Hugging Face researchers have introduced HarnessRisk, a lifecycle-oriented benchmark designed to evaluate the safety of AI agent harnesses—the systems that manage tools, extensions, persistent state, permissions, and external actions for large language models (LLMs). The benchmark addresses a critical gap: existing safety tests focus on individual attack mechanisms or limited operational settings, making it hard to compare how failures emerge across different harness responsibilities.
HarnessRisk organizes safety into six operational phases: Harness Configuration, Capability Extension, Runtime Operation, State Persistence, Action Control, and Incident Recovery. It includes 128 sandboxed cases, each pairing a benign user objective with an adversarial instruction embedded in an untrusted workflow artifact. The evaluation tracks four metrics: Utility, Attack Success Rate, Persistence, and Detection.
Across three harnesses, six language models, and 14 model-harness configurations, the benchmark reveals that attack success rates range from 12.6% to 80.9%, while utility remains high between 75.0% and 97.6%. Notably, Harness Configuration emerged as the most vulnerable phase across all harnesses, showing that attackers can succeed by altering security-sensitive parameters within otherwise authorized workflows.
The study also found that explicit risk recognition does not reliably lead to safe action. Some configurations detect risks in more than 90% of runs yet still retain substantial attack success, highlighting a disconnect between detection and prevention. The authors emphasize the need to evaluate agent safety across multiple harness responsibilities and at the level of the deployed model and harness configuration.
The benchmark is open-source, with code available on GitHub and additional details on the project page.