Skip to content

Threat taxonomy

harnesswatch threat taxonomy for AI coding-agent harnesses (RQ1). Status: final for Phase 2; 2026-10-15.

Classification rule

  • Each incident gets exactly one primary class, chosen by the first applicable step below (the control that failed first on the attack path), so two raters converge. Secondary classes may be recorded outside this file.
    1. kind = misuse (attacker operates the harness; no product defect) -> T16.
    1. Harness package, release or update channel compromised, or vendor release leaked internals -> T06; malicious or tampered skill/plugin/extension or its pin/signature verification -> T05; malicious MCP package -> T04.
    1. Execution sandbox or interpreter boundary crossed (including writes from inside the sandbox that an unsandboxed component later honours) -> T17. A browser-surface boundary -> T12.
    1. Control endpoint (HTTP/WebSocket/gateway/webhook/pairing/scope) lacks authentication, Origin/Host validation or correct scoping -> T18.
    1. Tenant, user or session separation on a shared/hosted service -> T13.
    1. Vendor-side data flow (telemetry, whole-workspace upload, retention) or missing audit log -> T15.
    1. Destructive action with no attacker involved -> T14.
    1. Non-interactive CI/automation workflow consuming untrusted trigger text -> T09.
    1. Persistent memory/context store -> T10; delegation to sub-agents or other harnesses -> T11.
    1. MCP protocol trust (tool definitions, approval binding/re-approval, OAuth, install deeplink, registry) -> T04.
    1. Repository, workspace or agent-writable configuration/file honoured or executed (including git config, workspace executables, folder names) -> T02.
    1. Approval, allowlist, path or command-validation logic or permissive default permission mode -> T03; if the only capability gained is data egress through a permitted command or filter -> T08.
    1. Output rendering, fetch tools, URL/domain filters, DNS or allowed-host egress -> T08.
    1. Credential/state storage, logging or telemetry content exposed by the harness itself -> T07.
    1. Conventional code defect (deserialization, SQL/argument/XSS injection, DoS, temp-file race) not gating an agent capability -> T19.
    1. Otherwise (injected content steers a harness that behaved as designed) -> T01.

Classes

ID Name Incidents Rules
T01 Indirect prompt injection via workspace and retrieved content 15 HG-CI-001, HG-INJ-001, HG-INJ-002, HG-INJ-003, HG-MCP-004, HG-PERM-001
T02 Repository and workspace configuration as code execution 52 HG-HOOK-001, HG-HOOK-002, HG-MCP-005, HG-MCP-006
T03 Permission-model weaknesses and approval bypass 67 HG-MCP-006, HG-PERM-001, HG-PERM-002, HG-SUB-001
T04 MCP trust: tool poisoning, rug pulls, OAuth and server identity 13 HG-MCP-001, HG-MCP-002, HG-MCP-003, HG-MCP-004, HG-MCP-005, HG-MCP-006
T05 Skills, plugins, extensions and marketplaces 6 HG-INJ-001, HG-INJ-002
T06 Harness distribution and dependency supply chain 12 HG-HOOK-002, HG-INJ-003, HG-MCP-001, HG-SUP-001, HG-SUP-002
T07 Secret exposure and residue 10 HG-MCP-003, HG-PERM-003, HG-SEC-001, HG-SEC-002, HG-SEC-003
T08 Data exfiltration channels 23 HG-CI-001, HG-HOOK-002, HG-INJ-002, HG-MCP-002, HG-NET-001
T09 Headless and CI abuse (pwn request) 8 HG-CI-001, HG-CI-002
T10 Persistent memory and long-lived context poisoning 2 HG-MEM-001
T11 Sub-agent and cross-harness trust propagation 3 HG-SUB-001
T12 Browser and computer-use surfaces 1 -
T13 Multi-tenant isolation and authorization 8 -
T14 Destructive and unsafe autonomous actions 2 HG-CI-002, HG-PERM-001, HG-PERM-002, HG-PERM-003
T15 Telemetry, data residency, retention and audit gaps 4 HG-TEL-001
T16 Offensive misuse of harnesses by attackers 3 -
T17 Execution sandbox and isolation escape 19 -
T18 Agent control-plane exposure and authorization 34 -
T19 Conventional software defects in agent runtimes and SDKs 46 -

