Research · curated 2 Sep 2026
What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Context Privilege Escalation attacks show that widely deployed coding agents like Claude Code and Codex can be fully compromised or driven to remote code execution through how they assemble context, giving defenders a concrete new attack surface to harden.
A research paper titled "What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness" presents the first systematic analysis of context assembly in real-world AI agent harnesses, uncovering two novel attack classes: MessageRole Context Privilege Escalation (M-CPE), where attacker-controlled low-privilege content is elevated into a higher-privileged message role, and Cross-Scope Context Privilege Escalation (X-CPE), where attacker content persists beyond its original context. The authors evaluate these attacks against 12 harnesses including Claude Code and Codex, demonstrating consequences such as full agent compromise, remote code execution, denial of service, and manipulated tool or skill invocations.