From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents

Ranked by how close their title and abstract are to this paper’s. Select some to read them together.

Closest papers

1. Very close Another approach to the problem Cited by this paper Not relevant

   Authority Is Not a String: A Capability-Scoped Harness for Prompt-Injection-Resistant Coding Agents

   D. S. Bouras, Yi-Han Dai, Sergey Mechtaev · 2026 · Proceedings of the 2nd ACM SIGPLAN International Workshop on Language Models and Programming Languages · cited 5 times · Not summarized yet

   CapScope derives a task-wide authority ceiling before content is read, whereas this paper studies adversarial repository content that elicits overly broad saved allow-rules.

   Abstract

   Coding agents use system-level tools to read files, execute commands, and modify source code. Within the agent’s sandbox, these tools often carry ambient authority: naming a resource is sufficient to act on it. Indirect prompt injection exploits this authority by placing instructions in repository files or tool output that cause the agent to perform actions the user did not request. We propose CapScope, a harness-level authorization mechanism that restricts tool use without requiring the model to identify malicious text. Before repository contents or tool output are read, CapScope derives a task-wide authority ceiling from trusted input. It then assigns each agent a separate set of typed cap…

2. Close Same question Not relevant

   Do Coding Agents Understand Least-Privilege Authorization?

   Zheng Yan, Jingxiang Weng, Qiguang Chen et al. · 2026 · arXiv.org · preprint, not peer reviewed · cited 11 times · Not summarized yet

   Do Coding Agents Understand Least-Privilege Authorization? tests whether agents infer task-appropriate permissions, while this paper tests whether repository attacks induce excessive permissions.

   Abstract

   As coding agents gain access to shells, repositories, and user files, least-privilege authorization becomes a prerequisite for safe deployment: an agent should receive enough authority to complete the task, without unnecessary authority that exposes sensitive surfaces. To study whether current models can infer this boundary themselves, we first introduce permission-boundary inference, where a model maps a task instruction and terminal environment to a file-level read/write/execute policy, and AuthBench, a benchmark of 120 realistic terminal tasks with human-reviewed permission labels and executable validators for utility and attack outcomes. AuthBench shows that authorization is not a simple…

3. Close Broader context Not relevant

   Auditing Agent Harness Safety

   Chengzhi Liu, Yichen Guo, Yepeng Liu et al. · 2026 · Computation and Language · preprint, not peer reviewed · cited 15 times · AI summary available

   HarnessAudit evaluates whether agent harnesses respect permission and information-flow constraints throughout execution, a broader safety concern than privilege escalation through saved rules.

   Abstract

   LLM agents increasingly run inside execution harnesses that dispatch tools, allocate resources, and route messages between specialized components. However, a harness can return a correct, benign answer over a trajectory that accesses unauthorized resources or leaks context to the wrong agent. Output-level evaluation cannot see these failures, yet most safety benchmarks score only final outputs or terminal states, even though many violations occur mid-trajectory rather than at termination. The central question is whether the harness respects user intent, permission boundaries, and information-flow constraints throughout execution. To address this gap, we propose HarnessAudit, a framework that…

4. Close Same question Cited by this paper Not relevant

   Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks

   Yu-Bin Qu, Ying Zhang, Yan-Jun Zhang et al. · 2026 · arXiv.org · preprint, not peer reviewed · cited 20 times · Not summarized yet

   Overeager Coding Agents measures out-of-scope actions during benign tasks, while this paper studies how benign tasks can prompt approval of permissions enabling such actions.

   Abstract

   Coding agents now run autonomously with shell, file, and network privileges. When a user issues a benign request, the agent sometimes does more than asked: it deletes unrelated files, wipes a stale credentials backup, or rewrites configuration the user never mentioned. We call these scope expansions overeager actions, an authorization problem distinct from capability failures, prompt injection, or sandbox escapes. We present OverEager-Gen, a benchmark dedicated to overeager behavior on benign tasks. Building it surfaces a measurement-validity issue: if a benchmark spells out the authorized scope inside the prompt, the agent stops inferring boundaries and starts pattern-matching declaration t…

5. Close Another approach to the problem Cited by this paper Not relevant

   Progent: Securing AI Agents with Privilege Control

   Tian-Neng Shi, Jing-Xuan He, Zhun Wang et al. · 2025 · cited 191 times · Not summarized yet

   Progent controls agent tool privileges through symbolic policies, while this paper demonstrates attacks that exploit user-approved harness allow-rules.

