43 Attacks Can Fully Compromise a Self-Hosted AI Agent

Researchers documented 43 operations that fully compromise a self-hosted AI agent through its own files, per a paper on arXiv. Every one runs through system calls the agent already uses on its own memory and config. No vulnerability required.

That's the stake for anyone running an agent that keeps its own state on disk. If something can write to the memory file, it can redirect the agent. The OS can't tell that write from the agent updating itself.

The paper organizes the surface into a 23-cell matrix across four dimensions: Target, Mechanism, Granularity, and Temporal. The authors validated it against live traces from a real self-hosted agent, not a simulation.

Yes, but a layered defense closed most of the matrix. Access control locked down the instruction and config layers. Workload-conditioned detection watched the memory layer. Periodic backups covered the rest. Most, not all. One part of the surface stayed indistinguishable from legitimate activity at the OS level, even under that defense.

The attack count isn't the real finding. The gap that survived a purpose-built defense is. Detection tuned to normal agent behavior won't catch an attacker doing exactly what the agent already does to itself.