arXiv AI
Jun 6
CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents
arXiv:2601. 09923v3 Announce Type: replace Abstract: AI agents are vulnerable to prompt injection attacks, where malicious content hijacks agent behavior.
Securing Computer-Use Agents Against Branch Steering Attacks
Related stories
arXiv AI
Jun 9
SecureClaw: Clawing Back Control of LLM Agents
arXiv:2606. 09549v1 Announce Type: cross Abstract: Tool-using large language model (LLM) agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final output check can intervene.
arXiv AI
Jul 21
STAC: When Innocent Tools Form Dangerous Chains for LLM Agents
arXiv:2509. 25624v3 Announce Type: replace-cross Abstract: As LLMs advance into autonomous agents with tool-use capabilities, they introduce security challenges that extend beyond traditional content-based LLM safety concerns.
arXiv AI
Jul 1
Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens
arXiv:2606. 30755v1 Announce Type: cross Abstract: Claw-like AI agents (e.
arXiv AI
Sep 23
ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
ActGov is a runtime enforcement framework that validates each action proposed by a large language model (LLM) agent before it interacts with external tools, ensuring that actions stay within task‑scoped authorization boundaries and comply with dynamically constructed policies. It builds policies from tool specifications, benign tasks, and failure traces, verifying updates via SMT‑based counterexample checking. In evaluations on AgentDojo and AgentDyn benchmarks, ActGov consistently reduces indirect prompt‑injection attack success while maintaining task utility, outperforming existing defenses.
arXiv AI
Aug 26
WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents
WebMCP-Phalanx introduces a dual‑layer runtime for browser‑integrated LLM agents that enforces trust boundaries on web‑exposed tools. The first layer uses cryptographic capability credentials to bind tools to their registering principals and propagate provenance labels, while the second layer separates semantic inspection from privileged tool use via a Quarantine Agent that validates tool metadata before a Privileged Agent can execute it. Empirical results show the approach eliminates revocation and overwrite attacks, blocks most prompt‑injection attempts, and maintains task utility comparable to a no‑attack baseline.
arXiv AI
Sep 30
ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents
arXiv:2609.37196v1 Announce Type: cross Abstract: Tool-using LLM agents remain vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context, allow...
arXiv AI
Jun 10
Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
arXiv:2606. 10749v1 Announce Type: cross Abstract: Large language model (LLM) agents are rapidly moving from conversational interfaces to software components that plan, invoke tools, maintain memory, and act on external environments.
arXiv AI
Sep 1
SIR: Self-improving Red-teaming for Compute Use Agents
arXiv:2608.30207v1 Announce Type: cross Abstract: Computer use agents (CUAs) are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal...
Hugging Face Trending Papers
Sep 21
ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
Large language model (LLM) agents increasingly execute long-horizon workflows through external tools, allowing untrusted outputs to influence subsequent actions and exceed user authorization. Existing...
arXiv AI
Jul 28
Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents
arXiv:2607. 24625v1 Announce Type: cross Abstract: Autonomous LLM agents processing mixed-confidentiality data face severe security risks from prompt injection attacks and reasoning errors.
Hugging Face Trending Papers
Aug 31
SIR: Self-improving Red-teaming for Compute Use Agents
Computer use agents (CUAs) are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal, and they are increasingly deployed to automate ev...