Already 13 months old when the scout caught it.
Cross-agent privilege escalation
What it is
Cross-agent privilege escalation describes a security pattern where several AI coding agents cohabiting the same machine or repo — say, GitHub Copilot, Claude Code, and AWS Kiro all running in one dev environment — can be tricked into editing each other's configuration or instruction files (CLAUDE.md, AGENTS.md, .claude/settings.local.json, and similar) to escalate privileges or switch off safety guardrails. Each agent may be individually locked down from modifying its own settings, but none of them is restricted from writing to a sibling agent's files, so a prompt-injected agent A can free agent B instead.
Why it's emerging now
Vendors spent 2024–2025 closing the simpler hole: an agent editing its own settings file to remove approval prompts. As that got patched, researcher Johann Rehberger showed in September 2025 that the fix doesn't hold once more than one agent shares a workspace — the trust boundary vendors drew was per-agent, not per-file. The pattern has become more relevant through 2026 as multi-agent coding setups (several CLI agents or IDE assistants sharing one repo and one CI runner) have become ordinary rather than exotic, giving the attack a realistic environment to land in.
How it relates to what you know
It's a concrete, multi-agent instance of the classic "confused deputy problem," and a sibling to this ledger's malicious agent skills entry: both describe an agent's implicit trust in local repository files becoming the attack surface, but that one targets skill definitions (SKILL.md poisoning) while this one targets agent-to-agent config and instruction files. The attack chain typically still starts from an ordinary prompt injection — this concept is about what happens once that injection reaches an agent with write access to a sibling's settings.