Cato Networks Research Shows AI Harnesses Can Enable End-to-End Attack Chains

The Harness Is the Weapon

An AI harness is the layer that controls a model’s behavior, connects it to live systems, and shapes the context it operates within. Enterprises across the cybersecurity sector have been building these quietly for some time. What Cato Networks has now demonstrated is how much offensive capability that architecture can unlock.

Paired with OpenAI’s GPT 5.5-Cyber model, Cato’s harness completed end-to-end attack chains across six simulated scenarios—reaching domain administrator privileges and Active Directory access, in some cases within 40 minutes. The agent was given minimal starting resources: an external attack host, a target IP address, and low-level phishing-acquired credentials. Everything else it had to discover on its own.

No predetermined attack paths. No detailed network topology. No elevated credentials handed over in advance.

Context Engineering as Force Multiplier

The most significant finding is not that the model performed well. It is why it performed well.

According to Guy Weisel, a tech evangelist at Cato Networks and one of the research authors, the harness materially improved the model’s reasoning throughout the attack chain. The model was not simply executing instructions—it was probing, adapting, and escalating autonomously. The harness provided the operational context that made that possible.

This distinction matters. A general-purpose LLM operating without structured context will underperform. The same model, wrapped in a well-engineered harness with accurate, relevant data, behaves differently. The gap between those two states is where the real capability lives.

Industry Is Already Building This Infrastructure

Cato Networks is not an isolated case. Several cybersecurity firms have developed their own harness systems, each designed to steer model behavior while preserving flexibility across different LLMs.

• Tenable’s “Hexa” is built to run any commercial LLM through a consistent benchmark suite, ensuring that whichever model becomes dominant can be integrated without compromising reliability or safety constraints.
• Proofpoint’s “Satori” focuses on keeping agentic AI on task while maintaining human override capability—what their chief AI and data officer describes as the combination of context engineering and harness engineering being essential to real-world performance.
• SpecterOps frames the core challenge as effective tool calling and context enrichment—bootstrapped from first principles, not inherited from the frontier model itself.

The pattern is consistent: the frontier model provides raw reasoning capability, but the harness determines whether that capability translates into reliable, targeted performance.

The Offensive Implication

Cato Networks used OpenAI models as a test case, but the research is not a claim about any single model’s superiority. Weisel noted that comparable models would likely produce similar results. More pointedly, he observed that capabilities at this level are likely to reach open-source availability within a year if current trends hold.

That timeline matters for threat modeling. The technical infrastructure required to build an offensive harness is not exotic. Organizations with moderate engineering resources—including criminal groups—can replicate the architecture once the underlying models are freely available.

The attack chain demonstrated by Cato Networks—initial access via phished credentials, lateral movement through an Exchange server, privilege escalation to domain admin, full domain takeover—represents a complete operational kill chain. It required a single agentic operator and minimal human direction.

What This Means for Defense

The defensive response cannot be limited to monitoring frontier model releases. The more urgent question is whether defensive harnesses are being built with the same rigor as offensive ones.

Tenable’s approach—running every new model through Hexa to benchmark behavior before deployment—offers a practical model. It decouples defensive capability from any single LLM and builds consistency into the workflow regardless of which model leads at a given moment.

The broader implication is structural. Policymakers have concentrated attention on the spread of powerful frontier models. The Cato Networks research suggests the more consequential development is already underway: the quiet accumulation of harness infrastructure that turns general-purpose AI into precision offensive and defensive tooling.

The model is the engine. The harness is the vehicle. And the vehicle is already on the road.