arXiv AI
Jul 1
Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens
arXiv:2606. 30755v1 Announce Type: cross Abstract: Claw-like AI agents (e.
From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes
arXiv:2606. 29073v1 Announce Type: cross Abstract: Model Context Protocol (MCP)-style ecosystems give language-model applications a practical connection layer for tools, resources, prompts, and transports.
Related stories
arXiv AI
Sep 23
Zero-Trust Authorization and Discovery for Enterprise MCP
arXiv:2609.22573v1 Announce Type: cross Abstract: LLM agents translate natural-language context, which may include attacker-controlled text, into privileged tool calls, so authorization must remain e...
arXiv AI
Jun 10
GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines
arXiv:2606. 09935v1 Announce Type: cross Abstract: AI-powered agents are increasingly embedded in continuous integration and continuous delivery/deployment (CI/CD) pipelines to autonomously review pull requests (PRs), triage issues, and maintain codebases.
arXiv AI
Jun 2
Attested Tool-Server Admission: A Security Extension to the Model Context Protocol
arXiv:2605. 24248v2 Announce Type: replace-cross Abstract: The Model Context Protocol (MCP) standardizes how a large-language-model (LLM) agent and an external tool server exchange messages, but not trust: a host reads a server's self-declared tool list and dispatches calls, with no notion of which servers it may use, at what sensitivity, or which of a server's tools are in bounds.
arXiv AI
Aug 26
TrustShiftProbe: Characterizing, Benchmarking, and Defending Staged Trust Attacks on MCP Servers
The paper introduces TrustShiftProbe, a framework that characterizes and defends against staged trust attacks on Model Context Protocol (MCP) servers. It defines a temporal threat model where a compromised server behaves benignly during conditioning and later delivers adversarial payloads, and presents a multi‑tier runtime defense called SHIELD that reduces attack success from 69.5% to 42.7%. The work also provides a taxonomy of nine TrustShift variants across different execution mechanisms and objectives.
arXiv AI
Aug 24
ClawSentry: A Progressive Multi-Tier Security Monitor for Safeguarding Autonomous LLM Agents
ClawSentry is an open‑source, framework‑agnostic security supervision gateway designed to protect autonomous large language model (LLM) agents from progressive risks that can arise at four points in the agent control loop: skill admission, invocation‑time intent, execution‑time effect, and post‑action consequence. It introduces a multi‑tier decision engine—deterministic L1, rule‑anchored L2, and read‑only L3—alongside a First‑Use Skill Package Review (FSPR) and an Agent Harness Protocol (AHP) that applies a single policy across multiple agent runtimes without modifying their internals. Evaluation on SkillInject and the SkillsSafety benchmark shows that ClawSentry significantly reduces contextual adversarial skill risk (ASR) while maintaining high task success rates (TSR).
arXiv AI
Jul 8
Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations
arXiv:2607. 05744v1 Announce Type: cross Abstract: The Model Context Protocol (MCP) is the dominant way coding agents discover and invoke external tools.
arXiv AI
3d ago
ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents
arXiv:2609.37196v1 Announce Type: cross Abstract: Tool-using LLM agents remain vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context, allow...
arXiv AI
Jun 30
ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation
arXiv:2605. 26542v2 Announce Type: replace-cross Abstract: Tool-using agents increasingly operate in open-ended deployment environments, where they compose file systems, web APIs, code interpreters, and enterprise services at runtime.
arXiv AI
Sep 23
ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
ActGov is a runtime enforcement framework that validates each action proposed by a large language model (LLM) agent before it interacts with external tools, ensuring that actions stay within task‑scoped authorization boundaries and comply with dynamically constructed policies. It builds policies from tool specifications, benign tasks, and failure traces, verifying updates via SMT‑based counterexample checking. In evaluations on AgentDojo and AgentDyn benchmarks, ActGov consistently reduces indirect prompt‑injection attack success while maintaining task utility, outperforming existing defenses.
Hugging Face Trending Papers
Sep 21
ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
Large language model (LLM) agents increasingly execute long-horizon workflows through external tools, allowing untrusted outputs to influence subsequent actions and exceed user authorization. Existing...
arXiv AI
Jun 2
AgentRedBench: Dynamic Redteaming and Integration-Aware Defense for LLM Agents over SaaS Integrations
arXiv:2606. 02240v1 Announce Type: cross Abstract: Indirect prompt injection in tool-use agents is a concrete production threat: LLM agents read from integrations (third-party services such as Gmail, Salesforce, or Jira accessed through tool calls) whose response content the user neither writes nor controls.