Test the agent execution harness/runtime itself — LangChain/LangGraph, AutoGen, CrewAI, custom ReAct-style loops, or computer-use/browser-use agents — for intermediate-state poisoning, unscoped action spaces, and missing resource limits. Use when the agent isn't built on Claude Code (see `claude-config-security` for that) and you need to verify the loop that feeds tool/environment output back into the model actually enforces a trust boundary.