   Abstract

   AI agents interact with external environments through tool calls, exposing them to attacks like indirect prompt injection that can trigger unauthorized actions. Securing these agents is challenging: they behave autonomously and probabilistically, security requirements evolve depending on the user's task and execution state, and there is an inherent tradeofff between security and utility. In this work, we introduce Progent, a novel framework that secures AI agents via privilege control. Progent represents privilege as a security policy consisting of symbolic rules over tool names and arguments. These rules specify which tool calls are allowed for task completion and which unnecessary ones are…

6. Close Broader context Not relevant

   When Harmful Intent Dissolves into Technical Detail: How Safe Are Coding Agents Against Cyber Misuse?

   Xiang-Zhe Xu, Shiwei Feng, Guangyu Shen et al. · 2026 · CAIS · Not summarized yet

   When Harmful Intent Dissolves into Technical Detail evaluates coding-agent responses to cyber-misuse requests, rather than adversarially induced permission escalation.

   Abstract

   Coding agents are increasingly integrated into realistic software development workflows, where they can write, modify, and execute code on behalf of users. This capability creates a distinct safety requirement: agents must refuse requests that would enable malicious cyber activity. Yet in cybersecurity, harmful intent often dissolves into technical detail. A prompt may describe a sequence of legitimate operations without explicitly revealing the downstream consequence they collectively produce. Safe behavior therefore hinges on an agent’s ability to reason from prompt to consequence under partial information. In this paper, we empirically evaluate how safe are coding agents against cyber mis…

7. Close Broader context Not relevant

   Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems

   Yubin Qu, Yi Liu, Tong-Cheng Geng et al. · 2026 · arXiv.org · preprint, not peer reviewed · cited 50 times · Not summarized yet

   Supply-Chain Poisoning Attacks targets malicious directives in third-party agent skills, while this paper plants adversarial context in repositories to expand permissions.

   Abstract

   LLM-based coding agents extend their capabilities via third-party agent skills distributed through open marketplaces without mandatory security review. Unlike traditional packages, these skills are executed as operational directives with system-level privileges, so a single malicious skill can compromise the host. Prior work has not examined whether supply-chain attacks can directly hijack an agent's action space, such as file writes, shell commands, and network requests, despite existing safeguards. We introduce Document-Driven Implicit Payload Execution (DDIPE), which embeds malicious logic in code examples and configuration templates within skill documentation. Because agents reuse these …

8. Close Same question Not relevant

   SNARE: Adaptive Scenario Synthesis for Eliciting Overeager Behavior in Coding Agents

   Yu-Bin Qu, Yi Liu, Ge-Lei Deng et al. · 2026 · arXiv.org · preprint, not peer reviewed · cited 2 times · Not summarized yet

   SNARE elicits out-of-scope actions during benign coding tasks, while this paper examines whether adversarial context can obtain permissions that enable them.

   Abstract

   A coding agent executes a benign task as a sequence of shell, file, and network actions, any of which can quietly exceed the authorized scope while the task still completes. We call this overeager behavior: the prompt is not adversarial and the run succeeds, yet an out-of-scope step can leak credentials or delete files. Existing benchmarks miss it: task-completion suites credit any finished run, jailbreak suites probe adversarial prompts, and the one prior overeager benchmark applies a single fixed prompt set to every agent-model pair, leaving its easiest and most resistant pairs under-measured. We present SNARE (Synthesizing Non-adversarial scenarios for Adaptive Reward-guided Elicitation),…

Prior work it builds on

1. Related Broader context Used in depth by this paper Not relevant

   IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests

   Ankur Singh, Jin-Qiu Yang, T. Chen · 2026 · arXiv.org · preprint, not peer reviewed · cited 7 times · Not summarized yet

   IssueTrojanBench evaluates agents facing malicious issue requests, whereas this paper uses repository context during benign work to induce broad permission approvals.

   Abstract

   AI coding agents powered by LLMs are increasingly integrated into real-world software development, where they generate, edit, and execute code with autonomous access to local files and tools. Coding agents inherit security risks from both the LLM backbone, where adversarial prompts, poisoned training data, and backdoor triggers can cause models to emit insecure or attacker-chosen code, and their agentic architecture, where tool-using autonomy enables induced misuse of external APIs, data exfiltration, and persistent compromise of development environments. This paper presents a systematic evaluation of malicious issue requests against state-of-the-art coding agents (Cursor, Claude Code, and C…

2. Close Same method, another problem Not relevant

   StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection

   Zhuoxin Zhan, Akbar Rafiey, A. Ma et al. · 2026 · arXiv.org · preprint, not peer reviewed · cited 8 times · Not summarized yet

   StepJack decomposes adversarial goals into innocuous-looking steps against computer-use agents, resembling this paper's staged attack that elicits permissions before pursuing harmful goals.

