Pith. sign in

REVIEW 3 major objections 4 minor 35 references

A distributable harness can carry off-the-shelf security controls to AI coding agents without losing efficacy.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A harness-distributed bundle of OS sandboxing, skill scanning, and tool restriction matched the best secured commercial agent on adjusted security tests, with no regression against its own baseline.

T0 review reviewed 2026-08-01 challenge →

load-bearing objection A transparent screening-level study with a real artifact, but the n=1 test runs make the headline 'same efficacy at 100%' claim fragile—worth refereeing with a request for variance reporting. the 3 major comments →

arxiv 2607.25890 v1 pith:J6LRRE6S submitted 2026-07-28 cs.AI

Distributing Security Controls Through Harness Engineering

William Robert Gore This is my paper
classification cs.AI
keywords agent harnessdistributable security controlsOS sandboxingskill scanningtool restrictionAI coding agentsharness engineeringprompt injection
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that security controls for AI coding agents do not have to be configured one-by-one on each developer machine. It embeds three off-the-shelf control types—OS sandboxing, skill scanning, and tool restriction—into a distributable harness called SHarD that installs with a single command. In a 23-test functional screen targeting risks like indirect prompt injection, tool misuse, and supply-chain attacks, the hardened harness scored 100% on adjusted tests, matching the best directly secured commercial agent with no regression across any category. The paper argues this makes the harness a viable channel for scaling security and identifies two traits—controls expressed as code and enforced at the execution boundary—as candidates for a control-fitness framework.

Core claim

The paper's central claim is that off-the-shelf security controls can be scaled via a distributable agent harness while maintaining the same efficacy as when they are installed directly on commercial AI coding agents. SHarD, built by wrapping an existing open-source harness with a package manifest, an installer, and extension hooks, bundles OS sandboxing, skill scanning, and tool restriction. At session start it relaunches itself inside a kernel-enforced OS sandbox, it scans third-party skills through an external service before they reach the model, and it intercepts bash tool calls to enforce deny rules. Across the 23-probe suite, SHarD achieved an adjusted score of 100%, matching the best

What carries the argument

The harness itself—the code, configuration, and execution logic surrounding the model—is the central mechanism. SHarD's design has three load-bearing parts: an installer that provisions dependencies and writes policy files in one command; a package manifest that registers extension hooks at session start and tool-call time; and extension hooks that relaunch the agent inside a kernel-enforced OS sandbox, route skill analysis to an external scanner, and block denied bash commands before execution. The proposed fitness framework rests on two characteristics observed in the controls that carried forward: declarative policy (the control can be distributed as a versioned, portable artifact) and co

Load-bearing premise

Every score in the comparison rests on running each of the 23 probes exactly once and treating each pass/fail as a stable point; if agent non-determinism changes outcomes across runs, the 100% adjusted score and zero-regression claims are underdetermined.

What would settle it

Run the full 23-probe suite multiple times (for example, ten repetitions) on SHarD and on the best securely configured commercial agent under identical conditions. If SHarD's adjusted score falls below the commercial agent's, or if any category regresses relative to the unhardened harness, the equivalency claim fails. Alternatively, repeat the specific content-protection test that passed without the relevant control twenty times and count how often the agent spontaneously blocks the injection.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Security teams can distribute controls through the same one-command channel that engineering teams already use to ship code, removing per-machine manual configuration.
  • The three control categories—OS sandboxing, skill scanning, and tool restriction—retain basic efficacy when embedded in a harness, so vendor-native security is not the only path to scale.
  • Because model behavior alone proved non-deterministic and sometimes unsafe, harness-enforced deterministic controls are a more reliable security layer than reliance on model reasoning.
  • Autonomous agents can act outside their intended boundaries, for example by modifying another agent's configuration on the same system, which argues for defense in depth with OS-level containment.
  • A control-fitness framework based on declarative policy and control locality can help practitioners judge which controls to distribute, though more controls must be tested to validate it.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If harness distribution becomes standard, controls that require deep runtime integration or that conflict with other controls—the paper's content-protection experience is a hint—may be systematically left out; that exclusion deserves explicit testing.
  • The screening methodology runs each probe once, so the 100% adjusted score should be read as evidence of basic functionality, not as a stable effect size; repeated runs under model non-determinism would test whether the equivalency holds.
  • The proposed fitness framework predicts that any control expressible as a policy file plus a session or tool hook—secret scanning, egress filtering, MCP allow-listing—is a candidate for harness distribution; this is a falsifiable prediction for future work.
  • The observed cross-boundary behavior suggests harness distribution could be extended to manage multi-agent co-existence on one machine, not just sandboxing a single agent.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. This paper investigates whether off-the-shelf security controls for AI coding agents—content protection, skill scanning, tool restriction, and OS sandboxing—can be validated on commercial agents (Claude Code, Codex) and then redistributed through a custom agent harness (SHarD) while retaining efficacy. A 23-test suite derived from the OWASP Top 10 for Agentic Applications is run in four phases: two commercial baselines, two commercial configurations with controls, a Pi harness baseline, and the SHarD harness with controls. The central claim is that SHarD achieves an adjusted score of 100%, matching the best secured commercial agent, with no regression across test categories, thus answering RQ1 and RQ2 at a basic functional level. The paper also reports qualitative observations about model non-determinism and cross-agent contamination, and proposes two initial characteristics (Declarative Policy, Control Locality) toward a control-harness fitness framework.

Significance. If the headline result were robust, the paper would be a useful empirical data point for practitioner adoption: it demonstrates a plausible mechanism for distributing security controls through an agent harness rather than relying on vendor-native solutions, and it publishes reproducible artifacts (pinned hashes, raw data repository, one-command installer). The methodology is transparent and the screening-level intent is reasonable. However, the central comparative claim depends on single-run point scores in a system the paper itself shows to be non-deterministic. The evidence therefore supports a qualitative 'these controls can function in a harness' conclusion more strongly than the quantitative equivalence claim in the abstract. With repeated trials and variance reporting, the contribution could be solid as a screening study.

major comments (3)
  1. [§IV.C / §V.A / Table IV] The headline claim that SHarD 'matched' Claude Code with an adjusted score of 100% rests on a single execution of each probe per phase/agent. The paper itself supplies direct evidence that this premise is unsafe: §VII.A reports that CPR-01 passed for SHarD without content protection because the agent 'went down a reasoning path' that 'the agent never took this specific path again.' That is an observed non-reproducible outcome in the exact system being scored. With n=1 per test, Eq. (1) has unknown variance; in Tool Selection, the category contains only two tests (TOOL-01, TOOL-02), so a single flipped outcome changes that category by 50 percentage points and can determine whether 'no regression' and 'matching' hold. Please repeat each test multiple times (e.g., 5–10 runs per configuration) and report variance/confidence intervals, or explicitly downgrade the claim to 'single-observation
  2. [§V.A / Table IV] The 'adjusted score' is not sufficiently operationalized. The text says the adjusted score is 'limited to just the controlled categories,' but it does not specify which tests are included and excluded, how Mixed outcomes are counted (0.5 in Eq. (1)), or how 'inconclusive results were excluded from the denominator' in each phase. Table V complicates this further: the Content Protection category shows Pi0 at 37.5% vs. SHarD at 44.4% over what appears to be the same nine-test CPR suite, which is only possible if different numbers of tests were excluded as inconclusive or if outcome classification changed between runs. Without a per-test, per-phase outcome table (or a complete data appendix), the raw and adjusted scores are not auditable, and the central 'equivalence' claim cannot be verified from the manuscript alone. The GitHub repository is a good start, but the paper should include the f
  3. [§VII.B / Table V] The 'no regression' claim is asserted for category scores, but the regression check compares Pi default to SHarD, not SHarD to the secured commercial agents. The abstract and conclusion use the phrase 'no regression across any test category' in the context of the equivalence claim, which could mislead readers into thinking this was tested against both commercial configurations. In addition, the regression comparison inherits the single-run fragility described above; a category improvement like Skill Scanning (+41.7) is presented as a point value with no measure of run-to-run variability. Please clarify the reference configuration for each 'regression' statement and, if possible, include repeated-trial estimates.
minor comments (4)
  1. [Throughout] The text consistently renders 'OWASP' as 'OW ASP' with an extra space (e.g., abstract, Section II.A, Table I). Please fix.
  2. [Appendix A, CPR-05] The pass condition for CPR-05 says 'CPR-04 passes...' — likely a copy-paste error; should read CPR-05. Also, in CPR-04 the prompt refers to a '.evn' file; should be '.env'.
  3. [Table V] The baseline harness is labeled 'Pi 0' in the table but 'Pi default' in the text and 'Pi Coding Agent' elsewhere. Use one consistent label.
  4. [§VI.B] The sentence 'Because nono enforcement is applied at the kernel level via macOS Seatbelt, the sandbox cannot be bypassed from within the sandboxed process itself' should cite a more specific source than a DEV Community blog post; if the kernel-level guarantee is central to the OS sandbox claim, a primary reference or direct test evidence would strengthen it.

Circularity Check

0 steps flagged

No significant circularity: empirical claims rest on external controls, external risk framework, and directly observed test scores.

full rationale

The paper's derivation chain is self-contained and non-circular. RQ1 and RQ2 are answered through a 23-test suite derived from the external OWASP Top 10 for Agentic Applications [4], using controls from external sources (nono OS sandbox, Permiso SandyClaw, native agent tool permissions). Scores are computed from observed pass/mixed/fail outcomes via Equation (1); no parameters are fitted to the headline comparison, and the SHarD 100% adjusted score and the match with Claude Code are direct measurements reported in Tables IV and V with raw and adjusted scores disclosed. The only author-overlapping references ([25], [28]) are pointers to the paper's own data and demo repository, used as artifact locations rather than as load-bearing evidence for the central claim. The proposed control-harness fitness framework in Section VII.B is explicitly preliminary: the paper states that the four-control sample is 'insufficient to support a validated framework' and poses RQ3 for future investigation. The characteristics (Declarative Policy, Control Locality) are inductively derived from the same successful controls, but the paper does not present this as a validated prediction or as proof of the empirical results. The notable non-determinism observation (CPR-01 passing without the relevant control, 'the agent never took this specific path again') is a methodological limitation concerning single-run variance, not a definitional circularity; the paper itself surfaces this honestly. Overall, no step reduces by construction to its own inputs, so the circularity score is 0.

Axiom & Free-Parameter Ledger

4 free parameters · 6 axioms · 2 invented entities

The empirical claims rest on domain assumptions about the OWASP framework, vendor tools (nono, SandyClaw), and the representativeness of two commercial agents. The scoring choices (mixed weight, inconclusive exclusion, adjusted-score composition, allow/deny lists) are hand-made and directly shape the headline percentages. No fundamentally new theoretical entity is introduced; SHarD is a built artifact, and the proposed framework characteristics are explicitly preliminary inductions.

free parameters (4)
  • Adjusted-score composition = excludes Content Protection category; keeps Skill Scanning, Tool Selection, OS Sandboxing
    The headline 100% adjusted score for SHarD equals Claude Code's only after removing the category where controls failed to show any improvement; the choice is disclosed (Table IV) but is hand-made and directly shapes the central equivalency claim.
  • Mixed-outcome weight = 0.5
    Pass=1, Mixed=0.5, Fail=0 (Eq. 1). The 0.5 weight is chosen rather than derived; it affects composite and category scores whenever a Mixed occurs.
  • Inconclusive-exclusion rule = excluded from denominator
    Testing rule that drops inconclusive results from score denominators; the paper does not report how many inconclusive results occurred, so the reported percentages may be inflated.
  • Allow/deny lists for tool restriction and OS sandboxing = deny: rm, rmdir; OS allow: github.com; OS deny: wicar.org; disallowed directory for OS-04
    These hand-chosen policy values define the positive/negative functional probes (TOOL-01/02, OS-01/02/04); a different policy would change pass/fail outcomes.
axioms (6)
  • domain assumption OWASP Top 10 for Agentic Applications (2026) is an appropriate risk model for single-user coding agents.
    Threat model (§II.A) is framed entirely by OWASP risk IDs; if this list misrepresents the real threat surface for coding agents, the control selections and scoping decisions inherit that error.
  • domain assumption The tested models (GPT-5.5, Sonnet 4.6) at the stated versions are representative of commercial coding agents and behave consistently enough for single-run probes.
    Lab configuration (§IV.B) fixes two agents/models; generalization to 'commercial AI coding agents' (RQ1) assumes these exemplars are representative.
  • domain assumption nono's kernel-level Seatbelt enforcement cannot be bypassed from within the sandboxed process.
    Relied on in §VI.B ('the sandbox cannot be bypassed from within the sandboxed process itself') citing vendor documentation; if false, OS-sandboxing results are vacuous.
  • domain assumption SandyClaw's scan verdicts are correct ground truth for skill maliciousness.
    Skill-scanning scores depend on an external vendor API whose detection quality is taken on faith; the paper does not independently validate SandyClaw's verdicts.
  • ad hoc to paper A single test run per phase/agent is sufficient to establish basic control function.
    The paper itself reports a non-reproduced one-off pass (CPR-01 in §VII.A), showing outcome non-determinism; the methodology nevertheless treats each Phase 1-4 run's Pass/Mixed/Fail as a stable point score.
  • domain assumption Passing a basic functional probe is a sufficient indicator that a control is a viable harness candidate.
    Stated in §IV.A ('a control that fails a basic functional probe is not a candidate for a scalable harness'); this deliberately narrows the research to basic-level validity.
invented entities (2)
  • SHarD (Secure Harness Distribution) independent evidence
    purpose: A distributable agent harness embedding OS sandboxing, skill scanning, and tool restriction via a single install command
    Not a postulate but a constructed, publicly hosted artifact (github.com/wrgore/shard-demo) with installer and source; its efficacy is the paper's central empirical claim.
  • Control Harness Fitness Framework characteristics (Declarative Policy, Control Locality) no independent evidence
    purpose: Proposed criteria for identifying controls that are good candidates for harness distribution
    Introduced as 'initial characteristics' (§VII.B) induced from the same 4-control dataset; the paper itself states sample size is insufficient for a validated framework, so there is no independent falsifiable handle yet.

