The org.jboss.arquillian.core.impl.loadable.SecurityActions#newInstance(java.lang.Class<T>, java.lang.Class<?>[], java.lang.Object[]) method takes extra care to reflectively acquire an object constructor in a privileged block. However, it then calls setAccessible(true) outside of a privileged block, rendering previous efforts useless and causing execution failures. The fix is to move that statement to within the privileged block as well.