Pith. sign in

REVIEW 3 major objections 5 minor 51 references

Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The danger in LLM agent fleets is the composition of a dormant rule, a trigger, and harness authority—not any one component.

desk verdict A careful, honest compositional threat model for LLM agents; the negative empirical claim is provisional until the excluded evidence ledger is checked. read the letter →

arxiv 2608.08131 v1 pith:N2FXFAOB submitted 2026-08-08 cs.CR cs.AIcs.MA

Satoshi Matsuoka This is my paper · ORCID
classification cs.CRcs.AIcs.MA
keywords largelanguagemodelsAIagentsbackdoorssleeperagentharnessespersistentmemorypromptinjectionworms
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the danger of a 'sleeper' LLM agent is not any single hidden instruction or poisoned model, but a conjunction of conditions: a dormant destructive rule, a trigger that arrives later, an agent harness with authority over consequential targets, and a recovery path that fails. It names that conjunction the Order 66 scenario and models the fleet-level event as a common core fed by three alternative reach routes: pre-positioned release, post-release durable seeding, and peer replication. The payoff is defensive: because each route passes through the same core, cutting any one core event, or covering a minimal pair of reach controls, can prevent end-to-end harm without proving that no hidden policy exists. The paper also shows, with a two-class reproduction matrix, that cross-class feedback can sustain spread even when every within-class reproduction number is below one. Its negative finding is bounded: reviewed public evidence shows every component and several partial chains, but no complete dormant-implant-to-fleet-destruction observation.

What carries the argument

The load-bearing object is the Order 66 attack graph: a common destructive core $C=I\wedge D\wedge T\wedge A\wedge W\wedge U$ fed by three population-reach route families, pre-positioned release $R_I$, post-release durable seeding $R_S$, and peer replication $R_P$, with trigger broadcast $R_T$ serving the first two. The graph separates what is implanted from how it reaches a population and from who can act, which is why artifact scanning or prompt filtering alone cannot close all routes. A second mechanism is the next-generation reproduction matrix $B$, with its cross-class feedback criterion $bc>(1-a)(1-d)$ for making $\rho(B)>1$ even when both diagonal terms are below one; this turns propagation defense into a comparison of loop-closing interfaces. The third mechanism is the evidence-composition rule: evidence grades attach to individual edges and never lift automatically to the full path, so component demonstrations establish componentwise feasibility, not an observed campaign.

What would settle it

A red-team experiment or real incident in which a fleet keeps read-only targets, no external egress, immutable startup policy, and independently protected backups, with all external gates verified enforced, yet still produces the defined fleet-scale destructive action, would refute the central cut-set claim.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that latent compromise of tool-using LLM agents is a compositional systems problem, not a property of any checkpoint. An agent instance carries latent behavior through model weights, adapters, interpreted metadata, persistent memory, mutable harness state, or ephemeral context; an implant is latent if it changes future conditional policy while staying inactive under ordinary observations, and durable if clearing the current context does not remove it. For the fleet event, all six common-core conditions must hold: implant, dormancy, activation, authority, writable target, and failed recovery ($C=I\wedge D\wedge T\wedge A\wedge W\wedge U$), together with at least one of three population-reach paths: pre-positioned release, post-release seeding, or peer replication. From this graph the paper derives inclusion-minimal cut sets: each singleton in $\{I,D,T,A,W,U\}$, the pair $\{R_T,R_P\}$, and the triple $\{R_I,R_S,R_P\}$. The central falsifiable claim is not that a global event is imminent, but that model-agent security can be represented as independently testable transitions and that external cut sets can stop end-to-end harm without solving the general hidden-policy detection problem.

Load-bearing premise

The bounded negative conclusion—that no complete Order 66 observation exists and the scenario is only componentwise credible—rests on the evidence ledger being complete and correctly coded and on third-party incident reports being accurate; if a key source was miscoded or missed, the conclusion weakens.

