Step-Zero: agent harness archive processing before the model sees content

Evidence record

Research comparing archive carriers against 42 harness/path pairs; 32 exceeded a 4 MiB boundary before model-level filtering, and bounded extractor policy rejected 28/28 tested malicious carriers at a compatibility cost.

Read the original source ↗

Claim-level citations (3)

• supportsMalicious archives can trigger work before the agent inspects any prompt: The authors report 32 of 42 tested harness-carrier pairs crossed a 4 MiB processing budget.

  Archive-carrier coverage matrix and size limits

• supportsMalicious archives can trigger work before the agent inspects any prompt: The proposed bounded extractor rejected all 28 malicious carriers tested, with acknowledged compatibility costs.

  Bounded extractor tests and limitations

• supportsMalicious archives can trigger work before the agent inspects any prompt: The archive experiment found 32 of 42 malicious-carrier cells exceeding the 4 MiB budget versus zero of 42 benign twins, with 26 breaches preceding the first model-visible member; a separate aligned-carrier run bypassed a front-end gate in 1 of 28 cells.

  Section V-B and Section VII-C, archive and SZSP tests