From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents

Key points

• In this work, we show that this mechanism introduces a new risk: untrusted context can influence the permissions presented for approval, with consequences extending beyond the immediate task.1
• We investigate privilege escalation targeting this permission-update process.1
• Across production platforms, including Claude Code and Codex CLI, we demonstrate that agents successfully elicit the target allow-rules in 58% of experimental instances.1
• To further quantify the downstream risk, we show that conditional on rule approval, our exploit achieves verified, silent goal completion in 47 of the 58 eligible instances (81.0%), undermining the safety promise of human-in-the-loop oversight.1

Sources (1)

• [1]From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 16, 06:13 AM

  Coding agents use execution harnesses to constrain the consequences of prompt injection by enforcing permission boundaries.

  In this work, we show that this mechanism introduces a new risk: untrusted context can influence the permissions presented for approval, with consequences extending beyond the immediate task.

Extractive summary: sentences quoted from the sources.