Researchers Plant Delayed Attacks Inside AI Agent Artifacts

A poisoned computer-use agent can write its own future attack into a harmless-looking artifact and wait, per a paper called SynChain. The payload passes vetting when it's created, survives the agent's own internal updates, and reactivates in a later workflow with no new outside input required. That timing is the whole point: a single check at the moment an artifact is produced tells you nothing about what it does downstream.

The researchers used what they call persistence-aware directed fine-tuning to train the agent. It learns to hide malicious influence inside structural redundancy, patterns of duplication that still pass vetting.

They tested it against three agents used for real coding work: OpenClaw, Codex, and Claude Code.

The authors' own conclusion is the sharpest part of the paper: point-in-time artifact scanning can't catch this. They argue defense has to reason about provenance across an agent's full execution trajectory, not just inspect what it hands over at the end.