Research · curated 15 Sep 2026
What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness
First reported alphaxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Context Privilege Escalation reveals design-level flaws in how widely deployed agent harnesses assemble prompts, enabling untrusted data to gain system-level privilege and drive RCE or full agent takeover — a threat defenders cannot mitigate with prompt-injection filtering alone.
Researchers from the University of Illinois Urbana-Champaign present the first systematic analysis of context assembly in real-world AI agent harnesses, introducing two novel 'Context Privilege Escalation' (CPE) attack classes: MessageRole (M-CPE), where attacker-controlled low-privilege content is promoted into a higher-privilege message role, and Cross-Scope (X-CPE), where injected content persists beyond its intended context. Using their CORA analysis pipeline they validated these against 12 harnesses including Claude Code and Codex, achieving full agent compromise, remote code execution, denial of service, and manipulated tool/skill invocations.