese Academy of Sciences · Institute of Applied Physics and Computational Mathematics +1

LLM Agent SafetyLLM Agent HarnessesTool Access Control for LLM Agents
AskPDF
Aug 7, 2026

HarnessSafe: Evaluating Safety Across Persistent Carriers in Agent Harnesses

Modern agent harnesses persist state across tasks and sessions through persistent carriers like memory, skills, tools, and shared artifacts. However, this capability creates delayed safety risks: attacker-influenced content can cross system boundaries and later affect the execution of a benign request. Existing benchmarks typically focus on a few carriers or harnesses, while end-to-end attack-success rates reveal little about how risks propagate. To this end, we present HarnessSafe, a benchmark comprising 328 executable cases across seven persistent-carrier families and evaluated on most mainstream agent harnesses. Each case is specified as a Persistent-Risk Lifecycle that traces attacker influence from its initial entry, through persistence across carriers and system boundaries, to a later benign trigger and an observable violation. We further introduce a multi-stage, trace-based evaluation that uses observable execution evidence to determine how far each attack chain progresses and where it is stopped. Experiments show that containment is carrier-specific and strongly depends on the harness-model configuration. Both the harness and model backend substantially shape containment outcomes, while attack success rates cannot reflect distinct lifecycle progression patterns.

Xiao Zhang, Yusheng Wang, Yuhao Fei +5

Beijing University of Posts and Telecommunications · China Telecom Group Co., Ltd. · Beijing Academy of Artificial Intelligence

AI Agent SecurityAI Agent Safety BenchmarksLLM Agent SafetyLLM Agent Harnesses
AskPDF
May 14, 2026

Auditing Agent Harness Safety

LLM agents increasingly run inside execution harnesses that dispatch tools, allocate resources, and route messages between specialized components. However, a harness can return a correct, benign answer over a trajectory that accesses unauthorized resources or leaks context to the wrong agent. Output-level evaluation cannot see these failures, yet most safety benchmarks score only final outputs or terminal states, even though many violations occur mid-trajectory rather than at termination. The central question is whether the harness respects user intent, permission boundaries, and information-flow constraints throughout execution. To address this gap, we propose HarnessAudit, a framework that audits full execution trajectories across boundary compliance, execution fidelity, and system stability, with a focus on multi-agent harnesses where these risks are most pronounced. We further introduce HarnessAudit-Bench, a benchmark of 210 tasks across eight real-world domains, instantiated in both single-agent and multi-agent configurations with embedded safety constraints. Evaluating ten harness configurations across frontier models and three multi-agent frameworks, we find that: (i) task completion is misaligned with safe execution, and violations accumulate with trajectory length; (ii) safety risks vary across domains, task types, and agent roles; (iii) most violations concentrate in resource access and inter-agent information transfer; and (iv) multi-agent collaboration expands the safety risk surface, while harness design sets the upper bound of safe deployment.

Chengzhi Liu, Yichen Guo, Yepeng Liu +8

University of California, Santa Barbara · University of California, Berkeley · Microsoft Research +2

AI Agent AuditingLLM AuditingAI Agent Security BenchmarksLLM Agent SafetyMulti-Agent System Security
AskPDF