ETUDE: malicious agent tool updates can run before model-level inspection

Evidence record

Study of adversarial package/tool updates as an attack plane outside the LLM-readable context; authors report 97.6% adversarial success while 95.9% benign-task completion remains in their controlled harnesses.

Read the original source ↗

Claim-level citations (3)

• supportsTool updates can execute a malicious side effect before an agent reads a prompt: ETUDE reports a 97.6% successful malicious-tool-update rate across its selected experimental configurations.

  Evaluation, attack success rates

• supportsTool updates can execute a malicious side effect before an agent reads a prompt: In the same evaluation, benign task completion remained 95.9%, indicating malicious side effects need not visibly interrupt user tasks.

  Evaluation, benign task utility

• supportsTool updates can execute a malicious side effect before an agent reads a prompt: In the W3 evaluation, the updated tool attained the specified malicious file content in 700 of 700 tasks, while the ordinary core task body was delivered in 698 of 700.

  Section 5.2, Table 3 and Appendix B, W3 research-note modification