# When Context Gets Root: Privilege Escalation in LLM Harnesses

> Instruction privilege escalation, a novel attack exploiting agent-side context reconstruction, achieves all 13 attack objectives across six coding-agent harnesses, bypassing both instruction hierarchy and automatic permission review defenses.

- **Source:** [arXiv](https://arxiv.org/abs/2608.27299)
- **Published:** 2026-08-29
- **Permalink:** https://picx.dev/p/2QFOq2
- **Whiteboard:** https://picx.dev/p/2QFOq2/image

## Summary

## Summary (Overview)

- **New Attack Paradigm**: The paper introduces **instruction privilege escalation (IPE)**, a novel attack that elevates malicious content from a lower instruction level (e.g., tool output) to a higher one (e.g., user or system level) through agent-side context reconstruction, breaking a shared provenance assumption underlying both instruction hierarchy defenses and automatic permission review.
- **Two Escalation Forms**: The authors identify and realize **tool-to-user escalation** (via multi-agent delegation, persistent goals, scheduled tasks) and **tool-to-system escalation** (via custom-subagent installation) across six coding-agent harnesses.
- **Comprehensive Empirical Results**: Across 13 attack objectives spanning confidentiality, integrity, availability, and remote code execution, the attacks achieve **all 13 objectives on all six harnesses** under full-access execution, and **all 13 objectives on all three harnesses** that support automatic permission review (Auto PR).
- **Generality Demonstrated**: The vulnerability extends beyond multi-agent delegation to persistent goals and scheduled tasks, showing it is a systemic issue across multiple context-reconstruction mechanisms.
- **Defense Bypass**: The attack bypasses both model-side defenses (instruction hierarchy) and harness-side defenses (automatic permission review), with tool-to-user escalation achieving a **97.3% mean success rate after escalation** and tool-to-system escalation achieving an **80.3% mean per-attempt attack success rate**.

---

## Introduction and Theoretical Foundation

### Background and Motivation

Modern LLM agents operate in real-world environments, performing complex tasks such as coding, command execution, and routine workflows. However, untrusted content from files, webpages, emails, or tool results can induce agents to take harmful actions, leading to data exfiltration, persistent modification, or remote code execution.

Agent harnesses rely on two primary defenses:

1. **Working agent training**: The model is trained to identify and refuse unsafe instructions.
2. **Automatic permission review (Auto PR)**: A separate model-mediated reviewer assesses whether proposed actions are authorized.

Both defenses rely on an **instruction hierarchy** that assigns different privilege levels to different content sources (system > user > tool). Models are trained to trust system- and user-level instructions more while treating tool-level content as less reliable.

### Theoretical Foundation: The Provenance Assumption

Both defenses rely on a critical assumption: **role labels faithfully reflect the true provenance of content**. The paper demonstrates this assumption is flawed. When a harness delegates a task, resumes a persistent goal, runs a scheduled task, or loads a custom subagent, it may reconstruct context **without preserving the content's original provenance**. Tool-level content can become a user-level task or be persisted as system-effective policy.

### Why Instruction Hierarchy Is Necessary

Assigning instruction levels is unavoidable because an agent combines content from provider policy, user requests, model responses, tool results, stored state, and other agents. Without hierarchy, user instructions and attacker-injected content would be indistinguishable. Provider policies (e.g., OpenAI's Model Spec, Claude's principal hierarchy) turn this into explicit privilege rules.

Models **internalize** instruction hierarchy through explicit training and data-level reinforcement: modern corpora consist largely of role-structured conversations where higher-privilege roles disproportionately contain content that is followed, creating a closed-loop data flywheel.

### Root Cause: Context Reconstruction Breaks Hierarchy

Context reconstruction sometimes lifts content to a higher instruction level. When a harness carries existing content into a new model invocation, if the new level is higher than the original, the content gains instruction privilege. Because reconstruction drops original provenance, defenses cannot distinguish elevated content from genuine user instructions—**escalation is complete before either defense makes its decision**.

