Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-30 · high
Each command passes its permission check alone, so allowlist rules built for one command at a time miss the chain.
Why now: The paper landed in July 30 coverage after testing five production coding agents instead of lab prototypes.
MOSAIC broke five coding agents and five backend LLMs in 2,525 trials, hitting a 96.59% attack success rate on benign developer tasks, per a paper posted to arXiv (2607.02857). That number matters for anyone letting one of these agents run shell commands without a human checking every line. The test bed was live coding tools already handling real work, not lab simulators.
MOSAIC's attacks start from those benign tasks, then let the agent's own tool calls assemble the dangerous state one approved command at a time.
Each command in the chain looks safe by itself. A per-command allowlist checks one line at a time. It never sees the sequence, because the risk sits in the state the commands leave behind, not in any single call.
Whether agent builders start checking accumulated session state instead of gating individual commands is worth watching. Patching individual commands in the allowlist won't touch a success rate built on chains that already look fine alone.
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source domain / Shared topic / Earlier coverage
Both cover LLMs, MOSAIC; reported by the same outlet (arxiv.org); overlapping topics (agent, attack).
Shared entities / Same source domain / Earlier coverage / Tension
Both cover CLI, LLMs; reported by the same outlet (arxiv.org); earlier CLI coverage from 2026-03-22.
Shared entity: LLMs / Same source domain / Shared topic / Earlier coverage / Tension
Both cover LLMs; reported by the same outlet (arxiv.org); overlapping topics (attack, benign).
Both cover LLMs; reported by the same outlet (arxiv.org); overlapping topics (agent, coding).
Shared entity: LLMs / Same source domain / Shared topic / Earlier coverage
Both cover LLMs; reported by the same outlet (arxiv.org); overlapping topics (agent, attack, success).
Shared entities / Shared topic / Earlier coverage
Both cover CLI, LLMs; overlapping topics (agent, command); earlier CLI coverage from 2026-07-22.
Shared entity: LLMs / Same source domain / Shared topic / Earlier coverage
Both cover LLMs; reported by the same outlet (arxiv.org); overlapping topics (agent, coding).
Both cover LLMs; reported by the same outlet (arxiv.org); overlapping topics (attack, benign).