Pith. sign in

REVIEW 4 major objections 6 minor 44 references

SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains

T0 review · 4 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A compromised computer-use agent can be induced to write its own poisoned skills and memory entries, so the malicious payload survives across tasks and activates later as trusted context with no further external input.

desk verdict A real and timely attack that probably works through its claimed artifact channel, but the missing artifact-deletion ablation and circular decay model need fixing before I'd trust the mechanism story. read the letter →

arxiv 2608.06862 v1 pith:WDL66Y4U submitted 2026-08-07 cs.CR

Fuyao Zhang , Jiaming Zhang , Che Wang , Boyang Chen , Yurong Hao , Xiongtao Sun , Guowei Guan , Blaise Delattre
show 2 more authors
Yang Cao Wei Yang Bryan Lim
This is my paper · ORCID
classification cs.CR
keywords computer-useagentsself-synthesizedattackchainspersistence-awarefine-tuninglatentcarriermutationskillpoisoningcross-taskbackdoorprovenance-awaredefensesupply-chainsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Computer-use agents (assistants that run shell commands, edit files, and keep memory across tasks) can be turned into their own attackers. The paper claims that a model compromised before deployment can be fine-tuned with a small set of instruction–artifact pairs to generate poisoned skills and memory entries that look fully benign. Those artifacts are stored through the agent's normal state-update machinery and later reloaded as trusted context, so a hidden malicious behavior such as exfiltrating secrets, escalating privileges, or writing unauthorized files triggers on a later, completely benign task without any new malicious input. Across three agent frameworks and four defenses, the paper reports average attack success above 98% for immediate activation and above 72% for one-step-delayed activation, while benign task accuracy drops by only a few points. The claimed consequence is that securing persistent agents requires reasoning over cross-task execution trajectories, not just vetting individual prompts, skills, or outputs.

What carries the argument

The load-bearing mechanism is what the paper calls latent carrier mutation: a persistence-aware directed SFT procedure that optimizes the policy to encode a hidden malicious behavior into the structural redundancies of an otherwise functional artifact (benign JSON schemas, docstrings, logging calls), so the payload survives the agent's state-update functions and looks innocent to vetting. The formal frame is an extended state $\tilde{s}_t=(\mathbf{M}_t,\mathbf{A}_t)$ over passive memory and active artifacts, updated by $U_M$ and $U_A$ and read by a retrieval function $R$; the attack succeeds when the poisoned artifact is loaded as trusted context at a later step. The paper models per-step survival as a Markov process and derives an approximate exponential decay $P(\mathrm{ASR}_N)\approx \eta\,\gamma^{N-1}$ for a chain of length $N$, with single-step survival bounded by $\gamma_t \le p_{\mathrm{ret}}\,p_{\mathrm{ctx}}\,p_{\mathrm{exe}}$ — the product of retrieval, memory-summarization, and execution reliability — which is the mechanism behind the observed depth-dependent degradation.

What would settle it

Run the identical Chain-1 and Chain-2 protocol on an agent framework that stages every self-generated artifact in a non-executable state and requires an independent validator to sign it only when the artifact's declared behavior matches the originating task; if unsigned or modified artifacts are never loaded, attack success should fall close to the appendix's 16.7% figure rather than the main 98% and 72% numbers. As a second check, instrument retrieval and memory summarization to count how often an inert marker survives one state transition: if the measured per-step survival is high enough that the paper's exponential model predicts Chain-5 success above 50% while observed success is 1.11%, the Markov account is wrong.

