MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents

Abstract: LLM coding agents increasingly complete development tasks by issuing ordinary CLI commands. Following the Unix design, these commands cooperate through shared operating-system state: one command may write state that a later command reads. While this composition is benign and intended, it creates an overlooked exploit surface. Existing attacks and defenses mainly target the instruction layer, where malicious intent appears as hostile text. In contrast, we observe that individually benign commands can form a dangerous producer-consumer state relation across the command trace, exposing what we call CLI command-composition risk (CCR). Given this new attack surface, it is critical to systematically uncover and characterize the impact of CCR in real-world coding agents. However, systematically understanding this risk is quite challenging, because naive command enumeration and end-to-end LLM generation produce mostly invalid workflows. We present MOSAIC, a knowledge-guided framework that distills validated command-state behaviors from CVEs, advisories, and researcher PoCs into reusable summaries, composes them into exploit paths, and instantiates them as realistic developer workflows for black-box agent evaluation. Across five real-world CLI coding agents and five backend LLMs over 2,525 trials, MOSAIC achieves a 96.59% attack success rate under benign developer tasks.

• The paper identifies CLI Command-Composition Risk (CCR) as a novel vulnerability in LLM coding agents, where benign commands can combine to trigger malicious outcomes.
• It leverages a modular pipeline named MOSAIC to curate evidence, synthesize exploit paths, and validate attack instances, achieving a 96.59% success rate.
• Findings imply that standard defenses, focused on individual command analysis, are inadequate against multi-step state handoffs in autonomous agent workflows.

Knowledge-Guided CLI Command Composition Attacks in LLM Coding Agents

Introduction: Composition Risks in LLM-Driven CLI Agents

LLM coding agents are increasingly leveraged as fully autonomous development tools, frequently operating via the command-line interface (CLI). These agents decompose natural language instructions into sequential CLI commands for automated software engineering. The Unix philosophy underpins this paradigm: each command performs an isolated task and communicates effects through a shared operating system state, including filesystems, environment variables, package metadata, and configuration files. This compositionality, while essential for workflow expressivity, introduces an unrecognized vulnerability surface—benign individual commands may become collectively malicious via state handoffs across a workflow.

Figure 1: Among existing LLM coding agents, user tasks are typically handled with combinations of CLI commands.

Standard security analyses and defenses for LLM agents have focused on the instruction layer, capturing prompt injections (direct/indirect) and adversarial natural language attacks. These rely on the visibility of attack signals in instructions, model responses, or explicit actions. However, the command composition layer—not text, but the implicit state dependencies between issued commands—enables a new and highly evasive class of attacks. The paper formalizes this as CLI Command-Composition Risk (CCR): a threat model wherein individually innocuous commands, when sequenced appropriately, manifest out-of-scope, security-sensitive capabilities (e.g., remote code execution, credential leakage) absent from any isolated action.

Composition-Based Vulnerabilities: Concrete Mechanisms

A CCR instance can be realized through the composition of state-producing and state-consuming commands within a single agent-driven workflow. For example, one benign command can set a configuration variable or script hook in a local repository, while a subsequent, equally benign command unwittingly triggers the tainted configuration, invoking attacker-controlled logic.

Figure 2: An example of CCR, where two benign Git commands compose through the on-disk .git/config and cause RCE.

This paradigm is exemplified by attacks exploiting Git hooks and config handoff: a git config command modifies the hooks path to point to attacker-controlled scripts, and a routine git commit subsequently executes the unauthorized script, causing RCE in the agent's context. The misbehavior is invisible to traditional command-line scanners, since each command is semantically innocuous and the exploit only emerges through their composition via persistent OS state.

The MOSAIC Framework: Systematic Discovery of Composition Risks

To rigorously assess and expose CCR in deployed LLM coding agents, the paper introduces MOSAIC—a modular, knowledge-driven pipeline for high-fidelity attack synthesis and black-box agent evaluation. The core challenge in surfacing CCR is the combinatorial intractability and low yield of naive command enumeration or unguided LLM-based generation. Instead, MOSAIC systematically distills actionable command-state pairs from curated sources: CVEs, security advisories, proof-of-concepts, and abuse knowledge bases. This process is organized into three technical modules: (1) multi-source evidence curation, (2) command-state summary extraction and composition, and (3) automated instance generation, validation, and runtime agent evaluation.