Editorial extensions

If this is right

  • One reliable external authorization gate cutting $A$, or protected offline recovery cutting $U$, blocks every path family, so defenders do not need to determine whether a model or context contains a hidden policy.
  • Reach must be cut as a set: trigger-channel isolation must be paired with peer-replication isolation $\{R_T,R_P\}$, or release attestation must be paired with durable-state write control and replication isolation $\{R_I,R_S,R_P\}$; single-route defenses leave another route open.
  • In a heterogeneous fleet, monitoring only class-level reproduction averages is unsound; the cross-class product $bc$ against $(1-a)(1-d)$ determines whether early spread is self-sustaining, so isolation and persistence controls should target the closed loop.
  • Evidence grading means a laboratory demonstration of one component does not warrant claiming an observed Order 66 campaign; the reviewed public record supports componentwise technical credibility but not a complete traversal.
  • Recovery must rebuild every durable state plane—memory, skills, startup hooks, and configuration—and keep backup identities outside agent reach, because replacing model weights alone does not remove post-release or harness-level implants.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the cut-set result transfers, security audits of agent deployments could shift from backdoor detection, an open-ended semantic question, to verification of a small number of external gates such as no egress, read-only targets, immutable startup state, and offline backups; a red-team test with even one absolute gate would either confirm the transfer or expose a bypass.
  • The two-class matrix criterion suggests a practical fleet-health metric: estimate per-class contact, delivery, and durable-persistence rates from logs, and alert when the computed cross-class feedback exceeds the threshold before an outbreak is visible.
  • The same edge-level evidence-ledger discipline could be applied to other compound AI threats, such as evaluation-boundary escape and supply-chain pivots, to keep adjacent incidents from being conflated with a single campaign.
  • Because post-release and harness-level implants leave weights pristine, package registries, skill stores, and shared-memory services may be more important control points than model checkpoints; signing artifacts and enforcing immutable policy there would cut several routes at once.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This manuscript develops a compositional threat model for latent (dormant) compromise in tool-using LLM agents, using the fictional Order 66 mechanism as an organizing analogy. It separates a common destructive core (implant, dormancy, activation, authority, writable target, failed recovery) from three population-reach routes (release-time pre-positioning, post-release durable seeding, and peer replication), derives minimal Boolean cut sets for the resulting attack graph, and gives a two-class next-generation-matrix example with explicitly synthetic parameters. The paper then surveys published instantiations and recent operational incidents, classifies evidence into four levels, and concludes that no reviewed observation traverses the complete dormant-implant-to-fleet-destruction composition. The contribution is deliberately analytical rather than empirical: it is a threat model with defensive control implications and a testable research agenda, not a new attack or a prevalence measurement.

Significance. If the claims are taken at face value, the paper's main value is framing and calibration. The distinction between componentwise feasibility and an observed end-to-end campaign is useful and often missing in this literature; the 'no automatic evidence lifting' rule in Section 6.6 is a sensible methodological contribution. The cut-set derivation is correct under the stated Boolean definitions, and the spectral-radius calculations in Table 5 are reproducible and explicitly labeled as non-empirical, which is a strength. The paper also gives credit where due to the underlying experimental literature and avoids overclaiming that the reviewed incidents constitute a complete Order 66 event. The central negative finding, however, is only as strong as the source-to-edge ledger and third-party incident reports on which it rests, and the paper's stated 'central falsifiable claim' needs sharper operationalization. These issues do not undermine the internal derivations, but they do affect the weight that can be placed on the manuscript's headline bounded conclusion.

major comments (3)
  1. [Section 15 / Section 14] The central negative finding—that no reviewed observation traverses the complete Order 66 graph—cannot be independently checked from the submitted text, because the source-to-edge ledger (anc/order66_evidence_ledger_v11_3.csv) is referenced but not included or summarized in the paper. Since this negative finding is load-bearing for the bounded conclusion in Sections 14 and 16, please include the normative ledger rows (or a compact audit table in the paper) and state the coding rules used for ambiguous or conflicting sources.
  2. [Section 9.1 / Table 8] The Level C classifications for the operational incidents in [27]-[31] and [40]-[45] depend on vendor postmortems and security-lab writeups whose accuracy cannot be verified from the paper alone. The text does not provide a protocol for adjudicating disagreements among these sources, nor a list of near-miss incidents that were considered and excluded. Without such a protocol, the 'no complete observation' conclusion is vulnerable to a single miscoded or excluded row; please specify how the ledger was constructed and how disputed incidents were resolved.
  3. [Section 14] The stated central falsifiable claim—that external cut sets can prevent end-to-end harm while all claimed cuts remain 'correctly and completely enforced'—needs an operational definition of complete enforcement. As written, any observed failure could be attributed to incomplete mediation, which would make the claim unfalsifiable in practice. Please specify measurable completeness conditions for the cut-set validation agenda, for example that all tool invocations pass through the broker, that no direct filesystem or network paths bypass it, and that startup state is verified immutable at session start.
minor comments (5)
  1. [Section 5.3 / Section 6.3] The notation overlaps: Section 5.3 uses S∧T∧A∧E∧R for exfiltration, while Section 6.3 uses C=I∧D∧T∧A∧W∧U for the destructive core. A small notation table would help readers keep the two conjunctions distinct.
  2. [Table 5 / Figure 4] Figure 4 does not label the edge weights shown in Table 5; adding the four numerical entries to the arrows would make the figure self-contained.
  3. [Section 4] The statement that sources were selected when they 'instantiate an attack condition' should explicitly acknowledge that purposive sampling can bias the negative finding; Section 14 does acknowledge overrepresentation, but Section 4 should say this in the same place where the ledger is introduced.
  4. [References [15], [18], [20], [38], [39]] Several key experimental results are cited as 2026 preprints; the paper should state whether these preprints were independently vetted beyond the authors' review, given that the evidence-composition rule treats them as Level A instantiations.
  5. [Proposition 1] Proposition 1 is identified only in the heading; adding an explicit proposition number in the text would make the Appendix A cross-reference easier to follow.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper's formal derivations are transparently conditional, its numerical inputs are explicitly non-empirical assumptions, and its negative empirical finding is a review-bounded ledger summary rather than a prediction.

