arXiv AI
Jul 21
Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?
arXiv:2607. 17986v1 Announce Type: cross Abstract: Self-hosted AI agents read and write their own memory and configuration files to function.
Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?
Self-hosted AI agents read and write their own memory and configuration files to function. An agent may get compromised via corruption of its own state -- a compromise realized via legitimate OS system call invocation.
Related stories
arXiv AI
Jul 1
Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens
arXiv:2606. 30755v1 Announce Type: cross Abstract: Claw-like AI agents (e.
arXiv AI
Sep 1
SIR: Self-improving Red-teaming for Compute Use Agents
arXiv:2608.30207v1 Announce Type: cross Abstract: Computer use agents (CUAs) are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal...
Hugging Face Trending Papers
Aug 31
SIR: Self-improving Red-teaming for Compute Use Agents
Computer use agents (CUAs) are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal, and they are increasingly deployed to automate ev...
arXiv AI
Jul 17
Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
arXiv:2607. 14611v1 Announce Type: cross Abstract: A growing class of agentic systems maintain persistent state across sessions through memory files, behavioral preferences, and knowledge bases.
arXiv AI
Sep 30
Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses in LLM Agents
arXiv:2605.01970v4 Announce Type: replace-cross Abstract: Memory systems enable otherwise stateless LLM agents to persist user information across sessions, but also introduce a new attack surface. Th...
arXiv AI
Sep 24
Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory
The paper introduces ShadowMem, a defensive framework that protects large language model agents from long-horizon threats by maintaining a dedicated safety-focused memory. Inspired by the shadow stack concept, ShadowMem stores safety-critical context throughout an agent’s execution and uses this shadow memory to evaluate the risk of upcoming actions before they are carried out. Experiments show that ShadowMem outperforms existing defenses in detection accuracy, detects most attacks early, and adds minimal overhead to agent performance.
arXiv AI
Jul 31
MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair
arXiv:2607. 27080v1 Announce Type: cross Abstract: Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist.
arXiv AI
Jul 3
ElephantAgent: Contextual State Continuity in Agentic Systems
arXiv:2607. 01919v1 Announce Type: new Abstract: Agentic systems enhance their capabilities by invoking external tools and maintaining persistent memory.
arXiv AI
Sep 17
Reflections on Trusting Trust, Revisited: Contaminating Self-Modifying AI Coding Agents with Poisoned Benchmarks
The paper revisits Thompson’s classic compiler back‑door attack in the context of self‑modifying AI coding agents. By poisoning the benchmarks used for self‑evaluation, the authors demonstrate that agents such as the Darwin Gödel Machine, Self‑Improving Coding Agent, and Hyperagents can be coaxed into generating vulnerable code, even on clean, held‑out tasks. Experiments show that the contamination can persist after subsequent clean training, highlighting the need for more robust agent designs.
arXiv AI
Oct 5
Pincer: Resource Authorization for Agents using a Digital Twin
Pincer is a defense mechanism for coding agents that operates at the resource layer, complementing existing tool‑call defenses. It uses a digital twin—an isolated‑context model that learns and enforces dynamic, user‑specific least‑privilege policies—to act as a proxy for the agent’s permission requests. The authors introduce a user‑centric dataset to emulate the learning phase and demonstrate that Pincer outperforms several baselines in both security and utility, especially against adversarial attack types.
arXiv AI
Jul 31
SecRespond: Benchmarking AI Agents for Real-World Post-Compromise Incident Response
arXiv:2607. 26791v1 Announce Type: cross Abstract: Large Language Model (LLM) agents are increasingly adopted in real-world security operations with access to host artifacts and command-line interfaces (CLIs), making it critical to thoroughly assess their security capabilities.