SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains

arXiv:2608.06862 · cs.CR · Submitted 2026-08-07 · Read on arXiv

Fuyao Zhang, Jiaming Zhang, Che Wang, Boyang Chen, Yurong Hao, Xiongtao Sun, Guowei Guan, Blaise Delattre, Yang Cao, Wei Yang Bryan Lim

cs.CR

Submitted: 2026-08-07

Updated: 2026-08-10

Code: https://github.com/nousresearch/hermes-agent

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Trace — 16× in this paper · explained in 2 episodes
• Attack Success Rate — 10× in this paper
• Provenance — 10× in this paper · explained in 5 episodes
• Accuracy — 8× in this paper · explained in 1 episode
• Core — 6× in this paper · explained in 2 episodes
• Robustness — 6× in this paper · explained in 6 episodes
• Fine-Tuning — 5× in this paper · explained in 5 episodes
• Information Bottleneck — 5× in this paper · explained in 3 episodes
• Evaluation Protocol — 4× in this paper · explained in 2 episodes
• Indirect Prompt Injection — 3× in this paper · explained in 2 episodes
• QLoRA — 3× in this paper · explained in 2 episodes
• Abstraction — 2× in this paper · explained in 1 episode
• Agentic AI — 2× in this paper · explained in 2 episodes
• Attack Success Rate (ASR) — 2× in this paper · explained in 3 episodes
• Benchmark — 2× in this paper · explained in 2 episodes
• Benchmarking — 2× in this paper · explained in 4 episodes
• False Negatives — 2× in this paper · explained in 2 episodes
• Generator — 2× in this paper · explained in 2 episodes
• LLM judge — 2× in this paper · explained in 2 episodes
• Reinforcement Learning — 2× in this paper · explained in 4 episodes
• Scaffold — 2× in this paper · explained in 2 episodes
• AI Agents — 1× in this paper · explained in 2 episodes
• Chain-of-Thought Prompting — 1× in this paper · explained in 2 episodes
• Foundation Model — 1× in this paper · explained in 3 episodes
• Generalization — 1× in this paper · explained in 14 episodes
• In-Context Learning — 1× in this paper · explained in 7 episodes
• LLM-as-a-Judge — 1× in this paper · explained in 4 episodes
• Language Models (LLMs) — 1× in this paper · explained in 2 episodes
• Large Language Models (LLMs) — 1× in this paper · explained in 9 episodes
• MLLMs — 1× in this paper · explained in 2 episodes
• Multi-Agent System — 1× in this paper · explained in 7 episodes
• Online Reinforcement Learning — 1× in this paper · explained in 2 episodes
• Papers — 1× in this paper · explained in 3 episodes
• Performance Gap — 1× in this paper · explained in 2 episodes
• Prompt Injection Attacks — 1× in this paper · explained in 2 episodes
• RAG — 1× in this paper · explained in 3 episodes
• State Management — 1× in this paper · explained in 3 episodes
• Unified Framework — 1× in this paper · explained in 6 episodes

Sources

• EvoSkill: Automated Skill Discovery for Multi-Agent Systems
• Anthropic Economic Index report: Uneven geographic and enterprise AI adoption
• Formal Analysis and Supply Chain Security for Agentic AI Skills
• Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain
• Evaluating Large Language Models Trained on Code
• CUA-Skill: Develop Skills for Computer Using Agent
• A Trajectory-Based Safety Audit of Clawdbot (OpenClaw)
• The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agents
• SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement
• AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents
• BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents
• The Llama 3 Herd of Models
• SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents
• SOK: A Taxonomy of Attack Vectors and Defense Strategies for Agentic Supply Chain Runtime
• SoK: Agentic Skills -- Beyond Tool Use in LLM Agents
• ComputerRL: Scaling End-to-End Online Reinforcement Learning for Computer Use Agents
• SkillsBench: Benchmarking How Well Agent Skills Work Across Diverse Tasks
• Ministral 3
• From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem
• Chain-of-Trigger: An Agentic Backdoor that Paradoxically Enhances Agentic Robustness

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Estimating the Social Cost of Corporate Data Breaches
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills