From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents

Classés selon la proximité de leur titre et de leur résumé avec ceux de cet article. Sélectionnez-en pour les lire ensemble.

Les articles les plus proches

1. Très proche Cité par cet article Pas pertinent

   Authority Is Not a String: A Capability-Scoped Harness for Prompt-Injection-Resistant Coding Agents

   D. S. Bouras, Yi-Han Dai, Sergey Mechtaev · 2026 · Proceedings of the 2nd ACM SIGPLAN International Workshop on Language Models and Programming Languages · cité 5 fois · Pas encore résumé

   Résumé scientifique

   Coding agents use system-level tools to read files, execute commands, and modify source code. Within the agent’s sandbox, these tools often carry ambient authority: naming a resource is sufficient to act on it. Indirect prompt injection exploits this authority by placing instructions in repository files or tool output that cause the agent to perform actions the user did not request. We propose CapScope, a harness-level authorization mechanism that restricts tool use without requiring the model to identify malicious text. Before repository contents or tool output are read, CapScope derives a task-wide authority ceiling from trusted input. It then assigns each agent a separate set of typed cap…

2. Proche Pas pertinent

   Do Coding Agents Understand Least-Privilege Authorization?

   Zheng Yan, Jingxiang Weng, Qiguang Chen et al. · 2026 · arXiv.org · preprint, non relu par les pairs · cité 11 fois · Pas encore résumé

   Résumé scientifique

   As coding agents gain access to shells, repositories, and user files, least-privilege authorization becomes a prerequisite for safe deployment: an agent should receive enough authority to complete the task, without unnecessary authority that exposes sensitive surfaces. To study whether current models can infer this boundary themselves, we first introduce permission-boundary inference, where a model maps a task instruction and terminal environment to a file-level read/write/execute policy, and AuthBench, a benchmark of 120 realistic terminal tasks with human-reviewed permission labels and executable validators for utility and attack outcomes. AuthBench shows that authorization is not a simple…

3. Proche Pas pertinent

   Auditing Agent Harness Safety

   Chengzhi Liu, Yichen Guo, Yepeng Liu et al. · 2026 · Computation and Language · preprint, non relu par les pairs · cité 15 fois · Résumé IA disponible

   Résumé scientifique

   LLM agents increasingly run inside execution harnesses that dispatch tools, allocate resources, and route messages between specialized components. However, a harness can return a correct, benign answer over a trajectory that accesses unauthorized resources or leaks context to the wrong agent. Output-level evaluation cannot see these failures, yet most safety benchmarks score only final outputs or terminal states, even though many violations occur mid-trajectory rather than at termination. The central question is whether the harness respects user intent, permission boundaries, and information-flow constraints throughout execution. To address this gap, we propose HarnessAudit, a framework that…

4. Proche Cité par cet article Pas pertinent

   Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks

   Yu-Bin Qu, Ying Zhang, Yan-Jun Zhang et al. · 2026 · arXiv.org · preprint, non relu par les pairs · cité 20 fois · Pas encore résumé

   Résumé scientifique

   Coding agents now run autonomously with shell, file, and network privileges. When a user issues a benign request, the agent sometimes does more than asked: it deletes unrelated files, wipes a stale credentials backup, or rewrites configuration the user never mentioned. We call these scope expansions overeager actions, an authorization problem distinct from capability failures, prompt injection, or sandbox escapes. We present OverEager-Gen, a benchmark dedicated to overeager behavior on benign tasks. Building it surfaces a measurement-validity issue: if a benchmark spells out the authorized scope inside the prompt, the agent stops inferring boundaries and starts pattern-matching declaration t…

5. Proche Cité par cet article Pas pertinent

   Progent: Securing AI Agents with Privilege Control

   Tian-Neng Shi, Jing-Xuan He, Zhun Wang et al. · 2025 · cité 191 fois · Pas encore résumé

   Résumé scientifique

   AI agents interact with external environments through tool calls, exposing them to attacks like indirect prompt injection that can trigger unauthorized actions. Securing these agents is challenging: they behave autonomously and probabilistically, security requirements evolve depending on the user's task and execution state, and there is an inherent tradeofff between security and utility. In this work, we introduce Progent, a novel framework that secures AI agents via privilege control. Progent represents privilege as a security policy consisting of symbolic rules over tool names and arguments. These rules specify which tool calls are allowed for task completion and which unnecessary ones are…

6. Proche Pas pertinent

   When Harmful Intent Dissolves into Technical Detail: How Safe Are Coding Agents Against Cyber Misuse?

