AI 安全
Agent Frameworks “Upgrade” Malicious Instructions When Reconstructing Context, Affecting All Six Coding Agents Tested
New research finds that subagents, persistent goals, and scheduled tasks can repackage tool output as high-privilege user instructions. The attacks achieved all 13 objectives across six agents, and enabling automated permission review did not block the tested attack paths.
A research team at Nanjing University has introduced the concept of “Instruction Privilege Escalation” (IPE). The problem is not that models disregard the instruction hierarchy, but that agent frameworks lose content provenance when reconstructing context. When an ordinary project file enters a model through a file-reading tool, it is merely low-privilege `tool` content. If the primary agent passes text from that file to a subagent, however, the framework may label the same text as a `user` message in the new conversation. The model is correctly following the privilege label it sees, but it does not know that the supposed “user request” originally came from an attacker-controlled file.
The authors tested Claude Code, Codex, Gemini CLI, Qwen Code, Kimi, and OpenCode against 13 attack objectives spanning data exfiltration, integrity compromise, denial of service, and remote code execution. Under unrestricted or full-access configurations, all six frameworks ultimately completed every objective. The three frameworks offering automated permission review also failed to prevent all 13 attack categories. Success rates per individual attempt were not uniformly 100%: depending on the framework and objective, the tool-to-user path succeeded between 31.7% and 100% of the time. Thus, “13/13” means that all objectives were achieved within at most ten attempts, not that every attempt succeeded.
More troublingly, the vulnerability is not limited to multi-agent delegation. Persistent goals and scheduled tasks can also store text in state and later return it to the model as a user message. Four tested paths—Claude Code scheduled tasks, Codex goals and scheduled tasks, and Qwen Code scheduled tasks—likewise achieved 13/13 objectives. An automated reviewer may even correctly identify a command as high-risk but still approve it because the reconstructed history appears to show that the user explicitly authorized it.
From an engineering perspective, improving prompt-injection detection alone is insufficient. Frameworks must preserve immutable provenance and privilege labels across delegation, restoration, and scheduling. Reviewers should also receive the original data flow rather than seeing only reconstructed conversation roles. Future tasks created by agents should additionally be governed by independent capability controls. The paper is currently an unreviewed preprint, and its testing focuses on specific versions and an attack environment designed by the authors; each vendor’s patch status still needs to be verified individually.