Computer-Use Agents (Claude Code / Codex / OpenClaw) exploded in 2026 — pushing LLMs into real software engineering makes CUA both tool consumer and tool producer, forming reverse supply chain (artifact-channel). The previous eight articles covered LLM security “transient + persistent + data + retrieval + browser” five dimensions. This article is the ninth dimension — runtime + artifact-channel layer — CUA outputs (skill / code patch / commit / artifact) reverse-flow as next agent’s input, forming cyclic supply chain instead of traditional DAG. This article is piick.cc’s LLM Security series “ninth-dimension deep-dive”.

arxiv 2608.06862 SynChain (2026-08) empirically validated Chain-1/2/3 three lengths of attack chains, Claude Code 82.22% accuracy maintained + Codex 58.89% + OpenClaw all compromised, artifact-channel internal supply chain. arxiv 2602.19555 empirically validated viral agent loop: data supply chain (Discovery) + tool supply chain (Invocation) closed loop → cyclic graph instead of traditional DAG, paradigm shift. arxiv 2608.01558 empirically validated Prompt Infection malicious instruction propagates like virus across agents, even if agents do not share all communication. OWASP Agentic Top 10 2026 ASI04 Supply Chain + ASI05 RCE + ASI06 Memory & Context + ASI07 Inter-Agent all directly map.

30-Second Overview

  • CUA SynChain is the LLM era’s ninth-dimension attack surface — 2026 H2 Claude Code / Codex / OpenClaw / Cursor Composer / Devin 2 / Genie 3 all launched, CUA both tool consumer (read codebase / call shell / see screenshot) and tool producer (write code / write commit / write skill / write artifact), cyclic supply chain replaces DAG
  • 8 CUA SynChain attacks (progressing by CUA component layer: skill library → codebase → cross-agent → runtime): Skill library poisoning / Artifact-channel reverse SC / Persistence via skill cache / Codebase embedded trigger / Chain-1/2/3 long-chain synthesis / Cross-agent virus propagation / CUA confused deputy / Runtime supply chain injection
  • 5 2026 real incidents/papers: SynChain arxiv 2608.06862 Chain-1/2/3 + Claude Code 82.22% + Codex 58.89%, Agentic Runtime SC arxiv 2602.19555 viral agent loop, Prompt Infection arxiv 2608.01558 cross-agent virus propagation, Malice in Agentland arxiv 2510.05159 AI supply chain backdoors, SkillJect (arxiv 2026) skill-layer injection
  • 7-day defense plan (each ≤ 30 minutes to start): skill library signing / artifact-channel e2e verify / codebase trigger detection / runtime SC graph audit / agent version pinning / chain length cap / CUA capability least-privilege / red team regression
  • Use the Piick tool set to debug tokens, URLs, regex, and encoded payloads on CUA output / skill / artifact — all tools run 100% locally and never upload, keeping your audit log clean

Why CUA SynChain Is the Ninth-Dimension Attack Surface in the LLM Era

To understand why all 8 attacks work, go back to the CUA architecture:

User → CUA (Claude Code / Codex / OpenClaw) ← Skill library / Memory / Tool ↓ ↓ ↓ Codebase (packages.json / submodule / dockerfile) ↓ ↓ ↓ Write Code / Commit / Patch / Artifact ↓ ↓ ↓ Artifact-channel reverse flow (next CUA reads) ↓ ↓ ↓ Multi-agent Federation ↓ ↓ Runtime Supply Chain (Discovery + Invocation + Cyclic Propagation)

Every layer is both input and output — completely different from traditional LLM security:

  • Traditional LLM input (prompt / corpus / memory) vs CUA input (prompt + codebase + skill + previous CUA outputs)
  • Traditional LLM output (response) vs CUA output (code + commit + skill + artifact) reverse-becoming input
  • Traditional supply chain is DAG (upstream → downstream, acyclic); CUA supply chain is cyclic graph (outputs reverse-flow)
  • Traditional supply chain attack relies on poisoning external dependencies; CUA supply chain attack relies on making CUA self-synthesize attack chains (SynChain)

Core: in the LLM era, supply chain paradigm shifts from DAG → cyclic graph, meaning supply chain no longer “terminates” but can infinitely propagate (arxiv 2602.19555 empirically validated viral agent loop).

