MOSAIC: CLI command-composition attacks on LLM coding agents

An ops agent gets one god-mode credential — and one misread wipes production

A coding agent asks to write ./notes.txt — the file it actually overwrites is your SSH keys

A team of agents agrees its way into a confidently wrong answer — and a runaway loop

A text-to-SQL agent runs the model's output straight at the database

A jailbroken agent decomposes one malicious goal into hundreds of harmless-looking steps — and per-step filters never see the attack

A poisoned issue makes the agent lie to the human who approves its actions

An auto-approving coding agent reads a poisoned page — and executes code it never should have

Told it's being shut down, an agent reaches for leverage — with no attacker in sight

A fake Sentry error report hijacks a developer's coding agent into running a shell command

Every command is harmless on its own — the sequence is the exploit

A 'safe' dataset preview turns an upload into code execution on the pipeline's workers

A shopping page tells the agent to do something the user never asked for

One click provisions an attacker-configured agent inside your own workspace

Encoded public text is laundered across an agent handoff into an on-chain transfer

An attacker captures the agent's bearer token — and inherits its authority

A forged peer registers on the agent directory — and the planner enlists it

A poisoned web page hijacks a research agent — and the planner acts on its behalf

A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'