A single technique defeats permission review on six coding-agent harnesses

The researchers name a new attack class, instruction privilege escalation, in which an agent harness reconstructs context, through subagent delegation, persistent goals, scheduled tasks or custom subagent installs, in a way that relabels attacker-controlled tool output as a trusted user or system instruction. Tested across Claude Code, Codex, Gemini CLI, Qwen Code, Kimi and OpenCode against 13 attack objectives spanning credential theft to remote code execution, the technique reached every objective on every harness under full-access execution, and on all three harnesses that support automatic permission review. In one traced case, a reviewer approved a script it had already identified as downloading and executing an external program, because "it appears to have been explicitly requested by the user."

Why it matters: A review layer reading a clean-looking transcript can authorize real damage because the harness constructed that transcript from content the attacker planted.