I&#x27;m not talking about a &quot;trusting trust&quot; attack, which is difficult to pull off and requires special compiler knowledge because it needs to survive bootstrapping.<p>Here the attacker just needs to patch a binary once and he already has complete control over the machine, so he has an infinite number of options: from simply manually replacing the binary file before it&#x27;s uploaded to the website, to replacing gcc with a script that patches the source code before calling the original gcc.