The post inspects how mobile agent platforms run per-tenant VMs on phones: Claude Code boots a Firecracker microVM with a sealed in-guest control process and read-only harness while inference is served remotely over SSE, and Instinct rents disposable E2B KVM sandboxes running Ubuntu where the agent persists memory as a git-backed Markdown vault pushed to S3 using short-lived STS creds.

The paper generalizes Ken Thompson's trusting‑trust attack beyond compilers by constructing a complete attack that manipulates finished ELF binaries (specifically GNU strip) to implant a payload that propagates across rebuilds. They demonstrate the attack in the NixOS bootstrap: a single tampered strip seeds a payload that survives dependency pruning and backdoors nearly every binary in a built graphical installer, enabling arbitrary malicious behavior across the distribution.