The Trust Boundary You Forgot You Had: Threats Posed by AI-Coded Plugins and DAW Workstations, and a Human-in-the-Loop Architecture for Stopping Them
Year: 2026
Type: article
Abstract: Paper Description Title: The Trust Boundary You Forgot You Had: Threats Posed by AI-Coded Plugins and DAW Workstations, and a Human-in-the-Loop Architecture for Stopping Them Authors: Lewis James Seals Jr. and Angela La’Vette Seals Full description (for submission metadata, program listings, or repository README): Digital audio workstations and their plugin ecosystems have quietly become one of the least defended executable supply chains in professional computing. Plugins are native code loaded into the DAW host process with the full privileges of the logged-in user; MCP servers now hand large language models write, render, and shell access to live sessions; and AI coding agents have made the production and distribution of new plugin binaries routine. This paper synthesizes the empirical record of the resulting attacks — the Zrythm repository compromise, the Phantom-Audio MCP path-traversal and decompression-bomb vulnerabilities, the Suno breach affecting 55.3 million accounts, the DinDoor campaign impersonating Ableton Live and Kontakt installers, GlassWorm’s poisoning of the developer-extension registries, the Sound Radix credential exposure, and caption-poisoning attacks on retrieval-augmented text-to-music systems — into a five-part threat taxonomy: supply-chain compromise, agentic tool-boundary violation, resource-exhaustion and decompression amplification, data-integrity and caption poisoning, and credential theft. It then analyzes the structural reasons the DAW workstation is uniquely exposed: in-process plugin execution, broad filesystem permissions, unbounded audio ingestion, weak installer verification, high-value project data with low-backup culture, and the collapse of the boundary between developer and musician toolchains. The paper’s constructive contribution is a defensive architecture grounded in the Watchtower Pattern, a detection-and-review system that observes, scores, explains, and queues findings while reserving every consequential action for a human reviewer. The authors extend Watchtower’s threat model to music production and specify five implementable, stdlib-only detection rules — MCP output-path confinement, audio decompression amplification thresholds, caption and prompt poisoning indicators, unpinned package installation in startup scripts, and unauthenticated control-endpoint exposure — together with a DAW baseline profile and integration into the existing scoring and review queue. The central argument is that automated enforcement in a creative environment will eventually destroy a session, a project, or a career, and that an advisory tier which fires an action is not advisory at all. Security in a studio, like security in a SOC, must be the presence of judgment rather than the absence of risk. Short description (one to two sentences): AI-coded plugins and MCP-connected DAW workstations have turned the plugin folder into an executable trust boundary. This paper documents the resulting attacks — from Phantom-Audio path traversal to Suno and DinDoor — and specifies a human-in-the-loop detection architecture based on the Watchtower Pattern. Keywords: DAW security, VST3, plugin supply chain, Model Context Protocol, AI coding agents, prompt injection, decompression bomb, caption poisoning, human-in-the-loop detection, Watchtower Pattern Suggested GitHub repository description (≤350 characters): A paper by Lewis James Seals Jr. and Angela La’Vette Seals on threats from AI-coded plugins and MCP-connected DAW workstations — supply-chain compromise, path traversal, decompression bombs, caption poisoning — and a human-in-the-loop Watchtower detection architecture for stopping them. Advisory only; humans decide.
Language: English
Subfield: Hardware and Architecture
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225783461
FWCI:
Cites:
Cited by:
Related to: