When a coding agent opens a file or fetches a URL, it must process the data first to know what it contains. This first processing step can cause harm before the model ever sees the content. The paper calls this the Step-Zero attack.
The authors tested six models across seven harnesses. Each agent received only a file path or URL. They found most agents were unsafe: 32 out of 42 agent-model pairs exceeded a disk budget during extraction, often before the model saw any files. Network and image inputs let the input decide what file name was written.
The main finding is that current agent defenses act too late, since damage happens at the processing step itself. The authors propose a gate that counts bytes each call produces, which kept every extraction within budget while agents completed 25 out of 28 tasks.