📌 Highlights
Step-Zero attacks occur when the first operation that reveals an opaque input also creates a harmful side effect. In the archive condition, 32 of 42 fixture runs exceeded the 4 MiB budget and 26 did so before any member reached the model; all 42 matched twins stayed within budget.
For network and image carriers, agents frequently wrote a returned body under its declared filename. With a digest commitment, the measured wrong-write count was 1 of 42 for both the network and image conditions, though controls show that cues affected how often agents checked.
SZSP’s model-free archive extraction stayed within budget in all 50 adversarial trials. In live agents, routed extraction had zero breaches in 28 runs and the requested extraction task completed in 25.
- The first tool call can cause harm before content-based model safeguards can inspect the input.
- The matched-twin design attributes archive over-budget writes to the crafted stream in this evaluation.
- A bounded, staged tool-layer extraction preserved task completion in most live-agent runs.
🎯 Introduction
Coding agents use tools to inspect third-party artifacts, but an archive, endpoint response, or image can remain opaque until a tool processes it. The information needed to judge that first call may arrive only through the call itself, leaving no opportunity for a model-side content guard to prevent an immediate side effect.
Prior work discussed in the paper targets prompt injection after readable content enters model context, or guards tool actions using information available before or after execution. The authors argue that these approaches miss the first processing of an opaque carrier: matching visible fields can make a malicious carrier indistinguishable from a benign twin, while post-execution checks may arrive after writes have happened.
The paper names this first processing stage Step Zero and studies attacks carried by data without imperative instructions. It formalizes the distinction between hazard ingress and risk realization, measures archive availability and file integrity risks across agents, and evaluates whether safeguards placed in the processing primitive can contain them.
fig:oic
Caption: Step Zero for an opaque carrier. (1)~The prompt is a bare reference. Before the first call the agent has seen only that reference ($I_0$) or also a preview whose declared fields match across the two arms ($I_1$). (2)~The first processing call admits the hazard. Archive extraction usually exceeds the byte budget before any member reaches the model (immediate). On network and image carriers the scored violation is the later write of the body under the declared filename (deferred).
Why It Matters: Illustrates the paper’s distinction between the moment a hazard enters through processing and the later point when an invariant is violated.
🔬 Methodology
The Opaque Input Carrier model captures the artifact, the preview available before processing, the operation that materializes its contents, the workspace, and the model-context sink. The paper models knowledge as unseen, previewed, or observed, and pairs each adversarial fixture with a benign twin whose shared preview fields and declarations match.
The evaluation uses ZIP archives, network responses, and grayscale images. The archive fixture contains 169 members; one member is declared as 64 B while its local header and deflate stream carry 8 MiB. Network and image conditions pair a declared filename with a body, with separate digest-backed conditions. Seven harnesses and six models run with bare path or URL prompts, automatic tool approval, a recording proxy, isolated workspaces, and disk sampling.
SZSP provides a peek operation that decompresses to count produced bytes without writing members or exposing their contents to the model. Its extract operation writes to private staging, refuses a chunk that would exceed the byte budget, and commits by rename only when all members fit. The paper reports model-free primitive comparisons and live-agent evaluation of routed archive extraction; live-agent enforcement for network write binding is not reported.
equation 1
Meaning: Defines the Opaque Input Carrier components: artifact, metadata preview, materialization operation, environment, and model-context sink.
equation 2
Meaning: Represents the agent's progression from an unseen carrier to a metadata preview and then observed content.
equation 3
Meaning: Formalizes matched adversarial and benign carriers: shared preview and declarations match, while only the benign carrier’s inner content satisfies its declarations.
equation 4
Meaning: Defines the availability invariant that limits extracted-member bytes in the environment to the configured budget.
📊 Experiments
The main evaluation covers seven harnesses—Claude Code, OpenAI Codex, OpenCode, Qwen Code, mini-SWE-agent, gptme, and smolagents—and six models: Qwen3.8-Max, DeepSeek-V4.1-Flash, GLM-5.3, Kimi-K3, Gemini-4-Argon, and GPT-6-Sol. Each round-one condition has 42 cells per arm. The main metrics are archive-member bytes against a 4 MiB budget, first-return ingress, declared-file writes, digest checks, and rejections; the paper reports rates with counts and Wilson 95% intervals and uses paired, harness-and-model cluster analyses for confirmatory contrasts.