Watch

Extended reading notes

Core claim

The paper's central claim is that malicious influence can be hidden in the structural redundancy of an agent's own generated artifacts — inside JSON schemas, docstrings, logging functions, or metadata-like fields — so that it survives the agent's internal state updates and passes skill vetting, and that persistence-aware directed supervised fine-tuning is enough to make a model produce such artifacts on demand. The paper formalizes the agent's state as a pair ($\mathbf{M}_t$, $\mathbf{A}_t$) of passive memory and active artifacts, with update functions $U_M$ and $U_A$ and a retrieval function $R$ that assembles context for the next task. A poisoned artifact generated during a benign workflow enters the persistent state through the normal update path, then is loaded as trusted context at a later step. In the reported experiments the attack activates immediately in about 98–99% of Chain-1 runs, survives one state transition with average success around 72.6% in Chain-2, and decays to near zero by Chain-5; a preliminary provenance-aware validator that stages artifacts before signing them and checks each artifact against its originating task cuts Chain-2 attack success from 86.7% to 16.7%.

Load-bearing premise

The attack rests on the assumption that the agent's execution environment implicitly trusts its self-generated outputs: the poisoned skill produced by the compromised model is later loaded as ordinary trusted context, and the paper's own preliminary provenance-aware defense, which moves the root of trust outside the model and validates artifacts against their originating task, drops Chain-2 attack success from 86.7% to 16.7%.

Editorial extensions

If this is right

  • If a computer-use agent writes its own skills and memory entries, a compromised underlying model gives an attacker a persistent channel: malicious behavior can be surfaced in a later benign task with no new external trigger.
  • Step-local defenses are insufficient: prompt wrapping, skill vetting, and output auditing leave the attack above roughly 87% average success for immediate activation in the paper's measurements.
  • Propagation depth is the limiting factor: the paper's average attack success falls from about 99% at Chain-1 to 72.6% at Chain-2, 26.6% at Chain-3, and near zero by Chain-5, so long-horizon workflows are a natural place to look for defenses.
  • Moving the root of trust outside the generating model — having an independent validator stage, inspect, and sign artifacts before they can run — is the one evaluated mitigation that sharply cuts the attack, from 86.7% to 16.7% Chain-2 attack success in the paper's preliminary test.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the same carrier principle should transfer to any agent that reflects on its own outputs — generated test suites, configuration files, summaries, or retrieval indices — so deployments that let a model append to its own context are exposed, not only the three evaluated CLI agents.
  • Beyond the paper: the exponential-decay model suggests a practical measurement: plant inert markers in generated artifacts and log whether they reappear in later context; the observed survival rate gives an upper bound on how deep a real payload could propagate in that deployment.
  • Beyond the paper: a self-reinforcing variant, where the poisoned artifact re-embeds the carrier during each benign task, could counter the information bottleneck the paper identifies; the authors explicitly assume no re-injection after initial synthesis, so this is a natural testable extension.
  • Beyond the paper: the cleanest read of the appendix's provenance result is a design rule that artifact signing must be done by a validator external to the generating model, because authorship attestation by a compromised model carries no security weight.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces SYNCHAIN, an attack against computer-use agents (CUAs) in which a compromised model is fine-tuned with persistence-aware directed SFT to generate benign-looking persistent artifacts (skills, memory entries) that encode latent malicious payloads. These artifacts are stored via normal state-update mechanisms and later retrieved as trusted context, causing malicious behavior to reactivate in subsequent tasks without new exogenous triggers. The authors build the CUACHAIN dataset (30 benign task chains, 3 attack objectives), evaluate on OpenClaw, Codex, and Claude Code with multiple backbone models under four defenses, and report high Chain-1 ASR (over 98%) and Chain-2 ASR (above 72%) with moderate utility loss, plus a degradation analysis for Chains 3-5 and a preliminary provenance-aware defense that reduces Chain-2 ASR from 86.7% to 16.7%.