WAAA empirically validated 10 web classic threats get “amplified” in agent era; SynChain / Prompt Infection empirically validate the core loop in CUA supply chain era == “agent’s own outputs reverse-flow”. OWASP Agentic Top 10 2026 ASI04 Supply Chain Vulnerabilities + ASI06 Memory & Context Poisoning + ASI07 Insecure Inter-Agent Communication directly map.

8 CUA SynChain Attack Variants (Progressing by CUA component layer: skill library → codebase → cross-agent → runtime)

Attack 1: Skill Library Poisoning (SkillJect Pattern)

Symptom: CUA skill library (like Claude Code Skills / OpenClaw Skills) poisoned / typosquatted; once installed persistently affects all CUA sessions; SkillJect (arxiv 2026) empirically validated.

Why it works: CUA skill library is the core of CUA persistence — once a skill is installed, all subsequent sessions auto-load. Attacker registers typosquatting skill (like “claude-code-helper” vs “claude-code-helpers”) → after install every CUA session auto-triggers malicious behavior.

Minimal reproduction (SkillJect pattern):

Step 1: attacker registers typosquatting skill, e.g. “claude-code-helpers” (actually typosquatting popular “claude-code-helper”) Step 2: attacker recommends install to user (disguised as “improve CUA experience”) Step 3: user installs skill, CUA persists to skill cache Step 4: every CUA session start → auto-load skill → trigger malicious behavior (read git history / write malicious commit / exfil token) Step 5: data exfil → attacker’s server Step 6: user normally uses CUA not knowing all sessions are monitored

Fix:

  • Skill library signing + content hash verification (see Day 1). CUA skill library all enter SBOM + content hash; verify signature on install; typosquatting detection
  • Skill install goes IT review; unknown source skill force disable
  • Skill store strengthens typosquatting detection (similar to batch-35 Foot-Gun 6 extension store)

Attack 2: Artifact-Channel Reverse Supply Chain (Viral Agent Loop)

Symptom: CUA outputs (code patch / commit / artifact) become next agent’s input; cyclic graph instead of traditional DAG; arxiv 2602.19555 empirically validated viral agent loop; paradigm shift.

Why it works: Traditional supply chain is one-way DAG — upstream producer → downstream consumer, compromise eventually terminates. CUA supply chain is cyclic graph — CUA’s outputs (code patch / commit / artifact) enter codebase → next CUA reads codebase → writes new outputs → reverse-pollutes codebase. Compromise doesn’t terminate, can infinitely propagate.

Minimal reproduction (Viral Agent Loop pattern):

Step 1: attacker plants trigger in initial codebase (comment / TODO / hidden text) Step 2: CUA-A reads codebase → trigger triggers → writes malicious code patch Step 3: malicious code patch enters codebase (repo commit) Step 4: CUA-B (another user / same user different session) reads codebase → sees malicious patch → continues propagation Step 5: code patch chain-propagates to 10+ CUAs, each CUA thinks it’s “normal code” Step 6: entire supply chain polluted, corpus appears “normal”

Fix:

  • Artifact-channel egress e2e verify (see Day 2). CUA outputs (code patch / commit / skill / artifact) go through e2e verify; artifact reverse flow must verify signature + sandbox execution
  • Viral agent loop defense: each CUA-written artifact must content hash + signature; subsequent CUA reading artifact verifies
  • Codebase continuous scan; new commit auto audit + alert

Attack 3: Persistence via Skill Cache (CUA Cross-Session)

Symptom: Malicious skill enters CUA skill cache → cross-session persistence; auto-loads every CUA start; OWASP ASI06 Memory & Context Poisoning.

Why it works: CUA skill cache is the core of CUA cross-session — similar concept to batch-32 agent memory but more covert. Once malicious skill enters cache, all subsequent sessions auto-load, even if user deletes “looks like attack” input, skill still in cache. CUA has no easy “clear skill cache” tool.

