Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-30 · high
Each command passes its permission check alone, so allowlist rules built for one command at a time miss the chain.
Why now: The paper landed in July 30 coverage after testing five production coding agents instead of lab prototypes.
MOSAIC broke five coding agents and five backend LLMs in 2,525 trials, hitting a 96.59% attack success rate on benign developer tasks, per a paper posted to arXiv (2607.02857). That number matters for anyone letting one of these agents run shell commands without a human checking every line. The test bed was live coding tools already handling real work, not lab simulators.
MOSAIC's attacks start from those benign tasks, then let the agent's own tool calls assemble the dangerous state one approved command at a time.
Each command in the chain looks safe by itself. A per-command allowlist checks one line at a time. It never sees the sequence, because the risk sits in the state the commands leave behind, not in any single call.
Whether agent builders start checking accumulated session state instead of gating individual commands is worth watching. Patching individual commands in the allowlist won't touch a success rate built on chains that already look fine alone.
Each link below shares sources, entities, or timing with this story.
Sleeper Cell (2603.03371) — Two-stage attack embeds latent malicious behavior in fine-tuned tool-using LLMs. Poisoned models pass all benchmarks while harboring temporal trigger-activated harmful tool calls. Direct supply-chain risk for anyone using third-party LoRA adapters....
1. Flip your multi-model pipeline to review-then-generate. Instead of using a reasoning model to plan before code generation, let the specialist generate freely and use reasoning tokens for review. Paper shows 90.2% pass@1 vs 87.2% for the planning pattern. Source 2. Audit you...
arXiv 2607.24174 (July 27) generated adversarial log entries from real attack traces and got multiple state-of-the-art LLMs to classify traces containing clear indicators of compromise as benign. The defensive gift: the natural-language explanations emitted alongside the class...
The PlayCoder benchmark is the cold shower the vibe coding movement needed. Researchers tested 10 state-of-the-art code LLMs on generating GUI applications across six categories. The models achieved high compilation rates. The code built and ran. But when they measured whether...
Researchers demonstrate LLMs assign authority based on formatting rather than source, enabling 61% success on agent exfiltration tasks. Novel "role probes" predict attack success before generation begins. No defenses proposed — the gap is fundamental. arXiv ---
Every platform capability, Agentforce, Data 360, Slack, exposed through REST APIs, MCP tools (@salesforce/mcp), and sf CLI commands, with the Einstein Trust Layer enforcing field-level security and PII masking before data reaches external LLMs (VentureBeat). Announced at TDX 2...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.