// learn · intermediate
Guard the harness, not just the model
Martin's security lens: risk lives in what an agent can execute.
credit: Martin
Martin's way
- List every tool, shell and credential your agent harness can reach.
- Cut it to the minimum the task needs.
- Keep secrets in a credential vault, never in prompts or dotfiles.
- Review shell plugins before install: anyone can build for the shell.
- Have a second model review security fixes, including an offline one.