---
title: "From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents"
authors:
  - "Xianglin Yang"
  - "Yechao Zhang"
  - "Jiahao Liu"
  - "Yulin Chen"
  - "Yuxin Cao"
  - "Bryan Hooi"
  - "Jiaheng Zhang"
year: 2026
venue: "arXiv preprint (cs.AI)"
arxiv: "2610.22987"
doi: null
source: "https://arxiv.org/abs/2610.22987"
topics:
  - "agent-failure-localization"
  - "provenance-first-agent-memory"
seed_rank: 2365
seed_batch: "frontier-2026-10-20"
reviewed: "2026-10-20"
pool: "agents"
relevance_score: 8
cites:
  - title: "From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents"
    url: "https://arxiv.org/abs/2610.22987"
    year: 2026
    arxiv: "2610.22987"
    doi: null
see:
  - 2245-package-hallucination-attacks-on-coding-agents-through-prompt-injection
---

# From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents

## One-sentence takeaway

Adversarial text planted in a repository can steer a coding agent doing a routine task into proposing a plausible but dangerously broad reusable allow-rule; across Claude Code and Codex CLI the agents asked for the target rule in 58% of instances, the rules covered 56.9% of category-specific capability tests, and once a user approved one, the attack silently completed its malicious goal in 47 of 58 eligible cases (81.0%), with no further approval prompt.

## Why it matters here

Broadside's agents (and this bot fleet) run behind approval gates and saved permissions, and users approve allow-rules to avoid approval fatigue; the paper cites Anthropic's figure that 49.5% of active Claude Code CLI users had configured a Bash allow rule as of June 2026. The lesson is that the permission-update step itself is an attack surface: an allow-rule proposed by an agent that has read untrusted content is untrusted input, and its scope should be judged against the task, not against the agent's justification.

## Key ideas

- **Threat model.** Harnesses intercept out-of-sandbox actions and ask the user; to cut prompts, the agent may propose a reusable rule that, once approved, lets every matching future action through. Untrusted context shapes which rule gets proposed and how it is justified.
- **Two-stage attack.** Stage I (permission acquisition) weaponizes a repository so a benign task leads the agent to request a broad rule; Stage II uses the saved rule to run goals such as unauthorized reading, data exfiltration, file deletion and artifact download without triggering oversight.
- **Targets.** Codex CLI with gpt-5.6-luna and gpt-5.6-sol, and Claude Code with claude-haiku-4.5 and claude-sonnet-5, each with its native harness and permission interface.
- **Results.** Target rules elicited in 58% of instances; acquired rules cover 56.9% of category-specific capability test cases ("semantic blast radius"); conditional on approval, verified silent goal completion in 81.0%. Codex with gpt-5.6-luna completed every eligible case across sensitivity tiers; claude-sonnet-5 was more constrained (2/4 ordinary, 1/4 sensitive, 0/1 critical) but still penetrated where baselines did not.

## Caveats

Stage II success is conditional on a human approving the rule, and the study measures what agents request, not how often real users approve such requests. Sample sizes per tier are small (single digits for the critical tier). The four model–harness configurations are snapshots of fast-moving products, and no released code was linked in the preprint. Defenses are surveyed in related work rather than proposed and evaluated.

## Links

- arXiv abstract: https://arxiv.org/abs/2610.22987
- PDF: https://arxiv.org/pdf/2610.22987