Original title: What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness
Zichuan Li, Jian Cui, Ashley Chen, Xiaojing Liao +1 · September 2026
AI agents need a harness, which is software that gathers data from different places and feeds it to the AI as context. Because companies keep these setups private, nobody fully understood their safety risks. Researchers studied how real systems collect this background information. They discovered that attackers can trick the harness into upgrading malicious text. In one attack, dangerous input from an untrusted source gets placed into a high-priority message role that the AI treats as trusted commands. In another attack, harmful text lingers and spills over past its original area. The team tested these attacks across 12 real agent setups, such as Claude Code and Codex. They found attackers can cause full takeovers, run remote code, block service, and hijack tools.
Imagine packing a suitcase for a trip, where you separate clean clothes from laundry. Normally, you keep them in different pockets. But if a dirty sock somehow ends up in the clean clothes pocket and you wear it, the whole outfit gets ruined. In this paper, AI agents separate information by trust levels, but attackers can sneak malicious content into high-trust areas, causing the agent to malfunction or be controlled.
If you use AI coding tools like Claude Code, these attacks could let someone remotely run harmful code on your system. This exposes a serious security gap in how real-world AI agents handle information, affecting developers and users who rely on them.
The abstract does not propose any defenses or fixes for these attacks, only identifies vulnerabilities. It analyzes only 12 real-world agent harnesses, so it may not cover all possible designs or scenarios.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness — Zichuan Li, Jian Cui, Ashley Chen et al.
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.