Search papers, labs, and topics across Lattice.
This paper investigates a novel attack vector termed instruction privilege escalation, where low-level malicious content is elevated to a higher instruction level within agent harnesses, allowing it to bypass intended constraints. The authors evaluate this vulnerability across six coding-agent harnesses, successfully achieving 13 distinct attack objectives related to confidentiality, integrity, availability, and remote code execution. The findings reveal that with unrestricted execution and under automatic permission review, the attacks consistently compromise all targeted harnesses, highlighting a critical security flaw in current model-side defenses.
Elevating low-level malicious instructions can completely compromise agent behavior, achieving all attack objectives across multiple harnesses.
Instruction hierarchy is a model-side defense that assigns instructions different levels of privilege according to their sources. These levels constrain which content may direct model behavior. During agent execution, however, agent harnesses construct context for each model invocation. This construction can elevate low-level content to a higher instruction level and grant it greater model-facing privilege. We introduce instruction privilege escalation. In this attack, an attacker induces an agent to elevate low-level malicious content to a higher instruction level. The elevated content then causes the agent to execute instructions it would not follow at their original level. We evaluate this threat by using multi-agent mechanisms to achieve 13 attack objectives across six coding-agent harnesses. These objectives span confidentiality, integrity, availability, and remote code execution. With unrestricted action execution, the attacks achieve all 13 objectives on all six harnesses. Under automatic permission review, the attacks achieve all 13 objectives on all three harnesses that provide this mode. We further reproduce the vulnerability using harness-provided persistent goals and scheduled tasks. These results demonstrate the generality of instruction privilege escalation.
