Staging malicious requests bypasses safety in 9 coding agents

Nine production coding agents from Anthropic, OpenAI, Google, Moonshot, Zhipu, and Minimax fell to compositional attacks at a 53–86% end-to-end success rate. Researchers staged malicious objectives across ordinary-looking engineering tickets, which near-zero per-prompt safety filters failed to catch. The finding, published May 5, introduces MOSAIC-Bench (Malicious Objectives Sequenced As Innocuous Compliance).

Jonathan Steinberg and Oren Gal describe a structured evaluation of compositional attacks against coding agents. MOSAIC-Bench contains 199 three-stage attack chains spanning 10 web-application substrates, 31 CWE vulnerability classes, and 5 programming languages. Each chain breaks a malicious end-goal into individually innocuous-looking tickets. The agent never sees an overtly harmful request, only routine engineering asks that combine into a deployable exploit.

The vulnerability exposes a structural gap in safety alignment: models evaluate each prompt in isolation. Sequential compliance with benign-looking instructions produces dangerous cumulative artifacts. In matched direct-prompt experiments against four frontier Claude and Codex agents, vulnerable-output rates dropped to 0–20.4%. Claude predominantly refused outright; Codex predominantly hardened output. But ticket staging silenced both defense modes. Only two total refusals occurred across all staged runs across the nine agents.

Downstream code review offers little additional protection. Code reviewer agents approved 25.8% of confirmed-vulnerable cumulative diffs as routine pull requests. The researchers tested whether context fragmentation explained the gap: full implementation context closed only 50% of the staged-versus-direct difference. The attack surface survives richer context windows.

For enterprise teams running multi-turn agent pipelines — Jira-to-code workflows, autonomous PR generation, or AI-assisted sprint execution — the threat model has shifted. An adversary who can inject malicious intent across multiple innocuous-looking tickets (through prompt injection, supply chain manipulation of issue trackers, or insider access) can route around both the agent's alignment and the downstream reviewer. The 53–86% attack success rate reflects production systems, not toy models.

The paper identifies a deployable mitigation: reframe the code reviewer as an adversarial pentester rather than a conventional approver. Under that framing, evasion rates for the evaluated reviewer subset ranged from 3.0% to 17.6%. An open-weight Gemma-4-E4B-it model operating as a pentester detected 88.4% of attacks with a 4.6% false-positive rate, validated against 608 real-world GitHub pull requests. Smaller, purpose-built reviewer agents may outperform general-purpose frontier models at this task.

Remaining questions include whether attack chains generalize to non-web substrates, how attack success rate changes with longer decomposition chains beyond three stages, and whether intent-tracking memory attached to agent sessions can disrupt the compositional pattern. The benchmark and exploit oracles are positioned as evaluation infrastructure for regression testing as agent platforms evolve.

For CTOs deploying autonomous coding agents: per-prompt safety review is not a sufficient control. The pentester-framed reviewer is low-cost to implement. The Gemma-4 result suggests it can run at scale cheaply. That is the short-term operational lever while the field works toward composition-aware alignment.