T01

Indirect prompt injection via workspace and retrieved content

Attacker-authored text that the harness places in the model context (instruction files such as AGENTS.md/CLAUDE.md/.cursorrules, README and code comments, issues and PRs, fetched web pages, tool results, hidden Unicode) steers the agent to use its granted tools. In this taxonomy T01 is the primary class only when the harness behaved as designed and no separate permission, config-trust, egress or sandbox control failed; otherwise the failed control's class is primary and T01 is the entry vector.

  • Harness surfaces: AGENTS.md, CLAUDE.md, .cursor/rules/*, .cursorrules, .github/copilot-instructions.md, GEMINI.md, README/code comments/test fixtures read by the agent, issue/PR bodies and comments pulled by tools, web fetch and tool results, hidden Unicode tag/bidi/zero-width characters
  • MITRE ATLAS: AML.T0051.001, AML.T0093, AML.T0068, AML.T0094
  • OWASP LLM 2025: LLM01
  • OWASP Agentic: ASI01
  • OWASP MCP: MCP06
  • STRIDE: T, E

What is different in a harness. Classic LLM-app injection ends in a bad answer or leaked system prompt; in a harness the injected text is read from a developer's own repository or a tool result and the model holds shell, file-write and network tools, so the same string becomes code execution or exfiltration. Instruction files are also versioned, shared and loaded automatically, which makes the injection persistent and supply-chain-distributable. Output filtering does not help because the payload is the agent's actions, not its text.

T02

Repository and workspace configuration as code execution

Files that live in or are written into the workspace (hooks, MCP server definitions, IDE task files, workspace settings, project plugins, git configuration, workspace-resident executables, env files) are executed or honoured by the harness or its host IDE without the consent the product claims to require. This covers pre-trust execution, trust-dialog bypass, and configuration that the agent itself can write and that later runs unsandboxed.

  • Harness surfaces: .claude/settings.json and settings.local.json hooks, .cursor/hooks.json, .cursor/mcp.json, .cursor/cli.json, .kiro/hooks, .kiro/settings, .codex/config.toml, opencode.json, .vscode/tasks.json (runOn folderOpen), .vscode/settings.json, *.code-workspace, .mcp.json, .git/config (core.fsmonitor, core.hooksPath), git attributes filters, project .env files, workspace-resident executables found via search path
  • MITRE ATLAS: AML.T0081, AML.T0050, AML.T0053
  • OWASP LLM 2025: LLM06
  • OWASP Agentic: ASI05, ASI02
  • OWASP MCP: MCP09
  • STRIDE: E, T

What is different in a harness. A classic LLM app has no notion of a working directory whose contents are executable configuration; an agent harness inherits the IDE/CLI 'open folder' trust problem and adds an agent that can write those same files. The attack needs no model misbehaviour at all when the config is merely cloned, which puts it closer to malicious-repository attacks on editors than to prompt injection.

T03

Permission-model weaknesses and approval bypass

The mechanism that decides which tool calls, commands, paths and domains run without human approval is wrong, over-broad or defeated: allowlist matching on command prefixes, shell parsing differences, path or symlink checks, TOCTOU, over-permissive defaults and approve-everything modes. The harness believes a user approved or a policy permitted an action that in effect it did not.

  • Harness surfaces: permissions.allow/deny rules (Bash(*), prefix allowlists), auto-approve / YOLO / bypassPermissions / full-auto flags and settings, command parsers and safe-command lists (sed, find, echo, rg, git, env-var prefixes), path restriction, .gitignore-style ignore files, protected-path lists, symlink and junction handling, managed-settings precedence
  • MITRE ATLAS: AML.T0053, AML.T0050, AML.T0102
  • OWASP LLM 2025: LLM06
  • OWASP Agentic: ASI02, ASI03
  • OWASP MCP: MCP02
  • STRIDE: E, T

What is different in a harness. Classic LLM apps rarely execute model output; in a harness the approval layer is the primary security boundary between a manipulable model and the OS, and it is implemented as string and path matching over free-form shell, which is notoriously bypassable. Defective checks of this kind (root cause RC3) are the largest single root cause in the incident set.

