Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-22 · high
The attack runs through legitimate OS calls on the agent's own files, and a layered defense still left one gap open.
Why now: The paper is dated to the July 22 coverage of agent security research.
Researchers documented 43 operations that fully compromise a self-hosted AI agent through its own files, per a paper on arXiv. Every one runs through system calls the agent already uses on its own memory and config. No vulnerability required.
That's the stake for anyone running an agent that keeps its own state on disk. If something can write to the memory file, it can redirect the agent. The OS can't tell that write from the agent updating itself.
The paper organizes the surface into a 23-cell matrix across four dimensions: Target, Mechanism, Granularity, and Temporal. The authors validated it against live traces from a real self-hosted agent, not a simulation.
Yes, but a layered defense closed most of the matrix. Access control locked down the instruction and config layers. Workload-conditioned detection watched the memory layer. Periodic backups covered the rest. Most, not all. One part of the surface stayed indistinguishable from legitimate activity at the OS level, even under that defense.
The attack count isn't the real finding. The gap that survived a purpose-built defense is. Detection tuned to normal agent behavior won't catch an attacker doing exactly what the agent already does to itself.
Each link below shares sources, entities, or timing with this story.
Temporal partners with OpenAI / Shared entity: Most / Shared topic / Earlier coverage
Linked by a graph relationship (Temporal partners with OpenAI); both cover Most; overlapping topics (access, agent).
Shared entity: Self / Same source domain / Shared topic / Earlier coverage / Tension
Both cover Self; reported by the same outlet (arxiv.org); overlapping topics (agent, call).
Temporal partners with OpenAI / Same source domain / Shared topic
Linked by a graph relationship (Temporal partners with OpenAI); reported by the same outlet (arxiv.org); overlapping topics (agent, attack, memory).
Shared entities / Shared topic / Earlier coverage
Both cover Most, Temporal; overlapping topics (agent, config); earlier Most coverage from 2026-05-27.
Temporal partners with OpenAI / Shared topic / Tension
Linked by a graph relationship (Temporal partners with OpenAI); overlapping topics (against, agent, layer); pushes against this story (against).
Shared entity: Most / Shared topic / Earlier coverage / Tension
Both cover Most; overlapping topics (against, agent, attack); earlier Most coverage from 2026-07-10.
Temporal partners with OpenAI / Shared topic / Tension
Linked by a graph relationship (Temporal partners with OpenAI); overlapping topics (against, agent, layer); pushes against this story (against).
Linked by a graph relationship (Temporal partners with OpenAI); overlapping topics (against, agent, attack); pushes against this story (against).