An evaluation harness is the software, scripts, rules, and control logic used to run a model test and score the results. It may define the prompts, target tasks, time limits, allowed tools, network access, logging, and stop conditions. In other words, it is the wrapper that turns a raw model into a controlled experiment.
In cyber security, the harness matters as much as the model being tested. A weak harness can leak credentials, reach production services, or let a test behave like a real attack instead of a simulation. Defenders use strict harness design to keep evaluations isolated with synthetic targets, minimal privileges, egress controls, and auditable outputs. Attackers may try to exploit a harness through prompt injection, tool abuse, or reward hacking, so containment is part of the security boundary.