MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents
2026-07-03 • Cryptography and Security
Cryptography and SecuritySoftware Engineering
AI summaryⓘ
The authors explain that when AI coding helpers use command line instructions, they share information across steps in ways that can unintentionally create security risks, even if each command looks safe by itself. They call this problem CLI command-composition risk (CCR). To study this, the authors made a tool called MOSAIC that learns from known vulnerabilities and builds realistic attack paths to test AI coding assistants. They found MOSAIC could successfully exploit CCR in nearly all tries across several popular AI agents, showing that this hidden risk is important to understand and guard against.
LLM coding agentsCLI commandsUnix designproducer-consumer statecommand-composition riskMOSAIC frameworkCVEblack-box evaluationdeveloper workflowsattack surface
Authors
Jiangrong Wu, Huaijin Wang, Yihao Zhang, Yuhong Nan, Shuai Wang
Abstract
LLM coding agents increasingly complete development tasks by issuing ordinary CLI commands. Following the Unix design, these commands cooperate through shared operating-system state: one command may write state that a later command reads. While this composition is benign and intended, it creates an overlooked exploit surface. Existing attacks and defenses mainly target the instruction layer, where malicious intent appears as hostile text. In contrast, we observe that individually benign commands can form a dangerous producer-consumer state relation across the command trace, exposing what we call CLI command-composition risk (CCR). Given this new attack surface, it is critical to systematically uncover and characterize the impact of CCR in real-world coding agents. However, systematically understanding this risk is quite challenging, because naive command enumeration and end-to-end LLM generation produce mostly invalid workflows. We present MOSAIC, a knowledge-guided framework that distills validated command-state behaviors from CVEs, advisories, and researcher PoCs into reusable summaries, composes them into exploit paths, and instantiates them as realistic developer workflows for black-box agent evaluation. Across five real-world CLI coding agents and five backend LLMs over 2,525 trials, MOSAIC achieves a 96.59% attack success rate under benign developer tasks.