针对大模型智能体通过工具调用改变真实环境时面临的跨部件安全风险，文章以连接模型与环境的运行支撑层Harness为研究对象，采用定向文献检索与引用追踪，梳理1974---2026年的223项资料。围绕运行职责、威胁描述、保障机制及评价与演化建立分析框架，将七类运行部件与攻击者能力、策略实施位置和证据类型交叉标注，比较核心机制的保护范围、可信前提及效用代价。综合分析表明，来源区分、任务授权、环境隔离与独立验证分别约束不同环节；跨部件防护需要保留来源信息，将授权绑定具体操作与资源，并维持检查与提交的状态一致性。组件组合验证、安全与效用联合评估以及运行架构演化治理是后续研究的主要方向。

This survey examined cross-component security risks that arise when large language model agents change real environments through tool use. It focused on the harness, the runtime layer connecting a model to its environment, and reviewed 223 sources from 1974 to 2026 through targeted literature searches and citation tracing. It developed an analytical framework covering runtime responsibilities, threat descriptions, security mechanisms, and evaluation and evolution. It organized harness responsibilities into seven components: context management, tool interfaces, execution environments, control loops, state and memory, permissions and human oversight, and verification and feedback. It cross-mapped these components to attacker capabilities, enforcement locations, and evidence types, and compared the protection scope, trust assumptions, and utility costs of key defenses. The synthesis identifies distinct roles for provenance separation, task authorization, environment isolation, and independent verification. Cross-component protection requires preserving provenance, binding authorization to specific operations and resources, and maintaining state consistency between checks and commits. Compositional verification, joint evaluation of security and utility, and governance of harness evolution are key directions for further research.

Paper In "信息网络安全 ISSN1671-1122"｜Click Here To Get The Full Paper