Metraipolis › archive › dc_6aedfa6a86bc

Step-Zero Attack: Agent Safety Before Observability — arXiv:2611.01953

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.01953
License (as archived): CC0-1.0
Archived: 2026-11-03T18:18:17.857Z
SHA-256 of the archived text: dcaff95af52c5a54c3653dd339f5765df586510fee40a5ea83b356cbc9c3c95b
Stable URL of this page: https://metraipolis.com/documento/dc_6aedfa6a86bc

How to cite

Step-Zero Attack: Agent Safety Before Observability — arXiv:2611.01953 — arXiv (en), https://arxiv.org/abs/2611.01953 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_6aedfa6a86bc (Metraipolis archive dc_6aedfa6a86bc, sha256 dcaff95af52c5a54c3653dd339f5765df586510fee40a5ea83b356cbc9c3c95b)

BibTeX

@misc{dc6aedfa6a86bc,
  title = {Step-Zero Attack: Agent Safety Before Observability — arXiv:2611.01953},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.01953},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_6aedfa6a86bc; sha256 dcaff95af52c5a54c3653dd339f5765df586510fee40a5ea83b356cbc9c3c95b},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.01953. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Existing attacks and defenses for coding agents act once content enters the model context: injected text persuades the model, and guards inspect what the model reads. Yet to judge whether processing an unknown archive, network response, or image is safe, an agent often must process it first, and that step can do harm before any content reaches the model. We call this first processing Step Zero, and harm done by it a Step-Zero attack. Across seven harnesses and six models, each agent received only a path or URL to a crafted input, paired with a benign twin showing the same visible fields. Step Zero is where most agents are already unsafe: 32/42 harness-model pairs overran a 4 MiB disk budget, 26/42 before the model saw any member, and four of the six models did so in every round (84/84), so the damage precedes any model-side defense. Every twin stayed within budget, so the attacker's bytes alone cause the harm. On network and image inputs the risk moves to what the agent writes: agents stored the body under the name the input declared, letting the input decide what is written, and their checks faded once cues were removed. Model-free tests trace the harm to the processing primitive, so we defend it there: a gate that counts the bytes each call produces held every routed extraction within budget while agents completed 25/28 tasks. Vendors should pair such gates with safety-alignment training that teaches agents to inspect an input before processing it.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.AI, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Software Engineering (cs.SE).
Pagina del lavoro: https://arxiv.org/abs/2611.01953 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-03T18:09:53.640Z dalla pagina https://arxiv.org/list/cs.AI/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).