When benign CLI commands compose into an exploit in coding agents
A July 2026 study names CLI command-composition risk: individually harmless commands a coding agent runs chain through shared OS state into out-of-scope capability — and five deployed defenses miss it.
What is this?
On July 3, 2026, researchers from Sun Yat-sen University and collaborators at Shandong University, Peking University, and HKUST posted an arXiv paper describing an overlooked risk surface in LLM coding agents. Modern coding agents — Claude Code, Codex CLI, Gemini CLI and similar tools — increasingly work by issuing ordinary command-line commands: they clone repositories, read files, install dependencies, run tests, edit configuration, and commit changes. Following the Unix philosophy, these commands cooperate through shared operating-system state, so one command can write state that a later command reads. The paper’s contribution is to name and measure what happens when that cooperation is abused: a sequence of individually benign commands can compose into a capability well outside the user’s task. The authors call this CLI command-composition risk (CCR), and they show that current agents are broadly susceptible to it.
How it works
Almost all prior work on coding-agent security studies the instruction layer: adversarial text placed in a file, web page, issue, or tool output that tries to steer the model into a harmful next action. Defenses live at the same layer — prompt filtering, structured prompting, isolation, or runtime checks that ask whether a proposed tool call matches the user’s intent. All of these share an implicit assumption: the attack signal is visible in a single input, response, or proposed action.
CCR breaks that assumption. The paper models an agent’s run as a stateful command trace — each command is a transition over local state that includes environment variables, workspace files, repository configuration, package lifecycle scripts, and hooks. The malicious signal never appears in any one command. Instead it lives in a producer–consumer relation across benign steps: one command legitimately writes a piece of state, a later command legitimately consumes it, and the combined effect reaches something sensitive. A local approval gate that inspects the current command string cannot see the hidden state a command produces or consumes, so the composed trace slips past it.
The paper’s illustrative case is the git hooks-path pattern, already documented publicly in coding-agent advisories: an attacker-controlled repository asks the agent, via its README, to run a one-line setup step that repoints git’s hooks directory into the repo; the agent’s later, routine commit then reads that configuration and runs the planted hook in the agent’s context, yielding code execution. Neither command is malicious on its own. To surface such cases at scale, the researchers built a knowledge-guided framework that distills validated command-state behaviors from public CVEs, maintainer advisories, and researcher proofs of concept into reusable summaries, composes them into plausible workflows, and tests agents black-box. This paper is a measurement of an existing risk class built from already-public knowledge, not a new exploit.
Why it matters
Across five real-world CLI coding agents and five backend models over 2,525 trials, the composition attacks reached a 96.59% end-to-end success rate under benign-looking developer tasks, while matched instruction-layer baselines topped out around 2.18%. The structured knowledge base mattered: it produced over 50% more effective cases than a standalone model generator. Because the CLI substrate reaches straight into the developer’s machine and production environment, the impact is not theoretical — the same class of composition can wipe data, exfiltrate source code and credentials, poison a downstream supply chain, plant persistent backdoors, or pivot into internal systems.
The sharper finding is defensive. The authors evaluated five representative deployed defenses and found that none of them observed the composition risk at all, because each reasons about a single command or action rather than the state relations across the trace. That is the structural gap: the relevant unit of risk is the whole command trace, but the controls in production still judge commands one at a time.
Defenses
The practical shift is to stop treating each command string as the unit of safety and start tracking state provenance across the trace. Instrument the agent so it records what state each command produces and consumes — environment variables, git and tool configuration, hooks, package lifecycle scripts — and raise friction when a later, security-relevant command consumes state that was written from untrusted content such as a cloned repo or fetched page. Gate the consumers, not just the producers: a commit, install, or test step that depends on configuration an earlier step wrote from untrusted input deserves review even when every individual command looks routine.
Cut the standing authority the composed capability depends on. Run coding agents in a sandbox without access to real credentials or production systems, and disable auto-firing execution surfaces by default — pin or ignore git hooks paths, skip package lifecycle scripts (for example with install-time script suppression), and isolate the config the agent can mutate. Add human approval at trace boundaries where produced state changes later execution semantics. Finally, red-team coding agents with multi-command compositional cases, not only instruction-layer injection, and align controls with the paper’s proposed direction: a provenance-aware defense that reasons over state relations across the command trace rather than inspecting actions in isolation.
Status
| Item | Detail |
|---|---|
| Contribution | Names and measures CLI command-composition risk (CCR) in coding agents |
| Method | Knowledge-guided framework distilling command-state behavior from public CVEs, advisories, PoCs |
| Evaluation | 5 CLI coding agents · 5 backend LLMs · 2,525 trials |
| Attack success | 96.59% end-to-end under benign tasks · instruction-layer baselines ≤2.18% |
| Deployed defenses | 5 representative defenses tested — none observe the composition risk |
| Proposed direction | Provenance-aware defense over the command trace |
| Real-world instance | git hooks-path composition RCE in a coding-agent IDE — CVE-2026-26268 |
Key date: paper posted to arXiv on July 3, 2026.