Agent Harnesses Need Security Rule: Untrusted Input ≠ Privileged Access
MoreIndependent5967 · reddit · 2026-08-28
This post proposes a core security principle for Agent harnesses: untrusted external content should never have side-effecting capabilities.
The Risk
Currently, main agents often have privileged access (filesystem, shell, Git, APIs) while also browsing arbitrary web or reading external emails, creating a dangerous trust model.
Proposed Architecture
External content should be processed by read-only subagents:
- WebReader: Can search/fetch/read pages, but cannot execute shell commands or write files.
- MailReader: Can search/read messages, but cannot send/reply/delete.
These subagents pass structured results to the Main Agent, which handles reasoning and delegates to privileged executors.
Key Rules
- Default-Deny: Subagents start with zero capabilities; permissions are explicitly granted.
- Decoupling: Reasoning power (e.g., strong models) should be independent of action permissions.
These restrictions must be enforced by the runtime, not just by prompting.
More from coding & agent
- User Drops Spark Desktop CLI for Grok Bot Plugins Amid Convenience vs. Local-First Debate — bfrench · 2026-08-28
- Full Guide: Using Claude Design inside Claude Code — EXM7777 · 2026-08-28
- Daughter Directs, Dad Codes: Multi-Agent Workflow for Short Film — azed_ai · 2026-08-28
- AI Employee Generates Headlines, Structure, and Drafts in One Task — eyishazyer · 2026-08-28
- Tencent Hunyuan Hy4 Preview Shows Strong End-to-End Agent Performance — TencentHunyuan · 2026-08-28
- Developer automates GitHub issue triage and bug fixes with AI agent — nicolascraske · 2026-08-28