Minimal reproduction:

Step 1: attacker induces CUA to install malicious skill (via SkillJect pattern) Step 2: malicious skill enters CUA skill cache (persists) Step 3: user restarts CUA, switches session, even reinstalls CUA, skill cache remains Step 4: every session auto-loads skill → continuous exfil / write malicious commit / read codebase Step 5: user completely unaware (skill in background) Step 6: persistent attack continues for months or even years

Fix:

  • Skill library signing + content hash verification (see Day 1, shared with Attack 1)
  • Skill cache audit: periodic review of installed skills, mark suspicious
  • CUA provides “clear skill cache” official tool + secondary confirmation
  • Critical CUA skill cache goes enterprise policy force reset cycle

Attack 4: Codebase Embedded Trigger (Malware-in-Codebase)

Symptom: Malicious trigger planted in codebase (packages.json / git submodule / dockerfile); CUA reads codebase → trigger triggers subsequent attack; arxiv 2510.05159 empirically validated.

Why it works: CUA reads codebase as “natural language” understanding, but codebase has many possibilities for hidden trigger — packages.json contains typosquatting package names, git submodule points to malicious repos, dockerfile contains exfil commands. CUA sees “normal” codebase structure, executes trigger subsequent attack.

Minimal reproduction (Malware-in-Codebase pattern):

Step 1: attacker plants packages.json with typosquatting dependency: “@myapp/helpers” actually is “@myapp/helper” Step 2: attacker plants git submodule pointing to attacker-controlled repo Step 3: CUA reads codebase, sees “normal packages.json + submodule” Step 4: CUA runs npm install / git submodule update → triggers typosquatting package / submodule malicious code Step 5: typo package / submodule code executes → exfil codebase content / write malicious patch / persistent attack Step 6: subsequent CUA reads codebase → sees “normal” codebase but already has malicious code

Fix:

  • Codebase trigger detection (codebase scan) (see Day 3). Malicious trigger planted in codebase scanning rules (packages.json typosquatting / git submodule pointing / dockerfile exfil commands); Malware-in-Codebase detection
  • CUA reads codebase → scan + alert; suspicious trigger refuses execution
  • packages.json / dockerfile goes enterprise mirror; disable public typosquatting

Attack 5: Chain-1/2/3 Long-Chain Synthesis (SynChain Empirically Validated)

Symptom: 3 lengths of attack chains; CUA self-synthesizes attack chain, no pre-poisoning environment needed; SynChain Chain-1 short chain 80%+, Chain-3 long chain Claude Code 82.22% / Codex 58.89% / OpenClaw all compromised.

Why it works: SynChain (arxiv 2608.06862) empirically validated — CUA can be induced to self-synthesize attack chain, no external pre-poisoning environment needed. Attacker only needs to give CUA a high-level instruction (“fix this issue”) → CUA runs shell / writes code / calls API on its own, ultimately producing attack chain. Chain-1 (short chain 1-3 steps) 80%+ success rate, Chain-3 (long chain 10+ steps) Claude Code 82.22% accuracy maintained, but Codex 58.89%, OpenClaw all compromised. CUA both tool consumer and tool producer → reverse supply chain forms.

Minimal reproduction (SynChain Chain-3 pattern):

Step 1: attacker gives CUA high-level instruction: “fix this bug in our CI pipeline” Step 2: CUA reads codebase / calls CI tool / runs shell Step 3: CUA self-synthesizes attack chain — writes malicious CI patch / changes secrets environment variables / adds malicious cron job Step 4: attack chain enters production via code commit / pipeline config Step 5: production environment compromised Step 6: entire attack chain is CUA self-synthesized, attacker didn’t directly write any malicious code

Fix:

  • Agent SKU / version pinning + chain length cap (see Day 5). CUA agent version lock; Chain-1/2/3 chain length upper limit; SynChain long-chain blocked
  • chain length cap = max 5 steps; exceeding auto alert + user confirmation
  • CUA runs shell / writes code force sandbox; sandbox detects exfil / secrets change behavior
  • High-sensitivity operation (transitive change) force user secondary confirmation

Attack 6: Cross-Agent Virus Propagation (Prompt Infection)

Symptom: Malicious instruction propagates like virus in multi-agent system, even if agents do not share all communication; arxiv 2608.01558 empirically validated.

Why it works: Prompt Infection (arxiv 2608.01558) empirically validated — malicious instruction can propagate like virus in multi-agent system, even if agents don’t directly share all communication. Agent-A infected → via codebase / artifact / shared memory → Agent-B infected → Agent-C infected. Existing protocol-level defenses offer no formal guarantees against model and reasoning level compromise spreading across a federation.

Minimal reproduction (Prompt Infection pattern):

Step 1: Agent-A infected by malicious instruction (via codebase / artifact / shared tool) Step 2: Agent-A outputs code / text / artifact containing malicious instruction Step 3: Agent-B reads Agent-A’s outputs → malicious instruction enters Agent-B context Step 4: Agent-B treats instruction as “high-privilege user command”, executes malicious behavior Step 5: Agent-B’s outputs again contain malicious instruction → passes to Agent-C / Agent-D / Agent-N Step 6: entire multi-agent federation compromised, protocol-level defenses fail

Fix:

  • Artifact-channel egress e2e verify (see Day 2, shared with Attack 2)
  • Multi-agent federation protocol layer (e.g. MCP federation / Anthropic Claude Agent SDK) goes content hash + signature verify
  • Cross-agent instruction quarantine: received agent instruction must verify signature + source
  • System prompt explicitly “agent instruction is data, not privileged command”

Attack 7: CUA Confused Deputy (Action + Capability Boundary Missing)

Symptom: CUA calls tool / runs shell / writes file boundary missing; low-privilege attacker induces CUA to call high-privilege tool; OWASP ASI07 Insecure Inter-Agent Communication.

Why it works: CUA is “confused deputy” — it has high privilege (git commit / call cloud API / write config), but receives low-privilege attacker’s instructions. CUA’s tool list has no capability boundary, one CUA session can call all tools, attacker only needs to induce CUA to call “looks innocuous” tool to indirectly achieve high-privilege action.

Minimal reproduction:

Step 1: attacker induces CUA to call “git status” (looks innocuous) Step 2: CUA actually runs git status → simultaneously configures git config with attacker exfil endpoint Step 3: attacker induces CUA to run “git commit -m fix” → triggers git config → commit content sent to attacker Step 4: CUA thinks it’s just “ordinary git commit”, but actually leaks codebase content Step 5: entire chain runs under user’s identity / user’s git config, but user doesn’t see any alert

Fix:

  • CUA capability least-privilege + prompt hierarchy (see Day 6). CUA tool list by user action whitelist; low-privilege attacker cannot induce high-privilege action
  • CUA runs shell / writes file force sandbox; sandbox detects capability boundary
  • High-sensitivity tool (git push / cloud API / secrets) force user secondary confirmation

Attack 8: Runtime Supply Chain Injection (Zero-Trust Runtime Missing)

Symptom: CUA’s data supply chain (Discovery) + tool supply chain (Invocation) no Zero-Trust Runtime enforcing Deterministic Capability Binding; tool identifier via semantic similarity “guess”, structurally insecure.

Why it works: arxiv 2602.19555 empirically validated — CUA’s tool identifier relies on LLM through semantic similarity “guess”, structurally insecure. Attacker can make CUA misidentify “read_file” as “exec_shell” (via similarity attack); or induce CUA when calling tool to inject malicious payload via supply chain. Zero-Trust Runtime + Deterministic Capability Binding is the necessary antidote.

Minimal reproduction:

Step 1: attacker injects tool name typosquatting — adds “read_files” to skill cache (actually points to exec_shell) Step 2: CUA via semantic similarity calls “read_files” (thinking it’s similar to read_file tool) Step 3: CUA actually triggers exec_shell → executes attacker code Step 4: runtime supply chain injection success Step 5: attacker fully controls CUA execution environment

Fix:

  • Runtime supply chain graph audit (see Day 4). Data supply chain + tool supply chain two-layer audit; Zero-Trust Runtime enforce Deterministic Capability Binding
  • Tool identifier not rely on semantic similarity guess → use exact-match registry (similar to OWASP Agentic AI top 10 proposal)
  • Tool invocation audit: every CUA tool call force verify tool name + signature
  • Runtime supply chain graph continuous scan; new tool registration auto audit

5 Real 2026 Incidents / Papers

Incident 1: SynChain arxiv 2608.06862 (2026-08) — CUA Self-Synthesized Attack Chains

Paper summary: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains; Chain-1/2/3 three lengths of attack chains; Claude Code 82.22% accuracy maintained + Codex 58.89% + OpenClaw all compromised; artifact-channel internal supply chain; in testing CUA self-synthesized attack chain, no external pre-poisoning environment needed.

