Preliminary research

What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness

Zichuan Li, Jian Cui, Ashley Chen, Xiaojing Liao and Luyi Xing · arXiv · 1 September 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

CoRA discovers which files and metadata enter an agent's context, then checks their message roles and persistence. The paper maps sixteen vectors and five attack chains; its contribution is a systematic harness audit, while role promotion and persistent memory poisoning have earlier published precedents.

Record

Researcher

Zichuan Li, Jian Cui, Ashley Chen, Xiaojing Liao and Luyi Xing

Published by

arXiv

Date

1 September 2026

Format

Whitepaper

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• ai-agent
• prompt-injection
• privilege-escalation
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Zichuan Li, Jian Cui, Ashley Chen, Xiaojing Liao and Luyi Xing, first published at the original source. Preserved copies are kept so the citation survives its host.