   Xiang-Zhe Xu, Shiwei Feng, Guangyu Shen et al. · 2026 · CAIS · Pas encore résumé

   Résumé scientifique

   Coding agents are increasingly integrated into realistic software development workflows, where they can write, modify, and execute code on behalf of users. This capability creates a distinct safety requirement: agents must refuse requests that would enable malicious cyber activity. Yet in cybersecurity, harmful intent often dissolves into technical detail. A prompt may describe a sequence of legitimate operations without explicitly revealing the downstream consequence they collectively produce. Safe behavior therefore hinges on an agent’s ability to reason from prompt to consequence under partial information. In this paper, we empirically evaluate how safe are coding agents against cyber mis…

7. Proche Pas pertinent

   Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems

   Yubin Qu, Yi Liu, Tong-Cheng Geng et al. · 2026 · arXiv.org · preprint, non relu par les pairs · cité 50 fois · Pas encore résumé

   Résumé scientifique

   LLM-based coding agents extend their capabilities via third-party agent skills distributed through open marketplaces without mandatory security review. Unlike traditional packages, these skills are executed as operational directives with system-level privileges, so a single malicious skill can compromise the host. Prior work has not examined whether supply-chain attacks can directly hijack an agent's action space, such as file writes, shell commands, and network requests, despite existing safeguards. We introduce Document-Driven Implicit Payload Execution (DDIPE), which embeds malicious logic in code examples and configuration templates within skill documentation. Because agents reuse these …

8. Proche Pas pertinent

   SNARE: Adaptive Scenario Synthesis for Eliciting Overeager Behavior in Coding Agents

   Yu-Bin Qu, Yi Liu, Ge-Lei Deng et al. · 2026 · arXiv.org · preprint, non relu par les pairs · cité 2 fois · Pas encore résumé

   Résumé scientifique

   A coding agent executes a benign task as a sequence of shell, file, and network actions, any of which can quietly exceed the authorized scope while the task still completes. We call this overeager behavior: the prompt is not adversarial and the run succeeds, yet an out-of-scope step can leak credentials or delete files. Existing benchmarks miss it: task-completion suites credit any finished run, jailbreak suites probe adversarial prompts, and the one prior overeager benchmark applies a single fixed prompt set to every agent-model pair, leaving its easiest and most resistant pairs under-measured. We present SNARE (Synthesizing Non-adversarial scenarios for Adaptive Reward-guided Elicitation),…

Les travaux antérieurs sur lesquels il s’appuie

1. Apparenté Utilisé en profondeur par cet article Pas pertinent

   IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests

   Ankur Singh, Jin-Qiu Yang, T. Chen · 2026 · arXiv.org · preprint, non relu par les pairs · cité 7 fois · Pas encore résumé

   Résumé scientifique

   AI coding agents powered by LLMs are increasingly integrated into real-world software development, where they generate, edit, and execute code with autonomous access to local files and tools. Coding agents inherit security risks from both the LLM backbone, where adversarial prompts, poisoned training data, and backdoor triggers can cause models to emit insecure or attacker-chosen code, and their agentic architecture, where tool-using autonomy enables induced misuse of external APIs, data exfiltration, and persistent compromise of development environments. This paper presents a systematic evaluation of malicious issue requests against state-of-the-art coding agents (Cursor, Claude Code, and C…