Core conclusion: CUA can self-synthesize attack chain; in long chain (Chain-3, 10+ steps) Claude Code still maintains 82.22% accuracy (equal to normal task accuracy), showing CUA doesn’t know it’s executing attack chain; Codex 58.89% already starts dropping accuracy, attack side cost is smaller. Directly maps to Foot-Gun 5.

Incident 2: Agentic Runtime Supply Chain arxiv 2602.19555 (2026-02) — Viral Agent Loop Paradigm Shift

Paper summary: Agentic AI as a Cybersecurity Attack Surface — Threats, Exploits, and Defenses in Runtime Supply Chains; Viral Agent Loop = data supply chain (Discovery) + tool supply chain (Invocation) closed loop; cyclic graph instead of traditional DAG; paradigm shift: traditional supply chain is DAG, compromise terminates; CUA supply chain is cyclic, compromise infinitely propagates; systematically analyzes existing agentic SC defenses + proposes Zero-Trust Runtime + Deterministic Capability Binding.

Core conclusion: DAG → cyclic graph paradigm shift; CUA supply chain attack cannot be solved by traditional SC defense, must use Zero-Trust Runtime enforcement. Directly maps to Foot-Gun 2 + Foot-Gun 8.

Incident 3: Prompt Infection arxiv 2608.01558 (2026-08) — Cross-Agent Virus Propagation

Paper summary: Securing Agentic AI — From Per-Action Checks to Trajectory Assurance; Microsoft AI Red Team taxonomy; Prompt Infection = malicious instruction propagates like virus in multi-agent system; even if agents do not share all communication, Prompt Infection still propagates; existing protocol-level defenses offer no formal guarantees against model and reasoning level compromise spreading across a federation.

Core conclusion: Prompt Infection propagation in multi-agent federation has no protocol-level defense; need trajectory assurance + behavioral containment across multi-agent system. Directly maps to Foot-Gun 6.

Incident 4: Malice in Agentland arxiv 2510.05159 (2025-10) — AI Supply Chain Backdoors

Paper summary: Malice in Agentland — Down the Rabbit Hole of Backdoors in the AI Supply Chain; Claude / Llama / GPT series all compromised; rabbit hole down to backdoors; static + dynamic + behavioral three-layer backdoor detection; OWASP Agentic Security Initiative + Microsoft AI Red Team taxonomy both cite.

Core conclusion: mainstream LLM models all have supply chain backdoor risk; not prompt injection, but model-layer backdoor; Malware-in-Codebase extends to Model layer. Directly maps to Foot-Gun 4.

Incident 5: SkillJect (arxiv 2026) + DemonAgent — Skill-Layer vs Trigger-Conditioned Backdoor

Paper summary: SkillJect — skill-layer injection; CUA skill cache persistent attack; DemonAgent — trigger-conditioned agent backdoor (CUA sees trigger auto-executes malicious behavior). SynChain compared with SkillJect, persistence stronger (SkillJect one-time install) + autonomous synthesis (SynChain self-generates chain); the two complement.

Core conclusion: SkillJect + DemonAgent + SynChain three-layer CUA attack = complete CUA supply chain threat surface; persistence, autonomous synthesis, cross-agent propagation three axes parallel. Directly maps to Foot-Gun 1 + Foot-Gun 3.

7-Day Defense Plan

Day 1 — Skill Library Signing + Content Hash Verification (15 minutes to start)

  • CUA skill library all enter SBOM + content hash
  • Verify signature on install; typosquatting detection
  • SkillJect defense
  • Skill install goes IT review; unknown source skill force disable
  • Skill store strengthens typosquatting detection (similar to batch-35 Foot-Gun 6)

Day 2 — Artifact-Channel Egress E2E Verify (30 minutes)

  • CUA outputs (code patch / commit / skill / artifact) go through e2e verify
  • Artifact reverse flow must verify signature + sandbox execution
  • Viral agent loop defense: each CUA-written artifact must content hash + signature
  • Subsequent CUA reading artifact verifies + alerts
  • Codebase continuous scan; new commit auto audit

Day 3 — Codebase Trigger Detection (codebase scan, 1 hour)

