Agents Leak Privilege via Context Assembly

Problem

This paper studies how real-world AI agent harnesses assemble context for large language models and the security risks that arise when that assembly is opaque or vendor-specific. The authors show that agents collect context from heterogeneous sources such as system prompts, configuration and memory files, skills and plugins, tool outputs, version-control metadata and environment information. Because agents label those pieces with privilege roles and persist some across sessions, attacker-controlled content from low-trust sources can influence higher-privilege instructions or persist beyond its origin, creating novel privilege-escalation threats with serious consequences for agent behaviour and host security.

Approach

The authors performed a systematic analysis of 12 real-world agent harnesses, implemented proof-of-concept end-to-end attacks using state-of-the-art models, and built an LLM-assisted analysis pipeline named ContextRiskAnalyzer (CoRA). CoRA statically analyses harness source code to identify candidate context sources and their roles and scopes, instruments agent code to intercept requests to model endpoints, constructs isolated environments with canaries to validate sources, and automatically enumerates and validates context privilege-escalation (CPE) paths.

Key Findings

• Two new classes of attacks: Message-Role Context Privilege Escalation (M-CPE), where attacker-controlled content from a low-privileged source is incorporated into a higher-privileged message role; and Cross-Scope Context Privilege Escalation (X-CPE), where attacker-controlled content is persisted into broader or more persistent scopes.
• Taxonomy and prevalence: the authors identify a taxonomy of 16 attack vectors spanning memory and instruction files, skill discovery, configuration manipulation, environment-derived context, markup-wrapping and model-output tags, inline shell execution and dynamic content blocks. Across 12 agents CoRA identified 463 candidate context sources and verified 282 at runtime.
• Exploitability and impact: CoRA enumerated 1,761 candidate CPE paths (940 M-CPE, 640 X-CPE, 181 both). Under evaluated models, many paths load and some produce the expected behaviours: under GPT-5.4-mini 1,284 paths were loaded and 1,028 behaviourally verified; under GPT-5.5 1,315 were loaded and 1,034 verified. Demonstrated consequences include full agent compromise, remote code execution, denial of service and manipulated tool or skill invocations.

Limitations

CoRA requires constructing validation environments and may fail when sources need complex runtime setup or special configuration; some identified sources were filtered due to limited payload capacity; and attack validation can be affected by the target LLM’s instruction-following or alignment, so automated validation gives a conservative lower bound. The work focuses on open harnesses and controlled proof-of-concept attacks rather than adversary access to host systems.

Implications

From an offensive security viewpoint, the findings show concrete, practical paths for attackers who can control third-party content or third-party components to escalate privileges inside an agent harness. Attackers can move low-privilege tool outputs into system-level or user-level memory, inject high-privilege skills or override configuration, and persist attacker instructions across sessions to influence future tasks or execute arbitrary commands on the host. These vectors enable supply-chain and repository-based attacks such as malicious pull requests, crafted archives, or package contents that exploit discovery and loading logic to achieve remote code execution or persistent compromises.