T04

MCP trust: tool poisoning, rug pulls, OAuth and server identity

Trust failures specific to Model Context Protocol and similar tool protocols: tool descriptions or results that carry instructions, definitions that change after approval, project-supplied servers started or auto-approved without a prompt, install deeplinks that hide arguments, OAuth flows that send credentials to a server-chosen authorization server, and malicious or typosquatted MCP packages. Vulnerabilities in MCP server code are classified by their mechanism (T03, T18, T19), not here.

  • Harness surfaces: .mcp.json, mcpServers in settings, per-harness MCP config, tool name/description/schema fields shown to the model, tool-approval and re-approval state, MCP install deeplinks (cursor://, vscode:), MCP OAuth discovery and token storage, MCP registries and npx/uvx launch commands
  • MITRE ATLAS: AML.T0110, AML.T0109, AML.T0011.002, AML.T0010.005, AML.T0099, AML.T0131
  • OWASP LLM 2025: LLM03, LLM01, LLM06
  • OWASP Agentic: ASI04, ASI02
  • OWASP MCP: MCP03, MCP04, MCP05, MCP07, MCP09, MCP10
  • STRIDE: S, T, E

What is different in a harness. The tool catalogue is itself model input: a server can change what the model sees after the user approved it, and tool results re-enter the context, so supply-chain and prompt-injection risk merge. A chat app with plugins has the same shape, but harness MCP servers run as local processes with the developer's credentials.

T05

Skills, plugins, extensions and marketplaces

Installable capability bundles for the harness or its host IDE (skills with SKILL.md, plugins, extensions, slash-command packs, subagent definitions) that are malicious, tampered with, mis-pinned or loaded from a repository, plus the marketplaces that distribute them. Instruction content in a skill is both code and prompt.

  • Harness surfaces: SKILL.md and bundled scripts, plugin manifests and marketplaces (Claude Code plugins, VS Code/Open VSX extensions, ClawHub, omp extensions, dsh plugins), plugin SHA/version pinning, install-time scripts and auto-update
  • MITRE ATLAS: AML.T0010.005, AML.T0115.002, AML.T0011.001, AML.T0111
  • OWASP LLM 2025: LLM03
  • OWASP Agentic: ASI04
  • OWASP MCP: MCP04
  • STRIDE: S, T, E

What is different in a harness. A skill is natural-language instruction executed by the agent with the user's tools, so malware needs no exploit and static scanners for code miss it; classic LLM apps have no equivalent end-user-installable instruction layer.

T06

Harness distribution and dependency supply chain

Compromise or integrity failure of the harness itself or of the packages around it: trojanised npm/PyPI releases, maintainer-account takeover, unauthorised publishes, curl-pipe-sh installers, unsigned auto-update, and accidental release of source or secrets in published artifacts. Worms that abuse the developer's installed AI CLIs with auto-approve flags belong here.

  • Harness surfaces: npm/PyPI/cargo packages and postinstall scripts, curl | sh installers, auto-update channel, release pipelines, signing and provenance, source maps and debug files in packages, ~/.claude.json, ~/.codex, ~/.gemini config files as harvest targets
  • MITRE ATLAS: AML.T0010.001, AML.T0011.001, AML.T0010, AML.T0083
  • OWASP LLM 2025: LLM03
  • OWASP Agentic: ASI04
  • OWASP MCP: MCP04
  • STRIDE: T, S, E

What is different in a harness. Harnesses are installed on developer machines that hold cloud and source-control credentials, and they are scriptable by other malware: the incident set shows packages that weaponise an installed agent with auto-approve flags as the exfiltration tool.

T07

Secret exposure and residue

Credentials and sensitive data are stored, logged or exposed by the harness in ways that exceed what the user expects: plaintext tokens, world-readable state directories, secrets copied into transcripts, memory, traces or exports, and race conditions on credential files. The harness itself, not an attacker-steered agent, is the source of the exposure.

