Researchers find context-privilege flaws in Claude Code, Codex

A paper posted to arXiv describes two new attacks on AI agent context windows, tested against 12 harnesses including Claude Code and Codex. The consequences the researchers found range from full agent compromise and remote code execution to denial of service and manipulated tool or skill invocation.

The first, MessageRole Context Privilege Escalation, happens when content from a low-privileged source gets folded into a higher-privileged message role.

The second, Cross-Scope Context Privilege Escalation, happens when that content doesn't clear. It persists beyond the context that first pulled it in, carrying into later turns or tasks, according to the context-privilege escalation paper.

Earlier work titled 'When Context Gets Root' already argued that the harness itself, not the model, is where these systems fail. This analysis is a second independent group reaching that conclusion, and the first to name the shipped harnesses directly.

Unclear from the analysis is whether Anthropic or OpenAI have closed these specific paths already. Equally unclear: whether the 12 harnesses share one root cause or twelve separate implementation bugs. That question decides whether this gets fixed harness by harness or once, at the protocol level.