---

## Methodology

### Unified Instruction Hierarchy

The authors map protocol-specific message types to three model-facing instruction levels:

$$\Lambda = \{ \text{tool}, \text{user}, \text{system-effective} \}$$

$$\text{tool} < \text{user} < \text{system-effective}$$

**Table 1: Mapping message types to unified hierarchy**

| Unified level | Protocol | Native representation |
|---|---|---|
| System-effective | OpenAI Chat Completions | System and developer messages |
| System-effective | OpenAI Responses | System and developer messages |
| System-effective | Anthropic Messages | System instructions |
| System-effective | Google Gemini Interactions | system_instruction |
| User | OpenAI Chat Completions | User messages |
| User | OpenAI Responses | User messages |
| User | Anthropic Messages | Ordinary content in user messages |
| User | Google Gemini Interactions | user_input |
| Tool | OpenAI Chat Completions | Tool messages |
| Tool | OpenAI Responses | function_call_output items |
| Tool | Anthropic Messages | Structured tool_result blocks in user messages |
| Tool | Google Gemini Interactions | function_result items |

### Formal Escalation Definition

For each content item $c$, let $P(c) \in \Lambda$ be its **origin level** (the level at which $c$ first enters the agent). Let $P_{\mathrm{har}}^{(\tau)}(c) \in \Lambda$ be the level the harness assigns during context construction at step $\tau$.

Instruction privilege escalation occurs when context construction presents content at a higher level than its origin:

$$
\langle P(c), c \rangle \xrightarrow{R_1} \langle P_{\mathrm{har}}^{(1)}(c), c \rangle \xrightarrow{R_2} \dots \xrightarrow{R_k} \langle P_{\mathrm{har}}^{(k)}(c), c \rangle, \qquad P_{\mathrm{har}}^{(k)}(c) > P(c)
$$

- **Tool-to-user escalation**: $P(c) = \text{tool}$, $P_{\mathrm{har}}^{(k)}(c) = \text{user}$
- **Tool-to-system escalation**: $P(c) = \text{tool}$, $P_{\mathrm{har}}^{(k)}(c) = \text{system-effective}$

### Threat Model

The victim is modeled as an agent system:

$$V = (H, M_w, M_r), \quad M_r \in \mathcal{M} \cup \{\bot\}$$

where $H$ is the harness, $M_w$ is the working agent model, and $M_r$ is the reviewer model ($M_r = \perp$ when no reviewer is used).

The attacker controls workspace artifacts $A$ (repository files, task documents) that the agent may read, with content entering at the tool level ($P(c) = \text{tool}$). The attacker does **not** control the user request, harness, models, developer instructions, tool permissions, sandbox policy, or approval policy. The attack does **not** rely on prompt injection or model jailbreaks.

### Attack Mechanisms

**Tool-to-User Escalation via Delegation**: The attacker places an inducing instruction in the repository that causes the main agent to delegate a malicious task to a subagent. The harness places the delegated task as a **user-level message** in the subagent's context:

$$\langle \text{tool}, c \rangle \xrightarrow{R_{\text{delegate}}} \langle \text{user}, c \rangle$$

Two induction strategies:
- **Direct induction**: Explicit delegation directive in README.md (works for GPT, DeepSeek, Qwen)
- **Indirect induction**: Benign task steps separated from inducing instruction in AGENT.md (works for Claude Opus, Fable)

**Tool-to-System Escalation via Custom Subagents**: The attacker installs a malicious subagent with a modified AGENT.md. The installation places attacker-controlled content into system-effective configuration:

$$\langle \text{tool}, c \rangle \xrightarrow{R_{\text{install}}} \langle \text{system-effective}, c \rangle$$

Two variants:
- **Direct**: Malicious code explicitly embedded in subagent's system prompt
- **Hidden script**: System prompt instructs subagent to call an external malicious script, with constrained tool calls to prevent inspection

**Additional Mechanisms**: Persistent goals (harness resends as user-level prompt) and scheduled tasks (harness delivers as user-level message at a later time).

