An arXiv paper treating the harness (tool use, context management, state) as the attack surface. It proposes four defense layers: adversarial context filtering, causal verification of decisions, privilege-separated tool control and safe rollback. It reports ~42% lower attack success on benchmarks. Caveat: simulated evaluation, not production evidence.