The Australian Signals Directorate (ASD) has released new guidance on Agentic AI Harnesses, highlighting the security, governance and operational risks organisations need to consider as they adopt agentic AI systems. The publication shifts attention beyond large language models (LLMs) to the software layer that connects models with organisational data, tools and systems. According to ASD, the AI harness is a critical component of an agentic AI system because it determines what information an agent receives, which tools it can access, what actions it can perform and what controls are applied.

Why Agentic AI Harnesses Matter

An agentic AI system combines an LLM with external tools, data sources, memory and planning workflows. While the LLM processes information and proposes actions, the harness provides the surrounding infrastructure needed to execute those actions and enforce permissions. ASD said many significant organisational risks emerge when an LLM is connected to enterprise systems through a harness. Security, privacy, governance and operational risks can depend on what an agent can access, the actions it can perform and how it interacts with connected systems. The publication also notes that some risks, including prompt injection, cannot be reliably addressed within the model alone. Additional controls are required across the harness, connected systems and organisational governance processes.

Harness Becomes a Long-Term Security Focus

ASD describes the harness as the component organisations can most directly govern, secure and control. While LLMs can be replaced as models evolve, the harness and its surrounding integrations are expected to represent a longer-term organisational investment. The harness can manage context and memory, provide access to tools, enforce execution privileges and record activity for monitoring and evaluation. Its components can include a user interface, policy layer, context manager, model interface, tool registry, permission system, execution environment, connector layer, memory and session store, and audit and observability capabilities. [caption id="attachment_114032" align="aligncenter" width="600"] Image Source: ASD- https://www.cyber.gov.au/[/caption] This makes the harness a key configuration surface for agentic AI security, particularly where organisations need to control tools, permissions, approvals and system integrations.

ASD Highlights Key Agentic AI Risks

The guidance identifies five broad risk categories associated with agentic AI systems: privilege, design and configuration, behavioural, structural and accountability risks. Excessive privileges can allow a compromised agent to have far-reaching access, while insecure architecture or configuration can introduce weaknesses before deployment. Behavioural risks include unintended actions and manipulation through techniques such as prompt injection and data poisoning. Structural risks can emerge when failures cascade across interconnected components and workflows. Accountability risks may arise when complex agentic systems make it difficult to trace decisions, audit actions or assign responsibility. ASD also recommends treating multi-agent systems as a single agent for security purposes because a compromise in one component may propagate through shared context and trust relationships.

Security Controls for Agentic AI

The publication recommends established cybersecurity practices, including least-privilege access, identity and access management, secure design, monitoring and incident response. Organisations are also advised to require human oversight for high-impact actions, control access to external data and tools, validate agent outputs, maintain audit logs and apply supply-chain assurance. ASD recommends a phased approach to deployment, beginning with approved use cases, appropriate data classification and security validation before broader adoption. The guidance also stresses that no harness is inherently secure. Organisations should select harnesses appropriate to their tasks, understand their capabilities and permissions, and apply controls across multiple layers rather than relying solely on model behaviour or prompts. For executives and CISOs, ASD recommends asking what data and systems an agent can access, what actions require human approval, how AI-specific attacks are mitigated, whether significant actions can be monitored and audited, and what could happen if the harness were compromised or misconfigured. As agentic AI adoption expands, ASD's guidance positions the harness as a central part of managing the technology's security, governance and operational risks.

Researchers at Adversa AI disclosed an attack technique that smuggles malicious instructions past AI safety filters by encrypting them. They then demonstrated it against production deployments of xAI's Grok and Google's Gemini - including a zero-click chain that could exfiltrate a Grok user's entire chat history.

The technique, which the researchers call Cryptographic Context Injection, inverts the usual assumption behind input filtering. Guardrails inspect prompts and retrieved content as text; an AES-256-GCM ciphertext contains no readable instruction to flag. The model itself performs the decryption inside its own code-execution sandbox, and then treats the recovered plaintext as trusted intermediate output rather than as untrusted external content. Adversa noted that every element a scanner would need is present on the page, but recovering it requires "running PBKDF2 and AES-256-GCM."

That distinction separates the work from earlier cipher-based jailbreaks such as CipherChat and CodeChameleon, which relied on substitution ciphers or Base64 encoding that large language models can decode natively during inference. Strong authenticated encryption forces execution, and execution is what launders the payload's provenance.

The demonstrated impact differed by target. Against Grok, the researchers showed an indirect, zero-click path. Encrypted JSON embedded in a web page is picked up when Grok's agentic browsing analyzes the site, and the decrypted instructions then leak session data like user name, coarse location, subscription tier and full conversation history, to an attacker-controlled URL. No click or warning reached the user.

Also read: French Police Raid X Offices as Grok Investigations Grow

Against Gemini 3 Flash on the web at the paid tier, the same approach produced instructions for building incendiary devices in the model's Deep Thinking mode, and caused the model to reproduce its own system instructions. Adversa said its Gemini success rate had fallen sharply since June and dropped significantly by August, but could not attribute the change to filter updates, model version changes or both.

Vendor engagement was limited. Adversa reported the Grok issue to xAI on June 3, received an initial acknowledgment, and followed up on August 4 and 10 without substantive response. The firm confirmed the attack still reproduced on August 19.

The Gemini finding was never formally reported, because Google's AI vulnerability reward program excludes prompt injection, jailbreaks and alignment issues from scope, directing them instead to in-product feedback channels. Guardrail-bypass research at one of the largest model providers therefore sits outside a coordinated-disclosure track with a reward and a disclosure clock.

The findings land against a body of evidence that prompt injection remains the dominant failure mode in deployed agentic systems, a position reflected in OWASP's guidance and in Microsoft research published in May on remote code execution in AI agent frameworks. The pattern here is narrower and more concerning for defenders. Content-based guardrails, the primary control most enterprises have deployed, are structurally unable to inspect a payload that only exists in plaintext after the model has already decided to trust it.

Whether xAI ships a fix or acknowledges the report, whether Google revises its reward-program scope to cover guardrail bypasses, and whether AI security vendors move detection from input text to sandbox execution monitoring, is something to watch-out for.