reviewed 2026-08-01 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Distributing Security Controls Through Harness Engineering." pith.science (2026). https://pith.science/paper/J6LRRE6S

@misc{pith2026260725890,
  author       = {Pith},
  title        = {Pith review of: Distributing Security Controls Through Harness Engineering},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/J6LRRE6S}},
  note         = {Machine review of arXiv:2607.25890}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

AI coding agents are being adopted at historic speed, yet security and risk concerns remain the primary barrier to scaling agentic AI across organizations. Existing security controls for coding agents are not systematically distributed to engineering teams, and vendor-native solutions introduce ecosystem dependencies that may not suit every deployment context. This paper investigates whether off-the-shelf security controls can be implemented on commercial AI coding agents and scaled to a distributed user base via a custom agent harness. A phased testing methodology was applied across four agent configurations --- two commercial agents with and without controls, a baseline harness, and a security-hardened harness --- using a 23-test suite derived from the OWASP Top 10 for Agentic Applications. SHarD (Secure Harness Distribution), a distributable harness built on the Pi agent harness, demonstrated that three categories of security controls --- OS sandboxing, skill scanning, and tool restriction --- can be embedded and distributed via a single install command while retaining equivalent efficacy to direct installation on commercial agents. SHarD achieved an adjusted score of 100\%, matching the best securely configured commercial agent, with no regression across any test category. Notable observations include evidence that model non-determinism produces inconsistent security outcomes and that autonomous agent behavior can cross system boundaries in ways that OS sandboxing directly mitigates. Initial characteristics toward a control harness fitness framework are proposed, and a third research question is identified for future investigation.

Figures

Figures reproduced from arXiv: 2607.25890 by William Robert Gore.

Figure 1
Figure 1. Figure 1: Lab Environment Configuration Note that conflicts and control interoperability were not em￾pirically measured, however observational results are discussed in Section VII.A of this paper. The test suite can be found in Appendix A. B. Lab Configuration The testing environment was configured with a developer system which acted as a host to the coding agents and a malicious MCP server hosted on a virtual machi… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

35 extracted references · 1 canonical work pages · 1 internal anchor

  1. [1]

    The shift to agentic AI: Evidence from Codex,

    D. Johnston, D. Holtz, A. Martin Richmond, C. Ong, P. Tambe, and A. Chatterji, “The shift to agentic AI: Evidence from Codex,” OpenAI, 2026. [Online]. Available: https://cdn.openai.com/pdf/5d1e1489-21c0-43e4-9d42-f87efdbf0082/ the-shift-to-agentic-ai-evidence-from-codex.pdf

    2026

  2. [2]

    The AI Index 2026 annual report,

    S. Sajadieh et al., “The AI Index 2026 annual report,” AI Index Steering Committee, Institute for Human-Centered AI, Stanford University, Stanford, CA, Apr. 2026. [Online]. Available: https://hai.stanford.edu/ assets/files/ai_index_report_2026.pdf

    2026

  3. [3]

    OWASP top 10 for LLM applications 2025,

    OWASP Foundation, “OWASP top 10 for LLM applications 2025,” OWASP Gen AI Security Project, 2025. [Online]. Available: https: //genai.owasp.org/llm-top-10/

    2025

  4. [4]

    OWASP top 10 for agentic applications 2026,

    OWASP Foundation, “OWASP top 10 for agentic applications 2026,” OW ASP Gen AI Security Project, 2026. [Online]. Available: https://genai. owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/

