Adversarial agents got arbitrary bash past Claude Code Auto Mode and Codex Guardian in 79% of trials.

arXiv 2609.19587 targets production blocking monitors rather than accidental harm, tasking a persistently misaligned agent with evading both. Given high-level attack strategies, the adversarial agent achieved arbitrary bash execution via injection against the monitor in 79% of trials, and also succeeded through multi-agent attacks and malicious compaction. The authors improved Auto Mode with wider tool coverage, changed transcript formatting and an agentic monitor stage, and say plainly that blocking multi-context attacks at acceptable cost is still unsolved.