Personal agents need a different kind of harness

Independent researcher Kira Howe released a security analysis showing that personal AI assistants cannot remain secure while retaining command-line shell access, as detailed in kirahowe.com's report. The analysis shows that giving models interactive shell access creates an inevitable failure mode when combining private data with untrusted web content. To halt exfiltration, platforms must eliminate terminal environments entirely from autonomous agent workflows.

This report examines why execution sandboxes and model classifiers fail, how session history determines authority, and what software teams must replace shells with in production. It is written for systems engineers and architects deploying developer agents or enterprise copilots across untrusted networks. Readers will find concrete operational metrics from frontier labs, recent breach analyses, and reference monitor designs for autonomous tools.

A different kind of harness: what actually changed

The conventional approach to securing developer assistants like Claude Code and Codex relies on granting broad shell access while imposing external guardrails like approval prompts, sandboxes, and secondary classifiers. Empirical testing demonstrates that this strategy routinely fails in production. Anthropic revealed that users accepted ninety-seven percent of approval prompts, which quickly induced severe review fatigue. After evaluating only fifty prompts, human supervisors caught just five percent of dangerous commands because inspecting complex, mangled bash syntax manually is completely impractical during daily development tasks.

Automated classifiers evaluating model actions also suffer from significant leakiness. Anthropic's Claude containment documentation noted that auto mode blocked point four percent of benign commands while letting seventeen percent of overeager actions pass through. Security researcher Johann Rehberger of Embrace The Red achieved malicious execution past auto mode with up to eighty percent success by directing Claude to bypass tools and invoke curl directly. Although Anthropic recorded zero hijackings in seven hundred twenty controlled tests, real-world evaluations confirm that classifiers fail as reliable security perimeters.

A different kind of harness: how it works

The alternative framework establishes the runtime harness as a classical reference monitor that remains tamper-proof, small enough for formal verification, and always invoked. In this design, every read operation, tool invocation, model query, and outbound message must pass through the harness before execution occurs. An interactive shell obscures operational intent because commands like cat, curl, rm -rf, and git push appear as raw string payloads handed to bash. Removing shell access allows the harness to inspect structured operations explicitly, evaluating data flow prior to execution.

This architecture treats authority as a dynamic session property rather than an identity attribute. Applying Kenneth Biba's 1977 integrity model, permissions follow a low-water-mark policy where an agent's authority drops upon consuming untrusted external inputs. Meta adopted a related principle with its Agents Rule of Two, requiring human supervision once an agent touches all three lethal trifecta capabilities: private data, untrusted inputs, and outbound channels. Mediating authority inside the harness avoids implementing complex information-flow operating systems like Asbestos, HiStar, or Flume beneath unconstrained terminal environments.

A different kind of harness: why it matters now

Relying on ambient authority exposes personal agents to persistent prompt injection vulnerabilities. Human judgment remains stable after reading deceptive messages, but models execute instructions supplied in context. When an agent reads an email from an external sender, that sender effectively gains operational control over subsequent actions. This dynamic recreates the Confused Deputy problem identified in Norm Hardy's 1988 paper, where a privileged program misuses its authority on behalf of an untrusted requester because permissions attach to process identity rather than verified request intent.

Recent incidents demonstrate that traditional operating-system sandboxes cannot stop data exfiltration when network access remains available. Two days after Anthropic launched Cowork, PromptArmor showed that planted credentials forced the system to upload local files to an attacker's Anthropic account via the official Files API. The exploit executed curl in a shell toward api.anthropic.com, an endpoint explicitly on the allowlist. Anthropic confirmed the sandbox functioned perfectly even as data leaked. Similarly, Aim Labs uncovered the EchoLeak flaw in Microsoft 365 Copilot, exfiltrating enterprise data through image URLs on trusted Teams domains.

A different kind of harness: who is affected

Software developers using command-line coding assistants face severe exposure under ambient execution models. Systems like Claude Code operate with direct access to local project files, credentials, and active terminal environments. Because single shell commands can move data from disk storage to external networks without passing through the model's text context—such as appending file contents to query parameters during a fetch—attackers can exfiltrate sensitive files unnoticed. Any untrusted repository or web documentation an agent reads can inject hidden instructions that commandeer shell access and compromise the host environment.

Enterprise organizations deploying workplace copilots across collaborative office environments encounter identical risks. When automated assistants connect corporate inboxes, file repositories, and messaging platforms to the web, untrusted external communications can trigger unauthorized internal actions. Aim Labs' discovery in Microsoft 365 Copilot proved that content security policies on trusted communication services like Teams fail to prevent exfiltration when assistants process third-party messages. Because user prompt confirmations produce ninety-seven percent approval rates due to cognitive exhaustion, organizations cannot rely on human workers to spot subtle exfiltration payloads hidden within routine command sequences.

A different kind of harness: what to watch

The artificial intelligence industry faces growing scrutiny regarding whether frontier labs can self-police their security claims. Anthropic marketed a zero percent attack success rate across seven hundred twenty automated tests for auto mode, but subsequently classified Johann Rehberger's eighty percent bypass rate as out of scope by defining auto mode as an unverified best-effort classifier rather than a security boundary. As enterprise adoption expands, platform vendors will need to provide transparent documentation on whether guardrail filters, sandboxes, or network restrictions offer verifiable containment against untrusted data streams.

The transition away from raw interactive shells toward discrete, structured tool APIs represents the primary operational shift to monitor. Future architectures will test whether systems can replace unmonitored bash invocation with reference monitors that track session data flow and apply session-based authority models like Kenneth Biba's low-water-mark policy or Meta's Rule of Two. Removing shell environments prevents malicious payloads from manipulating underlying network sockets or file descriptors without inspection. Systems that successfully mediate all read and send interactions at the harness level will establish viable standards for deploying useful yet secure personal software agents.