Instruction hierarchy is a model-side defense that ranks instructions by source. The paper shows that can break this ranking when they reconstruct context: tool-level content can be relabeled as a user or system instruction, gaining higher privilege than it originally had. This is called instruction privilege escalation, and it is distinct from prompt injection because the harness itself performs the elevation rather than the model being deceived.
The attack was demonstrated across six coding-agent harnesses on 13 objectives spanning confidentiality, integrity, availability, and remote code execution. With unrestricted action execution, all 13 objectives succeeded on all six harnesses. Under automatic permission review, all 13 objectives succeeded on the three harnesses that provide that mode. The same escalation was reproduced through persistent goals and scheduled tasks, showing the problem is not limited to one delegation path.