From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents
The paper shows that coding-agent execution harnesses with user-approved allow-rules can be turned into a privilege-escalation channel: malicious repository context can steer agents like Claude Code and Codex CLI into asking for broad, plausible permissions that later let attacks run silently. The interesting bit is that it shifts the threat model from one-off prompt injection to persistent permission abuse and quantifies both acquisition and blast radius, though the attack still depends on users approving the proposed rule and the evidence appears limited to controlled experiments on a small set of production tools.
Abstract
Coding agents use execution harnesses to constrain the consequences of prompt injection by enforcing permission boundaries. These systems deterministically intercept any out-of-sandbox action and prompt the user for approval. To reduce approval fatigue, users can approve allow-rules proposed by the agent, after which any future action matching the rule is allowed without a prompt. In this work, we show that this mechanism introduces a new risk: untrusted context can influence the permissions presented for approval, with consequences extending beyond the immediate task. We investigate privilege escalation targeting this permission-update process. Specifically, adversarial context planted in a repository can reliably steer an agent performing a routine task into requesting a plausibly justified, yet dangerously broad allow-rule. If the user approves the request, the saved rule can effectively blind the harness, enabling adversaries to execute malicious actions that would otherwise require approval, without triggering human oversight. Across production platforms, including Claude Code and Codex CLI, we demonstrate that agents successfully elicit the target allow-rules in 58% of experimental instances. Once acquired, these rules exhibit a massive semantic blast radius, covering 56.9% of category-specific capability test cases. To further quantify the downstream risk, we show that conditional on rule approval, our exploit achieves verified, silent goal completion in 47 of the 58 eligible instances (81.0%), undermining the safety promise of human-in-the-loop oversight.