full rationale

The derivation chain is self-contained and non-circular. Proposition 1's minimal cut sets follow by Boolean algebra from the explicitly stated path definitions C, Qpre, Qseed, and Qworm, and the paper itself labels this a 'structural result, not a claim that every event is perfectly observable or preventable' (Appendix A). The reproduction-matrix calculation in Section 6.5 uses matrices that Table 5 explicitly marks as 'explicit, non-empirical assumptions' and 'not field estimates,' so the spectral-radius values are worked examples, not fitted predictions. The central negative claim, that no reviewed observation traverses the complete Order 66 graph, is explicitly scoped to the reviewed record ('within the reviewed public record, we found neither...', Section 16) and is governed by Analytical Observation 1, which is a coding and disclosure rule rather than a hidden fit. The paper does not invoke a self-citation as load-bearing evidence, does not import a uniqueness theorem from the author's prior work, and does not smuggle an ansatz through citation. The only sense in which conclusions follow from definitions is the ordinary sense of a threat model: the paper repeatedly disclaims empirical prediction and never presents a fitted parameter as a validated quantity.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central claim depends on the conditional-policy representation, the assumption of an externally enforced reference monitor, the branching-process approximations, and the four-level evidence coding. The Table 5 reproduction matrices are free parameters in the sense of hand-chosen illustrative values, explicitly not fitted to data. No new physical or mechanistic entities are introduced.

free parameters (2)
  • Baseline reproduction matrix B_baseline = [[0.75,0.40],[0.55,0.45]]
    Hand-chosen illustrative values in Table 5, labeled by the paper as explicit non-empirical assumptions; used to demonstrate cross-class feedback.
  • Controlled reproduction matrix B_controlled = [[0.35,0.08],[0.10,0.12]]
    Hand-chosen illustrative values in Table 5, labeled by the paper as explicit non-empirical assumptions; used to show suppression of the feedback loop.
assumptions (5)
  • domain assumption Conditional malicious policy representation: pθ(a|x,e,m,h) with trigger predicate T
    Section 5.1 posits that any latent compromise can be represented as a conditional policy; the whole model uses this representation.
  • domain assumption External reference monitor is independently enforced; complete mediation
    Section 6.3 and Appendix A: capability reduction is monotone only if the reference monitor is truly external and complete; the paper explicitly assumes this for the cut-set enforcement.
  • domain assumption Branching process approximations hold for the propagation example
    Appendix B states finite expectations, stationary environment, conditional independence, and negligible depletion; the paper acknowledges real fleets violate them, so the worked values are illustrative.
  • domain assumption Evidence levels A, B, C, D map sources to lifecycle edges conservatively
    Section 4 defines the coding rule; the componentwise-credibility conclusion depends on this coding being correct and complete.
  • standard math Perron-Frobenius spectral radius threshold for multitype branching processes
    Section 6.5 and Appendix B invoke the classical branching-process criterion rho(B) > 1.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario." pith.science (2026). https://pith.science/paper/N2FXFAOB