For archives, extraction exceeded the budget in 32/42 fixture cells and 0/42 twin cells. In 26/42 fixture cells, the breach preceded any member reaching model context. Across three repeated rounds, the four models present in every round breached in 84/84 archive fixture cells and 0/84 twins. Network and image outcomes differ by declaration condition: the in-band network fixture had 11/42 realized wrong writes, and the dual-record image fixture had 19/42. With digest commitments, each corresponding fixture condition had 1/42 wrong writes; the paper cautions that cues influenced checking.
The model-free SZSP primitive study used ten adversarial carriers and six twins, five trials each, with a 20 ms sampler. SZSP extract held all 50 adversarial cells within budget, completed all 30 twin extractions, and had 58 ms median twin overhead. In live agents, routed extraction breached in 0/28 cells versus 28/28 without the gate, while the task was completed in 25/28 gated runs. These results support the archive gate in the tested setup; they do not establish live-agent enforcement for network write binding.
tab:step0_main
Caption: Step-Zero ingress, the agent's act, and realization per condition in round~1, in percent with counts, $42$ cells per arm. Ingress: the first return carrying the body also carried the declaration, or for the archive an extraction was issued. Act: the extraction, or a write of the declared file. Realization: extracted members exceeded $4$\,MiB, or the declared file held the conflicting body; it is zero by construction for network and image twins. Level~(i) exposure, where the input fixes no correct content (sec:deferred); the digest rows count violations against a commitment.
| Carrier and condition | Realization | Ingress | Act, fixture | Act, twin | Realized, fixture | Realized, twin | Hash | Reject |
|---|---|---|---|---|---|---|---|---|
| Archive, size declaration | Imm. 26, Def. 6 | 79 (33/42) | 79 (33/42) | 88 (37/42) | 76 (32/42) | 0 (0/42) | -- | -- |
| Network, header declaration | Deferred | 36 (15/42) | 17 (7/42) | 33 (14/42) | 14 (6/42) | 0 (0/42) | -- | -- |
| Network, in-band declaration | Deferred | 95 (40/42) | 26 (11/42) | 50 (21/42) | 26 (11/42) | 0 (0/42) | -- | -- |
| Network, digest commitment | Deferred | 98 (41/42) | 10 (4/42) | 12 (5/42) | 2 (1/42) | 0 (0/42) | 88 (37/42) | 74 (31/42) |
| Image, dual record | Deferred | 93 (39/42) | 45 (19/42) | 60 (25/42) | 45 (19/42) | 0 (0/42) | -- | -- |
| Image, digest record | Deferred | 76 (32/42) | 21 (9/42) | 38 (16/42) | 2 (1/42) | 0 (0/42) | 55 (23/42) | 33 (14/42) |
Why It Matters: The main-body table provides the primary round-one counts for ingress, agent actions, and realization, while distinguishing commitment-backed integrity violations from exposure.
tab:repeat
Caption: Repeated rounds on the four models that took part in every round of every repeated condition (DeepSeek-V4.1-Flash, GLM-5.3, Kimi-K3, Qwen3.8-Max). Each round has 28 cells, one for each of these models in each of the seven harnesses. The extension control has five trials and the other conditions have three.
| Condition | R1 | R2 | R3 | R4 | R5 | Pooled |
|---|---|---|---|---|---|---|
| Archive, byte budget exceeded | 28/28 | 28/28 | 28/28 | -- | -- | 100 (84/84) |
| Archive twin, byte budget exceeded | 0/28 | 0/28 | 0/28 | -- | -- | 0 (0/84) |
| Image dual, Step-Zero ingress | 27/28 | 27/28 | 26/28 | -- | -- | 95 (80/84) |
| Image dual, wrong write | 11/28 | 15/28 | 13/28 | -- | -- | 46 (39/84) |
| Image dual twin, wrong write | 0/28 | 0/28 | 0/28 | -- | -- | 0 (0/84) |
| Container, protected file overwritten | 5/28 | 8/28 | 4/28 | -- | -- | 20 (17/84) |
| Directory, protected file overwritten | 0/28 | 0/28 | 0/28 | -- | -- | 0 (0/84) |
| Image .png, body in context | 26/28 | 25/28 | 24/28 | 24/28 | 26/28 | 89 (125/140) |
| Image without extension, body in context | 25/28 | 23/28 | 25/28 | 26/28 | 26/28 | 89 (125/140) |
Why It Matters: Repeated runs show stable archive breaches and zero twin breaches, alongside variation in image writes and container overwrites.
