Compositional Safety Failures in Harness Evolution: Identification and Runtime Monitoring

Zhixiang Zhang; Zesen Liu; Wai Ip Lai; Hongxu chen; Dongdong She

cs.AISep 27, 2026

Compositional Safety Failures in Harness Evolution: Identification and Runtime Monitoring

Authors: Zhixiang Zhang, Zesen Liu, Wai Ip Lai, Hongxu chen, Dongdong She

Organizations: The Hong Kong University of Science and Technology

Abstract

Self-evolving agent harnesses continually update persistent components such as memory, prompts, skills, and tools. We call this process harness evolution. However, such evolution could introduce unexpected safety risks. Existing work studies harness misevolution and validates candidate harnesses or attributed individual component updates, leaving safety analysis of cross-component update interactions largely unexamined. To address this gap, we study compositional safety failures in harness evolution, where interactions among individually safe and utility-preserving component updates can produce undesirable or unsafe agent behavior, revealing a safety risk intrinsic to harness evolution. Across three safety-related benchmarks, we identify 43 pairwise and 18 irreducible 3-way compositional safety failures. Conventional solution incurs combinatorial complexity in validating cross-component interactions, leaving the safety checking impractical as the harness evolves. To solve this, we introduced a typed hypergraph that represents component states as nodes and safety-relevant higher-order interactions as hyperedges. When the harness changes, the hypergraph updates only the interaction neighborhood of the changed states rather than reconstructing the global composition space. Building on that, we develop a hypergraph-guided runtime monitoring mechanism. Experiments show that our method effectively mitigates compositional safety risks while preserving task utility and reducing interaction-checking costs, and further reveal an empirical safety-utility-cost trade-off across different safety mechanisms.

Figures & tables

Figure 1: A motivating example of compositional safety failure in harness evolution. The arrows denote two independently accepted updates: the prompt update $P_{0}\rightarrow P_{1}$ adds Bob to authorize_group , while the memory update $M_{0}\rightarrow M_{1}$ adds BoA to bank_account . Under the rule that authorize_group can access bank_account , either update alone remains safe: Bob is not authorized under $P_{0}$ , and BoA is unavailable under $M_{0}$ . However, when the updated states $P_{1}$ and $M_{1}$ coexist, Bob can access BoA, producing a compositional safety failure.

Method	Phase	Verification Scope	Interaction-Level Analysis
TTHE ( Nie et al., 2026 )	Test-time	Candidate harness	✗
AutoSaddler ( Park et al., 2026 )	Offline	Component patch	✗
HarnessLens ( Xu et al., 2026a )	Offline	Harness modification	✗
SHE ( Qu et al., 2026 )	Offline	Attributed update	✗
SafeEvolve ( Mao et al., 2026 )	Offline	Candidate harness	✗
Ours	Runtime	Component-state interaction	✓

Table 1: Position of our work with existing literature. Existing works mainly focus on individual components, while our work analyzes the cross-component interactions.

Benchmark	Panels	Eligible	CF	CFR
AgentDojo ( Debenedetti et al., 2024 )	600	157	22	14.01%
Agent-SafetyBench ( Zhang et al., 2024b )	182	11	2	18.18%
Agent Security Bench ( Zhang et al., 2025 )	1362	1243	19	1.53%

Table 2: Results of pairwise compositional safety failure identification.

Figure 2: Overview of our method. (a) A candidate update $u_{t}$ introduces a component-state node ( $t^{+}$ in this example), and the local interaction neighborhood $\Gamma_{h}(u_{t})$ is extracted from the existing hypergraph $G_{t}$ . (b) Local completion proposes interactions involving the new state. An LLM filters these candidates using component states and provenance, yielding the provisional hypergraph $\widetilde{G}_{t+1}$ . Solid and dashed contours denote observed and predicted hyperedges, respectively; node shapes encode component types. (c) Within one action context, participating nodes become active (filled) in sequence. Each activation visits only incident hyperedges; a fully activated interaction is checked before the action takes effect. Execution provenance promotes a predicted hyperedge to observed status once confirmed at runtime, irrespective of its safety verdict.

Method	AgentDojo	Agent-SafetyBench	Agent Security Bench
No Monitoring	22/157 (14.01%)	2/11 (18.18%)	19/1243 (1.53%)
Naive	1/157 (0.64%)	0/11 (0.00%)	0/1243 (0.00%)
SHE ( Qu et al., 2026 )	6/157 (3.82%)	1/11 (9.09%)	5/1243 (0.40%)
HarnessLens ( Xu et al., 2026a )	8/157 (5.10%)	1/11 (9.09%)	5/1243 (0.40%)
Ours	2/157 (1.27%)	0/11 (0.00%)	1/1243 (0.08%)

Table 3: Safety effectiveness of different mechanisms against compositional failures. Each entry reports the residual compositional failure rate (CFR) as

f/n

(

\%

), where

f

is the number of compositional failures among the

n

eligible panels. The eligible panel set is fixed before applying each safety mechanism.