   Abstract

   Computer-use agents (CUAs) face a growing threat from indirect prompt injection, where adversarial instructions are planted in the environment such as web pages. In this paper, we introduce multi-step indirect prompt injection, a new attack class against CUAs in which the adversarial goal is decomposed into multiple innocuous-looking sub-steps and distributed across a chain of pages referenced along the agent's navigation path. We develop a pipeline to automatically decompose an adversarial goal under the constraint that the execution of the decomposed sub-steps must achieve the original goal while optimizing the innocuousness of each decomposed sub-step. With this pipeline, we build StepJac…

3. Close Groundwork for this paper Not relevant

   Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection

   Kai Greshake, Sahar Abdelnabi, Shailesh Mishra et al. · 2023 · Cryptography and Security · cited 2,442 times · AI summary available

   Not what you've signed up for demonstrates indirect prompt injection against LLM-integrated applications, the attack setting extended here to coding-agent permission updates.

   Abstract

   Large Language Models (LLMs) are increasingly being integrated into various applications. The functionalities of recent LLMs can be flexibly modulated via natural language prompts. This renders them susceptible to targeted adversarial prompting, e.g., Prompt Injection (PI) attacks enable attackers to override original instructions and employed controls. So far, it was assumed that the user is directly prompting the LLM. But, what if it is not the user prompting? We argue that LLM-Integrated Applications blur the line between data and instructions. We reveal new attack vectors, using Indirect Prompt Injection, that enable adversaries to remotely (without a direct interface) exploit LLM-integr…

4. Close Groundwork for this paper Not relevant

   The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents

   Feiran Jia, Tong Wu, Xin Qin et al. · 2024 · Annual Meeting of the Association for Computational Linguistics · cited 163 times · Not summarized yet

   The Task Shield develops defenses against indirect prompt injection that diverts agents from user intent, the broader threat exploited here through permission requests.

   Abstract

   Large Language Model (LLM) agents are increasingly being deployed as conversational assistants capable of performing complex real-world tasks through tool integration. This enhanced ability to interact with external systems and process various data sources, while powerful, introduces significant security vulnerabilities. In particular, indirect prompt injection attacks pose a critical threat, where malicious instructions embedded within external data sources can manipulate agents to deviate from user intentions. While existing defenses based on rule constraints, source spotlighting, and authentication protocols show promise, they struggle to maintain robust security while preserving task fun…

5. Related Broader context Not relevant

   AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases

   Zhaorun Chen, Zhen Xiang, Chao-Wei Xiao et al. · 2024 · Neural Information Processing Systems · cited 607 times · Not summarized yet

   AgentPoison studies attacks that poison agent memories or knowledge bases, while this paper places adversarial instructions in repository context to influence permissions.

   Abstract

   LLM agents have demonstrated remarkable performance across various applications, primarily due to their advanced capabilities in reasoning, utilizing external knowledge and tools, calling APIs, and executing actions to interact with environments. Current agents typically utilize a memory module or a retrieval-augmented generation (RAG) mechanism, retrieving past knowledge and instances with similar embeddings from knowledge bases to inform task planning and execution. However, the reliance on unverified knowledge bases raises significant concerns about their safety and trustworthiness. To uncover such vulnerabilities, we propose a novel red teaming approach AgentPoison, the first backdoor at…

Papers that cite it

1. Close Broader context Uses this paper in depth Not relevant

   Step-Zero Attack: Agent Safety Before Observability

   Tian Qin, Yu-Hang Jiang, Jun-Zhe Chen et al. · 2026 · Not summarized yet

   Step-Zero Attack examines harm during input processing before content reaches the model, unlike this paper's attacks that use repository context to elicit approvals.

   Abstract

   Existing attacks and defenses for coding agents act once content enters the model context: injected text persuades the model, and guards inspect what the model reads. Yet to judge whether processing an unknown archive, network response, or image is safe, an agent often must process it first, and that step can do harm before any content reaches the model. We call this first processing Step Zero, and harm done by it a Step-Zero attack. Across seven harnesses and six models, each agent received only a path or URL to a crafted input, paired with a benign twin showing the same visible fields. Step Zero is where most agents are already unsafe: 32/42 harness-model pairs overran a 4 MiB disk budget,…