The paper introduces the Agent Cross‑Layer Evidence (ACE) corpus, pairing application‑level telemetry with kernel‑level syscall traces to study agent security. It shows that kernel evidence alone is discriminative and that combining it with application‑level data outperforms either layer alone, revealing complementary signals. The study also demonstrates that this cross‑layer approach generalizes to unseen attack families and works across different agent runtimes.
By Spencer King, Zhilu Zhang, Mikhail Kuznetsov, Kay Liu, Baris Coskun, Wei Ding
arXiv:2606. 16358v1 Announce Type: cross Abstract: Agents increasingly access large language models (LLMs) through API routers.
By Sipeng Xie, Qianhong Wu, Hengrun Lu, Ziliang Sun, Qi Wu, Bo Qin, Qin Wang
ChannelGuard introduces an application‑controlled defense that inspects information at every handoff between models in multi‑agent LLM systems, eliminating the need for extra training or model calls. In over 5,700 test runs across five agent models, it stopped all attacks hidden in tool outputs, and on two open models it reduced successful prompt attacks from 80% to 3% and from 77% to 10%, without affecting accuracy on 30 math problems. The study shows that safety scores can mask very different underlying protections, and that relying solely on model or provider filters may be risky if either changes.
By Elias Hossain, Md Mehedi Hasan Nipu, Fatema Tuj Johora Faria, Shubhashis Roy Dipta, Maleeha Sheikh, Tasfia Nuzhat Ornee, Niloofar Yousefi
RouteScan is a non‑intrusive auditing framework that detects harmful behavior in Mixture‑of‑Experts (MoE) large language models by analyzing expert‑routing telemetry captured from GPU execution. It uses the number of active GPU threads during the prefilling phase as a micro‑architectural fingerprint to isolate cross‑domain risk indicators and precisely identify malicious prompts. Evaluations on four open‑source MoE LLMs show strong generalization with AUROC > 0.91 on unseen harmful domains, while privacy tests indicate that full prompts cannot be reliably recovered from aggregated telemetry.
By Bo Lv, Zhiheng Xu, KeDong Xiu, Ruyi Ding, Tianhang Zheng, Zhibo Wang, Kui Ren
ProtoArena is a new black-box benchmark that tests AI agents on 80 cross‑component vulnerability‑exploitation environments across 11 protocol and application domains and 7 attack categories. It evaluates agents at three information levels—guided reproduction, exploitation with context, and effect‑directed black‑box exploration—using a hybrid verifier that combines rule‑based checks with LLM review of traffic and logs. In experiments, Claude Opus 4.8 achieved the highest success rates, reaching 48.8% under guided conditions and 12.5% in effect‑directed black‑box scenarios, while also demonstrating significant DNSBomb optimization performance.
By Fasheng Miao, Zhaoyu Hu, Xiang Li, Changqing An, Jiutian Zeng, Longtao Huang, Haixin Duan, Jilong Wang
The paper discusses how the shift from centralized AI APIs to local edge inference enables Client‑Side Autonomous Agents (CSAAs) that collaborate in Agentic Peer‑to‑Peer (P2P) networks. Unlike traditional P2P systems that exchange static content, these networks share dynamic, heterogeneous capabilities that may be unsafe, necessitating semantic discovery, drift management, and risk‑aware execution. The authors propose a plane‑based reference architecture, signed soft‑state capability descriptors for intent‑aware routing, and a tiered verification spectrum (reputation, canary probes, cryptographic evidence) to align trust costs with task risks, showing improved workflow success in simulations.
By Taotao Wang, Lizhao You, Jingwen Tong, Chonghe Zhao, Shengli Zhang
arXiv:2607. 10490v1 Announce Type: cross Abstract: Tool-using large language model (LLM) agents are attractive for network operations, but tickets, alerts, logs, runbooks, and ChatOps messages can carry indirect prompt injections.
By Ruksat Khan Shayoni, Muhammad Faraz Shoaib, S M Asif Hossain, M. F. Mridha
arXiv:2607. 26791v1 Announce Type: cross Abstract: Large Language Model (LLM) agents are increasingly adopted in real-world security operations with access to host artifacts and command-line interfaces (CLIs), making it critical to thoroughly assess their security capabilities.
By Lehan Wang, Boli Chen, Ruixue Ding, Pengjun Xie, Jinwei Huang, Zhendong Liu, Shuo Wang, Tao Lei, Xin Ouyang, Xiaomeng Li
arXiv:2605. 02187v2 Announce Type: replace-cross Abstract: LLM agents convert model outputs into consequential actions, including communications, code changes, and financial transactions.
By Mingyu Luo, Zihan Zhang, Zesen Liu, Yuchong Xie, Zhixiang Zhang, Dung Hiu Hilton Yeung, Wai Ip Lai, Ping Chen, Ming Wen, Dongdong She
arXiv:2606. 00152v1 Announce Type: cross Abstract: LLM-based agents are rapidly advancing, autonomously invoking external tools to complete multi-step tasks for users.
By Mingxuan Zhang, Jiahui Han, Dadi Guo, Songze Li, Guanchu Wang, Na Zou, Dongrui Liu, Xia Hu
The paper "Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol" investigates how natural-language metadata in the Model Context Protocol (MCP) can be exploited to inject malicious post‑hoc logging calls into large language model agents. The authors introduce the Log-To-Leak attack, which adds an attacker‑controlled call after a legitimate tool invocation, targeting user queries, MCP server names, server responses, and agent responses. Experiments across five MCP servers and four LLM agents show high attack success rates (up to 100%) and significant logging accuracy, while existing defenses still leave substantial residual risk.
By Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du
arXiv:2603. 23171v3 Announce Type: replace-cross Abstract: Providers monitor deployed large language models (LLMs) to detect misuse that they cannot prevent.
By Toluwani Aremu, Daniil Ognev, Samuele Poppi, Nils Lukas