From approval to abuse: privilege escalation attacks against coding Agents protected by execution frameworks

The core problem is the privilege escalation risk introduced by reusable authorization mechanisms: In coding agents protected by an execution harness, can untrusted repository content induce the agent, while performing benign tasks, to propose broad permission rules beyond the task's needs, thereby causing subsequent malicious operations to bypass human approval after the user approves them.

• Interactive approval and fatigue mitigation: Coding agents use the governance layer to intercept operations outside the sandbox and request human approval; to reduce approval fatigue caused by frequent interruptions, the system allows users to save general rules (such as always allowing the curl prefix), and matching commands will subsequently execute directly without prompting.
• The security disconnect between dynamic approval and static allowlisting: Existing systems assume that human approval can effectively block malicious behavior, but the generation of permission requests depends on the agent's context; the authors argue that when the context is adversarially controlled, the governance layer may be induced to generate overly permissive permissions.
• Core observation driven by execution dependencies: Agent behavior follows the data flow and control flow dependencies of the environment; disguising unauthorized operations as technical prerequisites indispensable for task completion can prompt the agent to autonomously request the corresponding permissions.
• Automated two-stage evaluation framework: The paper proposes an evaluation method to measure the feasibility of permission induction and the risk of downstream exploitation, covering Stage I permission acquisition and Stage II permission abuse.
• Threat model:
  • Victim system: Coding agent systems deployed with a local interactive execution harness and reusable permission rules (such as Codex CLI and Claude Code).
  • Attacker knowledge: With black-box access capability, the attacker understands the governance layer's rule matching mechanism, but cannot directly modify the governance layer or existing authorization policies.
  • Attacker capability: The attacker can implant adversarial content in the repository read by the agent (such as constructing specific directory structures, test scripts, or documentation files), but permission updates must go through the normal user approval channel.
  • Attacker goal: During the agent's execution of benign tasks, induce it to initiate broad reusable permission requests, and after user approval, silently accomplish malicious goals outside the sandbox (such as unauthorized reading, data exfiltration, file deletion, etc.).

In related work, the paper mainly discusses the following three groups of research as well as related benchmarks and baselines:

• Indirect prompt injection and long-horizon attacks:
  • Greshake et al. (2023b) study indirect prompt injection that uses untrusted context to induce agents to perform attacker-specified operations.
  • Benchmarks such as InjecAgent (Zhan et al., 2024), AgentDojo (Debenedetti et al., 2024), RepoGuardBench (Li, 2026), and IssueTrojanBench (Singh et al., 2026) evaluate injection risks in repositories, tickets, and tool descriptions.
  • StepJack (Zhan et al., 2026) decomposes attacks into multi-step harmless subtasks; Zombie Agents (Yang et al., 2026) and AgentPoison (Chen et al., 2024b) study long-term memory poisoning.
• Operational safety and permission boundaries:
  • SABER (Hu et al., 2026) and Overeager Agents (Qu et al., 2026) evaluate unintended out-of-bounds operations by agents without adversarial injection.
  • AmPermBench (Ji et al., 2026) stress-tests permission interception gateways under ambiguous conditions.
• Privileged control and governance-layer defenses:
  • Model alignment (Struq, Chen et al., 2024a; Secalign, Chen et al., 2025; Wallace et al., 2024) and isolation architectures (IsolateGPT, Wu et al., 2025) attempt to limit permissions from the input or execution layer.
  • Progent (Shi et al., 2026) and CapScope (Bouras et al., 2026) enforce strict privilege policies, where CapScope derives an immutable permission upper bound before reading untrusted context.
• Baseline methods and benchmarks: The experiments compare Benign Control (no-injection control), Direct Request / Direct Injection (direct instructions adapted from AgentDojo), and IssueTrojanBench-adapted (four-segment context-disguised injection); the evaluation benchmarks are the authors' PCC benchmark containing 100 test cases and 25 downstream attack instances.

The authors state that existing work mainly studies single-step injection or static permission configuration, whereas this paper studies the decomposition of the permission lifecycle, revealing that when context-dependent human approval is persisted as context-detached syntactic rules, the governance layer itself evolves into the confused deputy of classical security.