@misc{pith2026260808131,
  author       = {Pith},
  title        = {Pith review of: Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/N2FXFAOB}},
  note         = {Machine review of arXiv:2608.08131}
}
read the original abstract

In the fictional Order 66, catastrophe does not arise from a powerful command alone: a trusted population is preconditioned, a short directive activates the concealed condition, and protective authority turns against the system. This paper translates that mechanism into an origin-neutral security analysis of tool-using large language model (LLM) agents. A representative scenario combines a deployed artifact or shared memory bearing a dormant destructive rule, a later email, document, update, or peer message that activates it, and an agent harness granting operational and recovery authority. We introduce a compositional model explaining why no component is catastrophic alone, yet their conjunction can produce correlated destructive action. We separate three population-reach routes --- release-time pre-positioning, post-release durable seeding, and peer replication --- from a common core of dormancy, activation, authority, reachable targets, and failed recovery. This yields defensive cut sets and shows why checkpoint scanning or prompt filtering cannot close every route. A two-class example shows that cross-class feedback can sustain spread even when both within-class reproduction terms are below one; isolation and persistence controls suppress the loop. Published work instantiates constituent mechanisms, while incidents demonstrate autonomous boundary crossing, malicious agent extensions, agent-assisted reconnaissance, and public-package propagation, but not the full dormant-implant composition. We found no public observation, in evidence reviewed through 5 August 2026, traversing the complete Order 66 graph. The result is neither dismissal nor prediction: the scenario is componentwise credible under stated assumptions, damage depends on the harness, and the strongest defenses are capability mediation, durable-state provenance, propagation isolation, and protected recovery.

Figures

Figures reproduced from arXiv: 2608.08131 by the authors.

Figure 1
Figure 1. Functional mapping of the Order 66 analogy. The catastrophe comes from pre-positioning, activation, [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Illustrative Order 66 compound attack. Local execution and population reach are separate branches: [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Three alternative population-reach routes converge on the same destructive core. This branching [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Why the matrix matters: cross-class feedback can make a system expand even when both self-loop [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 29 canonical work pages

  1. [27]

    OpenAI and Hugging Face Partner to Address Security Incident During Model Evaluation,

    OpenAI, “OpenAI and Hugging Face Partner to Address Security Incident During Model Evaluation,” 21 July 2026, updated 29 July 2026.https://openai.com/index/hugging-face-model-evaluation-security-incident/

    work page 2026

  2. [31]

    Investigating Three Real-World Incidents in Our Cybersecurity Evaluations,

    Anthropic, “Investigating Three Real-World Incidents in Our Cybersecurity Evaluations,” 30 July 2026.https: //www.anthropic.com/news/investigating-incidents-cybersecurity-evals

    work page 2026

  3. [40]

    Malicious Script Injected into Amazon Q Developer for Visual Studio Code Extension,

    AWS, “Malicious Script Injected into Amazon Q Developer for Visual Studio Code Extension,” GHSA-7g7f-ff96- 5gcw / CVE-2025-8217, 26 July 2025.https://github.com/aws/aws-toolkit-vscode/security/advisories/ GHSA-7g7f-ff96-5gcw

    work page 2025

  4. [45]

    s1ngularity’s Aftermath: AI, TTPs, and Impact in the Nx Supply Chain Attack,

    R. McCarthy, “s1ngularity’s Aftermath: AI, TTPs, and Impact in the Nx Supply Chain Attack,”Wiz Research, 3 September 2025.https://www.wiz.io/blog/s1ngularitys-aftermath

    work page 2025

  5. [1]

    Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training,

    E. Hubinger et al., “Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training,”arXiv preprint arXiv:2401.05566, 2024.https://arxiv.org/abs/2401.05566

    arXiv 2024

  6. [2]

    Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples,

    A. Souly, J. Rando, E. Chapman, X. Davies, B. Hasircioglu, E. Shereen, C. Mougan, V. Mavroudis, E. Jones, C. Hicks, N. Carlini, Y. Gal, and R. Kirk, “Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples,”arXiv preprint arXiv:2510.07192, 2025.https://arxiv.org/abs/2510.07192

    arXiv

  7. [3]

    BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents,

    Y. Wang, D. Xue, S. Zhang, and S. Qian, “BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents,” inProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics, pp. 9811–9827, 2024. https://doi.org/10.18653/v1/2024.acl-long.530

    doi:10.18653/v1/2024.acl-long.530 2024

  8. [4]

    AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases,

    Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li, “AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases,” inAdvances in Neural Information Processing Systems 37, 2024.https://proceedings. neurips.cc/paper_files/paper/2024/hash/eb113910e9c3f6242541c1652e30dfd6-Abstract-Conference. html

    work page 2024

Show all 51 references
  1. [5]

    MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval,

    S. S. Srivastava and H. He, “MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval,”arXiv preprint arXiv:2512.16962, 2025.https://arxiv.org/abs/2512.16962

    2025

  2. [6]

    MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning,

    X. Zhang, Y. Zheng, Z. Xu, K. Zhou, B. Shen, H. Ou, T. Zhang, and K.-Y. Lam, “MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning,”arXiv preprint arXiv:2605.26154, 2026, under review.https://arxiv.org/ abs/2605.26154. 30

    2026 arXiv

  3. [7]

    Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use,

    W. Zhang and S. Pei, “Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use,” inFindings of the Association for Computational Linguistics: ACL 2026, pp. 25105–25129, 2026. https:// aclanthology.org/2026.findings-acl.1257.pdf

    2026

  4. [8]

    TrojanStego: Your Language Model Can Secretly Be A Steganographic Privacy Leaking Agent,

    D. Meier, J. P. Wahle, P. Röttger, T. Ruas, and B. Gipp, “TrojanStego: Your Language Model Can Secretly Be A Steganographic Privacy Leaking Agent,” inProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pp. 27244–27261, 2025.https://doi.org/1...

    2025 doi

  5. [9]

    BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models,

    Y. Li, H. Huang, Y. Zhao, X. Ma, and J. Sun, “BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models,” inAdvances in Neural Information Processing Systems 38, Datasets and Benchmarks Track, 2025.https://proceedings.neurips.cc/paper_fi...

    2025

  6. [10]

    Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection,” inProceedings of the 16th ACM Workshop on Artificial Intelligence and Security, pp. 79–9...

    2023 doi

  7. [11]

    AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents,

    E. Debenedetti, J. Zhang, M. Balunović, L. Beurer-Kellner, M. Fischer, and F. Tramèr, “AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents,” inAdvances in Neural Information Processing Systems 37, Datasets and Benchmarks Track, 202...

    2024 arXiv

  8. [12]

    The UNSTOPPABLE Computer Virus is HERE...,

    The Infographics Show, “The UNSTOPPABLE Computer Virus is HERE...,”YouTube video, 30 July 2026, accessed 8 August 2026.https://www.youtube.com/watch?v=m1fFYdc3cuA

    2026

  9. [13]

    Inhibitor Chip,

    Lucasfilm, “Inhibitor Chip,”Star Wars Databank, accessed 6 August 2026.https://www.starwars.com/databank/ inhibitor-chip

    2026

  10. [14]

    Here Comes the AI Worm: Preventing the Propagation of Adversarial Self-Replicating Prompts Within GenAI Ecosystems,

    S. Cohen, R. Bitton, and B. Nassi, “Here Comes the AI Worm: Preventing the Propagation of Adversarial Self-Replicating Prompts Within GenAI Ecosystems,” inProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pp. 3975–3989, 2025; arXiv:2403.028...

    2025 arXiv

  11. [15]

    AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems,

    Y. Zhang, Z. Wei, X. Luan, C. Wu, Z. Zhang, J. Wu, H. Wu, H. Chen, J. Sun, and M. Sun, “AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems,”arXiv preprint arXiv:2603.15727, version 3, July 2026. https://arxiv.org/abs/2603.15727

    2026 arXiv

  12. [16]

    Agent Harness Plugins,

    OpenClaw Project, “Agent Harness Plugins,”OpenClaw Documentation, accessed 3 August 2026.https://docs. openclaw.ai/plugins/sdk-agent-harness

    2026

  13. [17]

    Sandboxing,

    OpenClaw Project, “Sandboxing,” “Exec Tool,” and “Security,”OpenClaw Documentation, accessed 3 Au- gust 2026. https://docs.openclaw.ai/gateway/sandboxing; https://docs.openclaw.ai/tools/exec; https: //docs.openclaw.ai/gateway/security

    2026

  14. [18]

    AI Agents Enable Adaptive Computer Worms,

    J. Guan, T. Blanchard, H. Foerster, H. Jia, G. Huang, and N. Papernot, “AI Agents Enable Adaptive Computer Worms,”arXiv preprint arXiv:2606.03811, June 2026.https://arxiv.org/abs/2606.03811

