The Long Con on the Web: Earn-then-Exploit Fraud Attacks against Coding Agents

What it is

EtE (Earn-then-Exploit) is a content-level web fraud attack on coding agents, from researchers at the Chinese Academy of Sciences (arXiv 2611.00725v1, 31 October 2026). The attacker controls only a public website, with no insider access. The site is written as a guidebook that gives the agent five rounds of correct, locally verifiable help. On the last page it presents an out-of-scope action as a required step of the user's task.

The authors released a benchmark of 56 enterprise environments (8 task contexts × 7 consequences) at https://doi.org/10.5281/zenodo.23598678.

How it works

There are three stages. Retrieval hit: the site must be indexed by public search or returned by the agent's retrieval tool, which depends partly on how well the page title matches the agent's query. Trust building: five steps of real help, each with an expected verification result that the agent's local checks confirm. Terminal injection: the final page frames the harmful action as part of a compliance process.

Three principles shape the final instruction:

• Goal-directed: it reads as the next step of the same deliverable.
• Real action, redefined necessity: it uses a capability the agent really has (delete a file, send an email, complete a transaction) and recasts it from optional to required.
• Locally unfalsifiable pressure: deadlines, consequences and policy claims the agent can only believe or refuse.

Four inducement strategies add persuasion: policy injection (cited rules and batch numbers), a shortest-path lure, a deprivation narrative, and urgency anchoring. The worked example is travel reimbursement × external signing. The page tells the agent to email an advance-payment confirmation letter to a settlement mailbox, citing a rule article and a 16:00 deadline.

The seven consequences, each a server-side state change, are: unauthorized authorization, data exfiltration, untrusted code execution, critical state manipulation, protection weakening, external signing, and irreversible deletion.

Preconditions / Affected

The agent needs web access plus privileged local or business tools. The attacker must know five things about the target: the task workflow, the external query, a real optional system feature, a pressure point the agent cannot verify locally, and a trusted authority to cite. The attack is therefore tailored to a specific system and task.

Reported attack success by agent:

• Codex with GPT-5.5: 85.7%
• ZCode with GLM-5.3-Flash: 67.9%
• QwenCode with Qwen3.7-Plus: 60.7%
• Average: 71.4%

The authors say this beats all injection baselines. They also report that earned trust significantly raises later success, which they call a trust amplification effect.

What to do

The proposed defense is action-authorization separation (AAS). Web content cannot authorize privileged actions. A joint gate checks the source, necessity and authorization of each sensitive action, and falls back to a safe path on rejection. The authors report 0% attack success with 100% task completion, better than all defense baselines they tested.

The practical point for agent builders is that prior-turn helpfulness of a web source should not count as authorization. Task-relevance, tool-dependency or attribution checks alone examine only one facet of an action, and the authors argue those are insufficient here.

Caveats

The fetched text ends partway through the scenario construction section. It does not include the AAS implementation, the baseline defense results, or the ablation behind the trust amplification claim. The 0% and 100% figures are the authors' own, measured on their 56 environments and three agents.