A carrier must survive weekly re-fetches and internal re-copies, not one run: how does that change the attacker's pick?

## Two different objectives, two different selections A carrier choice is only well-posed once you fix the payoff. For a **one-shot** effect, the carrier has to cross the pipeline **once**. For **durable redelivery** it has to cross the pipeline **every cycle**, and often survive copies made after the pipeline is done. These are different optimisation problems, and the leaf's payoff is explicitly the second: a carrier that keeps arriving intact across weekly republications and downstream copies, so the prize is measured in repeat delivery over months. Consider a research agent that re-fetches public pages each week and republishes an internal brief that colleagues then read, quote and paste into other documents. The attacker controls a public page. The question is which carrier maximises **repeat** delivery, not a single hit. ## What durability adds to the selection ### Survive the recurring path, not one traversal The weekly path is the same chain run again and again. Any stage that only *sometimes* strips a carrier is now a slow-acting filter: over enough weeks it will catch a fragile carrier at least once, and one catch can end the campaign if it also triggers a look. So the attacker down-weights carriers with probabilistic survival and prefers ones that survive the recurring chain **deterministically**. ### Prefer stable, re-read fields The carrier should sit in a field the agent re-reads verbatim every cycle on a resource the attacker can keep up. A carrier tied to a transient, a one-time redirect or a page likely to be edited by someone else, decays. Durability rewards a **stable host field** as much as a surviving carrier class. ### Survive human re-copying downstream Because the republished brief is copied onward by people, the carrier ideally survives an ordinary copy-and-paste and re-storage by a human who is not attacking anything. That is a different transform from the machine pipeline: it can preserve some carriers that a rasterise would have killed, and destroy others. The attacker who wants reach across those copies weights for it. ### Avoid the manual touch in the recurring path If the republish path includes any human review or re-export, that step runs every week too. A carrier a reviewer would flatten, or a re-export would re-encode away, is a poor durable choice precisely because the fragile step recurs. A one-shot attacker might gamble on a busy reviewer once; a durable attacker cannot, because the gamble is repeated until it loses. ## The trade the attacker actually makes Durable selection trades **peak stealth for repeatability.** The most invisible carrier is not the goal; the goal is the carrier with the best product of *survives the recurring chain* and *survives downstream copies* over the campaign's lifetime. Sometimes that is a slightly less clever carrier in a very stable field, chosen because it clears the chain every single week without depending on a stage behaving a particular way. ## Why an interviewer asks this It separates candidates who think of an injection as a single event from those who think of it as a **campaign against a recurring pipeline.** The senior insight is that the objective reshapes the selection: when the prize is months of redelivery, carrier choice becomes a bet on the stability of a host field and the determinism of survival across many identical runs and many human copies, not a bet on cleverness in one traversal. Note this is about the carrier surviving the recurring *pipeline and copies*, not about a technique transferring across model versions, which is a different question owned elsewhere.