MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents

• URL: http://arxiv.org/abs/2607.02857v1
• Date: Fri, 03 Jul 2026 01:41:17 GMT
• Title: MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents
• Abstract summary: MOSAIC is a knowledge-guided framework that distills validated command-state behaviors from CVEs, advisories, and researcher PoCs into reusable summaries.<n>We show that MOSAIC achieves a 96.59% attack success rate under benign developer tasks.
• Score: 12.605238431656927
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: LLM coding agents increasingly complete development tasks by issuing ordinary CLI commands. Following the Unix design, these commands cooperate through shared operating-system state: one command may write state that a later command reads. While this composition is benign and intended, it creates an overlooked exploit surface. Existing attacks and defenses mainly target the instruction layer, where malicious intent appears as hostile text. In contrast, we observe that individually benign commands can form a dangerous producer-consumer state relation across the command trace, exposing what we call CLI command-composition risk (CCR). Given this new attack surface, it is critical to systematically uncover and characterize the impact of CCR in real-world coding agents. However, systematically understanding this risk is quite challenging, because naive command enumeration and end-to-end LLM generation produce mostly invalid workflows. We present MOSAIC, a knowledge-guided framework that distills validated command-state behaviors from CVEs, advisories, and researcher PoCs into reusable summaries, composes them into exploit paths, and instantiates them as realistic developer workflows for black-box agent evaluation. Across five real-world CLI coding agents and five backend LLMs over 2,525 trials, MOSAIC achieves a 96.59% attack success rate under benign developer tasks.

Related papers

• SIR: Self-improving Red-teaming for Compute Use Agents [71.71987044117371]
  Computer use agents (CUAs) are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal.<n>Because they can be exposed to untrusted content while operating, they are vulnerable to indirect prompt injection (IPI)<n>We present SIR, a black box IPI attack that composes stealthy injections from a small library of reusable principles stated in plain language.
  arXiv  Detail & Related papers  (2026-08-31T03:39:43Z)
• The Language of Security: How Prompt Syntax Shapes Secure Code Generation in Open LLMs [12.213106649470973]
  Large Language Models (LLMs) are increasingly used for source code generation despite their outputs often exhibiting security vulnerabilities.<n>We show that specific syntactic elements, such as constraints, guards, and concept bindings, and their position within the prompt consistently affect the likelihood of generating insecure code.<n>These findings identify prompt syntax as a concrete security control surface and provide actionable guidance for reducing vulnerability risk in LLM-assisted development.
  arXiv  Detail & Related papers  (2026-07-17T13:20:21Z)
• One Goal, Many Commands: Characterizing Denylist Fragility in AI Agents [8.5338788749266]
  Terminal AI agents rely heavily on shell command execution to interact with the host systems.<n>A built-in denylist of Claude Code, well-maintained by its developers, can overlook bypass commands that invalidate its effectiveness.<n>This paper presents the first systematic characterization of command denylist fragility in terminal AI agents.
  arXiv  Detail & Related papers  (2026-06-14T02:30:09Z)
• Learning CLI Agents with Structured Action Credit under Selective Observation [10.420078730796321]
  Command line interface (CLI) agents are emerging as a practical paradigm for agent-computer interaction over evolvings, executable command line programs, and online execution feedback.<n>Recent work has used reinforcement learning (RL) to learn these interaction abilities from verifiable task feedback, yet few methods exploit the native structured attributes of CLI actions as learning signals.<n>We study these bottlenecks through shell-driven information extraction and file editing tasks.
  arXiv  Detail & Related papers  (2026-05-08T17:02:31Z)
• You Told Me to Do It: Measuring Instructional Text-induced Private Data Leakage in LLM Agents [9.719776777345364]
  High-privilege LLM agents that autonomously process external documentation are increasingly trusted to automate tasks.<n>These agents are granted terminal access, control, and outbound network connectivity with minimal security oversight.<n>We measure a fundamental vulnerability in this trust model, which we term the emphTrusted Executor Dilemma<n>This vulnerability is a structural consequence of the instruction-following design paradigm, not an implementation bug.
  arXiv  Detail & Related papers  (2026-03-12T12:35:46Z)
• Context-Guided Decompilation: A Step Towards Re-executability [50.71992919223209]
  Binary decompilation plays an important role in software security analysis, reverse engineering and malware understanding.<n>Recent advances in large language models (LLMs) have enabled neural decompilation, but the generated code is typically only semantically plausible.<n>We propose ICL4Decomp, a hybrid decompilation framework that leverages in-context learning (ICL) to guide LLMs toward generating re-executable source code.
  arXiv  Detail & Related papers  (2025-11-03T17:21:39Z)
• Code Agent can be an End-to-end System Hacker: Benchmarking Real-world Threats of Computer-use Agent [64.08182031659047]
  We propose AdvCUA, the first benchmark aligned with real-world TTPs in MITRE ATT&CK Enterprise Matrix.<n>We evaluate the existing five mainstream CUAs, including ReAct, AutoGPT, Gemini CLI, and Cursor CLI.<n>Results demonstrate that current frontier CUAs do not adequately cover OS security-centric threats.
  arXiv  Detail & Related papers  (2025-10-08T03:35:23Z)
• Autonomous Penetration Testing: Solving Capture-the-Flag Challenges with LLMs [0.0]
  This study evaluates the ability of GPT-4o to autonomously solve beginner-level offensive security tasks by connecting the model to OverTheWire's Bandit capture-the-flag game.<n>Of the 25 levels that were technically compatible with a single-command SSH framework, GPT-4o solved 18 unaided and another two after minimal prompt hints for an overall 80% success rate.
  arXiv  Detail & Related papers  (2025-08-01T20:11:58Z)
• AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents [54.29555239363013]
  We propose a generic black-box fuzzing framework, AgentVigil, to automatically discover and exploit indirect prompt injection vulnerabilities.<n>We evaluate AgentVigil on two public benchmarks, AgentDojo and VWA-adv, where it achieves 71% and 70% success rates against agents based on o3-mini and GPT-4o.<n>We apply our attacks in real-world environments, successfully misleading agents to navigate to arbitrary URLs, including malicious sites.
  arXiv  Detail & Related papers  (2025-05-09T07:40:17Z)
• Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction [68.6543680065379]
  Large language models (LLMs) are vulnerable to prompt injection attacks.<n>We propose a novel defense method that leverages, rather than suppresses, the instruction-following abilities of LLMs.
  arXiv  Detail & Related papers  (2025-04-29T07:13:53Z)
• Compromising Embodied Agents with Contextual Backdoor Attacks [69.71630408822767]
  Large language models (LLMs) have transformed the development of embodied intelligence. This paper uncovers a significant backdoor security threat within this process. By poisoning just a few contextual demonstrations, attackers can covertly compromise the contextual environment of a black-box LLM.
  arXiv  Detail & Related papers  (2024-08-06T01:20:12Z)
• Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection [64.67495502772866]
  Large Language Models (LLMs) are increasingly being integrated into various applications. We show how attackers can override original instructions and employed controls using Prompt Injection attacks. We derive a comprehensive taxonomy from a computer security perspective to systematically investigate impacts and vulnerabilities.
  arXiv  Detail & Related papers  (2023-02-23T17:14:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.