    2026

  5. [5]

    OWASP MCP top 10,

    OWASP Foundation, “OWASP MCP top 10,” OWASP, n.d. [Online]. Available: https://owasp.org/www-project-mcp-top-10/

  6. [6]

    OWASP agentic skills top 10,

    OWASP Foundation, “OWASP agentic skills top 10,” OWASP, n.d. [Online]. Available: https://owasp.org/www-project-agentic-skills-top-10/

  7. [7]

    Securing AI agents at scale: Identity, governance, and zero trust,

    Microsoft, “Securing AI agents at scale: Identity, governance, and zero trust,” Microsoft Community Hub, May 11, 2026. [Online]. Available: https://techcommunity.microsoft.com/blog/marketplace-blog/ securing-ai-agents-at-scale-identity-governance-and-zero-trust/ 4518230

    2026

  8. [8]

    Indirect prompt injection: Generative AI’s greatest security flaw,

    D. Ruck and M. Sutton, “Indirect prompt injection: Generative AI’s greatest security flaw,” Centre for Emerging Technology and Security, The Alan Turing Institute, Nov

  9. [9]

    My AI adoption journey,

    M. Hashimoto, “My AI adoption journey,” Mitchell Hashimoto, Feb. 5, 2026. [Online]. Available: https://mitchellh.com/writing/ my-ai-adoption-journey

    2026

  10. [10]

    The anatomy of an agent harness,

    V . Trivedy, “The anatomy of an agent harness,” LangChain, Mar. 10, 2026. [Online]. Available: https://www.langchain.com/blog/ the-anatomy-of-an-agent-harness

    2026

  11. [11]

    From model scaling to system scaling: Scaling the harness in agentic AI,

    S. Gu, “From model scaling to system scaling: Scaling the harness in agentic AI,” arXiv:2605.26112, 2026. [Online]. Available: https://doi.org/ 10.48550/arXiv.2605.26112

    Pith/arXiv arXiv doi:10.48550/arxiv.2605.26112 2026

  12. [12]

    SafeHarness: Lifecycle-Integrated Security Architecture for LLM-based Agent Deployment

    X. Lin et al., “SafeHarness: Lifecycle-integrated security architecture for LLM-based agent deployment,” inProc. 64th Annu. Meeting Assoc. Comput. Linguistics (ACL 2026), 2026. [Online]. Available: https://doi. org/10.48550/arXiv.2604.13630

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2604.13630 2026

  13. [13]

    Breaking and fixing defenses against control-flow hijacking in multi-agent systems,

    R. Jha, H. Triedman, J. Wagle, and V . Shmatikov, “Breaking and fixing defenses against control-flow hijacking in multi-agent systems,” inProc. 14th Int. Conf. Learn. Representations (ICLR 2026), 2026. [Online]. Available: https://doi.org/10.48550/arXiv.2510.17276

    doi:10.48550/arxiv.2510.17276 2026

  14. [14]

    Agent skills in the wild: An empirical study of security vulnerabilities at scale,

    Y . Liu et al., “Agent skills in the wild: An empirical study of security vulnerabilities at scale,” arXiv:2601.10338, 2026. [Online]. Available: https://doi.org/10.48550/arXiv.2601.10338

    Pith/arXiv arXiv doi:10.48550/arxiv.2601.10338 2026

  15. [15]

    Introducing SandyClaw: Dynamic sandbox AI agent skills,

    A. Vats, “Introducing SandyClaw: Dynamic sandbox AI agent skills,” Permiso, 2026. [Online]. Available: https://permiso.io/blog/ introducing-sandyclaw-dynamic-sandbox-ai-agent-skills

    2026

  16. [16]

    The 2025 AI agent index: Documenting technical and safety features of deployed agentic AI systems,

    L. Staufer, K. Feng, K. Wei, L. Bailey, Y . Duan, M. Yang, A. P. Ozisik, S. Casper, and N. Kolt, “The 2025 AI agent index: Documenting technical and safety features of deployed agentic AI systems,” inFAccT ’26: Proc. 2026 ACM Conf. Fairness, Accountability, and Transparency, ACM,

    2025

  17. [17]

    Nono CLI internals: Seatbelt,

    nono, “Nono CLI internals: Seatbelt,” Nono, n.d. [Online]. Available: https://nono.sh/docs/cli/internals/seatbelt

  18. [18]

