The Model Has Preferences, but the Harness Got Controls - Part 1
Security Boulevard, Monday, October 26th, 2026
Anton Chuvakin argues the agent harness, not the AI model, must serve as the security boundary for AI agents.
In Part 1 of a series, Anton Chuvakin argues that an AI agent is a model plus a harness, and because models err and can be manipulated, the harness of sandboxes, tool policies, credentials and approval gates must be the security boundary.
He cites the April 2026 PocketOS incident, where a coding agent deleted a production database in nine seconds using an overly permissive token, along with approval fatigue and harness vulnerabilities in tools like Cursor and Copilot.
He recommends taking enforcement out of the model, limiting what agents can reach with scoped short-lived credentials and egress allowlists, and governing and monitoring harness configuration and telemetry.