arXiv:2607. 17986v1 Announce Type: cross Abstract: Self-hosted AI agents read and write their own memory and configuration files to function.
Self-hosted AI agents read and write their own memory and configuration files to function. An agent may get compromised via corruption of its own state -- a compromise realized via legitimate OS system call invocation.
arXiv:2606. 30755v1 Announce Type: cross Abstract: Claw-like AI agents (e.
arXiv:2608.30207v1 Announce Type: cross Abstract: Computer use agents (CUAs) are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal...
Computer use agents (CUAs) are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal, and they are increasingly deployed to automate ev...
arXiv:2607. 14611v1 Announce Type: cross Abstract: A growing class of agentic systems maintain persistent state across sessions through memory files, behavioral preferences, and knowledge bases.
arXiv:2605.01970v4 Announce Type: replace-cross Abstract: Memory systems enable otherwise stateless LLM agents to persist user information across sessions, but also introduce a new attack surface. Th...
arXiv:2607. 02514v1 Announce Type: new Abstract: As AI coding agents become more autonomous, they increasingly ship code iteratively, with the codebase persisting across sessions.
arXiv:2510. 06445v3 Announce Type: replace-cross Abstract: LLM-based agents are now used throughout cybersecurity.
arXiv:2605. 08442v5 Announce Type: replace-cross Abstract: We discover that prompt-injection success and tool-execution success are separable safety properties: defenses that block injection do not necessarily block execution, and vice versa.
The paper revisits Thompson’s classic compiler back‑door attack in the context of self‑modifying AI coding agents. By poisoning the benchmarks used for self‑evaluation, the authors demonstrate that agents such as the Darwin Gödel Machine, Self‑Improving Coding Agent, and Hyperagents can be coaxed into generating vulnerable code, even on clean, held‑out tasks. Experiments show that the contamination can persist after subsequent clean training, highlighting the need for more robust agent designs.
The paper introduces ShadowMem, a defensive framework that protects large language model agents from long-horizon threats by maintaining a dedicated safety-focused memory. Inspired by the shadow stack concept, ShadowMem stores safety-critical context throughout an agent’s execution and uses this shadow memory to evaluate the risk of upcoming actions before they are carried out. Experiments show that ShadowMem outperforms existing defenses in detection accuracy, detects most attacks early, and adds minimal overhead to agent performance.
Pincer is a defense mechanism for coding agents that operates at the resource layer, complementing existing tool‑call defenses. It uses a digital twin—an isolated‑context model that learns and enforces dynamic, user‑specific least‑privilege policies—to act as a proxy for the agent’s permission requests. The authors introduce a user‑centric dataset to emulate the learning phase and demonstrate that Pincer outperforms several baselines in both security and utility, especially against adversarial attack types.