Security Controls for AI Coding Agents via Harness Engineering

A recent study published on arXiv (2607.25890) explores the implementation of security measures for AI coding agents via a specialized agent harness. The researchers employed a phased testing approach across four configurations: two commercial agents—one with controls and one without—a baseline harness, and a security-enhanced harness. They utilized a suite of 23 tests based on the OWASP Top 10 for Agentic Applications. The team created SHarD (Secure Harness Distribution), based on the Pi agent harness, which showed that three types of security controls can be effectively applied to commercial AI coding agents and scaled for a distributed user base. This research tackles the key challenge of scaling agentic AI: addressing security and risk issues, as current controls lack systematic distribution to engineering teams, and vendor-native solutions create ecosystem dependencies.