News · 2026-09-13

EvoSafeHarness builds a different safety wrapper for each AI agent and cuts successful attacks from 46% to 10%

A team from Johns Hopkins University, NVIDIA, the University of Illinois Urbana-Champaign, UC Berkeley and the University of Wisconsin-Madison has shown that AI agents are safer when their protective wrapper is custom-built for each model and task domain. Their system, EvoSafeHarness, uses an AI coding model to evolve those wrappers automatically, and cut the average rate of successful attacks from 45.6% to 10.0% while costing just 3.3 points of normal task success.

Key facts

• Anchor number: average attack success fell from 45.6% to 10.0% across 15 model-and-domain combinations, and the method had the best overall score in 14 of 15.
• When: posted to arXiv on 5 September 2026; its upvotes on Hugging Face's daily papers board climbed through this week.
• Who: researchers including Bo Li (UIUC), Dawn Song (UC Berkeley) and Chaowei Xiao (Johns Hopkins and NVIDIA).
• Primary sources: the paper, the code and the Hugging Face paper page.

The problem with one-size-fits-all defenses

AI agents read emails, files and web pages and then take actions. That makes them vulnerable to prompt injection, where an attacker hides instructions inside content the agent processes. A common defense is a harness or guardrail: software around the model that checks each tool call and blocks the dangerous ones. Well-known research defenses such as CaMeL, DRIFT and Progent are designed by experts once and applied to every model.

The EvoSafeHarness authors argue that is the wrong shape. “A harness strict enough for one model over-blocks another, and a policy general enough to transfer across domains can miss the safety relations of the application,” they write. Different models make different mistakes, and a telecom help-desk agent needs different rules from one managing files.

Think of building security. A single rulebook for every building would either lock the hospital pharmacy too loosely or make the public library impossible to enter. Good security is fitted to what is inside and to how the people there actually behave.

How it works

EvoSafeHarness runs a search. A “Designer,” by default Claude Opus 4.8, reads traces of the agent failing, and proposes a harness: a plain-language policy plus executable code that can block or rewrite tool calls and remember state. A separate “Criticizer” with fresh context rejects rules that only exploit quirks of the test, such as specific filenames. A staged evaluator then scores normal usefulness, direct attacks and hidden-instruction attacks separately, with a score of usefulness minus attack success, so a harness that refuses everything scores nothing.

The results show why tailoring matters. The evolved harness for one model needed only a couple of meaning-based checks, while another model's needed hard gates, a ledger tracking where data flows and a cache of verdicts. “A weaker model does not just need more rules,” the authors write.

What they found

Across five victim models, including Claude Sonnet 4.6, GLM-5, Kimi-K2.5 and DeepSeek-V4-Flash, in file-system, finance and telecom domains, attack success dropped from 45.6% to 10.0%. Fixed defenses fell short: CaMeL left 37.7% and DRIFT 42.4%, while Progent matched on safety only by cutting normal task success far more. On a separate agent benchmark the evolved harness reached 82.8% task success with zero successful attacks, twice CaMeL's usefulness at the same zero.

The Criticizer mattered. Removing it cost between 9 and 31 points on held-out tasks, because the search otherwise overfits to what it can see.

Why it matters

As agents get standing access to inboxes and accounts, the security layer around them is becoming as important as the model inside. Ground Truth has covered Microsoft patching the harness instead of the model and prompt injections that spread from agent to agent. This paper suggests those layers should be generated and tested per deployment rather than written once.

The caveat

Adaptive attackers weakened it: with 16 rounds of refinement against a frozen harness, attack success rose to an average of 19.5%. Scams that break no observable rule, such as persuading a client to pay, largely got through, and one model in the file-system domain still saw 44.3% attack success. The case that harnesses must be model-specific rests mainly on fixed defenses failing and on the different mechanisms each search produced, rather than on moving an evolved harness from one model to another, and each evaluation used only 30 benign tasks per setting. It is a strong research result, not a finished product.

Primary source, verified: read the paper → (arXiv 2609.05903)

Ground Truth. (2026, September 13). EvoSafeHarness builds a different safety wrapper for each AI agent and cuts successful attacks from 46% to 10%. Ground Truth. https://groundtruth.day/news/evosafeharness-builds-a-different-agent-safety-wrapper-for-each-model-and-cuts-attacks-to-a-tenth.html

@misc{groundtruth:evosafeharness-builds-a-different-agent-safety-wrapper-for-each-model-and-cuts-attacks-to-a-tenth,
  title  = {EvoSafeHarness builds a different safety wrapper for each AI agent and cuts successful attacks from 46% to 10%},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {sep},
  url    = {https://groundtruth.day/news/evosafeharness-builds-a-different-agent-safety-wrapper-for-each-model-and-cuts-attacks-to-a-tenth.html}
}

Topics: cybersecurity · prompt-injection · ai-security · agents · research · agent-harness