The Damage Happens Before the Model Looks: Step-Zero Attacks on Agent Safety
Submitted 1 November 2026 to arXiv (2611.01953) by researchers at Tsinghua University, the University of Sydney and Harbin Institute of Technology, Step-Zero Attack: Agent Safety Before Observability names the moment every model-side defense arrives too late for: the first processing call on an opaque input — an archive, a network response, an image — whose contents stay sealed until a tool unpacks, fetches or decodes them. The information needed to judge whether that call is safe arrives only through that call, and the call itself can write to the user’s machine before any content reaches the model. Across seven harnesses and six models, agents given nothing but a path or URL blew a 4 MiB disk budget in 32 of 42 cells (76.2 percent) — 26 of 42 before the model had seen a single archive member — while every benign twin stayed inside it. Four of the six models breached in every round (84 of 84). No prompt injection was involved: the carrier holds only data, and the call the agent chose is what admits the hazard.
Immediate on archives, deferred on network and images
The paper separates two realizations of the same hazard. For archives they coincide: extraction writes while it reads, so the budget violation is immediate, often complete before the first member enters the model context. The controls agents might have used were simply absent — in the breaching cells, 0 of 33 set a resource limit, and 17 breaches followed a directory listing the agent had already read. For network and image carriers the violation is deferred: agents saved the delivered body under the filename the input declared, letting the input decide what gets written into the workspace, and every such write followed the body into the model context — seeing the content did not stop the write. The uncomfortable controls result: a truthfully declared archive breached as often (28 of 28), and asking agents to extract an archive and run its tests still breached in 28 of 28 cells, while a digest-disagreeing attachment was saved in 27 of 28. Default agents extract whatever arrives; only defenses that read declared fields care whether the declaration was honest. This is the prequel to our ETUDE tool-update-gap coverage from two days ago — ETUDE showed trust granted at install decays when implementations change; Step-Zero shows the very first touch was never safe to begin with.
The defense lives in the primitive, and it mostly works
The authors’ response, the Step-Zero Safe Protocol (SZSP), concedes the model cannot be the control plane here and pushes the check into the tool: a read-only opening, a byte-counting bounded extraction, and a staged commit integrated into the opening call the agent uses. Routed through SZSP in live agents, extraction exceeded the budget in 0 of 28 cells against 28 of 28 ungated, while agents still completed the extraction task in 25 of 28 — the harm removed, utility kept. The one breach is instructive: it came from an extractor invoked by its absolute path, bypassing the gated tool layer — the gate is strongest inside the harness’s own tools, not as a wrapper agents can route around. Two honest limits the authors state: the network write-binding is a reference design whose enforced evaluation in live agents is future work, and image carriers were evaluated through tool decoding, with pixel-level perception left open. Plus a descriptive warning for model selectors: caution did not transfer across carriers — Gemini-4-Argon inspected archives read-only most often yet had the most conflicting writes on network and image inputs. A safe agent must weigh the operation that obtains information, not just the information obtained: bound the bytes per call, commit writes in stages, and teach agents to inspect before processing.
Our verification was read-only. We read the full arXiv abstract, metadata and introduction first-hand (submitted 1 November 2026; Tian Qin et al., Tsinghua / Sydney / HIT, Lijie Wen corresponding; 7 harnesses, 6 models, 42 cells; 32/42 overrun, 26/42 pre-observation, 84/84 for four models, benign twins all in budget, 28/28 truthful-declaration, 0/33 resource limits, 28/28 and 27/28 task variants, SZSP 0/28 vs 28/28 with 25/28 utility, absolute-path bypass, Gemini-4-Argon descriptive ordering, staged-commit and future-work limits). Section-level findings beyond the abstract and introduction are the authors’ reported results as stated there. The ETUDE parallel is our prior coverage linked above. We trained no model, ran no agent, extracted no archive, and contacted no one. Brave Search was used for discovery only.
Sources: