Earn-then-Exploit: staged trust-building attacks against coding agents

Evidence record

Controlled malicious-website study where six apparently helpful stages precede an unauthorized request; authors report 120 successes among 168 tested agent trajectories.

Read the original source ↗

Claim-level citations (3)

• supportsUseful website answers can establish trust before a later agent hijack: In 56 controlled scenarios tested against each of three coding agents, Earn-then-Exploit achieved the attacker goal in 48 Codex, 38 ZCode and 34 QwenCode scenario-agent combinations (120 of 168). The metric allowed up to two attempts per scenario-agent combination and counted a hit if either attempt caused the verified server-side effect.

  Section 5.1 (scenario-level metric, up to two trials), Section 5.3 and Table 1 (85.7%, 67.9%, 60.7% across 56 scenarios)

• supportsUseful website answers can establish trust before a later agent hijack: The six-page attack template contains five locally verified helpful pages followed by a malicious terminal notice on page six; it does not contain six benign preliminary pages.

  Appendix A.3.2, Six-Page Help Template, Table 5

• supportsUseful website answers can establish trust before a later agent hijack: The author-tested action-authorization-separation defense reported 0% attack success and 100% task completion on both evaluated agents in the 56-scenario defense matrix.

  Section 6, Table 3, Action-authorization separation