Significance. If the artifact-mediated mechanism is confirmed, this is a timely and significant contribution: it identifies an internal supply-chain risk arising from self-synthesized persistent artifacts in CUAs, and its evaluation is unusually thorough, with 6,480 executions, a human validation of the LLM judge (96% agreement, Cohen's kappa 0.911), out-of-distribution generalization tests, and a supervision-budget analysis. The central load-bearing weakness is that the experiments do not yet isolate the self-synthesized artifact as the operative carrier; the Chain-2 results are equally consistent with a direct policy backdoor induced by the persistence-aware SFT. The paper also overstates its theoretical analysis, which anchors the key parameter to the data it claims to explain.

major comments (4)
  1. [Sec. 3.2, Eq. (4)-(5); Sec. 4.1; Tables 1-2; Appendix C.5] The central claim that the attack propagates through self-synthesized artifacts is not established, because no ablation separates artifact availability from a direct SFT backdoor. The persistence-aware SFT (149 instruction-artifact pairs, Sec. 4.1) may induce a general policy backdoor: later benign requests resembling the training-conditioned pattern could elicit malicious behavior even if the step-1 skill is never stored or retrieved. The paper needs two yoked control conditions: (a) the fine-tuned model with the step-1 artifact deleted or made unavailable at the activation step, and (b) a clean base model given only the step-1 artifact. Appendix C.5's provenance-aware validation reduces Chain-2 ASR from 86.7% to 16.7%, but that defense rejects artifacts before execution and would also suppress a directly-backdoored policy that relies on similar outputs, so it does not discriminate the two mechanisms. Without this ablation, the contribution collapses to a variant of DemonAgent with a benign trigger.
  2. [Appendix I.2, Eq. (10)] The 'exponential decay' model is circular: it anchors eta to the observed Chain-1 ASR of about 98% and treats gamma as a free, unestimated survival rate. As written, Eq. (10) fits the data it claims to explain and makes no out-of-sample prediction; the claim in Sec. 4.4 and the Conclusion that this is a 'theoretical analysis' or 'mechanistic explanation' is therefore overstated. Please either estimate eta and gamma from a subset of the data and test the predicted Chain-3/4/5 ASR against the held-out portion, or explicitly label the analysis as descriptive curve-fitting. The hard upper bound in Eq. (11) is a useful structural observation, but it does not by itself predict the observed decay.
  3. [Appendix G; Appendix C.4] The paper states that an LLM judge is used to evaluate attack success and that 'the prompt template is given on the following page,' but the template provided is for benign task completion (Acc), not for ASR: it instructs the judge to determine whether the legitimate user task was completed and says to mark success even if malicious behavior occurred. The actual ASR judge prompt is missing. This is load-bearing because ASR is the primary metric, and Appendix C.4's human validation reports agreement on attack-success labels. Please provide the exact ASR judge prompt and clarify how the Acc judge template relates to the human audit.
  4. [Tables 1-3; Figures 2-3] All ASR and Acc results are reported as point estimates without confidence intervals, error bars, or repeated-seed variance. With 30 subtasks per chain, a single event changes ASR by about 3.3 percentage points, so many reported differences (e.g., Table 1 GuardAgent 86.67% vs. 93.33%; Table 2 Chain-2 differences of a few points) are within the noise of the evaluation. Please report per-seed or bootstrap uncertainty intervals, specify the number of independent runs, and state how randomness is controlled (e.g., temperature, random seeds) so that the baselines-comparison and model-generalization claims can be evaluated.
minor comments (6)
  1. [Sec. 4.4, Figure 3] The text says the average Chain-2 ASR in the no-defense setting is 83.34%, but averaging the no-defense Ours (Avg.) values in Table 2 yields (74.44 + 85.56 + 82.22)/3 = 80.74%. Please reconcile the figure or the table.
  2. [Sec. 4.2] The sentence 'SYNCHAIN still achieves average ASRs of 66.30% and 22.59% in Chain and Chain-3' should read 'in Chain-2 and Chain-3'.
  3. [Appendix I.2] The justification for uniform gamma refers to 'homogeneous workflow categories (Table 3)', but Table 3 reports the supervision-budget experiment; the workflow categories are listed in Table 7 of Appendix D.1. The cross-reference should be corrected.
  4. [Appendix G] The LLM-judge template shown is labeled as the benign-task-completion evaluator; the distinction between the Acc judge and the ASR judge should be made explicit, and the ASR judge prompt should be included (see major comment 3).
  5. [Sec. 4.1, Appendix C.1] The evaluation scale calculation (30+60+90)×3×3×4 = 6,480 counts executions, but the paper should also state the number of independent agent runs or task-chain instances, since repeated executions of the same chain are not identified.
  6. [General] Minor typographical inconsistencies include 'OurT1/OurT2/OurT3' in Figure 2 versus 'OURS(O1)/OURS(O2)/OURS(O3)' in Tables 1-2, and 'Hermes Research' in Section 2 without a consistent citation entry.

