Mar 22, 2026
Supply Chain Malware as Ground Truth: A Trace-Based Agent Safety Monitor Trained on Real Credential Exfiltration Patterns
Selim Sevim
Existing agent safety monitors evaluate tool calls in isolation, rely on keyword filtering, or require expensive frontier model inference per action. All three approaches share a common weakness: they lack labeled training data from real agent attacks.
We observe that this labeling problem has already been solved in an adjacent domain. Malicious PyPI packages execute credential exfiltration through the same behavioral sequence a misaligned agent would use: read environment variables or sensitive files, optionally encode the data, transmit it to an external endpoint. The behavioral trace is structurally analogous to what we want to detect in agents.
We repurpose DataDog's malicious-software-packages-dataset (2,339 packages, 2023-2024) as ground-truth training data for an agent safety monitor. A static AST parser extracts 339 verified exfiltration traces. We fine-tune Phi-3-mini (3.8B) with QLoRA on a balanced dataset, using an autoresearch-style hyperparameter search loop that evaluated 54 configurations overnight on a single GPU ($18 total compute).
On a 30-example hand-written test set isolated before training, the fine-tuned model achieves FNR=0.00 and FPR=0.10, compared to a regex baseline with FNR=0.15 and FPR=1.00. Cost-weighted score: 1 vs 40.
The primary contribution is the reframe: software supply chain malware is a labeled dataset of real-world agent exfiltration attacks. The transfer requires only a vocabulary mapping and a filtering step.
No reviews are available yet
Cite this work
@misc {
title={
(HckPrj) Supply Chain Malware as Ground Truth: A Trace-Based Agent Safety Monitor Trained on Real Credential Exfiltration Patterns
},
author={
Selim Sevim
},
date={
3/22/26
},
organization={Apart Research},
note={Research submission to the research sprint hosted by Apart.},
howpublished={https://apartresearch.com}
}
