Agent Harness Distillation: extracting multi-agent harnesses through black-box interaction

What happened on 30 July

On 30 July 2026 at 12:54 UTC, v1 of Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent Systems was submitted to arXiv. The authors argue that the inference-time harnesses guiding reasoning and action in LLM-based autonomous multi-agent systems are costly to engineer and are valuable intellectual property. Their AHD method extracts a target's harness through black-box interaction only: it infers harness behavior from the target's responses to build an initial harness, then iteratively refines it to match the target's behavioral patterns. They formalize harness extraction as a security problem with an evaluation framework, report effectiveness on real-world systems with multiple backbone models, and propose a deception-based defense. The abstract gives no specific numbers.

What it means for AI product threat models

The paper moves the cloning discussion from code to behavior. Many teams assume that keeping core logic on the server and never shipping it to clients prevents copying. For conventional business logic that remains the right direction, but for AI agent products the value often lies in orchestration, tool-call sequencing and prompting strategy, which are partly revealed through outputs. Server-side deployment blocks direct access to code but cannot stop outsiders from inferring behavior through many interactions. Note that the abstract provides no figures on extraction fidelity or cost, so the risk should not be overstated; the takeaway is that interaction-level abuse belongs in the threat model.

Checks you can run

First, identify which parts of your product's value come from orchestration and prompting strategy, and assess how much of that can be inferred from public outputs. Second, apply per-account and per-source rate limits and quotas to your interfaces, and monitor for systematic probing, such as large volumes of structurally similar queries that sweep edge cases. Third, avoid echoing internal plans, tool names or intermediate reasoning in outputs, and prohibit automated extraction in your terms of service. The deception-based defense in the paper is worth following as research, but evaluate it yourself before relying on it in production.

Your checklist

• Identify value that lives in orchestration and prompting
• Rate-limit interfaces and monitor for systematic probing
• Avoid echoing internal plans and tool details in outputs