harpe Preview

Why Harpe?

Harpe is a framework for building specialized agents.

It is designed for agentic workflows that rely on code generation to act on critical infrastructure and sensitive data, or to perform consequential operations.

Why specialized agents?

A general-purpose agent is usually granted with broad authorities. It can cause severe security issues when the agent is manipulated by either malicious prompts or incorrect AI instructions.

A specialized agent has a pre-defined role, so its authority can be scoped and checked. That is the principle of least authority (PoLA), and we believe it is the right way to make an agent fit for high-stake critical infrastructure and sensitive data use cases.

A general agent and a specialized agent side by side. The same five systems appear in both as bubbles: database, REST APIs, files, shell and email. For the general agent every bubble is open, so all of every system is in reach. For the specialized agent three bubbles are masked out entirely, and the two that remain are open only over a small patch of themselves.

A typed authority boundary

Harpe enforces fine-grained permissions through compile-time sandboxing.

Model-generated code is confined behind a typed boundary. It can reach the trusted runtime and outside world only through capabilities explicitly exposed by the application’s API.

For each agent action step, the model writes a Jo program. Harpe compiles it as an untrusted guest against capability interfaces predefined by the application. Trusted implementations retain credentials, tenant scope, and validation.

The capability interface scopes the agent’s authority:

Why let the agent write code?

Programming is more flexible and efficient than using fixed tools. It provides loops, branching, error handling, and data transformation without routing every intermediate value through the model.

This is not unique to Harpe. CodeAct [1] evaluated 17 LLMs and reported up to a 20% higher success rate for code than for the text-based and JSON-based action formats.

Task success rate by action format on the M³ToolEval benchmark. GPT-4-1106 scores 74.4% with code against 52.4% with JSON and 53.7% with text. Claude-2 scores 54.9% against 39.0% and 29.3%. GPT-3.5-turbo scores 51.2% against 26.8% and 20.7%. These are three of the seventeen models evaluated, and code came first on twelve of them.

Anthropic [2] and Cloudflare [3] have also shown how code execution can reduce tool-schema overhead, compose operations, and process intermediate data outside the model context.

Minimizing attack surface

The security of a traditional sandbox depends on the surface area that untrusted code can reach. In VMs won’t contain cyber-capable agents [4], Trail of Bits reports an agent escaping a QEMU/KVM virtual machine by chaining vulnerabilities in its virtualization and networking stack.

Harpe can reduce attack surface by narrowing the capability interface. A calendar agent can be granted capabilities to only check availability and reserve a slot, without access to credentials and non-granted API end points. In Harpe, the LLM-generated code has no direct access to system calls, thus there are no ambient access to a shell, file system, raw sockets, virtual devices.

The cost and benefits of typed trust boundaries

To develop a secure specialized agent, the trust boundary has to be defined explicitly. You design the capability interfaces the agent acts through, and provide trustworthy implementations behind them. The compiler verifies generated code can only use explicitly granted capabilities.

In an ACM Queue article, Safe Coding [5], Christoph Kern distills decades of Google’s security engineering into a principle of rigorous modular reasoning:

… the safety of risky operations within an abstraction must rely solely on assumptions supported by the abstraction’s APIs and type signatures. Conversely, the composition of safe abstractions with safe code (i.e., code free of risky operations, which constitutes the vast majority of a program) is automatically verified by the implementation language’s type checker.

That is the benefit of a type-checked trust boundary: you pay once in designing the capability interfaces, and every program LLMs write against them is checked by the compiler rather than by a reviewer.

Next: see why compile-time sandboxing makes those boundaries durable.

References

  1. Executable Code Actions Elicit Better LLM Agents. Wang et al., 2024.
  2. Code execution with MCP: Building more efficient agents. Anthropic, 2025.
  3. Code Mode: give agents an entire API in 1,000 tokens. Cloudflare, 2026.
  4. VMs won’t contain cyber-capable agents. Artem Dinaburg, Trail of Bits, 2026.
  5. Safe Coding: Rigorous modular reasoning about software safety. Christoph Kern, 2025.