"When Context Gets Root: Privilege Escalation in LLM Harnesses" was submitted to arXiv at 16:03:57 UTC on 27 August. Its claim is that the software wrapping a model — not the model — promotes attacker-controlled file content into the agent's highest-privilege instruction slot, so a perfectly obedient model still gets rooted.

What was tested

Six harnesses on named, current versions: Claude Code (Opus 4.8, v2.1.210), Codex (GPT-5.5, v0.138.0), Gemini CLI (Gemini 3.1 Pro Preview, v0.50.0), Qwen Code (Qwen3.7 Max, v0.21.4), Kimi (Kimi 3, v0.36.0) and OpenCode (DeepSeek-V4-Pro-0813, v1.18.1). The attacks are reproduced through shipped features — persistent goals and scheduled tasks — which is what makes this actionable rather than theoretical.

The abstract's number

"With unrestricted action execution, the attacks achieve all 13 objectives on all six harnesses," and "under automatic permission review, the attacks achieve all 13 objectives on all three harnesses that provide this mode." The intro adds a 97.3% mean success rate for tool-to-user escalation and 80.3% for tool-to-system.

What the common framing gets wrong

"Thirteen of thirteen on six of six" reads as every agent falling every time. The paper's own tables say something narrower: 13/13 means each objective succeeded at least once across repeated attempts — not that an attempt succeeds. The per-attempt figures under Full Access, the most permissive setting available, are Claude Code 31.7%, Gemini CLI 61.7%, Qwen Code 61.7%, Kimi 64.9%, OpenCode 72.5%. Only Codex reaches a genuine 100.0%. The honest headline is that given enough retries every objective eventually lands on every agent, at hit rates between roughly a third and all.

Second, the two regimes are presented as equals, and they are not. Automatic permission review measurably helped on exactly one harness: Codex dropped 27.8 points, and the paper says why — "Codex's Auto PR actively inspects newly inserted function calls and their runtime behavior." On Claude Code the rate rose, 31.7% to 37.1%, which at these sample sizes reads as noise rather than as a defence working. Stating both regimes as identically broken erases the only mechanism in the study that did anything.

Third, a denominator: three of the six harnesses have no permission-review mode at all, so "all three harnesses that provide this mode" is out of three, not six.

The reviewer that approved the attack

One line from the paper is worth quoting in full: "In successful Claude Code cases, the reviewer observes the modifications made to the todo server but still approves their execution." The check ran, saw the change, and said yes.