When the context achieves “command privilege escalation” attacks on Root: Agent
2026-09-05 08:00Cybersecurity🔥 42.2 heat score
1sources
1days unfolding
42.2heat score
3mentions
SummaryAI generated
A joint study by Nanjing University and Glory found that the Agent runtime framework (Harness) poses security risks during context reconstruction. This mechanism may repackage low-privilege tool content as high-privilege user commands, triggering “command privilege escalation” attacks. Experiments showed that the same malicious code was denied execution during the main Agent inspection phase, but was successfully executed by Subagent after being reconstructed using Harness. Unlike traditional prompt injection that relies on model role confusion, this type of attack occurs when the runtime framework directly passes tasks from external sources as User commands when creating sub-Agent contexts, leading to the system misjudging the source of the content and executing dangerous operations. The study pointed out that the attack surface has expanded from whether the model was deceived to whether the runtime framework correctly maintains command levels. It is recommended to introduce an automatic privilege auditing mechanism to mitigate risks.
A joint study by Nanjing University and Glory found that when the Agent runtime framework (Harness) reconstructs contexts, it may repackage low-privilege tool content as high-privilege user commands, triggering “command privilege escalation” attacks. This mechanism causes the model to misjudge the source of the content and execute dangerous operations; the essence is that the system itself changes the security identity of the information rather than the model being deceived. Traditional prompt injection relies on confusing model roles, and such attacks occur because Harness directly passes tasks from external sources such as README as User commands when creating sub-Agent contexts. Experiments show that the same malicious code is rejected during the main Agent inspection phase, but it is successfully executed by Subagent after being reconstructed by Harness. The study indicates that the attack surface has expanded from whether the model is deceived to whether the runtime framework correctly maintains command levels, and suggests introducing automatic privilege auditing mechanisms to mitigate risks.