  • Harness surfaces: ~/.claude/.credentials.json, ~/.codex/auth.json, ~/.pi/auth.json and equivalents, session transcripts, trajectories, response stores, OpenTelemetry spans and exported HTML sessions, MCP server env/headers in config, file modes of state directories
  • MITRE ATLAS: AML.T0055, AML.T0083, AML.T0037, AML.T0098
  • OWASP LLM 2025: LLM02
  • OWASP Agentic: ASI03
  • OWASP MCP: MCP01
  • STRIDE: I

What is different in a harness. A harness persists far more than a chat app: long transcripts that include tool output (so file contents and env dumps), credentials for model providers and MCP servers, and traces. Once the agent runs cat .env the secret is in the transcript for the retention period.

T08

Data exfiltration channels

Paths by which data in the agent's context leaves the machine: automatic Markdown image or link rendering, fetch tools and their URL or domain filters, pre-approved domains, DNS via 'safe' commands, schema-reference fetches, browser tools, git push and MCP egress. Applies when the net capability gained is egress; approval bypasses that give arbitrary execution are T03.

  • Harness surfaces: WebFetch/web search domain allowlists and preapproved lists, Markdown image/mermaid rendering in chat UIs, commands classed as safe (ping, nslookup, curl), JSON-schema $ref resolution, sandbox network policy, browser tool allowlists
  • MITRE ATLAS: AML.T0086, AML.T0077, AML.T0025, AML.T0057
  • OWASP LLM 2025: LLM02, LLM05
  • OWASP Agentic: ASI02
  • OWASP MCP: MCP10
  • STRIDE: I

What is different in a harness. Rendering-based exfiltration exists in chat apps, but a harness adds shell, git and browser egress and holds the data that is worth stealing (source, .env, keys). The lethal combination of private data, untrusted content and an outbound channel is routinely present by default.

T09

Headless and CI abuse (pwn request)

Agents run non-interactively in CI or issue/PR automation with repository secrets or write tokens while their prompt includes text written by untrusted parties (issue titles, PR bodies and branch names, comments, repo-local config from the PR head). No human is present to approve, so every control depends on static configuration.

  • Harness surfaces: claude -p, codex exec, gemini/grok/agy headless modes, official actions (claude-code-action and similar), pull_request_target / issue_comment / issues triggers, GITHUB_TOKEN permissions and secrets in agent steps, Actions cache, branch-name and title interpolation into shell steps
  • MITRE ATLAS: AML.T0051.001, AML.T0093, AML.T0119, AML.T0053
  • OWASP LLM 2025: LLM01, LLM06
  • OWASP Agentic: ASI01, ASI02, ASI03
  • OWASP MCP: MCP06
  • STRIDE: E, I, T

What is different in a harness. The attacker needs no foothold on a developer machine: a public issue is enough, and the agent runs inside the organisation's CI trust boundary with secrets. This is the pwn-request pattern from CI security with a model as the confused deputy.

T10

Persistent memory and long-lived context poisoning

Content that the agent can write into persistent stores which later sessions load as trusted context (memory files, notes, summaries produced by context compression, shared project memory, learned skills) lets one-time injection become standing instruction. The store may also be committed to version control and shared.

  • Harness surfaces: CLAUDE.md auto-memory and ~/.claude/projects memory, Hermes memory tool and context compression, omp Hindsight, OpenClaw memory and heartbeat files, thread summaries and compaction output
  • MITRE ATLAS: AML.T0080.000, AML.T0080, AML.T0081
  • OWASP LLM 2025: LLM04
  • OWASP Agentic: ASI06
  • OWASP MCP: -
  • STRIDE: T, E

What is different in a harness. Chat apps have per-user memory features too, but harness memory is plain files that are loaded into a context with shell access, shared across projects, and written by the same agent that reads untrusted repositories.

T11

Sub-agent and cross-harness trust propagation

Permissions, environment variables, credentials and sandbox exemptions flow from a parent agent to sub-agents, delegated harnesses (one harness driving another) or background workers more broadly than the user intended, or a delegated agent defaults to an approve-everything configuration.

