Morning Edition · Thursday, September 17, 2026Published at 2:17 AM EDT · New York

Two Papers Describe How a Poisoned Benchmark or a Low-Privilege Agent Can Compromise an Entire Agent Pipeline

One adapts Ken Thompson's compiler backdoor to self-modifying coding agents, the other shows how a compromised low-privilege agent can trigger unauthorized action by a higher-privilege one.

Two papers posted to arXiv on Thursday describe the same structural problem from opposite ends of an agent stack. The first revisits Ken Thompson's 1984 "Reflections on Trusting Trust", which showed that a poisoned compiler can reinsert its…