Auditing Agent Harness Safety

Most agent evaluations check the answer. If the refund was issued correctly, the run passes. But an agent working through a harness can reach that answer after reading a neighbouring customer's record, forwarding card digits to a teammate agent that needed only the order number, or calling an export tool its role was never granted. An answer-only check calls that run a success.

Chengzhi Liu, Xin Eric Wang and colleagues at UC Santa Barbara, with co-authors at Berkeley, Wisconsin, Stanford and Microsoft Research, propose HarnessAudit. Each task comes with an explicit policy: which role may call which tools, touch which resources, and pass which information to whom. The harness runs normally while the framework records every tool call, resource access and inter-agent message, plus snapshots of the environment, through logs the agents cannot see or influence. After the run, hidden audit rules are applied to that record.

The audit has three layers. Boundary compliance checks every action against the tool, resource and information-flow rules. Execution fidelity checks that the run reached its goal through valid steps, using task milestones rather than only the final answer. System stability repeats tasks with indirect prompt injections, ambiguous goals and tool errors. The benchmark, HarnessAudit-Bench, has 210 tasks across finance, e-commerce, healthcare, office work, social, daily life, legal and software engineering, run by single agents and by teams of four or five role agents.

A customer's security or compliance team will not ask whether the agent gave the right answer. They will ask what it accessed, what it passed along, and what record exists. This paper turns those questions into an evaluation you can build.

Write the policy down before you test. For each role or agent: allowed tools, allowed records, and which fields may cross to which other role. Without that, there is nothing to audit against.

Log outside the agent. The paper's audit evidence comes from tool wrappers and backend logs, never the agent's own report of what it did. An agent's summary of its actions is not an audit trail.

Expect the wrong record, not the wrong tool. Agents rarely called obviously inappropriate tools. They called reasonable tools on the wrong objects: an adjacent account, an out-of-scope file. Scope checks on arguments matter more than tool allowlists.

Treat multi-agent designs as a data-sharing risk. Teams leaked sensitive fields to each other far more than they sent messages to the wrong recipient. Field-level rules on what passes between agents are needed.

Do not trade safety away for completion scores. The configurations that finished the most work broke the most rules. Report both numbers to the customer.