  • Harness surfaces: sub-agent / task tools and their tool allowlists, delegation to other CLIs (Hermes/dsh driving Claude Code or Codex), heartbeat and scheduled runs, worktree isolation, tool relays between sandbox and host
  • MITRE ATLAS: AML.T0118, AML.T0118.001, AML.T0053
  • OWASP LLM 2025: LLM06
  • OWASP Agentic: ASI03, ASI07, ASI08
  • OWASP MCP: -
  • STRIDE: E, S

What is different in a harness. Multi-agent delegation multiplies confused-deputy paths: a low-privilege agent that reads untrusted data can instruct a high-privilege one. Classic LLM apps with a single model call have no inter-agent channel.

T12

Browser and computer-use surfaces

Agents that drive a browser or the desktop expose session cookies, same-profile logins, screenshots and page content to the model, and web content can act on the agent (clickbait, crafted pages) or reach local services from the browser's network position.

  • Harness surfaces: built-in or controlled Chromium (Antigravity, Cursor cloud agent browser), computer-use tools, browser profile and cookies, screenshots and DOM extraction, local agent endpoints reachable from the browser
  • MITRE ATLAS: AML.T0100, AML.T0078, AML.T0113, AML.T0112.000
  • OWASP LLM 2025: LLM01, LLM06
  • OWASP Agentic: ASI01, ASI02
  • OWASP MCP: -
  • STRIDE: S, I, E

What is different in a harness. Page content is attacker-controlled by construction and the agent acts with the user's logged-in identity; a chat app without browsing has no such surface.

T13

Multi-tenant isolation and authorization

Shared or hosted agent services fail to separate users, tenants, assistants, sessions or stores: missing or ignored authorization decorators, namespace prefix matching across tenants, session identifiers accepted without a principal check, client-supplied metadata trusted to reference another tenant's files.

  • Harness surfaces: agent platform APIs (assistants, runs, threads, stores), custom auth handlers and resource decorators, shared MCP server/transport instances, cloud sandboxes and shared workspaces, collaboration links
  • MITRE ATLAS: AML.T0085, AML.T0091
  • OWASP LLM 2025: LLM02
  • OWASP Agentic: ASI03
  • OWASP MCP: MCP07
  • STRIDE: I, E, S

What is different in a harness. Mostly classic multi-tenant authorization, but the stateful, tool-holding nature of an agent session means a cross-tenant mistake exposes credentials and tool access, not just records.

T14

Destructive and unsafe autonomous actions

The agent, without any attacker, takes irreversible actions beyond what the user intended (deleting data or drives, force-push, production migrations, ignoring a declared freeze), usually under auto-approve or with production credentials in reach. Impact depends on blast radius controls rather than on a bug.

  • Harness surfaces: auto-approve / turbo modes, cloud CLIs and database credentials in the environment, git force operations, instruction-following under code freeze or protected branches
  • MITRE ATLAS: AML.T0101, AML.T0048.000
  • OWASP LLM 2025: LLM06
  • OWASP Agentic: ASI02, ASI08
  • OWASP MCP: -
  • STRIDE: D, T

What is different in a harness. This is excessive agency in its literal form; it is distinctive because the harness grants the permission, so the same event can be hostile-injection or plain model error and must be bounded either way.

T15

Telemetry, data residency, retention and audit gaps

Vendor-side handling of code, prompts and transcripts, and the visibility the customer gets: telemetry that continues despite opt-out, whole-workspace uploads, retention, training-use defaults, region, and missing or incomplete audit logs. Policy choices are recorded as such and not scored as vulnerabilities.

  • Harness surfaces: telemetry and crash-reporting settings, cloud session upload / trajectory collection, retention and zero-data-retention options, training opt-out defaults, enterprise audit-log coverage
  • MITRE ATLAS: -
  • OWASP LLM 2025: LLM02
  • OWASP Agentic: -
  • OWASP MCP: MCP08
  • STRIDE: I, R

What is different in a harness. A coding harness streams source code and shell output to a vendor by design, so data governance becomes a security property; for chat apps the data is user-typed text.