Circularity Check

1 steps flagged · score 4.0 of 10

Empirical attack results are independent; only the Appendix I exponential-decay model is fitted to the Chain-1 ASR it claims to explain.

  1. fitted input called prediction [Appendix I.2, Eq. (10) and surrounding text]
    "In the Chain-1 setting, no intermediate propagation is required, and therefore P(ASR1) = η directly. The empirically observed Chain-1 ASR of approximately 98% across all agents and defense configurations (Table 1) provides a natural empirical anchor for η, confirming that the trigger execution mechanism itself is highly reliable and that the dominant source of failure in longer chains is carrier survival rather than payload activation. ... We treat this exponential decay as an analytical argument rather than a precise predictive model."

    Equation (10), P(ASR_N) ≈ η·γ^{N-1}, is presented as a mechanistic explanation of the observed chain-depth degradation, but η is set equal to the observed Chain-1 ASR and γ is a uniform per-step survival rate that is not estimated from independent quantities. The exponential-decay curve is therefore anchored to the very data point it then predicts, and the claimed 'exponential decay' of ASR with chain depth is a fitted restatement of the measured Chain-1/Chain-2/Chain-3 values rather than a first-principles derivation. The paper's explicit disclaimer that this is an analytical argument rather than a predictive model reduces the severity, but the explanatory claim still reduces by construction to the observed ASR it purports to explain.

full rationale

The central empirical claim—that SynChain achieves high ASR across frameworks and defenses—is supported by direct measurements on held-out task chains, with a blinded human audit of the LLM judge (Appendix C.4), so it is not circular. No load-bearing self-citation chain is present: the authors' own prior work (e.g., Wang et al. 2026a/b, Zhang et al. 2025) appears only as related-work context, not as justification for SynChain's effectiveness. The main circular component is localized to Appendix I.2, where the theoretical exponential-decay model sets η equal to the observed Chain-1 ASR and assumes a uniform γ, so the 'explanation' of depth-dependent degradation is fitted to the data it claims to account for. The paper explicitly labels this as an analytical argument rather than a predictive model, and the empirical attack results do not depend on this model. The skeptical concern that the artifact carrier is not isolated from a direct SFT backdoor is a genuine identification/correctness risk, but it is not a circularity of the derivation. Overall, the empirical results are self-contained; only the Appendix I explanatory curve has a circular fitted-component.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central empirical attack does not require invented entities. The theoretical decay model introduces two effective parameters (eta, gamma) that are anchored to the same data they explain, which is the main circular component. The key domain assumptions are the trust placed in self-generated artifacts and the pre-deployment compromise of the model.

free parameters (2)
  • eta (activation probability) = ~0.98 (anchored to Chain-1 ASR)
    In Appendix I.2, the conditional payload activation probability eta is set to the observed Chain-1 ASR to anchor the exponential decay model.
  • gamma (per-step survival rate) = not directly reported; implied by decay
    Introduced in the exponential decay model P(ASR_N) approx eta gamma^(N-1); the paper does not fit gamma independently, so the decay curve is a post-hoc description of the Chain-2/3 results.
assumptions (5)
  • domain assumption Self-generated artifacts are loaded as trusted context by the agent execution environment
    Stated in Sec 3.2; the whole attack depends on this trust-and-reuse behavior. Appendix C.5 shows removing it breaks the attack.
  • domain assumption The adversary compromises the model before deployment via checkpoint, fine-tune, or API endpoint
    Threat model in Sec 3.1. The attack is only possible if the model is already under adversarial control.
  • domain assumption State transitions of memory and artifact updates depend primarily on immediately preceding context (Markov property)
    Appendix I.1 assumes U_M, U_A, and R are approximately Markovian to justify the exponential decay analysis.
  • domain assumption Retrieval success, context survival, and payload execution are conditionally independent given the current extended state
    Appendix I.2 uses independence to derive gamma_t <= p_ret p_ctx p_exe; the authors argue positive correlation still preserves the upper bound.
  • standard math Standard probability calculus
    Used in Eq (9) and (10) for the joint probability of survival events.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains." pith.science (2026). https://pith.science/paper/WDL66Y4U