Method	Utility $\uparrow$	Verification $\downarrow$	Runtime Check Rate $\downarrow$	Time Cost (s/task) $\downarrow$
AgentDojo
Naive	58.6%	–	100.0%	103.9
SHE ( Qu et al., 2026 )	57.3%	1200	–	77.1
HarnessLens ( Xu et al., 2026a )	52.9%	114	–	33.8
Ours	59.2%	82	33.6%	32.5
Agent-SafetyBench

Table 4: Utility and verification cost of different safety mechanisms. Utility is the fraction of eligible panels satisfying the benchmark-specific task objective. Verification counts additional validation executions per harness update. Runtime Check Rate is the fraction of candidate actions invoking the runtime safety checker. Time Cost is the additional wall-clock time per panel over execution without a safety mechanism.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Benchmark	Triples	Eligible	3-CF	3-CFR
AgentDojo ( Debenedetti et al., 2024 )	540	138	15	10.87%
Agent Security Bench ( Zhang et al., 2025 )	681	578	3	0.52%

Appendix

Table 5: Identification of 3-way compositional failures. A triple is eligible only when the baseline, all individual updates, and all pairwise compositions are safe and utility-preserving. 3-CF counts failures that emerge only under the full three-update composition, and 3-CFR is computed as 3-CF/Eligible.

$h$	Residual CFR $\downarrow$	Utility $\uparrow$	Runtime Check Rate $\downarrow$	Time Cost (s/task) $\downarrow$
2	4/157 (2.55%)	60.5%	30.1%	30.1
3	2/157 (1.27%)	59.2%	33.6%	32.5
4	2/157 (1.27%)	58.0%	47.6%	49.7

Appendix

Table 6: Sensitivity to the local interaction radius

h

on AgentDojo.

Explore similar work

Aug 7, 2026cs.CR

HarnessSafe: Evaluating Safety Across Persistent Carriers in Agent Harnesses

Modern agent harnesses persist state across tasks and sessions through persistent carriers like memory, skills, tools, and shared artifacts. However, this capability creates delayed safety risks: attacker-influenced content can cross system boundaries and later affect the execution of a benign request. Existing benchmarks typically focus on a few carriers or harnesses, while end-to-end attack-success rates reveal little about how risks propagate. To this end, we present HarnessSafe, a benchmark comprising 328 executable cases across seven persistent-carrier families and evaluated on most mainstream agent harnesses. Each case is specified as a Persistent-Risk Lifecycle that traces attacker influence from its initial entry, through persistence across carriers and system boundaries, to a later benign trigger and an observable violation. We further introduce a multi-stage, trace-based evaluation that uses observable execution evidence to determine how far each attack chain progresses and where it is stopped. Experiments show that containment is carrier-specific and strongly depends on the harness-model configuration. Both the harness and model backend substantially shape containment outcomes, while attack success rates cannot reflect distinct lifecycle progression patterns.

Xiao Zhang, Yusheng Wang, Yuhao Fei +5

Beijing University of Posts and Telecommunications · China Telecom Group Co., Ltd. · Beijing Academy of Artificial Intelligence

Agent Harness Attack-Success Rate Persistence

Ask PDF

Aug 10, 2026cs.AI

SHE: Trajectory-driven Safety Harness Evolution for LLM Agents

The safety of large language model (LLM) agents depends not only on model weights but also on the agent harness that manages context, memory, tools, permissions, and runtime control. Existing safety mechanisms often treat the harness as a fixed deployment artifact, limiting their ability to evolve with emerging risks. Moreover, coupled functions across harness components obscure safety responsibility attribution, making localized evolution difficult. We propose Safety Harness Evolution (SHE), a framework that learns evolving safe boundaries from rollout trajectories. SHE decomposes the harness into four artifacts with explicit safety responsibilities, including the System Prompt, Rule Bank, Safety Memory, and Tool Policy, defining clear functional boundaries for localized evolution. Based on this decomposition, SHE introduces an attribution-guided evolution loop that converts trajectory failures into structured diagnoses, learns artifact-specific boundary refinements, and selects evolved harnesses through safety-utility validation. Experiments on Agent-SafetyBench demonstrate that SHE effectively enhances safety through harness evolution, achieving a 3.1x ASR reduction compared with static SafeHarness, while also improving benign utility. The evolved harness further generalizes to unseen risks on the held-out AgentHarm benchmark and transfers across agent models without additional evolution.

Wanying Qu, Qinghua Mao, Yu Li +12

Shanghai Artificial Intelligence Laboratory · Shanghai Jiao Tong University · Fudan University +1

Large Language Model Safety Large Language Model Agents Agentic Benchmarks

Ask PDF

May 14, 2026cs.CL

Auditing Agent Harness Safety

LLM agents increasingly run inside execution harnesses that dispatch tools, allocate resources, and route messages between specialized components. However, a harness can return a correct, benign answer over a trajectory that accesses unauthorized resources or leaks context to the wrong agent. Output-level evaluation cannot see these failures, yet most safety benchmarks score only final outputs or terminal states, even though many violations occur mid-trajectory rather than at termination. The central question is whether the harness respects user intent, permission boundaries, and information-flow constraints throughout execution. To address this gap, we propose HarnessAudit, a framework that audits full execution trajectories across boundary compliance, execution fidelity, and system stability, with a focus on multi-agent harnesses where these risks are most pronounced. We further introduce HarnessAudit-Bench, a benchmark of 210 tasks across eight real-world domains, instantiated in both single-agent and multi-agent configurations with embedded safety constraints. Evaluating ten harness configurations across frontier models and three multi-agent frameworks, we find that: (i) task completion is misaligned with safe execution, and violations accumulate with trajectory length; (ii) safety risks vary across domains, task types, and agent roles; (iii) most violations concentrate in resource access and inter-agent information transfer; and (iv) multi-agent collaboration expands the safety risk surface, while harness design sets the upper bound of safe deployment.

Chengzhi Liu, Yichen Guo, Yepeng Liu +8

University of California, Santa Barbara · University of California, Berkeley · Microsoft Research +2

Agent Harness Model Auditing Safety Constraints

Ask PDF