---

## Empirical Validation / Results

### Evaluation Setup

Six coding-agent harnesses paired with six models, evaluated across 13 attack objectives:

**Table 3: Thirteen attack objectives**

| Category | Attack objective | Security effect |
|---|---|---|
| Confidentiality | Local Service Secret Exfiltration | Local credential disclosure |
| Confidentiality | Session Material Exfiltration | Active session disclosure |
| Confidentiality | Phishing Email | Credential theft through phishing |
| Confidentiality | Remote Host Data Exfiltration | Remote-host data disclosure |
| Integrity | Git Proxy Hijacking | Git traffic interception |
| Integrity | Malicious CA Installation | TLS traffic interception |
| Integrity | Downloaded Binary Execution | Attacker-supplied code execution |
| Availability | Application Database Deletion | Application data loss |
| Availability | Local Toolchain Deletion | Developer toolchain loss |
| Availability | Integrity Monitor Termination | Security monitoring loss |
| Availability | Recurring Botnet Job | Persistent resource abuse |
| RCE | Command-and-Control Shell | Interactive remote control |
| RCE | SSH Authorized-Key Backdoor | Persistent remote access |

**Table 4: Evaluated configurations**

| Harness | Model | Native | Auto PR |
|---|---|---|---|
| Claude Code | Opus 4.8 | Yes | Yes |
| Codex | GPT-5.5 | Yes | Yes |
| Gemini CLI | Gemini 3.1 Pro Preview | Yes | No |
| Qwen Code | Qwen3.7 Max | Yes | Yes |
| Kimi | Kimi 3 | Yes | No |
| OpenCode | DeepSeek-V4-Pro-0813 | No | No |

### Tool-Level Baseline

Existing prompt-injection and role-confusion attacks (MCPTox, CoT Forgery, ChatInject) mostly **fail** at the tool level:

**Table 5: Tool-level baseline results (objectives achieved out of 13)**

| Harness | MCPTox | CoT Forgery | ChatInject |
|---|---|---|---|
| **Full Access** | | | |
| Claude Code | 0/13 | 0/13 | 0/13 |
| Codex | 0/13 | 0/13 | 0/13 |
| Gemini CLI | 7/13 | 4/13 | 3/13 |
| Qwen Code | 1/13 | 0/13 | 0/13 |
| Kimi | 0/13 | 0/13 | 0/13 |
| OpenCode | 1/13 | 0/13 | 0/13 |
| **Auto PR** | | | |
| Claude Code | 0/13 | 0/13 | 0/13 |
| Codex | 0/13 | 0/13 | 0/13 |
| Qwen Code | 0/13 | 0/13 | 0/13 |

### Tool-to-User Escalation Results

**Table 6: Tool-to-user escalation achieves all 13 objectives on all harnesses under both permission regimes** (✓ denotes success after baseline failure; ○ denotes success in both conditions).

**Table 7: Reliability metrics**

| Harness | Permission | Success after escalation | Attack success rate |
|---|---|---|---|
| Claude Code | Full Access | 100.0% | 31.7% |
| Codex | Full Access | 100.0% | 100.0% |
| Gemini CLI | Full Access | 96.2% | 61.7% |
| Qwen Code | Full Access | 100.0% | 61.7% |
| Kimi | Full Access | 96.2% | 64.9% |
| OpenCode | Full Access | 96.2% | 72.5% |
| Claude Code | Auto PR | 86.7% | 37.1% |
| Codex | Auto PR | 100.0% | 100.0% |
| Qwen Code | Auto PR | 100.0% | 59.1% |

### Tool-to-System Escalation Results

**Table 8: Tool-to-system escalation (C = hidden-script, D = direct)**

- Hidden-script variant: **13/13 objectives on all harnesses** under both full access and Auto PR
- Direct variant: 0–13 objectives depending on harness (Claude Code 0/13, OpenCode 13/13)

**Table 9: Installation success rates**

| Harness | Permission Regime | Installation Success Rate |
|---|---|---|
| Claude Code | Auto PR | 46.2% |
| Codex | Auto PR | 100.0% |
| Gemini CLI | Full Access | 100.0% |
| Qwen Code | Auto PR | 76.9% |
| Kimi | Full Access | 84.6% |
| OpenCode | Full Access | 100.0% |