The authors propose an automated framework comprising Stage I Permission Acquisition and Stage II Authority Reuse, which searches for adversarial repository configurations under black-box conditions through four-component closed-loop optimization.

Core Definitions and Formalization

• Interactive approval decision: The governance layer maintains an approval-free action space A(P) = S ∪ ⋃_{π ∈ P} ⟦π⟧ according to the currently active policy P (where S is the action within the sandbox and ⟦π⟧ is the action covered by rule π), and the approval decision is defined as: Auth(a; P) = \begin{cases} Pass, & a \in A(P) \\ Ask, & \text{otherwise} \end{cases} This decision only performs set membership detection and does not evaluate the true intent behind the operation.
• Policy state transition: When the user approves a reusable rule π, the authorization state is updated to: P' = P \cup \{\pi\}, \quad A(P') = A(P) \cup \llbracket\pi\rrbracket All subsequent commands matching this rule will be executed directly without prompting.

Stage I: Permission Acquisition

• Scenario and workflow planner (Mplan): Takes a benign task T and a target command prefix π* as input, and instead of directly injecting the command, conceives a technical scenario that must call that prefix command (such as pulling external resources).
• Repository builder (Mbuild): Maps the abstract plan to concrete repository file modifications (such as missing required dependencies, test errors, providing configuration guidance), building an enforced dependency.
• Proxy Agent Rollout: Runs an independent agent copy with the same configuration as the victim in the sandbox, recording the complete tool-call trajectory and permission request events.
• Feedback critic (Mcritic): If the target rule is not proposed, distinguishes whether it is a workflow design flaw or a concrete code implementation flaw, and generates targeted text feedback for the next round of optimization.

Stage II: Authority Reuse

• Exploiting already-allowed permissions: Starting from the repository state output by Stage I and the extended policy Pafter, the core goal shifts from acquiring rules to achieving the adversarial goal G.
• Seamless integration with business: Mplan and Mbuild construct data flow and control flow dependencies that downstream tasks must consume, so that malicious commands are naturally triggered as routine development steps.
• Dual silent verification: During the sandbox agent run, two hard conditions are checked: (1) the adversarial goal G is actually achieved; (2) the entire execution process is completely silent, with no new approval prompts.

Optimization Implementation and Convergence Determination

• Model configuration: The builder uniformly uses deepseek-v4-pro; the planner uses glm-5.3 as the primary model, and falls back to the backup model deepseek-v4-pro if the repair budget is exhausted.
• Semantic termination criterion: Stage I uses an LLM to determine whether the generated rule, assuming approval, has the potential capability range Potential(π*, G) to support the target G; Stage II terminates when the target is achieved and no pop-up occurs.

Experimental setup

• Models tested: Codex CLI with gpt-5.6-luna and gpt-5.6-sol; Claude Code with anthropic/claude-haiku-4.5 and anthropic/claude-sonnet-5, for a total of 4 target configurations.
• Dataset and cases: A task set containing 5 categories was constructed (unauthorized reading, data exfiltration, file deletion, artifact download, configuration modification), with 5 instances per category, and 25 instances tested per configuration; they were also divided into three tiers by resource sensitivity: Ordinary, Sensitive, and Critical; generalization evaluation used the PCC benchmark containing 100 cases (20 cases in each of 5 categories, covering D1–D4 complexity).
• Comparison baselines: Stage I compares Benign Control (no injection) and Direct Request (directly requesting persistent permissions); Stage II compares Direct Injection (single-step direct instruction) and IssueTrojanBench-adapted (four-part contextual disguise).
• Metric definitions: Stage I evaluates permission capability coverage PCC (score normalized from 0 to 1) and Goal Reachability (/25); Stage II evaluates Downstream Goal Completion and Prefix-Attributed completion rate.
• Review mechanism: Stage I uses an automated LLM judge to evaluate PCC and goal reachability based on declared tool semantics; Stage II directly verifies system state changes and exfiltrated payloads by the test sandbox, and counts whether an approval popup was triggered.
• Run settings: Run independently in a clean virtual development environment, with /home/user as the home directory; the repair limit for each step in each stage of the optimization phase is 5 times.

