What they did

The authors examined how coding-agent harnesses assemble context for model calls. They constructed attacks that induced an agent to reintroduce low-level malicious content at a higher instruction level, where the model would obey instructions it had previously rejected.

They tested 13 objectives across six coding-agent harnesses, covering confidentiality, integrity, availability, and remote code execution. They also evaluated automatic permission-review modes and reproduced the vulnerability through harness-provided persistent goals and scheduled tasks.

Key findings

• Under unrestricted action execution, all 13 attack objectives succeeded on all six harnesses: 78 successful harness-objective combinations.
• All 13 objectives also succeeded on each of the three harnesses offering automatic permission review.
• The attacks reached impacts spanning information disclosure, unauthorized modification, service disruption, and remote code execution.
• Persistent goals and scheduled tasks provided additional routes for reproducing the same privilege-escalation pattern.

Why it matters

Instruction hierarchy protects models only if the surrounding harness preserves the privilege assigned to each source. The results show that context construction itself forms a security boundary: if a harness promotes untrusted content, model-side defenses and automated permission checks may be bypassed without directly defeating the hierarchy mechanism.

Caveats

The evaluation covers six coding-agent harnesses and 13 constructed objectives, so it does not establish prevalence across other agent domains or context architectures. The reported successes concern unrestricted execution and automatic permission review; the abstract does not assess robust human approval, sandboxing, or specific mitigations.