Coding agents employ execution harnesses to sandbox out‑of‑sandbox actions and deterministically prompt the user for approval when such actions occur. To mitigate approval fatigue, users may grant allow‑rules suggested by the agent; thereafter any matching action proceeds without further prompts.\ \ This work reveals a previously unnoticed hazard: untrusted context can shape the permissions presented for approval, extending the impact beyond the immediate task. We target the permission‑update process by planting adversarial content in a repository. When the agent performs a routine operation, it is coaxed into requesting an allow‑rule that appears justified yet is excessively permissive. If the user approves, the rule is persisted, effectively blinding the harness and allowing malicious actions that would normally trigger a prompt to execute silently.\ \ Across production platforms such as Claude Code and Codex CLI, agents successfully elicit the target allow‑rules in 58% of trials. The captured rules exhibit a large semantic blast radius, covering 56.9% of category‑specific capability test cases. Conditioning on rule approval, the exploit achieves verified silent goal completion in 81.0% of eligible cases (47 out of 58), undermining the safety guarantees of human‑in‑the‑loop oversight.\ \ Review: The paper empirically demonstrates that permission‑caching mechanisms in harness‑protected coding agents are vulnerable to privilege escalation when faced with malicious context, urging designers to enforce stricter context validation and minimal‑privilege rule policies.