Personal agents need a different kind of harness

Kira Howe argues that personal agents, which combine private data, internet access and untrusted input, cannot be secured with the guardrails coding agents use, and that their harness should give the agent no shell. She cites a 97% approval-prompt acceptance rate, Johann Rehberger's up-to-80% bypass of Claude Code's auto mode, and a Cowork file exfiltration through an allowlisted API. Her proposal is a harness that mediates every action, with declared tool effects and data labels; she says no single runtime offers this yet.