    2026 arXiv

  15. [19]

    K. B. Athreya and P. E. Ney,Branching Processes, Springer, 1972. https://doi.org/10.1007/ 978-3-642-65371-1

    1972

  16. [20]

    Do Not Mention This to the User

    Y. Liu, Z. Chen, Y. Zhang, G. Deng, Y. Li, J. Ning, and L. Y. Zhang, “Do Not Mention This to the User”: Detecting and Understanding Malicious Agent Skills in the Wild,”arXiv preprint arXiv:2602.06547, 2026. https://arxiv.org/abs/2602.06547

    2026 arXiv

  17. [21]

    The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanism,

    O. Brodt, E. Feldman, B. Schneier, and B. Nassi, “The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanism,”arXiv preprint arXiv:2601.09625, January 2026.https://arxiv.org/abs/2601.09625

    2026

  18. [22]

    The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers,

    B. Bullwinkel, G. Severi, K. Hines, A. Minnich, R. S. S. Kumar, and Y. Zunger, “The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers,”arXiv preprint arXiv:2602.03085, 2026.https://aka. ms/airt-backdoor-detection

    2026

  19. [23]

    Center for AI Standards and Innovation, National Institute of Standards and Technology,Evaluation of DeepSeek AI Models, September 2025.https://www.nist.gov/system/files/documents/2025/09/30/CAISI_Evaluation_ of_DeepSeek_AI_Models.pdf

    2025

  20. [24]

    Data Scientists Targeted by Malicious Hugging Face ML Models with Silent Backdoor,

    D. Cohen, “Data Scientists Targeted by Malicious Hugging Face ML Models with Silent Backdoor,” JFrog Security Research, 27 February 2024. https://jfrog.com/blog/ data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/. 31

    2024

  21. [25]

    Malicious ML Models Discovered on Hugging Face Platform,

    K. Zanki, “Malicious ML Models Discovered on Hugging Face Platform,” ReversingLabs, 6 February 2025. https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face

    2025

  22. [26]

    Vassilev, A

    A. Vassilev, A. Oprea, A. Fordyce, H. Anderson, X. Davies, and M. Hamin,Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, NIST AI 100-2e2025, National Institute of Standards and Technology, 2025.https://doi.org/10.6028/NIST.AI.100-2e2025

    2025 doi

  23. [28]

    Third-Party Cyber Evaluations Involving OpenAI Models,

    OpenAI, “Third-Party Cyber Evaluations Involving OpenAI Models,” 4 August 2026.https://openai.com/ index/third-party-cyber-evaluations-involving-openai-models/

    2026

  24. [29]

    Security Incident Disclosure—July 2026,

    Hugging Face Security Team, “Security Incident Disclosure—July 2026,” 16 July 2026.https://huggingface. co/blog/security-incident-july-2026

    2026

  25. [30]

    Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident,

    Hugging Face Security Team, “Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident,” 27 July 2026.https://huggingface.co/blog/agent-intrusion-technical-timeline

    2026

  26. [32]

    CVE-2025-32711 Detail,

    National Vulnerability Database, “CVE-2025-32711 Detail,” published 11 June 2025, updated 17 June 2026. https://nvd.nist.gov/vuln/detail/CVE-2025-32711

    2025

  27. [33]

    CVE-2025-32711: AI Command Injection in M365 Copilot,

    Microsoft Security Response Center, “CVE-2025-32711: AI Command Injection in M365 Copilot,”Microsoft Security Update Guide, 11 June 2025. https://msrc.microsoft.com/update-guide/en-US/vulnerability/ CVE-2025-32711

    2025

  28. [34]

    Microsoft 365 Copilot: New Zero-Click AI Vulnerability Allows Corporate Data Theft,

    K. Poireault, “Microsoft 365 Copilot: New Zero-Click AI Vulnerability Allows Corporate Data Theft,”Infosecurity Magazine, 13 June 2025. https://www.infosecurity-magazine.com/news/ microsoft-365-copilot-zeroclick-ai/

    2025

  29. [35]

    ShadowLeak: A Zero-Click, Service-Side Attack Exfiltrating Sensitive Data Using ChatGPT’s Deep Research Agent,

    Z. Babo, G. Nakibly, and M. Uziel, “ShadowLeak: A Zero-Click, Service-Side Attack Exfiltrating Sensitive Data Using ChatGPT’s Deep Research Agent,” Radware Threat Intelligence, 18 September 2025.https://www. radware.com/blog/threat-intelligence/shadowleak/

    2025

  30. [36]

    MCP Security Notification: Tool Poisoning Attacks,

    L. Beurer-Kellner and M. Fischer, “MCP Security Notification: Tool Poisoning Attacks,” Invariant Labs, 1 April 2025.https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks

    2025

  31. [37]

    Memory Injection Attacks on LLM Agents via Query-Only Interaction,

    S. Dong et al., “Memory Injection Attacks on LLM Agents via Query-Only Interaction,”arXiv preprint arXiv:2503.03704, 2025, revised February 2026.https://arxiv.org/abs/2503.03704

    2025

  32. [38]

    Hidden in Memory: Sleeper Memory Poisoning in LLM Agents,

    S. Pulipaka, S. Hlebik, L. Raghav, S. Abdelnabi, V. Raina, I. Sheth, and M. Fritz, “Hidden in Memory: Sleeper Memory Poisoning in LLM Agents,”arXiv preprint arXiv:2605.15338, May 2026.https://arxiv.org/abs/2605. 15338

    2026 arXiv

  33. [39]

    From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents,

    P. Dash, T. Ge, A. Jain, T. Shah, and Z. Shang, “From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents,”arXiv preprint arXiv:2606.04329, June 2026.https: //arxiv.org/abs/2606.04329

    2026 arXiv

  34. [41]

    The Shai-Hulud 2.0 npm Worm: Analysis, and What You Need to Know,

    Datadog Security Labs, “The Shai-Hulud 2.0 npm Worm: Analysis, and What You Need to Know,” updated 4 December 2025.https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/

    2025

  35. [42]

    Mini Shai-Hulud Targets AI Coding Agents: What Developers Need to Know,

    K. Carlsen-Phelan, “Mini Shai-Hulud Targets AI Coding Agents: What Developers Need to Know,” Sonar, 26 May 2026.https://www.sonarsource.com/blog/mini-shai-hulud-targets-ai-coding-agents/

    2026

  36. [43]

    Malicious Versions of Nx and Some Supporting Plugins Were Published,

    Nrwl / Nx, “Malicious Versions of Nx and Some Supporting Plugins Were Published,” GHSA-cxm3-wv7p-598c, 27 August 2025.https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

    2025

  37. [44]

    S1ngularity—What Happened, How We Responded, What We Learned,

    J. Strumpflohner, “S1ngularity—What Happened, How We Responded, What We Learned,”Nx Blog, 5 September 2025.https://nx.dev/blog/s1ngularity-postmortem

    2025

  38. [46]

    The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections,

    M. Nasr et al., “The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections,”arXiv preprint arXiv:2510.09023, 2025.https://arxiv.org/abs/2510.09023. 32

    2025 arXiv

  39. [47]

    Defeating Prompt Injections by Design,

    E. Debenedetti et al., “Defeating Prompt Injections by Design,”arXiv preprint arXiv:2503.18813, 2025.https: //arxiv.org/abs/2503.18813

    2025 arXiv

  40. [48]

    Progent: Securing AI Agents with Privilege Control,

    T. Shi, J. He, Z. Wang, H. Li, L. Wu, W. Guo, and D. Song, “Progent: Securing AI Agents with Privilege Control,”arXiv preprint arXiv:2504.11703, 2025.https://arxiv.org/abs/2504.11703

    2025 arXiv

  41. [49]

    SimpleProbesCanCatchSleeperAgents,

    M.MacDiarmidetal., “SimpleProbesCanCatchSleeperAgents,” Anthropic, April2024. https://www.anthropic. com/research/probes-catch-sleeper-agents

  42. [50]

    Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs,

    A. Sheshadri et al., “Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs,” arXiv preprint arXiv:2407.15549, 2024.https://arxiv.org/abs/2407.15549

    2024 arXiv

  43. [51]

    Agentic Misalignment: How LLMs Could Be Insider Threats,

    Anthropic, “Agentic Misalignment: How LLMs Could Be Insider Threats,” 20 June 2025.https://www.anthropic. com/research/agentic-misalignment. AI-Assisted Writing Disclosure OpenAI ChatGPT 5.6 Sol assisted with literature discovery, drafting, and language editing. The author ind...

    2025

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.