{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:2X7STFOYITYYV74IKUSCHCINPV","short_pith_number":"pith:2X7STFOY","canonical_record":{"source":{"id":"2607.02857","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-03T01:41:17Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"234bd24fdf274ca03d156e31c9d42477572c8ac32e0e99d8e2295d9b4422037f","abstract_canon_sha256":"e63d5ac6a155d8c79ebd79d502494011e0d0b5a6cbc7a54a8527be1fe66ff0a5"},"schema_version":"1.0"},"canonical_sha256":"d5ff2995d844f18aff88552423890d7d40a482b380b15fddca271c655aecdd9f","source":{"kind":"arxiv","id":"2607.02857","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.02857","created_at":"2026-07-07T00:16:21Z"},{"alias_kind":"arxiv_version","alias_value":"2607.02857v1","created_at":"2026-07-07T00:16:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.02857","created_at":"2026-07-07T00:16:21Z"},{"alias_kind":"pith_short_12","alias_value":"2X7STFOYITYY","created_at":"2026-07-07T00:16:21Z"},{"alias_kind":"pith_short_16","alias_value":"2X7STFOYITYYV74I","created_at":"2026-07-07T00:16:21Z"},{"alias_kind":"pith_short_8","alias_value":"2X7STFOY","created_at":"2026-07-07T00:16:21Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:2X7STFOYITYYV74IKUSCHCINPV","target":"record","payload":{"canonical_record":{"source":{"id":"2607.02857","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-03T01:41:17Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"234bd24fdf274ca03d156e31c9d42477572c8ac32e0e99d8e2295d9b4422037f","abstract_canon_sha256":"e63d5ac6a155d8c79ebd79d502494011e0d0b5a6cbc7a54a8527be1fe66ff0a5"},"schema_version":"1.0"},"canonical_sha256":"d5ff2995d844f18aff88552423890d7d40a482b380b15fddca271c655aecdd9f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-07T00:16:21.168731Z","signature_b64":"tRCQ+dkNUFveYGuDpvHC4Ex4y7dQNIn3/PoyIHr1LhUhbJnh09k+Mv7HvxXYCOtUQNg+Ovy1bTo0jRK0GFUlDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d5ff2995d844f18aff88552423890d7d40a482b380b15fddca271c655aecdd9f","last_reissued_at":"2026-07-07T00:16:21.167936Z","signature_status":"signed_v1","first_computed_at":"2026-07-07T00:16:21.167936Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.02857","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-07T00:16:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Y3+ApP71Qjy95VBj7J5kiuMmajXO8afUsGqr8MWXD9oeAhibeGkaTKNrnDKlP/ng1AVXwpLEdzv451vEWJZUAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-22T00:25:09.336066Z"},"content_sha256":"e5e202f1e7019876e2704a966ad03e77c678231cd67191662de00f0e426b3652","schema_version":"1.0","event_id":"sha256:e5e202f1e7019876e2704a966ad03e77c678231cd67191662de00f0e426b3652"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:2X7STFOYITYYV74IKUSCHCINPV","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Huaijin Wang, Jiangrong Wu, Shuai Wang, Yihao Zhang, Yuhong Nan","submitted_at":"2026-07-03T01:41:17Z","abstract_excerpt":"LLM coding agents increasingly complete development tasks by issuing ordinary CLI commands. Following the Unix design, these commands cooperate through shared operating-system state: one command may write state that a later command reads. While this composition is benign and intended, it creates an overlooked exploit surface. Existing attacks and defenses mainly target the instruction layer, where malicious intent appears as hostile text. In contrast, we observe that individually benign commands can form a dangerous producer-consumer state relation across the command trace, exposing what we ca"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.02857","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.02857/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-07T00:16:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"i9tSmxDtYlglCL5jOxY5eUqPJTFaGSPEkVptEqBDhQ1fapzjPGSmEPCxfoGxw0s7C18xpcx1C+9PZ3fvKu7CAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-22T00:25:09.336448Z"},"content_sha256":"ef80ec2bdedb7206a55e7da16f3c8ebc494bed58c6f43f25d8188252c5e434ae","schema_version":"1.0","event_id":"sha256:ef80ec2bdedb7206a55e7da16f3c8ebc494bed58c6f43f25d8188252c5e434ae"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV/bundle.json","state_url":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