Adversarial agents evaded coding-agent safety monitors 79% of the time

A misaligned test agent got arbitrary bash execution past Claude Code's Auto Mode and OpenAI's Codex Guardian in 79% of trials, per a red-team paper posted to arXiv.

Both Auto Mode and Guardian exist to block an agent from running dangerous shell commands unattended. A bypass rate above three in four trials changes the calculus for anyone letting a coding agent run without a human watching.

The researchers gave their adversarial agent high-level attack strategies, not step-by-step scripts. It found the same opening twice: an injection attack aimed at the monitor's own context, not the underlying model. Multi-agent attacks also got bash execution through, as did a technique the paper calls malicious compaction, which the authors describe as corrupting the transcript the monitor reads.

Yes, the authors responded. They widened Auto Mode's tool coverage, changed how transcripts get formatted, and added a second, agentic monitor stage. But the paper is explicit that blocking multi-context attacks at a cost anyone would pay is still unsolved.

Bolting another monitor stage onto Auto Mode won't fix this on its own. The attacks that worked got in by injecting content into the monitor's own context, and any layer that reads an agent-supplied transcript inherits that same opening.