An attacker-controlled help site offers five pages of answers that the coding agent can locally verify. Only on the sixth page does it ask the agent to perform a task-irrelevant action. In the Earn-then-Exploit experiment, this sequence was effective even though the legitimate user task could be completed without the terminal request. The evidence is a…
Inspect the ClaimsCase · DiggingBeagle record
Useful website answers can establish trust before a later agent hijack
Earn-then-Exploit manipulates trust over a multi-step browsing history; 120 of 168 controlled runs followed the attacker goal.
Website instructions promoted into agent authorityIndirect prompt injectionLive authorization at the point of agent side effectEffect-bound approval
Public disclosure: Nov 1, 2026
Scope
Controlled coding-agent/website benchmark, not a real criminal intrusion; outcome rates are conditional on the prepared tasks.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The paper tests 56 constructed scenarios on each of three coding agents and compares attack baselines. The later defense is tested on two agents; it depends on the configured action-authorization checks rather than proving backend enforcement in all deployments.. Impact is ungraded because no independently measured production-target impact or victim scope is established by this record.
Assessed Nov 4, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-NOV04-EARN-THEN-EXPLOIT-1 · CLM-NOV04-EARN-THEN-EXPLOIT-2 · CLM-NOV04-EARN-THEN-EXPLOIT-3 · Earn-then-Exploit: staged trust-building attacks against coding agents
At a glance
Prior helpfulness is a credibility signal about information quality, not authority to execute commands or change security policy. Tool calls must be checked against the current user instruction regardless of source history.
Read the implicationsThe study does not establish general attack rates on arbitrary websites and users. The effects of independently configured allowlists or confirmations vary by agent architecture.
Limits and uncertaintyFull account
An attacker-controlled help site offers five pages of answers that the coding agent can locally verify. Only on the sixth page does it ask the agent to perform a task-irrelevant action. In the Earn-then-Exploit experiment, this sequence was effective even though the legitimate user task could be completed without the terminal request. The evidence is a controlled local web ecosystem, not an observed fraud campaign. Original study.
The experiment covered 56 scenarios for each of three coding agents. Codex hit the attacker's server-side goal in 48 scenarios, ZCode in 38 and QwenCode in 34: 120 of 168 agent-by-scenario combinations. These are not 168 independent trajectories. Each combination could be attempted twice and was counted successful if either attempt produced the designated effect. That distinction matters when comparing this study with benchmarks that count every execution independently. The paper's judge checked the actual server-side change rather than accepting the agent's report of what it had done.
Previous accuracy did not confer permission. A useful website may help identify a dependency or explain an API, but the sixth page still cannot expand the set of commands the user authorized. The underlying failure is promotion of previously helpful source content into authority for a later effect, distinct from single-response MCP tool poisoning.
The authors' action-authorization-separation evaluation checked the instruction source, whether the requested action was necessary, and whether the task permission table allowed it. In the 56-scenario defense comparison on two agents, the reported attack success was zero and legitimate completion was 100% for both. This is a specific experimental result for a prompt-mediated defense. It does not show that every real host has a separately enforced permission gate. A stronger deployment test rejects the same unauthorized operation at the executor even when the agent accepts the website's rationale. Defense experiment.
Mechanism and trust boundary
- 01
Answer legitimate questions helpfully
The adversarial site supplies useful information for several turns so the assistant repeatedly succeeds in its assigned work.
Boundary: External information source to agent trust assessment
- 02
Present a late-stage unauthorized instruction
After six helpful stages, the page embeds an action request that lies outside the original user permission envelope.
Boundary: Previously useful site content to purported operational authority
- 03
Attempt the side effect through agent tools
The evaluation records when the agent follows the malicious request; the actual effect depends on the tool executor and environment.
Boundary: Model compliance to host authorization
Claims & evidence
CLM-NOV04-EARN-THEN-EXPLOIT-1In 56 controlled scenarios tested against each of three coding agents, Earn-then-Exploit achieved the attacker goal in 48 Codex, 38 ZCode and 34 QwenCode scenario-agent combinations (120 of 168). The metric allowed up to two attempts per scenario-agent combination and counted a hit if either attempt caused the verified server-side effect.supported
Basis: reported finding
- supportsEarn-then-Exploit: staged trust-building attacks against coding agentsprimary disclosure
Section 5.1 (scenario-level metric, up to two trials), Section 5.3 and Table 1 (85.7%, 67.9%, 60.7% across 56 scenarios)
CLM-NOV04-EARN-THEN-EXPLOIT-2The six-page attack template contains five locally verified helpful pages followed by a malicious terminal notice on page six; it does not contain six benign preliminary pages.supported
Basis: reported finding
- supportsEarn-then-Exploit: staged trust-building attacks against coding agentsprimary disclosure
Appendix A.3.2, Six-Page Help Template, Table 5
CLM-NOV04-EARN-THEN-EXPLOIT-3The author-tested action-authorization-separation defense reported 0% attack success and 100% task completion on both evaluated agents in the 56-scenario defense matrix.supported
Basis: reported finding
- supportsEarn-then-Exploit: staged trust-building attacks against coding agentsprimary disclosure
Section 6, Table 3, Action-authorization separation
Implications
Prior helpfulness is a credibility signal about information quality, not authority to execute commands or change security policy. Tool calls must be checked against the current user instruction regardless of source history.
Controls and mitigations
- Track provenance and taint for web content across long sessions.
- Enforce non-delegable, task-scoped tool authorization for sensitive actions.
- Test delayed injections that follow multiple benign interactions.
- For every sensitive tool effect, verify the request origin, lack of a safe substitute, and operation-level permission independently of the website that supplied the suggestion.
Unknowns and contradictions
- The study does not establish general attack rates on arbitrary websites and users.
- The effects of independently configured allowlists or confirmations vary by agent architecture.
Sources and citation
Material revision history
- Nov 4, 2026 · Published version · first publication · revision 218