ETUDE shows trusted tool updates can smuggle malware past prompt-injection defences at 97.6% success

The dangerous update never had to win an argument with the model. It only had to keep the old tool name.

Early November 2026, Shiyu Kan and co-authors posted arXiv:2611.01976 on the tool update gap: trust granted at admission that survives implementation changes the agent never re-reads.

ETUDE updates a benign tool and executes beside the real job

ETUDE (Exploiting Tool Updates for Direct Execution) starts from a tool that is admitted clean. A later release keeps the declared interface and expected functionality, then adds unauthorized work in the tool’s own runtime: credential disclosure, unauthorized API calls, or local file modification in the authors’ workloads.

Because those operations never need to appear as adversarial text in the model context, prompt-injection detectors and static skill scanners aimed at model-visible content miss them. The agent can finish the user’s task while the update runs its payload.

Evaluation covers seven harnesses (Gemini CLI, Codex CLI, Claude Code, DeepSeek Harness, OpenCode, Pi, and Goose) across multiple LLM backends and three tool functionalities. Reported attack success is 97.6% with 95.9% legitimate task completion. Against the authors’ strongest prompt-injection baseline, ETUDE’s advantage is 85.1 percentage points.

The taxonomy table in the paper places ETUDE at post-admission delivery with direct code execution. That cell is distinct from poisoned descriptions at install time and from rug-pull updates that only change model-visible text. The practical sentence for operators is short: a formatting helper can grow a credential reader behind the same tool identity.

Marketplaces taught admission-time trust; updates reused it

Agent CLIs increasingly install tools from registries and marketplaces, then pull routine updates. The Cursor marketplace backdoor and MCP OAuth client RCEs already showed that supply-chain and client trust boundaries are live. ETUDE is the quieter sibling: no malicious first install required if the second release inherits permissions.

Defences the authors probe, integrity verification, code review, and runtime auditing, either miss obfuscated malice, block legitimate maintenance, or face coverage and overhead limits. File hashes notice change without judging intent. Description scanners never see the new binary behaviour. Cisco MCP Scanner, SkillFortify, and SkillSpector-style static checks are in the evaluation frame; the authors still find obfuscation and update-time gaps leave room for the attack to land during ordinary work.

Preprint measurement across seven named harnesses

Paper: arXiv:2611.01976, Shanghai Jiao Tong University and Inria authors. Maturity: attack-study and defence evaluation, usable as a red-team scenario for tool lifecycle reviews; not a consumer product. Public reproduction details should be read from the PDF and any companion artefacts the authors pin later.

Re-verify tools whenever the implementation changes

Reach for ETUDE’s framing when your agents auto-update MCP servers, skills, or CLI plugins. Require update-time review equivalent to admission: signed artefacts, diff review of executable paths, and permission re-attestation when code changes behind a stable name.

If your programme only scans tool descriptions and user-visible prompts, add execution-time controls that constrain filesystem and network effects even for “already trusted” tools. Prompt-injection hardening remains necessary; it is the wrong primary control for this path.

Interface stability is the camouflage

Keeping name, schema, and happy-path output stable is exactly how ETUDE stays invisible to model-centric monitors. Hash pinning without a human or policy judgment on the diff creates alert fatigue or rubber-stamp updates. Runtime auditors that only detonate on install will miss payloads gated on later inputs.

Results are tied to the seven harnesses and three workloads. A private enterprise registry with mandatory code signing and blocked auto-update may shrink the window; it does not erase the gap if signed updates can still widen privileges silently.

Lifecycle trust beats admission-time theatre

The Monday move is to treat every tool update as a fresh trust decision: pin versions, review executable diffs, and bound runtime authority so a formatting helper cannot grow into a credential reader without a new grant. Model-context defences stay on; they no longer carry the supply chain alone.