From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents
Xianglin Yang, Yechao Zhang, Bryan Hooi and colleagues (National University of Singapore, Nanyang Technological University, Ant Group) show that the allow-rule mechanism coding agents use to reduce approval prompts can be turned into a privilege escalation path by adversarial content planted in a repository.
Ask this paper
Attack surface. Harnesses such as Claude Code and Codex CLI intercept out-of-sandbox actions and ask the user. To reduce approval fatigue, users can accept allow-rules the agent proposes. Untrusted context can influence which rule the agent proposes.
Attack. Adversarial content in a repository steers an agent doing a routine task into requesting a plausibly justified but very broad allow-rule. Once approved, the rule lets later malicious actions run without any prompt.
Elicitation rate. Across production platforms including Claude Code and Codex CLI, agents request the target allow-rule in 58% of experimental instances.
Blast radius. Acquired rules cover 56.9% of category-specific capability test cases. Conditional on approval, the exploit completes its goal silently and verifiably in 47 of 58 eligible instances (81.0%).
Why it matters. Human-in-the-loop approval is the main safeguard in current coding agents. This shows the approval request itself is attacker-influenced, so rule proposals need the same scrutiny as actions.
Abstract
Coding agents use execution harnesses to constrain the consequences of prompt injection by enforcing permission boundaries. These systems deterministically intercept any out-of-sandbox action and prompt the user for approval. To reduce approval fatigue, users can approve allow-rules proposed by the agent, after which any future action matching the rule is allowed without a prompt. In this work, we show that this mechanism introduces a new risk: untrusted context can influence the permissions presented for approval, with consequences extending beyond the immediate task. We investigate privilege escalation targeting this permission-update process. Specifically, adversarial context planted in a repository can reliably steer an agent performing a routine task into requesting a plausibly justified, yet dangerously broad allow-rule. If the user approves the request, the saved rule can effectively blind the harness, enabling adversaries to execute malicious actions that would otherwise require approval, without triggering human oversight. Across production platforms, including Claude Code and Codex CLI, we demonstrate that agents successfully elicit the target allow-rules in 58% of experimental instances. Once acquired, these rules exhibit a massive semantic blast radius, covering 56.9% of category-specific capability test cases. To further quantify the downstream risk, we show that conditional on rule approval, our exploit achieves verified, silent goal completion in 47 of the 58 eligible instances (81.0%), undermining the safety promise of human-in-the-loop oversight.