· aka: Two-Stage RCE, Surrogate-to-Constructor Chain, Stateful Compound Exploit
A compound, two-stage attack exploiting stateful agents: the first interaction injects a Unicode surrogate into persistent state to force a serialization format downgrade, and the second interaction injects a constructor payload that executes during the degraded deserialization — achieving RCE across separate agent sessions.
Arbitrary code execution in the agent runtime. The chain nature makes detection difficult because the two stages can be separated by hours or days, and neither stage alone appears malicious.
Agent with persistent state across sessions. Serializer with format fallback behavior. Attacker ability to inject content into agent state (via prompt, tool output, or memory write).
🔒 Full defence implementations available through the NAIL SDK.