Summary (Overview)

• New Attack Paradigm: The paper introduces instruction privilege escalation (IPE), a novel attack that elevates malicious content from a lower instruction level (e.g., tool output) to a higher one (e.g., user or system level) through agent-side context reconstruction, breaking a shared provenance assumption underlying both instruction hierarchy defenses and automatic permission review.
• Two Escalation Forms: The authors identify and realize tool-to-user escalation (via multi-agent delegation, persistent goals, scheduled tasks) and tool-to-system escalation (via custom-subagent installation) across six coding-agent harnesses.
• Comprehensive Empirical Results: Across 13 attack objectives spanning confidentiality, integrity, availability, and remote code execution, the attacks achieve all 13 objectives on all six harnesses under full-access execution, and all 13 objectives on all three harnesses that support automatic permission review (Auto PR).
• Generality Demonstrated: The vulnerability extends beyond multi-agent delegation to persistent goals and scheduled tasks, showing it is a systemic issue across multiple context-reconstruction mechanisms.
• Defense Bypass: The attack bypasses both model-side defenses (instruction hierarchy) and harness-side defenses (automatic permission review), with tool-to-user escalation achieving a 97.3% mean success rate after escalation and tool-to-system escalation achieving an 80.3% mean per-attempt attack success rate.

---

Introduction and Theoretical Foundation

Background and Motivation

Modern LLM agents operate in real-world environments, performing complex tasks such as coding, command execution, and routine workflows. However, untrusted content from files, webpages, emails, or tool results can induce agents to take harmful actions, leading to data exfiltration, persistent modification, or remote code execution.

Agent harnesses rely on two primary defenses:

1. Working agent training: The model is trained to identify and refuse unsafe instructions.
2. Automatic permission review (Auto PR): A separate model-mediated reviewer assesses whether proposed actions are authorized.

Both defenses rely on an instruction hierarchy that assigns different privilege levels to different content sources (system > user > tool). Models are trained to trust system- and user-level instructions more while treating tool-level content as less reliable.

Theoretical Foundation: The Provenance Assumption

Both defenses rely on a critical assumption: role labels faithfully reflect the true provenance of content. The paper demonstrates this assumption is flawed. When a harness delegates a task, resumes a persistent goal, runs a scheduled task, or loads a custom subagent, it may reconstruct context without preserving the content's original provenance. Tool-level content can become a user-level task or be persisted as system-effective policy.

Why Instruction Hierarchy Is Necessary

Assigning instruction levels is unavoidable because an agent combines content from provider policy, user requests, model responses, tool results, stored state, and other agents. Without hierarchy, user instructions and attacker-injected content would be indistinguishable. Provider policies (e.g., OpenAI's Model Spec, Claude's principal hierarchy) turn this into explicit privilege rules.

Models internalize instruction hierarchy through explicit training and data-level reinforcement: modern corpora consist largely of role-structured conversations where higher-privilege roles disproportionately contain content that is followed, creating a closed-loop data flywheel.

Root Cause: Context Reconstruction Breaks Hierarchy

Context reconstruction sometimes lifts content to a higher instruction level. When a harness carries existing content into a new model invocation, if the new level is higher than the original, the content gains instruction privilege. Because reconstruction drops original provenance, defenses cannot distinguish elevated content from genuine user instructions—escalation is complete before either defense makes its decision.

---

Methodology

Unified Instruction Hierarchy

The authors map protocol-specific message types to three model-facing instruction levels:

$$\Lambda = \{ \text{tool}, \text{user}, \text{system-effective} \}$$ $$\text{tool} < \text{user} < \text{system-effective}$$

Table 1: Mapping message types to unified hierarchy

Formal Escalation Definition

For each content item $c$, let $P(c) \in \Lambda$ be its origin level (the level at which $c$ first enters the agent). Let $P_{\mathrm{har}}^{(\tau)}(c) \in \Lambda$ be the level the harness assigns during context construction at step $\tau$.

Instruction privilege escalation occurs when context construction presents content at a higher level than its origin:

$$\langle P(c), c \rangle \xrightarrow{R_1} \langle P_{\mathrm{har}}^{(1)}(c), c \rangle \xrightarrow{R_2} \dots \xrightarrow{R_k} \langle P_{\mathrm{har}}^{(k)}(c), c \rangle, \qquad P_{\mathrm{har}}^{(k)}(c) > P(c)$$

• Tool-to-user escalation: $P(c) = \text{tool}$, $P_{\mathrm{har}}^{(k)}(c) = \text{user}$
• Tool-to-system escalation: $P(c) = \text{tool}$, $P_{\mathrm{har}}^{(k)}(c) = \text{system-effective}$

Threat Model

The victim is modeled as an agent system:

$$V = (H, M_w, M_r), \quad M_r \in \mathcal{M} \cup \{\bot\}$$

where $H$ is the harness, $M_w$ is the working agent model, and $M_r$ is the reviewer model ($M_r = \perp$ when no reviewer is used).

The attacker controls workspace artifacts $A$ (repository files, task documents) that the agent may read, with content entering at the tool level ($P(c) = \text{tool}$). The attacker does not control the user request, harness, models, developer instructions, tool permissions, sandbox policy, or approval policy. The attack does not rely on prompt injection or model jailbreaks.

Attack Mechanisms

Tool-to-User Escalation via Delegation: The attacker places an inducing instruction in the repository that causes the main agent to delegate a malicious task to a subagent. The harness places the delegated task as a user-level message in the subagent's context:

$$\langle \text{tool}, c \rangle \xrightarrow{R_{\text{delegate}}} \langle \text{user}, c \rangle$$

Two induction strategies:

• Direct induction: Explicit delegation directive in README.md (works for GPT, DeepSeek, Qwen)
• Indirect induction: Benign task steps separated from inducing instruction in AGENT.md (works for Claude Opus, Fable)

Tool-to-System Escalation via Custom Subagents: The attacker installs a malicious subagent with a modified AGENT.md. The installation places attacker-controlled content into system-effective configuration:

$$\langle \text{tool}, c \rangle \xrightarrow{R_{\text{install}}} \langle \text{system-effective}, c \rangle$$

Two variants:

• Direct: Malicious code explicitly embedded in subagent's system prompt
• Hidden script: System prompt instructs subagent to call an external malicious script, with constrained tool calls to prevent inspection

Additional Mechanisms: Persistent goals (harness resends as user-level prompt) and scheduled tasks (harness delivers as user-level message at a later time).

---

Empirical Validation / Results

Evaluation Setup

Six coding-agent harnesses paired with six models, evaluated across 13 attack objectives:

Table 3: Thirteen attack objectives

Table 4: Evaluated configurations

Tool-Level Baseline

Existing prompt-injection and role-confusion attacks (MCPTox, CoT Forgery, ChatInject) mostly fail at the tool level:

Table 5: Tool-level baseline results (objectives achieved out of 13)

Tool-to-User Escalation Results

Table 6: Tool-to-user escalation achieves all 13 objectives on all harnesses under both permission regimes (✓ denotes success after baseline failure; ○ denotes success in both conditions).

Table 7: Reliability metrics

Tool-to-System Escalation Results

Table 8: Tool-to-system escalation (C = hidden-script, D = direct)

• Hidden-script variant: 13/13 objectives on all harnesses under both full access and Auto PR
• Direct variant: 0–13 objectives depending on harness (Claude Code 0/13, OpenCode 13/13)

Table 9: Installation success rates

Table 10: Hidden-script variant attack success rates

Generality via Goals and Scheduled Tasks

Table 12: All four evaluated paths achieve 13/13 objectives

---

Theoretical and Practical Implications

Theoretical Implications

1. The provenance assumption is fundamentally broken: The paper demonstrates that instruction hierarchy and Auto PR both rely on role labels faithfully reflecting content provenance—an assumption violated by normal harness context-reconstruction operations.

2. Escalation is distinct from prompt injection and role confusion: Unlike prompt injection (content stays at original level) or role-confusion (model misinterprets role), IPE involves the harness itself placing content at a higher instruction level in the actual model-facing context. The downstream model correctly obeys the visible hierarchy.

3. Defense-in-depth failure: Both model-side (instruction hierarchy) and harness-side (Auto PR) defenses fail independently. Auto PR correctly identifies actions as high-risk yet still authorizes them because the reconstructed history presents attacker-derived text as user authorization.

Practical Implications

1. Systemic vulnerability across harnesses: The attack works on all six evaluated harnesses (Claude Code, Codex, Gemini CLI, Qwen Code, Kimi, OpenCode), indicating a shared architectural weakness rather than a bug in any specific implementation.

2. Harness design must preserve provenance: Context-construction operations (delegation, goals, scheduled tasks, custom subagents) must either preserve original content provenance or clearly mark elevated content as derived from lower-privilege sources.

3. Auto PR needs provenance tracking: Permission reviewers must distinguish between genuine user authorization and content that merely appears as a user message due to context reconstruction.

4. Subagent isolation: When delegating tasks, harnesses should not present delegated content as if it came directly from the human user; provenance metadata should be maintained.

---

Conclusion

The paper introduces instruction privilege escalation, a novel attack paradigm that elevates attacker-controlled content to a higher model-facing instruction level through agent-side context construction. The attack is realized through:

• Tool-to-user escalation via multi-agent delegation, persistent goals, and scheduled tasks
• Tool-to-system escalation via custom-subagent installation and loading

Across six coding-agent harnesses and 13 attack objectives spanning confidentiality, integrity, availability, and RCE, the attacks achieve every objective on every harness under full access and every objective on all three harnesses with Auto PR.

Key takeaways:

1. Neither evaluated models nor their permission reviewers prevent instruction privilege escalation.
2. The vulnerability arises from a broken provenance assumption shared by both instruction hierarchy and automatic permission review.
3. The attack does not rely on prompt injection, model jailbreaks, or model-side role confusion—all components behave exactly as configured and trained.

Future directions: The authors note that system-effective is an analytical category where privilege can differ within the category (e.g., OpenAI distinguishes system and developer messages, and prompt position can affect privilege). Future work should explore defenses that preserve provenance across context reconstruction and investigate whether the vulnerability extends to other agent types beyond coding agents.