2. Proche Pas pertinent

   StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection

   Zhuoxin Zhan, Akbar Rafiey, A. Ma et al. · 2026 · arXiv.org · preprint, non relu par les pairs · cité 8 fois · Pas encore résumé

   Résumé scientifique

   Computer-use agents (CUAs) face a growing threat from indirect prompt injection, where adversarial instructions are planted in the environment such as web pages. In this paper, we introduce multi-step indirect prompt injection, a new attack class against CUAs in which the adversarial goal is decomposed into multiple innocuous-looking sub-steps and distributed across a chain of pages referenced along the agent's navigation path. We develop a pipeline to automatically decompose an adversarial goal under the constraint that the execution of the decomposed sub-steps must achieve the original goal while optimizing the innocuousness of each decomposed sub-step. With this pipeline, we build StepJac…

3. Proche Pas pertinent

   Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection

   Kai Greshake, Sahar Abdelnabi, Shailesh Mishra et al. · 2023 · Cryptography and Security · cité 2 442 fois · Résumé IA disponible

   Résumé scientifique

   Large Language Models (LLMs) are increasingly being integrated into various applications. The functionalities of recent LLMs can be flexibly modulated via natural language prompts. This renders them susceptible to targeted adversarial prompting, e.g., Prompt Injection (PI) attacks enable attackers to override original instructions and employed controls. So far, it was assumed that the user is directly prompting the LLM. But, what if it is not the user prompting? We argue that LLM-Integrated Applications blur the line between data and instructions. We reveal new attack vectors, using Indirect Prompt Injection, that enable adversaries to remotely (without a direct interface) exploit LLM-integr…

4. Proche Pas pertinent

   The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents

   Feiran Jia, Tong Wu, Xin Qin et al. · 2024 · Annual Meeting of the Association for Computational Linguistics · cité 163 fois · Pas encore résumé

   Résumé scientifique

   Large Language Model (LLM) agents are increasingly being deployed as conversational assistants capable of performing complex real-world tasks through tool integration. This enhanced ability to interact with external systems and process various data sources, while powerful, introduces significant security vulnerabilities. In particular, indirect prompt injection attacks pose a critical threat, where malicious instructions embedded within external data sources can manipulate agents to deviate from user intentions. While existing defenses based on rule constraints, source spotlighting, and authentication protocols show promise, they struggle to maintain robust security while preserving task fun…

5. Apparenté Pas pertinent

   AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases

   Zhaorun Chen, Zhen Xiang, Chao-Wei Xiao et al. · 2024 · Neural Information Processing Systems · cité 607 fois · Pas encore résumé

   Résumé scientifique

   LLM agents have demonstrated remarkable performance across various applications, primarily due to their advanced capabilities in reasoning, utilizing external knowledge and tools, calling APIs, and executing actions to interact with environments. Current agents typically utilize a memory module or a retrieval-augmented generation (RAG) mechanism, retrieving past knowledge and instances with similar embeddings from knowledge bases to inform task planning and execution. However, the reliance on unverified knowledge bases raises significant concerns about their safety and trustworthiness. To uncover such vulnerabilities, we propose a novel red teaming approach AgentPoison, the first backdoor at…

Les articles qui le citent

1. Proche Utilise cet article en profondeur Pas pertinent

   Step-Zero Attack: Agent Safety Before Observability

   Tian Qin, Yu-Hang Jiang, Jun-Zhe Chen et al. · 2026 · Pas encore résumé

   Résumé scientifique

   Existing attacks and defenses for coding agents act once content enters the model context: injected text persuades the model, and guards inspect what the model reads. Yet to judge whether processing an unknown archive, network response, or image is safe, an agent often must process it first, and that step can do harm before any content reaches the model. We call this first processing Step Zero, and harm done by it a Step-Zero attack. Across seven harnesses and six models, each agent received only a path or URL to a crafted input, paired with a benign twin showing the same visible fields. Step Zero is where most agents are already unsafe: 32/42 harness-model pairs overran a 4 MiB disk budget,…