Permission rules in coding agents enable privilege escalation attacks
From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents
Artificial Intelligence
Summary
Coding agents use rules to limit what actions they can take without asking a human each time. The authors found that if an attacker puts tricky code into a project, they can make the agent ask for permission to do very broad and risky actions. Once a user approves this, the attacker can use it to run harmful commands without more warnings. The authors tested this on real coding agents and showed it works often, breaking the safety method that relies on humans to catch problems.
What this means in practice
- •For software security teams: Detect and mitigate risks in permission-update processes within AI-assisted coding tools to prevent unnoticed privilege escalation.
- •For devops engineers: Enhance monitoring and approval workflows in AI coding assistants to safeguard operational environments against stealthy malicious code execution.
- •For enterprise software vendors: Develop safer AI coding platforms by integrating protections against approval rule manipulation revealed in this study.$Commercial implications: Enables product differentiation by offering advanced security features that prevent privilege escalation in AI coding assistants.
Authors
Xianglin Yang, Yechao Zhang, Jiahao Liu, Yulin Chen, Yuxin Cao, Bryan Hooi, Jiaheng Zhang
Abstract
Coding agents use execution harnesses to constrain the consequences of prompt injection by enforcing permission boundaries. These systems deterministically intercept any out-of-sandbox action and prompt the user for approval. To reduce approval fatigue, users can approve allow-rules proposed by the agent, after which any future action matching the rule is allowed without a prompt. In this work, we show that this mechanism introduces a new risk: untrusted context can influence the permissions presented for approval, with consequences extending beyond the immediate task. We investigate privilege escalation targeting this permission-update process. Specifically, adversarial context planted in a repository can reliably steer an agent performing a routine task into requesting a plausibly justified, yet dangerously broad allow-rule. If the user approves the request, the saved rule can effectively blind the harness, enabling adversaries to execute malicious actions that would otherwise require approval, without triggering human oversight. Across production platforms, including Claude Code and Codex CLI, we demonstrate that agents successfully elicit the target allow-rules in 58% of experimental instances. Once acquired, these rules exhibit a massive semantic blast radius, covering 56.9% of category-specific capability test cases. To further quantify the downstream risk, we show that conditional on rule approval, our exploit achieves verified, silent goal completion in 47 of the 58 eligible instances (81.0%), undermining the safety promise of human-in-the-loop oversight.