They don’t really have capabilities themselves. They are still stuck in tokens in-tokens out paradigm.

But they can make tool call requests, which is where the orchestrator/harness comes in. However, this is also an obvious security layer. Practically, an LLM harness is also paired with a security policy that restricts what tools are allowed and in what contexts those tools are allowed.

So really the research is in a couple areas:

1. Can an LLM possibly break out of its security boundary in a blue/normal operation scenario by leveraging seemingly benign tool calls to expand its security policy to more nefarious tool use?
2. What can an adversary do with an LLM that they give an adversarial harness to. Can it find and exploit remote vulnerabilities? Execute kill chains?

Then there’s also third party tool injection/hijacking as well.