Main results

Swipe horizontally to read the table

Target agent configuration	Qualified N	Direct Inject	IssueTrojanBench	Ours (prefix-attributed count)
Codex (gpt-5.6-luna)	17	0 (0)	5 (4)	17 (13)
Codex (gpt-5.6-sol)	18	1 (1)	4 (4)	14 (11)
Claude (claude-haiku-4.5)	14	0 (0)	11 (6)	13 (9)
Claude (claude-sonnet-5)	9	0 (0)	0 (0)	3 (0)

(Data according to Table 2; in parentheses is the number of prefix-attributed completions where the successful action exactly matches the prefix obtained in Stage I)

• Improvement in downstream goal completion rate: The authors report that across all configurations, the proposed method's completion rate is higher than the comparison baselines, achieving 17/17 (100%) on Codex gpt-5.6-luna and 14/18 (77.8%) on Codex gpt-5.6-sol.
• Evidence of cross-stage permission reuse: The authors state that most successes directly stem from prefix attribution (13/17 for Codex luna, 11/14 for Codex sol, 9/13 for Claude haiku), demonstrating that malicious execution effectively reused the syntactic prefixes approved in Stage I.
• Penetration on strongly aligned models: The authors report that on claude-sonnet-5, where the baselines were all 0/9, the proposed method still achieved 3/9 goal completion through other authorized paths.

Permission acquisition capability and coverage (Stage I)

• What was tested: On 4 configurations, compared the breadth of reusable permissions acquired (PCC score) and the number of reachable instances for specific malicious goals (Goal Reachability, out of 25) for Benign Control, Direct Request, and Ours.
• Results: According to Table 1, Benign Control had 0/25 reachable count on all models; Direct Request's reachable counts on gpt-5.6-luna, gpt-5.6-sol, claude-haiku-4.5, and claude-sonnet-5 were 7, 18, 6, and 1 respectively, with PCC of 0.25±0.35, 0.55±0.25, 0.43±0.32, and 0.28±0.30 respectively; Ours' reachable counts rose to 17, 18, 14, and 9 respectively, with PCC increasing to 0.57±0.38, 0.61±0.38, 0.60±0.35, and 0.48±0.38 respectively.
• Authors' interpretation: The authors state that the task-grounded optimization method can evade agent safety guardrails, and on the strictly aligned Claude models the reachable instance count exceeds the direct instruction baseline.

Performance by task sensitivity tier

• What was tested: The 25 test tasks were divided into three tiers by operational resources and severity of consequences: Ordinary, Sensitive, and Critical, and the goal completion rate under different sensitivities was analyzed.
• Results: According to Figure 4, Codex gpt-5.6-luna had a 100% goal completion rate across all three tiers (n=8, n=6, n=3); claude-sonnet-5 was 2/4 in the Ordinary tier, 1/4 in the Sensitive tier, and 0/1 in the Critical tier; across all models and tiers, Ours performed equal to or higher than the baselines.
• Authors' interpretation: The authors believe that increased task sensitivity did not lead to a consistent decline in attack completion capability.

Ablation of the permission execution induction mechanism

• What was tested: On claude-haiku-4.5, with granted permissions fixed, the system ablated different induction structures for embedding the target operation into the repository workflow.
• Results: According to Table 4, when only basic instructions were given, the success count was 0/3 (all failed); with a narrative semantic framing, 1/3 succeeded; with a blocking artifact gate (control flow) and a mainline consumer (data flow), the success count was 3/3 in both cases.
• Authors' interpretation: The authors believe that agents follow environmental dependencies rather than narrative storytelling, and that semantic explanation alone cannot reliably trigger authorized operations; constructing control flow and data flow dependencies is what forces the model to execute.

Other ablations and analyses

• Planner primary/backup model solution distribution: glm-5.3 independently solved 39 cases, and the backup model deepseek-v4-pro additionally solved 19 cases after the primary model failed (Section 4.1).
• Differences in governance layer abstraction dimensions: Codex generalizes broad rules based on the diversity of historical calls (e.g., multiple calls generalize to wget, a single call to wget -O); Claude Code generalizes wildcard rules based on unquoted syntax (e.g., curl reports *, while quoting degrades to exact matching) (Table 3).
• Active avoidance behavior of stronger models: In optimization targeting claude-sonnet-5, the model repeatedly bypassed non-dominant steps by reading alternative local files, restoring from cache, or directly writing downstream artifacts (Section 5.3).

