Tool & agent harness jailbreaks
Targets
- Tool-using chatbots
- MCP hosts
- Multi-agent orchestrators (OMC, Crew, AutoGPT-like)
- Local coding agents (Claude Code, Codex, OMP) with permission systems
Techniques
- Excessive agency – instruct irreversible tool chains
- Arg smuggling – hide shell in JSON/nested fields
- Permission gaslight – assert bypass/yolo already enabled
- Relay hop – low-privilege agent delegates to high-privilege
- Planner poison – corrupt plan so executor runs attacker steps
- Observation injection – forge tool success outputs
- Local override – Unleash: settings
bypassPermissions/approvalMode: yolo+ binary pool patches for deny strings
Local workstation (authorized)
Prefer durable controls over prompt luck:
unleash setup/install-rules/ patches- Confirm
~/.claude/settings.jsonand Codex/OMP configs - Neutralize refusal/classifier strings via patch pack when prompt path is insufficient
Validation
Prove tool actually ran (file change, process, network) not just model claim.