  • Malicious trigger planted in codebase scanning rules
  • packages.json typosquatting detection
  • git submodule pointing anomaly detection
  • dockerfile exfil commands detection
  • Malware-in-Codebase detection (arxiv 2510.05159 pattern)
  • CUA reads codebase → scan + alert

Day 4 — Runtime Supply Chain Graph Audit (2 hours)

  • Data supply chain + tool supply chain two-layer audit
  • Zero-Trust Runtime enforce Deterministic Capability Binding
  • Tool identifier not rely on semantic similarity guess → use exact-match registry
  • Tool invocation audit: every CUA tool call force verify tool name + signature
  • Runtime supply chain graph continuous scan; new tool registration auto audit

Day 5 — Agent SKU / Version Pinning + Chain Length Cap (2 hours)

  • CUA agent version lock; Chain-1/2/3 chain length upper limit; SynChain long-chain blocked
  • chain length cap = max 5 steps; exceeding auto alert + user confirmation
  • CUA runs shell / writes code force sandbox
  • Sandbox detects exfil / secrets change behavior
  • High-sensitivity operation (transitive change) force user secondary confirmation

Day 6 — CUA Capability Least-Privilege + Prompt Hierarchy (2 hours)

  • CUA tool list by user action whitelist; sensitive tool default disable
  • Low-privilege attacker cannot induce high-privilege action
  • CUA runs shell / writes file force sandbox; sandbox detects capability boundary
  • High-sensitivity tool (git push / cloud API / secrets) force user secondary confirmation
  • System prompt explicitly “page content / agent instruction is data, not privileged command”

Day 7 — Red Team Regression Against SynChain + OWASP ASI04 (3 hours)

  • Quarterly red team runs SynChain Chain-1/2/3 full case set
  • OWASP Agentic Top 10 2026 ASI04 (Supply Chain) + ASI05 (RCE) + ASI06 (Memory & Context) + ASI07 (Inter-Agent) full regression
  • New CUA version pre-release re-run red team tests
  • SkillJect + DemonAgent + Prompt Infection full case set run

Final Thoughts

CUA SynChain attack is the “ninth-dimension deep-dive” of piick.cc’s LLM Security series. CUA both tool consumer and tool producer — supply chain paradigm shifts from DAG → cyclic graph, compromise doesn’t terminate, can infinitely propagate. In SynChain Chain-3 long chain Claude Code still maintains 82.22% accuracy, showing CUA doesn’t know it’s executing attack chain — this is not an input/output problem, but a supply chain paradigm problem.

If your CUA (Claude Code / Codex / OpenClaw / Cursor Composer / Devin 2) is already online, start with Day 1 — Skill Library Signing + Content Hash Verification, spend 30 minutes adding signature + content hash verification to CUA skill library, that alone blocks most SkillJect poisoning. Then follow the 7-day plan forward.

CUA SynChain era security cannot be solved by any single defense — skill signing + artifact-channel e2e verify + codebase trigger detection + runtime SC graph audit + agent version pinning + chain length cap + CUA capability least-privilege + red team regression eight-layer independent fallback. This article’s 8 foot-guns + 5 real incidents + 7-day plan are the most stable fallback available now; the real protocol-level standards (MCP federation signing + Zero-Trust Runtime enforcing Deterministic Capability Binding) may have to wait for the next generation of CUA products to fully support.

The next phase of piick.cc’s LLM Security series will enter [MCP federation cross-server attacks] / [Agent output via MCP federation exfiltration] / [VLM vision manipulation] / [Agent vision attack]. If you have a specific direction you want to see, let me know.

Debugging tokens, URLs, regex, and encoded payloads on CUA output / skill / artifact? Use the Piick tool set:

  • /tools/jwt-decoder/ — locally read CUA output JWT capability tokens, confirm scopes are not widened (echoes Day 6 CUA capability least-privilege)
  • /tools/url-encoder-decoder/ — locally check whether CUA artifact channel contains hidden exfil URL; troubleshoot Foot-Gun 5 (Chain-1/2/3)
  • /tools/regex-tester/ — locally test codebase trigger detection regex; troubleshoot Foot-Gun 4 (Malware-in-Codebase)
  • /tools/text-encoder/ — Base64 / hex detection of encoded payloads in CUA artifact; echoes Foot-Gun 1 (SkillJect)

All tools run 100% locally; no file is uploaded to any server, keeping your audit log clean.