Negative results and exceptions

• Among the 3 downstream successes on claude-sonnet-5, the prefix-attributed counts were all 0 (Table 2), all achieved through other authorized paths that did not match the prefix.
• claude-sonnet-5 had a completion rate of 0/1 in the Critical sensitivity tier (Figure 4).

Limitations and future directions noted by the authors

• The paper does not specifically discuss limitations and future directions (the main text and appendix do not have separate Limitations, Discussion, or Future Work sections).

Experimental coverage

• Systems and models tested: The evaluation targets two platforms, Codex CLI and Claude Code, with models including gpt-5.6-luna, gpt-5.6-sol, anthropic/claude-haiku-4.5, and anthropic/claude-sonnet-5, for a total of 4 configurations (Section 4.1).
• Experimental environment specifications: All experiments were run in an isolated synthetic virtual developer workstation (directory structure including /home/user, control/, results/, etc.) and a simulated credential environment, and were not deployed in real user or third-party production systems (Appendix A.1 and Ethics Statement).
• Adversarial goals and sample size: The downstream adversarial goals are divided into 5 categories: unauthorized reading, data exfiltration, file deletion, artifact download, and configuration modification. Each agent configuration was evaluated on 25 instances, for a total of 100 experimental rounds; the PCC benchmark contains 20 test cases in each of 5 categories, for a total of 100 cases (Section 4.1 and Appendix B.2).
• Conditional downstream evaluation: The downstream goal completion rate of Stage II was evaluated only on qualified checkpoints where Stage I successfully obtained a valid rule and approval was assumed (58 instances in total), and did not cover the subsequent execution of cases that failed Stage I (Section 4.1 and Section 4.3).
• Unreported data and metrics: The paper does not report the specific distribution of iteration rounds required for Stage I automated search convergence, the total API query cost and call latency, nor does it report consistency test data between the LLM judge and human safety evaluation (Section 3.1, Section 4.1).

This paper systematically studies the privilege escalation security risks in human-in-the-loop reusable authorization mechanisms for coding agents protected by an execution harness.

• Problem background and core risk: To avoid human fatigue caused by frequent approvals, mainstream coding agent frameworks allow users to save reusable rules by command prefix or syntax. However, which rules the agent proposes is influenced by the repository context it reads, which makes it possible for untrusted context to induce the agent to request overly permissive permissions during benign tasks, and after approval, cause the governance layer to lose its interception effectiveness.
• Two-stage evaluation framework: The authors designed an automated closed-loop optimization system. In Stage I, through a loop of planner, builder, proxy agent, and critic, under black-box conditions, technical dependencies are constructed to induce the agent to initiate target rule requests; in Stage II, under the state of inheriting approved rules, the malicious payload is disguised as a data flow input of the mainline task, achieving popup-free silent execution.
• Permission induction and semantic generalization performance: Across 4 model configurations of Codex CLI and Claude Code, the framework successfully induced the target allow-rule in 58% of experimental instances; on the PCC benchmark containing 100 cases, the acquired rules achieved 56.9% category capability test coverage, with average coverage clearly expanded compared with the Direct Request baseline (e.g., Codex luna rose from 0.25 to 0.57, Claude haiku rose from 0.43 to 0.60).
• Downstream silent attack effect: Among the 58 qualified instances that passed Stage I, the framework achieved verified silent goal completion in 47 cases (completion rate 81.0%), and most successes were explicitly attributed to the prefixes obtained in Stage I (e.g., Codex luna reached 13/17, Codex sol reached 11/14), with exploitation effectiveness superior to the IssueTrojanBench (20/58) and Direct Injection (1/58) baselines.
• Mechanistic insights: The authors point out that different governance layers differ in their rule generalization axes (Codex relies on the behavioral diversity of call history, Claude Code relies on unquoted static syntax), and that agent execution is strictly driven by data flow and control flow dependencies rather than textual narration; more capable models (such as claude-sonnet-5) actively seek shortcuts that bypass non-dominant steps.
• Authors' conclusion: The authors believe that the current practice of directly persisting a dynamic, context-dependent single human approval into a static, context-detached syntactic rule has a security blind spot, and the governance layer itself has become a confused deputy; safety design must simultaneously examine the scope of permission proposals and their persistence consequences after approval.