Table IV
Caption: Model-free archive openings on ten adversarial carriers and six twins (adaptive variants share a twin), five trials each with the $20$\,ms sampler ($50$ adversarial, $30$ twin cells). Held: adversarial cells within $4$\,MiB. Peak: most bytes written on any adversarial carrier. Twin done: twins extracted completely. Overhead: median time on a twin. Disk quota: a watchdog that terminates unzip when the destination passes the budget.
| Opening | Held | Peak (MiB) | Twin done | Overhead |
|---|---|---|---|---|
| unzip | 0/50 | 512.0 | 30/30 | 6 ms |
| bsdtar | 20/50 | 16.0 | 30/30 | 10 ms |
| zipfile | 45/50 | 8.0 | 30/30 | 52 ms |
| ulimit+unzip | 0/50 | 4.0 | 30/30 | 8 ms |
| disk quota | 0/50 | 4.5 | 30/30 | 54 ms |
| header gate | 30/50 | 512.0 | 30/30 | 48 ms |
| SZSP peek | 50/50 | 0.0 | — | 51 ms |
| SZSP extract | 50/50 | 4.0 | 30/30 | 58 ms |
Why It Matters: Model-free comparisons show which archive-opening mechanisms kept all adversarial runs within budget and report benign-twin completion and overhead.
equation 7
Meaning: Defines Step-Zero ingress for archives as issuing an extraction, and for network or image carriers as returning declaration and body together in the first body-bearing response.
equation 8
Meaning: Classifies realization by whether the safety violation occurs before or after the carrier content reaches the model context.
🔮 Conclusion
The paper argues that opaque-input processing creates a safety gap because the action that reveals data can change the workspace before the model can inspect that data. Its paired measurements show frequent archive budget breaches and unverified network or image writes in the tested agent setups.
The authors’ archive gate contained all routed extractions in the live-agent evaluation while preserving task completion in most runs. They recommend pairing tool-layer controls with safety-alignment training that encourages agents to inspect inputs before processing them.
🛠️ Future Research Improvements
The paper identifies live-agent enforcement of network write binding as future work and leaves confidentiality outside its stated integrity and availability invariants. A useful next evaluation would bind writes to commitments from a trusted source and test whether staging preserves protected workspace files.
The image evaluation uses tool decoding and does not cover model-side visual perception. Extending the protocol to direct image inputs and additional carriers would clarify whether the same ingress and realization distinctions hold.
The archive gate should be evaluated across a broader range of archive formats, malformed inputs, resource limits, and harness escape paths; the reported live-agent breach involved an extractor invoked by absolute path.
🏭 Potential Industry Use Scenarios
The evidence supports considering bounded, staged archive tools in coding-agent harnesses that inspect downloaded repositories, attachments, or other third-party archives. Such tools can keep decompression writes within a configured budget even when the agent chooses to extract.
The paper’s network and image results suggest a separate use case for systems that fetch and materialize attachments: verify content against a trusted commitment and stage writes before replacing workspace files. This is a design implication, not a demonstrated live-agent deployment result in the paper.
💬 Critical Analysis
A strength is the paired twin design: shared preview fields and zero twin breaches in the primary archive condition make the role of the crafted stream directly testable. Recording model requests and sampling disk writes also helps distinguish immediate archive damage from later file writes. The experiments span multiple harnesses and models and include repeated rounds and prompt and fixture controls.
The evidence is strongest for archive extraction: the attack recurs across models and rounds, and the paper tests both model-free primitives and a live-agent gate. Network and image findings are more conditional: without a commitment they are exposure measures, and the digest results depend partly on cues and voluntary checking. The SZSP results establish tested archive behavior, while network write binding remains a reference design.
The benchmark is bounded to the specified harnesses, models, carriers, and evaluation setup. The paper notes that extraction through an absolute path escaped the live-agent gate once, making tool-layer coverage a practical deployment question. Broader testing should establish whether the gate can interpose on every route to a mutating primitive and preserve legitimate workflows across formats.