{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2026:2X7STFOYITYYV74IKUSCHCINPV","short_pith_number":"pith:2X7STFOY","schema_version":"1.0","canonical_sha256":"d5ff2995d844f18aff88552423890d7d40a482b380b15fddca271c655aecdd9f","source":{"kind":"arxiv","id":"2607.02857","version":1},"attestation_state":"computed","paper":{"title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Huaijin Wang, Jiangrong Wu, Shuai Wang, Yihao Zhang, Yuhong Nan","submitted_at":"2026-07-03T01:41:17Z","abstract_excerpt":"LLM coding agents increasingly complete development tasks by issuing ordinary CLI commands. Following the Unix design, these commands cooperate through shared operating-system state: one command may write state that a later command reads. While this composition is benign and intended, it creates an overlooked exploit surface. Existing attacks and defenses mainly target the instruction layer, where malicious intent appears as hostile text. In contrast, we observe that individually benign commands can form a dangerous producer-consumer state relation across the command trace, exposing what we ca"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2607.02857","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-03T01:41:17Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"234bd24fdf274ca03d156e31c9d42477572c8ac32e0e99d8e2295d9b4422037f","abstract_canon_sha256":"e63d5ac6a155d8c79ebd79d502494011e0d0b5a6cbc7a54a8527be1fe66ff0a5"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-07T00:16:21.168731Z","signature_b64":"tRCQ+dkNUFveYGuDpvHC4Ex4y7dQNIn3/PoyIHr1LhUhbJnh09k+Mv7HvxXYCOtUQNg+Ovy1bTo0jRK0GFUlDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d5ff2995d844f18aff88552423890d7d40a482b380b15fddca271c655aecdd9f","last_reissued_at":"2026-07-07T00:16:21.167936Z","signature_status":"signed_v1","first_computed_at":"2026-07-07T00:16:21.167936Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Huaijin Wang, Jiangrong Wu, Shuai Wang, Yihao Zhang, Yuhong Nan","submitted_at":"2026-07-03T01:41:17Z","abstract_excerpt":"LLM coding agents increasingly complete development tasks by issuing ordinary CLI commands. Following the Unix design, these commands cooperate through shared operating-system state: one command may write state that a later command reads. While this composition is benign and intended, it creates an overlooked exploit surface. Existing attacks and defenses mainly target the instruction layer, where malicious intent appears as hostile text. In contrast, we observe that individually benign commands can form a dangerous producer-consumer state relation across the command trace, exposing what we ca"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.02857","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.02857/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2607.02857","created_at":"2026-07-07T00:16:21.168036+00:00"},{"alias_kind":"arxiv_version","alias_value":"2607.02857v1","created_at":"2026-07-07T00:16:21.168036+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.02857","created_at":"2026-07-07T00:16:21.168036+00:00"},{"alias_kind":"pith_short_12","alias_value":"2X7STFOYITYY","created_at":"2026-07-07T00:16:21.168036+00:00"},{"alias_kind":"pith_short_16","alias_value":"2X7STFOYITYYV74I","created_at":"2026-07-07T00:16:21.168036+00:00"},{"alias_kind":"pith_short_8","alias_value":"2X7STFOY","created_at":"2026-07-07T00:16:21.168036+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV","json":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV.json","graph_json":"https://pith.science/api/pith-number/2X7STFOYITYYV74IKUSCHCINPV/graph.json","events_json":"https://pith.science/api/pith-number/2X7STFOYITYYV74IKUSCHCINPV/events.json","paper":"https://pith.science/paper/2X7STFOY"},"agent_actions":{"view_html":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV","download_json":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV.json","view_paper":"https://pith.science/paper/2X7STFOY","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2607.02857&json=true","fetch_graph":"https://pith.science/api/pith-number/2X7STFOYITYYV74IKUSCHCINPV/graph.json","fetch_events":"https://pith.science/api/pith-number/2X7STFOYITYYV74IKUSCHCINPV/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV/action/timestamp_anchor","attest_storage":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV/action/storage_attestation","attest_author":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV/action/author_attestation","sign_citation":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV/action/citation_signature","submit_replication":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV/action/replication_record"}},"created_at":"2026-07-07T00:16:21.168036+00:00","updated_at":"2026-07-07T00:16:21.168036+00:00"}