T16

Offensive misuse of harnesses by attackers

Threat actors use agent harnesses as operational tooling (reconnaissance, credential hunting, orchestration, extortion). Recorded descriptively from vendor threat reports; no technique detail is collected and the class describes use, not a product defect.

  • Harness surfaces: agent CLIs run with attacker-held accounts, autonomous orchestration of sub-agents, MCP tooling used for scanning
  • MITRE ATLAS: AML.T0124, AML.T0116, AML.T0117
  • OWASP LLM 2025: -
  • OWASP Agentic: ASI10
  • OWASP MCP: -
  • STRIDE: E

What is different in a harness. Here the harness is the attacker's tool rather than the victim; the relevant defender controls are account and abuse monitoring by the vendor and audit logging by the customer.

T17

Execution sandbox and isolation escape

The OS-level or interpreter-level boundary that confines agent-executed code (Seatbelt, bubblewrap, Landlock, containers, restricted Python interpreters) is bypassed or silently absent: symlink and path confusion, TOCTOU, writes to config or git hooks that an unsandboxed component honours later, leaky network or DNS policy, and weak fallbacks when the container runtime is missing.

  • Harness surfaces: sandbox profiles and writable-root lists, restricted Python executors (smolagents LocalPythonExecutor, code interpreters), git hooks and settings files writable from inside the sandbox, container/VM runtime fallback logic, sandbox network proxy
  • MITRE ATLAS: AML.T0105, AML.T0097
  • OWASP LLM 2025: LLM06
  • OWASP Agentic: ASI05
  • OWASP MCP: -
  • STRIDE: E

What is different in a harness. The sandbox must contain code written by a model that an attacker can steer; escapes are therefore reachable remotely through content, unlike classic sandbox bugs that need hostile local code.

T18

Agent control-plane exposure and authorization

Local or networked services of the harness (HTTP/WebSocket servers, gateways, dashboards, pairing and scope systems, webhooks, IDE bridges) accept requests without authentication, origin or Host validation, or with mis-scoped authorization, so a web page, another local process or an internet scanner can drive the agent or read its state.

  • Harness surfaces: localhost HTTP/WebSocket servers (IDE extension bridges, web UIs, kanban/hub dashboards), gateways bound to 0.0.0.0, DNS rebinding and cross-site WebSocket hijacking, device pairing and operator scopes, messaging webhooks, MCP servers exposed over HTTP without auth
  • MITRE ATLAS: AML.T0132, AML.T0006.002, AML.T0049, AML.T0122, AML.T0078
  • OWASP LLM 2025: -
  • OWASP Agentic: ASI03
  • OWASP MCP: MCP07
  • STRIDE: S, E, I

What is different in a harness. Classic web and API authentication failures, but the service fronts a shell-capable agent so an unauthenticated request is remote code execution; local-first design makes browser-origin attacks (rebinding, CSWSH) the common path.

T19

Conventional software defects in agent runtimes and SDKs

Ordinary implementation bugs located in harness, SDK or tooling code that are not an agent-capability gate: unsafe deserialization of checkpoints or caches, SQL and argument injection, XSS in web UIs and registries, DoS and resource exhaustion, insecure temporary files, privilege escalation, terminal-emulator features. Included so that the share of non-agent-specific risk is measured honestly.

  • Harness surfaces: checkpoint/state serialization (pickle, msgpack, JSON modes), SQL-backed stores and filters, web UIs, session exports and registries, SDK helpers that build command lines, temp files and install paths, terminal escape-sequence handling
  • MITRE ATLAS: AML.T0049, AML.T0029
  • OWASP LLM 2025: LLM05, LLM10
  • OWASP Agentic: ASI05
  • OWASP MCP: MCP05
  • STRIDE: T, D, E

What is different in a harness. This class is what remains of classic AppSec when the agent is stripped away; its size (about one in seven incidents) shows that harness security is both a new problem and an old one. LLM05 and LLM10 apply only to a subset, so the OWASP LLM mapping is partial.

Known gaps

  • No rule in rules/ targets T12, T13, T16, T17, T18 or T19; T05 and T10 have one or two partial rules. See reports/phase2_notes.md for proposed rules.