What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness

2026-09-01

AI Summary

本文系统分析了AI代理程序中上下文组装设计的安全风险，揭示了两种新型攻击方式：消息角色上下文特权提升和跨范围上下文特权提升，并对12个实际应用进行了安全评估。

Abstract

Real-world, high-profile AI agent harnesses often rely on vendor-proprietary or opaque designs for context assembly, leaving the sources and underlying logic of assembled context poorly understood and the resulting security risks largely unexplored. In this paper, we present the first systematic analysis of context assembly designs in real-world AI agent harnesses. We study and uncover how an agent harness is designed to collect and assemble context from diverse sources, and identify a set of practical attack vectors arising from these designs. Our analysis brings to light two novel categories of attacks in the context assembly of real-world harnesses: (1) MessageRole Context Privilege Escalation (M-CPE), which occurs when attacker-controlled content originating from a low-privileged context is incorporated into a higher-privileged message role. (2) Cross-Scope Context Privilege Escalation (X-CPE), which occurs when attacker-controlled content persists beyond the context in which it was introduced. We performed a systemic security analysis of the CPE attacks against 12 real-world agent harnesses, including Claude Code and Codex. The resulting consequences include full agent compromise, remote code execution, denial of service, and manipulated tool or skill invocations, etc.

Problem

• Context Privilege Escalation
• AI Agent Harness
• Security Risks

Innovation

• Context Privilege Escalation
• AI Agent Harness
• Security Analysis
• M-CPE
• X-CPE