What happened
In “Step-Zero Attack: Agent Safety Before Observability,” Tian Qin, Yuhang Jiang, Junzhe Chen, Lit Sin Tan and a fifth author describe attacks that cause harm during an agent’s first processing of an opaque input. Their examples include an archive, a network response or an image supplied as a path or URL. The paper calls this initial processing “Step Zero”: the agent must handle the input before it can judge its contents, so conventional defenses that inspect model context may act too late.
The authors tested seven harnesses with six models. Each agent received only a path or URL to a crafted input, paired with a benign twin that showed the same visible fields. For archives, 32 of 42 harness-model pairs exceeded a 4 MiB disk budget. In 26 of those pairs, the budget was exceeded before the model saw any archive member. Four of the six models exceeded the budget in every round, for 84 of 84 rounds. Every benign twin stayed within budget, which the paper says shows that the attacker’s bytes alone caused the harm.
The paper also reports a different risk for network and image inputs: agents wrote the body under the name declared by the input, allowing that input to determine what was written. The authors say the agents’ checks weakened when cues were removed. Model-free tests, they report, traced the harm to the processing primitive rather than model behavior.
As a mitigation, the researchers propose a gate that counts the bytes produced by each processing call. In their tests, every extraction routed through the gate stayed within budget, and agents completed 25 of 28 tasks. The authors recommend pairing such gates with safety-alignment training that teaches agents to inspect an input before processing it. The arXiv record dates the submission to 1 November 2026 and lists the paper as a 14-page preprint with five figures and four tables.
What the archive adds
New Runtime's earlier coverage reported attacks on agent planning in CrowdStrike’s expanded prompt-injection taxonomy (31 October 2026) and a command-execution backdoor implanted through poisoned pretraining data in research on agentic backdoors (1 November 2026). This paper adds a distinct pre-model processing failure mode to the broader agent-security story.
Trend signal
The finding supports the view that agent security must be enforced at runtime boundaries, not only through prompts or inspection of model inputs. The paper locates the failure in the processing primitive and tests a byte-counting gate there, consistent with agent security moving to runtime boundaries.
Why now
As coding agents accept files and URLs as work inputs, the first operation on that material can itself have effects. The paper’s tests make that ordering problem concrete: in many cases, disk use exceeded the stated budget before any archive member reached the model.
Connections to other events
New Runtime's earlier coverage has examined agent-planning attacks in CrowdStrike’s taxonomy and pretraining-poisoned agent backdoors. This paper differs by targeting the tools that process inputs before the model can inspect them.
Why it matters
A system can have careful prompt-injection filters and still be exposed if an archive extractor, fetcher or image processor performs unbounded work before the model has a chance to reason about the input. That shifts part of the security review from “What can the model be persuaded to do?” to “What can this tool do merely by receiving these bytes?”
For teams building coding agents, the paper suggests treating input-processing tools as security-sensitive capabilities. Budgets on extracted or written bytes are one concrete control to test, alongside policies for names and destinations declared by untrusted inputs. The reported 25-of-28 task completion result is encouraging but does not establish how the gate performs across other tasks, toolchains or operational conditions.
Limits and uncertainty
This is a preprint reporting a bounded set of experiments, not an independent evaluation of deployed coding agents. The results cover seven harnesses, six models and the tasks described by the authors; they do not establish how often Step-Zero failures occur in production or how representative the tested harnesses are. The reported gate results concern routed extractions and task completion in the study. The paper does not establish that the gate addresses every risk from network and image inputs, or that the proposed training and tool-layer controls are sufficient in other environments.
Skill to build now
Inventory every agent tool that opens, extracts, fetches or converts untrusted inputs. For each, test whether it has a hard output-byte budget enforced inside the tool call, before results reach the model. Include adversarial archives and inputs that control filenames in the test set, and record both resource limits and whether the agent can complete the intended task.
Reader takeaway
Model-side defenses cannot inspect damage that happens before content reaches the model. Put measurable limits at the runtime tools that first process untrusted inputs, then test that those limits preserve useful task completion.