# Two Papers Describe How a Poisoned Benchmark or a Low-Privilege Agent Can Compromise an Entire Agent Pipeline

One adapts Ken Thompson's compiler backdoor to self-modifying coding agents, the other shows how a compromised low-privilege agent can trigger unauthorized action by a higher-privilege one.

- Published: 2026-09-17T06:17:58.659Z
- Canonical: https://polylog.news/ai/2026-09-17/two-papers-describe-how-a-poisoned-benchmark-or-a-low-privil
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [arXiv cs.CR](https://arxiv.org/abs/2609.17817), [arXiv cs.CR](https://arxiv.org/abs/2609.17648), [Anthropic](https://www.anthropic.com/threat-intelligence-report-september-2026)

Two papers posted to arXiv on Thursday describe the same structural problem from opposite ends of an agent stack. The first revisits Ken Thompson's 1984 "Reflections on Trusting Trust", which showed that a poisoned compiler can reinsert its…

This story is for subscribers. Read it in full at https://polylog.news/ai/2026-09-17/two-papers-describe-how-a-poisoned-benchmark-or-a-low-privil (subscription information: https://polylog.news/pricing).