The aim is to specify the system under analysis and to fix a reproducible threat-modeling methodology on which the remaining parts build, combining a data-flow diagram annotated with trust boundaries, attack-surface.
Abstract
. Autonomous coding agents built on large language models increasingly execute mobile-development tasks directly inside corporate environments, where they access a virtual private network (VPN) with multi-factor authentication (MFA), Jira, GitLab, application-signing keys, Model Context Protocol (MCP) extensions, plugins, git hooks, and isolated git worktrees on macOS workstations. Although individual attack vectors against tool-integrated agents — indirect prompt injection, memory poisoning, supply-chain compromise, secret leakage, and insecure code generation — are well studied in isolation, no integrated model captures the full developer-side agent toolchain as a single system. This article, the first of a four-part series, establishes the methodological and system-model foundation. Its aim is to specify the system under analysis and to fix a reproducible threat-modeling methodology on which the remaining parts build. The methodology is convergent, combining a data-flow diagram (DFD) annotated with trust boundaries, attack-surface
It is shown that the more consequential risks lie one layer down, in the protocol between agents and commerce services, and a platform-agnostic defense that drives the structural attack-success rate to zero for four of the five structural classes.
This survey argues that four properties of that layer (irreversibility, signing authority, continuous autonomy, and sequence-level composition) qualitatively change the threat model, turning the recoverable failures of generic agent security into a standing, irreversible loss.
Rabimba Karanjai, Yang Lu, Nour Diallo et al.· 0 citations
A four-dimensional Integration Friction Index is introduced that separates one-time engineering cost from recurring organisational, legal, and maintenance cost and shows why scope and budget enforcement cannot be delegated to system prompts.
Israt Moyeen Noumi, Tarannum Ahmed Nowshin, Md. Mehedi Hasan Bhuiyan Nipu et al.· 0 citations
AI coding agents such as Claude Code, Cursor, GitHub Copilot, and OpenAI Codex are configured through artifacts developers write and share: instruction files, skills, hooks, MCP server declarations, subagents. This harness is a dependency layer installed from marketplaces and public repositories, running with the developer's privileges, with no lockfile, no install-time check, and no vocabulary for what a component may do. We study it over 3,171 public GitHub repositories: 2,660 setups that assemble two or more component types and 511 published skill collections. We measure only rules decidable from bytes whose consequence is a security exposure, a configuration that cannot work, or a departure from the Agent Skills specification, and validate every finding before it counts: an independent implementation re-derives it from the repository at its pinned commit, a language-model adjudicator with a released prompt rules on every disagreement, and a second independent model session re-checks every counted pair. Three security classes survive: 9.8% of setups install an MCP server with no version pinned, 3.1% pre-approve arbitrary execution behind a scoped-looking grant such as Bash(python:*), and 3.8% carry a skill that pre-approves the shell for whoever installs it. In total 16.0% of setups carry a security defect and 16.7% a confirmed defect of any kind, against a raw scanner rate of 25.5% on the same rules; the third class ships inside 3.7% of collections, where a marketplace scan can see it. Rules that compare two files detect differences that are usually intended and are reported as observations. No credential-exfiltration path was confirmed. The instrument, corpus manifest, prompt, and every verdict are released.
Benjamin Kapner, Carmel Soceanu, A. Petrunin et al.· 0 citations
The results show that TraceGrant provides a unified governance layer that connects trusted user intent, runtime evidence, concrete tool execution, and verified task completion.
Bohao Liao, Jing-Chao Wang, Qipeng Song et al.· 0 citations
Computer-use agents~(CUAs) have transformed large language models into persistent execution systems capable of generating, storing, and reusing artifacts like skills and memory entries. However, existing security defenses largely treat attacks as externally triggered or temporally bounded, leaving a critical gap in addressing how compromise can propagate internally through an agent's own persistent state. We reveal that malicious influence can be covertly embedded into the structural redundancies of autonomously synthesized artifacts, allowing it to survive internal state updates and bypass standard vetting mechanisms. To formalize this threat, we introduce SynChain, a self-synthesized attack paradigm utilizing persistence-aware directed supervised fine-tuning to induce agents to create poisoned yet benign-looking artifacts. To systematically evaluate this propagation, we construct CUAChain, a dataset comprising 30 benign task chains and three attack objectives. SynChain enables dormant payloads to seamlessly reactivate in future workflows as trusted context, operating entirely without new malicious exogenous inputs. Extensive experiments on OpenClaw, Codex, and Claude Code under four defense settings demonstrate that SynChain achieves high attack success and outperforms adapted baselines, proving that securing CUAs requires provenance-aware reasoning over cross-task execution trajectories.
Fuyao Zhang, Jiaming Zhang, Che Wang et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
