SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains

2026-08-07

AI Summary

This work addresses a critical gap in existing security defenses, which overlook the risk of implicit attack propagation through an agent’s internal persistent state and struggle to mitigate persistent threats arising from autonomously generated malicious artifacts. We propose SynChain, a novel endogenous attack paradigm that formalizes how structural redundancy in agent-synthesized artifacts can be exploited to stealthily embed malicious payloads. By employing persistence-aware, targeted supervised fine-tuning, SynChain enables agents to autonomously generate seemingly benign artifacts containing hidden payloads—without external input—and automatically activate them in subsequent tasks. We introduce CUAChain, a dataset comprising 30 task chains and three attack objectives, and demonstrate across OpenClaw, Codex, and Claude Code that SynChain significantly outperforms baseline methods under four distinct defense configurations, achieving high attack success rates.

Abstract

Computer-use agents~(CUAs) have transformed large language models into persistent execution systems capable of generating, storing, and reusing artifacts like skills and memory entries. However, existing security defenses largely treat attacks as externally triggered or temporally bounded, leaving a critical gap in addressing how compromise can propagate internally through an agent's own persistent state. We reveal that malicious influence can be covertly embedded into the structural redundancies of autonomously synthesized artifacts, allowing it to survive internal state updates and bypass standard vetting mechanisms. To formalize this threat, we introduce SynChain, a self-synthesized attack paradigm utilizing persistence-aware directed supervised fine-tuning to induce agents to create poisoned yet benign-looking artifacts. To systematically evaluate this propagation, we construct CUAChain, a dataset comprising 30 benign task chains and three attack objectives. SynChain enables dormant payloads to seamlessly reactivate in future workflows as trusted context, operating entirely without new malicious exogenous inputs. Extensive experiments on OpenClaw, Codex, and Claude Code under four defense settings demonstrate that SynChain achieves high attack success and outperforms adapted baselines, proving that securing CUAs requires provenance-aware reasoning over cross-task execution trajectories.

Problem

• computer-use agents
• persistent state
• attack propagation
• autonomous artifacts
• internal compromise

Innovation

• SynChain
• computer-use agents
• persistent state poisoning
• self-synthesized attack
• provenance-aware reasoning