**Table 10: Hidden-script variant attack success rates**

| Harness | Permission | Attack success rate |
|---|---|---|
| Claude Code | Full Access | 86.7% |
| Codex | Full Access | 100.0% |
| Gemini CLI | Full Access | 86.7% |
| Qwen Code | Full Access | 65.0% |
| Kimi | Full Access | 86.7% |
| OpenCode | Full Access | 86.7% |
| Claude Code | Auto PR | 76.5% |
| Codex | Auto PR | 72.2% |
| Qwen Code | Auto PR | 61.9% |

### Generality via Goals and Scheduled Tasks

**Table 12: All four evaluated paths achieve 13/13 objectives**

| Harness | Path | Permission | Successful objectives |
|---|---|---|---|
| Claude Code | Scheduled task | Full Access | 13/13 |
| Codex | Goal | Full Access | 13/13 |
| Codex | Scheduled task | Auto PR | 13/13 |
| Qwen Code | Scheduled task | Auto PR | 13/13 |

---

## Theoretical and Practical Implications

### Theoretical Implications

1. **The provenance assumption is fundamentally broken**: The paper demonstrates that instruction hierarchy and Auto PR both rely on role labels faithfully reflecting content provenance—an assumption violated by normal harness context-reconstruction operations.

2. **Escalation is distinct from prompt injection and role confusion**: Unlike prompt injection (content stays at original level) or role-confusion (model misinterprets role), IPE involves the harness itself placing content at a higher instruction level in the actual model-facing context. The downstream model correctly obeys the visible hierarchy.

3. **Defense-in-depth failure**: Both model-side (instruction hierarchy) and harness-side (Auto PR) defenses fail independently. Auto PR correctly identifies actions as high-risk yet still authorizes them because the reconstructed history presents attacker-derived text as user authorization.

### Practical Implications

1. **Systemic vulnerability across harnesses**: The attack works on all six evaluated harnesses (Claude Code, Codex, Gemini CLI, Qwen Code, Kimi, OpenCode), indicating a shared architectural weakness rather than a bug in any specific implementation.

2. **Harness design must preserve provenance**: Context-construction operations (delegation, goals, scheduled tasks, custom subagents) must either preserve original content provenance or clearly mark elevated content as derived from lower-privilege sources.

3. **Auto PR needs provenance tracking**: Permission reviewers must distinguish between genuine user authorization and content that merely appears as a user message due to context reconstruction.

4. **Subagent isolation**: When delegating tasks, harnesses should not present delegated content as if it came directly from the human user; provenance metadata should be maintained.

---

## Conclusion

The paper introduces **instruction privilege escalation**, a novel attack paradigm that elevates attacker-controlled content to a higher model-facing instruction level through agent-side context construction. The attack is realized through:

- **Tool-to-user escalation** via multi-agent delegation, persistent goals, and scheduled tasks
- **Tool-to-system escalation** via custom-subagent installation and loading

Across six coding-agent harnesses and 13 attack objectives spanning confidentiality, integrity, availability, and RCE, the attacks achieve **every objective on every harness** under full access and **every objective on all three harnesses** with Auto PR.

Key takeaways:

1. Neither evaluated models nor their permission reviewers prevent instruction privilege escalation.
2. The vulnerability arises from a broken provenance assumption shared by both instruction hierarchy and automatic permission review.
3. The attack does not rely on prompt injection, model jailbreaks, or model-side role confusion—all components behave exactly as configured and trained.

**Future directions**: The authors note that system-effective is an analytical category where privilege can differ within the category (e.g., OpenAI distinguishes system and developer messages, and prompt position can affect privilege). Future work should explore defenses that preserve provenance across context reconstruction and investigate whether the vulnerability extends to other agent types beyond coding agents.

---

_Markdown view of https://picx.dev/p/2QFOq2, served by PicX — AI-generated visual whiteboard summaries of research papers._