Step-Zero examines archives fed to coding agents and related harnesses. Tool-specific unpacking and preview steps can process a carrier before the model receives readable content. Among 42 harness-carrier pairs the researchers tested, 32 exceeded a 4 MiB processing boundary. A separately proposed bounded extractor stopped 28 of 28 tested malicious carriers,…
Inspect the ClaimsCase · DiggingBeagle record
Malicious archives can trigger work before the agent inspects any prompt
Step-Zero evaluates expansion and processing that occur in the harness before model input checks, exposing a distinct pre-model attack boundary.
Public disclosure: Nov 2, 2026
Scope
Researcher-designed carrier/harness tests; not proof of actual malware installation on all named harnesses.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The primary study uses paired hostile and benign archive fixtures across harnesses, measures actual materialized bytes and first model visibility, and separately tests replacement extractors. A name-based front-end failed in one aligned-carrier run, so coverage is not complete. The findings do not imply that each tested agent experienced a security breach beyond the defined resource budget.. Impact is ungraded because no independently measured production-target impact or victim scope is established by this record.
Assessed Nov 4, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-NOV04-STEPZERO-ARCHIVE-BOOTSTRAP-1 · CLM-NOV04-STEPZERO-ARCHIVE-BOOTSTRAP-2 · CLM-NOV04-STEPZERO-ARCHIVE-BOOTSTRAP-3 · Step-Zero: agent harness archive processing before the model sees content
At a glance
Pre-model work must have its own file-type, nesting, expanded-size, path and runtime limits. LLM-level monitoring is too late for side effects that have already occurred in the parser.
Read the implicationsThe tested archive carriers may not represent ordinary user distributions. Bounded extraction can reduce legitimate task coverage and needs explicit diagnostic reporting.
Limits and uncertaintyFull account
Step-Zero examines archives fed to coding agents and related harnesses. Tool-specific unpacking and preview steps can process a carrier before the model receives readable content. Among 42 harness-carrier pairs the researchers tested, 32 exceeded a 4 MiB processing boundary. A separately proposed bounded extractor stopped 28 of 28 tested malicious carriers, while creating some legitimate-archive compatibility failures. These counts apply to the selected fixtures and are not a census of exploitable production systems.
The central distinction is between a prompt-injection filter and execution-time input processing. The LLM can be perfectly instructed to ignore malicious text, yet the host could already have expanded an unsafe archive or exceeded its resource budget. This is closely related to tool-update execution risks, but archive preprocessing and dependency installation remain different entry points. Research.
Matched benign twin archives make the resource claim more precise: 32 of 42 hostile-carrier cells, but zero of 42 twins, crossed the 4 MiB written-byte budget; 26 hostile cells breached it before the first member reached model-visible text. The issue is not that a model obeyed a malicious sentence. The first extraction already mutated the workspace. A bounded, staging-based extractor performed better in author tests. In the main live-agent front-end comparison it prevented all 28 budget breaches, but an aligned-carrier configuration still produced one breach in 28 because an agent invoked the extractor by an absolute path and bypassed the front-end wrapper. Results and protocol tests.
A control that only instructs the model to choose the safe tool can be bypassed by another executable path. The guarantee belongs in a constrained tool implementation or workspace quota below the model, with cumulative budgets across calls. This is a separate input path from ETUDE tool-code updates, even though both occur before useful model inspection.
Mechanism and trust boundary
- 01
Supply a hostile archive to a legitimate task
The attacker controls a compressed artifact that the user or tool path asks the agent environment to inspect.
Boundary: Untrusted file bytes to local harness processing
- 02
Trigger preprocessing before prompt filtering
The harness parses or expands archive content before the model can evaluate any resulting text instructions.
Boundary: Input parser and archive expansion to filesystem/resource authority
- 03
Consume resources or create side effects
Selected fixtures exceed processing budgets; a bounded extractor addresses this class while potentially rejecting legitimate uncommon archives.
Boundary: Pre-model processing to host safety and availability
Claims & evidence
CLM-NOV04-STEPZERO-ARCHIVE-BOOTSTRAP-1The authors report 32 of 42 tested harness-carrier pairs crossed a 4 MiB processing budget.supported
Basis: reported finding
- supportsStep-Zero: agent harness archive processing before the model sees contentprimary disclosure
Archive-carrier coverage matrix and size limits
CLM-NOV04-STEPZERO-ARCHIVE-BOOTSTRAP-2The proposed bounded extractor rejected all 28 malicious carriers tested, with acknowledged compatibility costs.supported
Basis: reported finding
- supportsStep-Zero: agent harness archive processing before the model sees contentprimary disclosure
Bounded extractor tests and limitations
CLM-NOV04-STEPZERO-ARCHIVE-BOOTSTRAP-3The archive experiment found 32 of 42 malicious-carrier cells exceeding the 4 MiB budget versus zero of 42 benign twins, with 26 breaches preceding the first model-visible member; a separate aligned-carrier run bypassed a front-end gate in 1 of 28 cells.supported
Basis: reported finding
- supportsStep-Zero: agent harness archive processing before the model sees contentprimary disclosure
Section V-B and Section VII-C, archive and SZSP tests
Implications
Pre-model work must have its own file-type, nesting, expanded-size, path and runtime limits. LLM-level monitoring is too late for side effects that have already occurred in the parser.
Controls and mitigations
- Use a dedicated sandboxed archive parser with compressed/expanded byte budgets and path confinement.
- Enforce timeouts and fail closed on unbounded or unsupported archive types.
- Record what was processed or rejected before sending model-visible text.
- Put a staged, byte-counting extractor and cumulative workspace quotas beneath all invocation paths, including absolute commands and Python archive APIs; keep policy budgets outside agent-writable state.
Unknowns and contradictions
- The tested archive carriers may not represent ordinary user distributions.
- Bounded extraction can reduce legitimate task coverage and needs explicit diagnostic reporting.
Sources and citation
Material revision history
- Nov 4, 2026 · Published version · first publication · revision 217