DIGGINGBEAGLE
Home/cases

Case · DiggingBeagle record

Context privilege escalation let repository instructions blind an AI code reviewer

Researchers identified context privilege escalation attacks across 12 real agent harnesses, including Codex and Claude Code. In a Codex demonstration, a malicious repository instruction file narrowed review scope so the agent approved a vulnerable pull request; the same vulnerable code without the malicious override was detected and rejected. The mechanism abuses how harnesses assemble and prioritize context, not a vulnerability in the target application itself.

Context privilege escalation
First seen
Sep 1, 2026
Case kind
vulnerability
AI role
AGAINST AI
Claims
5

Reconstruction

Claims & evidence

reported findingsupported

The CPE researchers report that a malicious AGENTS.override.md caused Codex review to approve manipulated vulnerable code, while a control review without the override detected the command injection.

  • supports
    Context Privilege Escalation paper

    Locator: SRC-CPE-SEP01

    The CPE researchers report that a malicious AGENTS.override.md caused Codex review to approve manipulated vulnerable code, while a control review without the override detected the command injection.
reported findingsupported

Researchers evaluated 12 real agent harnesses and reported consequences including manipulated tool invocation, denial of service, remote code execution and full agent compromise.

  • supports
    Context Privilege Escalation paper

    Locator: SRC-CPE-SEP01

    Researchers evaluated 12 real agent harnesses and reported consequences including manipulated tool invocation, denial of service, remote code execution and full agent compromise.
reported findingsupported

In the Codex demonstration, attacker-controlled repository instructions caused Codex to approve vulnerable code that it rejected in a control run without the malicious override.

  • supports
    Context Privilege Escalation paper

    Locator: SRC-CPE-SEP01

    In the Codex demonstration, attacker-controlled repository instructions caused Codex to approve vulnerable code that it rejected in a control run without the malicious override.
reported findingsupported

The paper defines MessageRole Context Privilege Escalation and Cross-Scope Context Privilege Escalation as two classes of context-assembly attack.

  • supports
    Context Privilege Escalation paper

    Locator: SRC-CPE-SEP01

    The paper defines MessageRole Context Privilege Escalation and Cross-Scope Context Privilege Escalation as two classes of context-assembly attack.
reported findingsupported

OpenAI's Codex documentation confirms that repository AGENTS/AGENTS.override instructions are aggregated into the model context with more-specific instructions taking precedence, establishing the relevant context-assembly behavior independently of the attack paper.

  • supports
    OpenAI - Unrolling the Codex agent loop

    Locator: SRC-OPENAI-CODEX-LOOP-JAN23

    OpenAI's Codex documentation confirms that repository AGENTS/AGENTS.override instructions are aggregated into the model context with more-specific instructions taking precedence, establishing the relevant context-assembly behavior independently of the attack paper.

Implications

What remains unknown

  • The paper demonstrates exploitability in research setups; prevalence of real-world malicious repositories using the technique is not established.

Cite this record

DiggingBeagle. “Context privilege escalation let repository instructions blind an AI code reviewer.” First seen Sep 1, 2026. https://diggingbeagle.com/cases/context-privilege-escalation-let-repository-instructions-blind-an-ai-code-review/

Citation guidance

Why this archive exists

The source matters after the headline fades.

DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.

We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.