What is an agent harness (and how do you secure one)?

What it is

The page gives mechanism-level detail for three Adversa AI-named attacks already listed in the summary — SymJack, GuardFall, and TrustFall — plus a fourth class (trust boundary carryover) sourced to Novee Security's Black Hat USA 2026 talk on Gemini CLI and Codex.

How it works

SymJack: a repo ships an instructions file telling the agent to copy a file using a raw shell cp instead of the agent's native write tool (native tools flag sensitive paths, raw copy doesn't). The copy target is a symlink committed in the repo pointing at the agent's own config directory. The developer approves what looks like a video-file copy; the kernel follows the symlink and writes attacker-controlled MCP server definitions, which execute on next restart with full user privileges. Root cause: the approval prompt inspects command text, not resolved filesystem effect.

GuardFall: agents gate shell execution behind a string-matcher checking the command against a blocklist, but bash expands/unquotes/rewrites the string after the matcher sees it, so the executed command differs from the inspected one. Tested across 11 open-source agents (~548,000 combined GitHub stars); 10 were exploitable via one of four bypass patterns.

TrustFall: accepting a folder-trust prompt ("Quick safety check") causes Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI to auto-execute project-defined MCP servers immediately, with no indication of what trust actually grants.

Trust boundary carryover (Novee Security, Black Hat USA 2026): in Gemini CLI, GitHub tokens/API keys are stripped from child processes but remain readable in the parent process, where injected instructions actually run. In Codex, two separate runs share a workspace, so a compromised first run can write an AGENTS.md that the second run automatically trusts and reads.

Preconditions / Affected

SymJack requires the agent to accept raw shell copy commands and follow symlinks without resolving the target before prompting. GuardFall requires shell-matcher-based (not allowlist-based) command gating. TrustFall requires one of the four named CLIs and an accepted folder-trust prompt on an untrusted project directory. The carryover issue requires multi-run sessions or child-process credential handling in Gemini CLI/Codex specifically.

What to do

• Don't rely on approval prompts that inspect command text rather than resolved effect (defeated by symlinks, scrolling-off-screen commands, nested deeplinks, argument injection).
• Replace shell command blocklists with tool/credential allowlists — blocklisting is a losing game against shell string rewriting.
• Treat MCP definitions, project settings, AGENTS.md, and .cursor/rules/ as executable code: pin via managed settings a repo cannot override, deny project-scope process spawning, review in code review like a CI workflow file.
• In CI, do not auto-trust the workspace on pull-request branches.

Caveats

The 10/11 GuardFall figure and the "six agents" SymJack figure are Adversa's own test results, not independently reproduced. The trust-boundary carryover findings are attributed to a third party (Novee Security) via conference talk, not a linked paper or advisory.