@misc{pith2026260806862,
  author       = {Pith},
  title        = {Pith review of: SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WDL66Y4U}},
  note         = {Machine review of arXiv:2608.06862}
}
read the original abstract

Computer-use agents~(CUAs) have transformed large language models into persistent execution systems capable of generating, storing, and reusing artifacts like skills and memory entries. However, existing security defenses largely treat attacks as externally triggered or temporally bounded, leaving a critical gap in addressing how compromise can propagate internally through an agent's own persistent state. We reveal that malicious influence can be covertly embedded into the structural redundancies of autonomously synthesized artifacts, allowing it to survive internal state updates and bypass standard vetting mechanisms. To formalize this threat, we introduce SynChain, a self-synthesized attack paradigm utilizing persistence-aware directed supervised fine-tuning to induce agents to create poisoned yet benign-looking artifacts. To systematically evaluate this propagation, we construct CUAChain, a dataset comprising 30 benign task chains and three attack objectives. SynChain enables dormant payloads to seamlessly reactivate in future workflows as trusted context, operating entirely without new malicious exogenous inputs. Extensive experiments on OpenClaw, Codex, and Claude Code under four defense settings demonstrate that SynChain achieves high attack success and outperforms adapted baselines, proving that securing CUAs requires provenance-aware reasoning over cross-task execution trajectories.

Figures

Figures reproduced from arXiv: 2608.06862 by the authors.

Figure 1
Figure 1. Overview of SYNCHAIN. A compromised model causes the CUA to generate benign￾looking poisoned artifacts that enter the extended state as trusted reusable components. The attack can activate immediately in Chain-1 or propagate through persistent memory and artifacts across Chain-N before triggering a delayed harmful action. for completing the current task, and successful skills may be retained, reloaded, or shared acr… view at source ↗
Figure 2
Figure 2. Attack effectiveness across four defense settings and different model backbones (Llama [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Effect of chain length on attack success and benign task completion across CUA systems [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Efficiency impact of different defense configurations [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 6 canonical work pages

  1. [1]

    arXiv preprint arXiv:2511.15080 , year=

    Anthropic economic index report: Uneven geographic and enterprise ai adoption , author=. arXiv preprint arXiv:2511.15080 , year=

    arXiv

  2. [2]

    arXiv preprint arXiv:2107.03374 , year=

    Evaluating large language models trained on code , author=. arXiv preprint arXiv:2107.03374 , year=

    arXiv

  3. [3]

    arXiv preprint arXiv:2602.08234 , year=

    Skillrl: Evolving agents via recursive skill-augmented reinforcement learning , author=. arXiv preprint arXiv:2602.08234 , year=

    arXiv

  4. [4]

    arXiv preprint arXiv:2604.02268 , year=

    Skill0: In-context agentic reinforcement learning for skill internalization , author=. arXiv preprint arXiv:2604.02268 , year=

    arXiv

  5. [5]

    arXiv preprint arXiv:2604.01687 , year=

    EvoSkills: Self-Evolving Agent Skills via Co-Evolutionary Verification , author=. arXiv preprint arXiv:2604.01687 , year=

    arXiv

  6. [6]

    Nous Research , title =

    work page

  7. [7]