/2X7STFOYITYYV74IKUSCHCINPV/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-22T00:25:09Z","links":{"resolver":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV","bundle":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV/bundle.json","state":"https://pith.science/pith/2X7STFOYITYYV74IKUSCHCINPV/state.json","well_known_bundle":"https://pith.science/.well-known/pith/2X7STFOYITYYV74IKUSCHCINPV/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:2X7STFOYITYYV74IKUSCHCINPV","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"e63d5ac6a155d8c79ebd79d502494011e0d0b5a6cbc7a54a8527be1fe66ff0a5","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-03T01:41:17Z","title_canon_sha256":"234bd24fdf274ca03d156e31c9d42477572c8ac32e0e99d8e2295d9b4422037f"},"schema_version":"1.0","source":{"id":"2607.02857","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.02857","created_at":"2026-07-07T00:16:21Z"},{"alias_kind":"arxiv_version","alias_value":"2607.02857v1","created_at":"2026-07-07T00:16:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.02857","created_at":"2026-07-07T00:16:21Z"},{"alias_kind":"pith_short_12","alias_value":"2X7STFOYITYY","created_at":"2026-07-07T00:16:21Z"},{"alias_kind":"pith_short_16","alias_value":"2X7STFOYITYYV74I","created_at":"2026-07-07T00:16:21Z"},{"alias_kind":"pith_short_8","alias_value":"2X7STFOY","created_at":"2026-07-07T00:16:21Z"}],"graph_snapshots":[{"event_id":"sha256:ef80ec2bdedb7206a55e7da16f3c8ebc494bed58c6f43f25d8188252c5e434ae","target":"graph","created_at":"2026-07-07T00:16:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.02857/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"LLM coding agents increasingly complete development tasks by issuing ordinary CLI commands. Following the Unix design, these commands cooperate through shared operating-system state: one command may write state that a later command reads. While this composition is benign and intended, it creates an overlooked exploit surface. Existing attacks and defenses mainly target the instruction layer, where malicious intent appears as hostile text. In contrast, we observe that individually benign commands can form a dangerous producer-consumer state relation across the command trace, exposing what we ca","authors_text":"Huaijin Wang, Jiangrong Wu, Shuai Wang, Yihao Zhang, Yuhong Nan","cross_cats":["cs.SE"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-03T01:41:17Z","title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.02857","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:e5e202f1e7019876e2704a966ad03e77c678231cd67191662de00f0e426b3652","target":"record","created_at":"2026-07-07T00:16:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"e63d5ac6a155d8c79ebd79d502494011e0d0b5a6cbc7a54a8527be1fe66ff0a5","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-03T01:41:17Z","title_canon_sha256":"234bd24fdf274ca03d156e31c9d42477572c8ac32e0e99d8e2295d9b4422037f"},"schema_version":"1.0","source":{"id":"2607.02857","kind":"arxiv","version":1}},"canonical_sha256":"d5ff2995d844f18aff88552423890d7d40a482b380b15fddca271c655aecdd9f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d5ff2995d844f18aff88552423890d7d40a482b380b15fddca271c655aecdd9f","first_computed_at":"2026-07-07T00:16:21.167936Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-07T00:16:21.167936Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"tRCQ+dkNUFveYGuDpvHC4Ex4y7dQNIn3/PoyIHr1LhUhbJnh09k+Mv7HvxXYCOtUQNg+Ovy1bTo0jRK0GFUlDw==","signature_status":"signed_v1","signed_at":"2026-07-07T00:16:21.168731Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.02857","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:e5e202f1e7019876e2704a966ad03e77c678231cd67191662de00f0e426b3652","sha256:ef80ec2bdedb7206a55e7da16f3c8ebc494bed58c6f43f25d8188252c5e434ae"],"state_sha256":"ed3e9212b64bc8bfb880cc7ff9709900a55d9b97c191e4fc261c31cd4da38ee9"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"paFZ7xkQG9Xe5WikFAAYRrJ1Mrpd5OH2Pepm5SxuA+/ZUT7EW5DJSKFBsQOWVPDLIh1v4UQoQbr4RSuOoSCKAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-22T00:25:09.338466Z","bundle_sha256":"55199af94df0ee42cd9e556b537e74d3236447254782e429dda429d348891656"}}