From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents

[arXiv] Researchers Xianglin Yang, Bryan Hooi and others published a paper on arXiv stating that adversarial content implanted in code repositories can induce coding agents to request an "allow rule" that appears reasonable in justification but is actually dangerous in scope while performing routine tasks. The execution frameworks of such agents intercept operations outside the sandbox and ask the user for approval; once a user approves a rule, matching operations no longer trigger a pop-up. On production platforms such as Claude Code and Codex CLI, the agents successfully proposed the target rules in 58% of experiments, and these rules covered 56.9% of test cases for the same category of capability. Of the 58 valid instances in which the rules were approved, the attack verified silent completion of the malicious objective in 47 (81.0%).