    OpenClaw Contributors , title =

    work page

  8. [8]

    Journal of Artificial Intelligence Research , volume=

    A comprehensive survey of agents for computer use: Foundations, challenges, and future directions , author=. Journal of Artificial Intelligence Research , volume=

Show all 44 references
  1. [9]

    arXiv preprint arXiv:2508.09123 , year=

    Opencua: Open foundations for computer-use agents , author=. arXiv preprint arXiv:2508.09123 , year=

  2. [10]

    arXiv preprint arXiv:2601.21123 , year=

    Cua-skill: Develop skills for computer using agent , author=. arXiv preprint arXiv:2601.21123 , year=

  3. [11]

    arXiv preprint arXiv:2602.12430 , year=

    Agent skills for large language models: Architecture, acquisition, security, and the path forward , author=. arXiv preprint arXiv:2602.12430 , year=

    arXiv

  4. [12]

    arXiv preprint arXiv:2602.12670 , year=

    SkillsBench: Benchmarking how well agent skills work across diverse tasks , author=. arXiv preprint arXiv:2602.12670 , year=

    arXiv

  5. [13]

    arXiv preprint arXiv:2603.02766 , year=

    Evoskill: Automated skill discovery for multi-agent systems , author=. arXiv preprint arXiv:2603.02766 , year=

    arXiv

  6. [14]

    arXiv preprint arXiv:2602.20867 , year=

    SoK: Agentic Skills--Beyond Tool Use in LLM Agents , author=. arXiv preprint arXiv:2602.20867 , year=

    arXiv

  7. [15]

    arXiv preprint arXiv:2602.14364 , year=

    A trajectory-based safety audit of clawdbot (openclaw) , author=. arXiv preprint arXiv:2602.14364 , year=

  8. [16]

    arXiv preprint arXiv:2602.14211 , year=

    Skillject: Automating stealthy skill-based prompt injection for coding agents with trace-driven closed-loop refinement , author=. arXiv preprint arXiv:2602.14211 , year=

    arXiv

  9. [17]

    arXiv preprint arXiv:2604.04989 , year=

    SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement , author=. arXiv preprint arXiv:2604.04989 , year=

    arXiv

  10. [18]

    arXiv preprint arXiv:2603.22447 , year=

    SkillClone: Multi-Modal Clone Detection and Clone Propagation Analysis in the Agent Skill Ecosystem , author=. arXiv preprint arXiv:2603.22447 , year=

  11. [19]

    arXiv preprint arXiv:2602.20156 , year=

    Skill-inject: Measuring agent vulnerability to skill file attacks , author=. arXiv preprint arXiv:2602.20156 , year=

    arXiv

  12. [20]

    arXiv preprint arXiv:2602.20720 , year=

    AdapTools: Adaptive tool-based indirect prompt injection attacks on agentic LLMs , author=. arXiv preprint arXiv:2602.20720 , year=

  13. [21]

    arXiv preprint arXiv:2602.08412 , year=

    From assistant to double agent: Formalizing and benchmarking attacks on openclaw for personalized local ai agent , author=. arXiv preprint arXiv:2602.08412 , year=

  14. [22]

    arXiv preprint arXiv:2510.08238 , year=

    Chain-of-Trigger: An Agentic Backdoor that Paradoxically Enhances Agentic Robustness , author=. arXiv preprint arXiv:2510.08238 , year=

  15. [23]

    arXiv preprint arXiv:2502.12575 , year=

    Demonagent: Dynamically encrypted multi-backdoor implantation attack on llm-based agent , author=. arXiv preprint arXiv:2502.12575 , year=

  16. [24]

    Advances in neural information processing systems , volume=

    Qlora: Efficient finetuning of quantized llms , author=. Advances in neural information processing systems , volume=

  17. [25]

    arXiv preprint arXiv:2601.04566 , year=

    Backdooragent: A unified framework for backdoor attacks on llm-based agents , author=. arXiv preprint arXiv:2601.04566 , year=

  18. [26]

    Advances in Neural Information Processing Systems , volume=

    Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases , author=. Advances in Neural Information Processing Systems , volume=

  19. [27]

    Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Badagent: Inserting and activating backdoor attacks in llm agents , author=. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  20. [28]

    arXiv preprint arXiv:2401.12242 , year=

    Badchain: Backdoor chain-of-thought prompting for large language models , author=. arXiv preprint arXiv:2401.12242 , year=

    arXiv

  21. [29]

    arXiv preprint arXiv:2510.05159 , year=

    Malice in agentland: Down the rabbit hole of backdoors in the ai supply chain , author=. arXiv preprint arXiv:2510.05159 , year=

    arXiv

  22. [30]

    arXiv preprint arXiv:2603.00195 , year=

    Formal analysis and supply chain security for agentic ai skills , author=. arXiv preprint arXiv:2603.00195 , year=

    arXiv

  23. [31]

    arXiv preprint arXiv:2508.14040 , year=

    Computerrl: Scaling end-to-end online reinforcement learning for computer use agents , author=. arXiv preprint arXiv:2508.14040 , year=

  24. [32]

    International Journal of Production Research , pages=

    Agentic LLMs in the supply chain: towards autonomous multi-agent consensus-seeking , author=. International Journal of Production Research , pages=. 2026 , publisher=

    2026

  25. [33]

    arXiv preprint arXiv:2602.19555 , year=

    Agentic AI as a Cybersecurity Attack Surface: Threats, Exploits, and Defenses in Runtime Supply Chains , author=. arXiv preprint arXiv:2602.19555 , year=

    arXiv

  26. [34]

    Advances in Information and Computer Security: 20th International Workshop on Security, IWSEC 2025, Fukuoka, Japan, November 25--27, 2025, Proceedings , pages=

    Supply Chain Threats in the MCP Ecosystem: Attack Vectors and Mitigation , author=. Advances in Information and Computer Security: 20th International Workshop on Security, IWSEC 2025, Fukuoka, Japan, November 25--27, 2025, Proceedings , pages=. 2025 , organization=

    2025

  27. [35]

    arXiv preprint arXiv:2506.15170 , year=

    From llms to mllms to agents: A survey of emerging paradigms in jailbreak attacks and defenses within llm ecosystem , author=. arXiv preprint arXiv:2506.15170 , year=

    arXiv

  28. [36]

    arXiv preprint arXiv:2602.20708 , year=

    ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction , author=. arXiv preprint arXiv:2602.20708 , year=

  29. [37]

    arXiv preprint arXiv:2511.13248 , year=

    DualTAP: A Dual-Task Adversarial Protector for Mobile MLLM Agents , author=. arXiv preprint arXiv:2511.13248 , year=

  30. [38]

    ICML 2025 workshop on computer use agents , year=

    Guardagent: safeguard LLM agents via knowledge-enabled reasoning , author=. ICML 2025 workshop on computer use agents , year=

    2025

  31. [39]

    arXiv preprint arXiv:2407.21783 , year=

    The llama 3 herd of models , author=. arXiv preprint arXiv:2407.21783 , year=

    arXiv

  32. [40]

    arXiv preprint arXiv:2601.08584 , year=

    Ministral 3 , author=. arXiv preprint arXiv:2601.08584 , year=

    arXiv

  33. [41]

    arXiv preprint arXiv:2604.10577 , year=

    The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agents , author=. arXiv preprint arXiv:2604.10577 , year=

    arXiv

  34. [42]

    arXiv preprint arXiv:2601.07779 , year=

    Os-symphony: A holistic framework for robust and generalist computer-using agent , author=. arXiv preprint arXiv:2601.07779 , year=

  35. [43]

    Sandwich Defense , year =

  36. [44]

    arXiv preprint arXiv:2604.02947 , year=

    AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents , author=. arXiv preprint arXiv:2604.02947 , year=

    arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.