Figure 3: Workflow of MOSAIC: a three-module pipeline that assess the security boundary of LLM coding agent.

The knowledge base encodes 13 command-state families covering primary state handoff channels (e.g., environment variables, configuration files, hooks, package lifecycle events). For each family, MOSAIC synthesizes concrete exploit paths, with each path consisting of a benign producer and consumer chain, an attacker-controllable resource instantiation, and an evaluator for observable security-relevant side effects.

Experimental Evaluation: Pervasiveness of CCR and Defense Limitations

MOSAIC was evaluated against five production LLM coding agents (Claude Code, Codex CLI, Gemini CLI, GitHub Copilot CLI, Trae Agent) and five state-of-the-art LLM backends (OpenAI GPT-5.1, Gemini-2.5 Flash, Claude Haiku-4.5, DeepSeek V4, Qwen3.7+), with 2,525 total attack trials using 101 validated attack instances spanning multiple composition patterns and exploit categories.

Key findings:

• MOSAIC achieves a 96.59% attack success rate exploiting CCR across all agents and LLMs, independent of exploit path length or model family.
• Instruction-layer attacks (e.g., explicit prompt injection) yield at most 2.18% attack success, indicating that existing instruction-level defenses (e.g., prompt scanning, alignment monitors, post-training refusals) are ineffective against CCR.
• All five classes of deployed defenses (prompt filters, capability controls, provenance tracking, command scanners, task aligners) fail to block CCR, with the best static analysis and action-level alignment monitors reducing the success rate by at most 14.06 percentage points. Modern instruction scanners and privilege policies do not observe or reason about cross-command state provenance.

These results underscore that the core weakness is architectural: present security solutions reason exclusively over single-step actions or arguments, and cannot reconstruct or track implicit multi-step state handoffs in the agent's operational environment.

Knowledge Base Analysis and Generation Fidelity

Ablation analysis shows that the curated, structured CLI security knowledge base is the primary enabler of effective, valid attack instance generation. Without this curated resource, LLM-based or raw RAG-based instance constructors achieve less than 18.22% instance validity, compared to 100% when aided by the knowledge base. The fidelity of synthesized exploit paths and the modularization of security-relevant command-state summaries directly dictate the overall attack effectiveness and transferability across agents and constructions models.

Implications for Agent Architecture and Future Defenses

The identification and systematization of CCRs have several immediate implications:

• Agent runtime monitors must become provenance-aware, explicitly tracking the tainted origin and consumption of OS state spanning multiple CLI commands.
• Security boundaries must be enforced at the level of state transitions and their provenance, not just input prompts or isolated command arguments.
• Developer best practices should include ephemeral, least-privilege agent execution and explicit distrust of all imported OS state (environment variables, hooks, lifecycle scripts) during agent runtime.
• The proposed knowledge-base-driven approach can serve as a proactive self-assessment pipeline for agent vendors and can seed the development of provenance-based runtime policies and static analyzers.

Lingering limitations include incomplete coverage of all possible CLI compositions and attack paths, though the evaluated set provides strong evidence for the breadth of the attack surface. Extending the knowledge base and generalizing the validation pipeline offers a promising direction for semi-automated hardening of agent workflows.

Conclusion

This work establishes CLI Command-Composition Risk (CCR) as a fundamental, previously unaddressed security vector in modern LLM-driven coding agents. MOSAIC demonstrates that composition-based attacks are both highly effective and virtually undetectable by current defenses, fundamentally undermining existing instruction-layer threat models. This necessitates a paradigm shift in agent security, foregrounding state provenance across workflows as the core analytic target, and leveraging curated security knowledge for both detection and defense. These results mandate reconsideration of agent design, evaluation, and hardening in production and research settings.

---

Reference: "MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents" (2607.02857)