Yesterday I saw that Anthropic had (accidentally) leaked Claude Code source via a source map in an npm package.

There’s already debate about whether it was “really” a leak or if the code was effectively public anyway.

I wasn’t that interested in the discourse.

I was interested in the source.

Specifically:
• What it tells us about AI agent plumbing (the harness)
• And what that means for security - beyond prompt injection and model-centric thinking

So I pulled it apart.

The result ended up being… longer than expected 😅
So I split it into a 3-part series.

Part 1 is here:
https://cirriustech.co.uk/blog/agent-harness-abuse-part-1/

If you know me, it won’t surprise you:
This is very much about identity, trust boundaries, and systems thinking.

None of this is new.

But it is increasingly relevant as agent runtimes become distributed systems in their own right.

Curious what others think - especially if you’ve looked at similar architectures