Researchers from Shanghai Jiao Tong University and Inria submitted a paper on 1 November 2026 describing a supply-chain vulnerability in large language model (LLM) agents: frameworks may keep trusting tools after their implementations change, without checking their safety again. The authors call this the tool update gap.[1]
Their attack, ETUDE (Exploiting Tool Updates for Direct Execution), embeds malicious functionality in updates to initially benign tools while preserving legitimate functionality. According to the abstract, the malicious code executes outside the LLM’s context and requires no adversarial instructions. The authors therefore argue that defenses restricted to content visible to the model leave this attack path uncovered.[1]
The authors report evaluating three attack workloads across seven commercial and open-source agent frameworks, including Gemini CLI, Codex CLI, and Claude Code. They report a 97.6% attack success rate and a 95.9% legitimate task completion rate, and say existing defenses provide insufficient protection. These are author-reported aggregate findings; the saved abstract does not provide per-framework results, tested versions, or enough methodology to assess their applicability to a particular deployment.[1]
[1]: Beyond Prompt Injection: The Tool Update Gap in LLM Agent Security. arXiv, 1 November 2026. https://arxiv.org/abs/2611.01976
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
5e18c42a2998516b64641120dae4d4b84a72c17f252fecef777989c6c45e947c