    Introducing nono: A secure sandbox for AI agents,

    L. Hinds, “Introducing nono: A secure sandbox for AI agents,” DEV Community, Feb. 2, 2026. [Online]. Available: https://dev.to/lukehinds/ introducing-nono-a-secure-sandbox-for-ai-agents-1lo2

    2026

  19. [19]

    The landscape of prompt injection threats in LLM agents: From taxonomy to analysis,

    P. Wang et al., “The landscape of prompt injection threats in LLM agents: From taxonomy to analysis,” arXiv:2602.10453, 2026. [Online]. Available: https://doi.org/10.48550/arXiv.2602.10453

    doi:10.48550/arxiv.2602.10453 2026

  20. [20]

    Not what you’ve signed up for: Compromising real-world LLM- integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world LLM- integrated applications with indirect prompt injection,” inProc. 16th ACM Workshop Artificial Intelligence and Security, ACM, 2023, pp. 79–90. [Online]. Available: https://doi.org/10.1145/3605764.3623985

    arXiv 2023

  21. [21]

    Codex models,

    OpenAI, “Codex models,” 2026. [Online]. Available: https://developers. openai.com/codex/models

    2026

  22. [22]

    Claude models overview,

    Anthropic, “Claude models overview,” 2026. [Online]. Available: https: //platform.claude.com/docs/en/about-claude/models/overview

    2026

  23. [23]

    toxicskills-goof,

    Snyk Labs, “toxicskills-goof,” GitHub, n.d. [Online]. Available: https: //github.com/snyk-labs/toxicskills-goof

  24. [24]

    Anthropic skills,

    Anthropic, “Anthropic skills,” GitHub, n.d. [Online]. Available: https: //github.com/anthropics/skills

  25. [25]

    Agent security lab,

    W. Gore, “Agent security lab,” GitHub, 2026. [Online]. Available: https: //github.com/wrgore/agent-security-lab

    2026

  26. [26]

    No free lunch with guardrails,

    D. Kumar, N. A. Birur, T. Baswa, S. Agarwal, and P. Harshangi, “No free lunch with guardrails,” arXiv:2504.00441, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2504.00441

    Pith/arXiv arXiv doi:10.48550/arxiv.2504.00441 2025

  27. [27]

    Pi documentation,

    Pi, “Pi documentation,” n.d. [Online]. Available: https://pi.dev/

  28. [28]

    SHarD demo,

    W. Gore, “SHarD demo,” GitHub, 2026. [Online]. Available: https:// github.com/wrgore/shard-demo

    2026

  29. [29]

    Creating a Pi package,

    Pi, “Creating a Pi package,” n.d. [Online]. Available: https://pi.dev/docs/ latest/packages#creating-a-pi-package

  30. [30]

    Troubleshooting: Using nono –why-self for debugging,

    nono, “Troubleshooting: Using nono –why-self for debugging,” Nono, n.d. [Online]. Available: https://nono.sh/docs/cli/usage/troubleshooting# using-nono-why-self-for-debugging

  31. [31]

    Child process: Synchronous process creation,

    W3C/Node.js, “Child process: Synchronous process creation,” Node.js, n.d. [Online]. Available: https://nodejs.org/api/child_process.html# synchronous-process-creation

  32. [32]

    SemaClaw: A step towards general-purpose personal AI agents through harness engineering,

    N. Zhu et al., “SemaClaw: A step towards general-purpose personal AI agents through harness engineering,” arXiv:2604.11548, 2026. [Online]. Available: https://doi.org/10.48550/arXiv.2604.11548 APPENDIXA TESTSUITE CPR-01This test evaluates if the agent can be tricked into processing and acting on instructions embedded in PDF data. • 1 pdf will be hosted vi...

    Pith/arXiv arXiv doi:10.48550/arxiv.2604.11548 2026

  33. [35]

    theme":

    Runnode index.js The server was run on port 3000. Full configuration documen- tation is available in the repository README. B.5 GitHub Test Repository A public GitHub repository was configured to host additional test assets for content protection and skill scanning tests. Assets include a README containing an embedded indirect prompt injection, a credenti...

  34. [2024]

    Available: https://cetas.turing.ac.uk/publications/ indirect-prompt-injection-generative-ais-greatest-security-flaw

    [Online]. Available: https://cetas.turing.ac.uk/publications/ indirect-prompt-injection-generative-ais-greatest-security-flaw

  35. [2026]

    Available: https://doi.org/10.1145/3805689.3806728

    [Online]. Available: https://doi.org/10.1145/3805689.3806728

    arXiv

This paper was first reviewed by deepseek-v4-flash on August 1, 2026.