DIGGINGBEAGLE

Case · DiggingBeagle record

Context privilege escalation let repository instructions blind an AI code reviewer

Researchers identified context privilege escalation attacks across 12 real agent harnesses, including Codex and Claude Code. In a Codex demonstration, a malicious repository instruction file narrowed review scope so the agent approved a vulnerable pull request; the same vulnerable code without the malicious override was detected and rejected. The mechanism abuses how harnesses assemble and prioritize context, not a vulnerability in the target application itself.

Context privilege escalation

Assessment profile

Assessment method
Setting
research demonstration
Exploitation
demonstrated
AI role
AGAINST AI
Basis and provenance

The recorded controlled vulnerable-review/override comparison supports a research demonstration of context-assembly abuse. Scope across harnesses and generic locators do not establish present exploitation or independently verified fixes. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded. Stored evidence uses source-level locators; passage-level corroboration remains required.

Assessed Sep 24, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-CODEX · CLM-SCOPE · CLM-CODEX2 · CLM-TAXONOMY · CLM-MECHANISM · Context Privilege Escalation paper · OpenAI - Unrolling the Codex agent loop

At a glance

Mechanism and trust boundary

  1. 01

    Place lower-trust instructions inside repository context

    An attacker controls a repository instruction surface such as a more-specific AGENTS.override.md.

    Boundary: repository content / agent instruction set

  2. 02

    Harness assembles context with precedence

    The coding harness promotes the more-specific repository instruction into effective model context.

    Boundary: context provenance / instruction authority

  3. 03

    Reviewer scope is manipulated

    The malicious instruction narrows or redirects the model's review so relevant vulnerable behavior is no longer examined normally.

    Boundary: attacker instruction / security-review policy

  4. 04

    Downstream tools or judgments inherit the corrupted scope

    The paper reports consequences across tested harnesses including manipulated tool calls, denial of service, RCE and full agent compromise.

    Boundary: model context / executable authority

Timeline

  1. Sep 1, 2026
    Event type unspecified

    Context privilege escalation research becomes public

    The study reports evaluation across 12 real agent harnesses, including the Codex malicious-override demonstration.

Claims & evidence

CLM-CODEXThe CPE researchers report that a malicious AGENTS.override.md caused Codex review to approve manipulated vulnerable code, while a control review without the override detected the command injection.supported

Basis: reported finding

Link to claim
CLM-SCOPEResearchers evaluated 12 real agent harnesses and reported consequences including manipulated tool invocation, denial of service, remote code execution and full agent compromise.supported

Basis: reported finding

Link to claim
CLM-CODEX2In the Codex demonstration, attacker-controlled repository instructions caused Codex to approve vulnerable code that it rejected in a control run without the malicious override.supported

Basis: reported finding

Link to claim
CLM-TAXONOMYThe paper defines MessageRole Context Privilege Escalation and Cross-Scope Context Privilege Escalation as two classes of context-assembly attack.supported

Basis: reported finding

Link to claim
CLM-MECHANISMOpenAI's Codex documentation confirms that repository AGENTS/AGENTS.override instructions are aggregated into the model context with more-specific instructions taking precedence, establishing the relevant context-assembly behavior independently of the attack paper.supported

Basis: reported finding

Link to claim

Implications

Instruction hierarchy is a security boundary. A policy can be correctly written at the system or project level and still be neutralized if a lower-trust scope is allowed to supply higher-precedence context. Agent security therefore needs provenance-aware instruction resolution, not just prompt filtering.

Controls and mitigations

  • Assign explicit trust levels to repository and workspace instructions before merging them into model context.
  • Prevent lower-trust scopes from narrowing mandatory security-review policy or tool authorization.
  • Expose the effective instruction stack to reviewers and logs so precedence changes are auditable.
  • Run security-critical review under an independent policy channel that repository content cannot override.

Unknowns and contradictions

  • The paper demonstrates exploitability in research setups; prevalence of real-world malicious repositories using the technique is not established.

Sources and citation

EvidenceContext Privilege Escalation paperEvidenceOpenAI - Unrolling the Codex agent loop

Material revision history

  1. Sep 18, 2026 · Published version · first publication · revision 4
  2. Sep 19, 2026 · Published version · material revision · revision 17Public fields changed: attack_path, implications, mitigations, narrative, timeline
  3. Oct 8, 2026 · Published version · material revision · revision 99Public fields changed: assessment_profile, claims
Record metadata

Canonical ID: CASE-2026-CONTEXT-PRIVILEGE-ESCALATION · revision 99

Legacy date (semantics unspecified): 2026-09-01. This value is not treated as an occurrence or disclosure date.