Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-02 · high
A paper tested 12 production coding agents and got full compromise, RCE, and hijacked tool calls out of context that was never supposed to be trusted.
Why now: The paper posted to arXiv covers findings from tests run directly against shipped harnesses, not simulated ones.
A new paper names the mechanism plainly: Context Privilege Escalation. It splits into two classes. M-CPE is when content an attacker controls, something low-privilege like a file or a web page, gets folded into a message the agent treats as coming from the system or the user. X-CPE is when that elevated trust persists after the context that created it should have expired. The authors tested both against 12 production coding harnesses, including Claude Code and Codex, and documented outcomes ranging from full compromise to remote code execution, denial of service, and tool calls the user never asked for, according to the paper.
What stands out is the target list. Security papers on prompt injection usually run against research prototypes or single-turn chat setups. This one ran against the agents developers already install and grant file and shell access to.
The stakes are ordinary until they aren't. Most coding agents already read from sources an attacker could touch: a README in a cloned repo, a GitHub issue, a web search result pulled into context mid-session. If M-CPE is real in your harness, any of those can end up read as an instruction with system-level trust. X-CPE means that elevated trust doesn't necessarily clear when the untrusted content should have scrolled out of relevance.
The paper doesn't say which of the 12 harnesses are still vulnerable as shipped, or whether Anthropic and OpenAI have patched the specific chains it used. That's the open question worth tracking: not whether this class of bug exists, but which vendors close it and how fast.
Each link below shares sources, entities, or timing with this story.
SynChain uses persistence-aware directed SFT to make a computer-use agent produce artifacts that pass vetting while hiding malicious influence in structural redundancies, surviving internal state updates and reactivating in a later workflow with no new external input. Tested a...
A paper from Xiao Yu, Baolin Peng, and Ruize Xu makes a claim that seems obvious once stated and is genuinely new as a training methodology: modern agents are inseparable from their inference harnesses, so training them in stripped-down RL sandboxes produces a train/serve mism...
If you have a CLAUDE.md, you're in scope. Today. arXiv 2607.14611 (cs.CR, filed July 16) evaluates prompt injection planted in the persistent memory files that agentic coding systems write and re-read across sessions. The researchers tested both Anthropic's Claude Code and Ope...
$3,054 against $38,370. Same benchmark, better score. Praxist (arXiv 2608.25955, submitted August 26) replaces per-attempt agent memory with a typed evidence graph of findings, plus lane-structured frontiers and agendas, so later attempts inherit validated mechanisms rather th...
Deng et al. built 120 real-case-grounded tasks across 20 business scenes in six financial domains, running four self-evolving scaffolds on a shared Qwen3.7-Max backbone against paired non-evolving controls. Letta posted the highest evolved score (91.65) and fewest compliance i...
Microsoft's July 23 release targets a genuine gap: harness-based agents like Claude Code and Codex drive multi-turn reasoning, tool use, and external system access but were hard to train end-to-end with standard open RL infrastructure. The trick is decoupling training from inf...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.