AI coding-agent security depends on the harness executing the action a person approved. This abstract names and tests failures in that approval–execution binding.
Why it matters: A defense that checks only recorded tool-dispatch fields may miss mismatches that diverge one process level below those fields. The reported Scope and Argument results make the boundary of a field-only verifier a practical concern when evaluating approval-binding defenses.
Anthropic reports that GLM-5.3 can build working exploits and that simple techniques bypass its safeguards in simulated tests; it says this combination makes advanced cyber capability more accessible to attackers.
Why it matters: The findings make both defender access and independent safety testing practical concerns: Anthropic argues defenders need capable tools, while governments should test sufficiently capable models and their successors.
HARDE treats runtime defense as an optimizable harness: probe its modules, then refine execution control using safety and utility feedback.
Why it matters: For runtime defense, the abstract points to a practical design choice: coordinate detection with timely intervention, and tune the harness to both the attack risks and the monitor’s capabilities while limiting disruption to benign tasks.