awesome-agent-skills-security

# Awesome Agent Skills Security [](https://awesome.re) > 🛡️ A curated list of resources on securing AI agent tool use and skill ecosystems — attacks, defenses, frameworks, benchmarks, and standards. AI agents increasingly use external tools, plugins, and skills to interact with the world. This creates a new attack surface: **agent skills security**. This list covers the threats, defenses, and research landscape for securing these capabilities. ## Contents - [Threat Frameworks & Standards](#threat-frameworks--standards) - [Surveys & Systematizations](#surveys--systematizations) - [Attack Research](#attack-research) - [Prompt Injection via Tools](#prompt-injection-via-tools) - [Tool Poisoning & Supply Chain](#tool-poisoning--supply-chain) - [Privilege Escalation & Excessive Agency](#privilege-escalation--excessive-agency) - [Data Exfiltration & Privacy](#data-exfiltration--privacy) - [Indirect Prompt Injection](#indirect-prompt-injection) - [Cross-Plugin Attacks](#cross-plugin-attacks) - [Backdoor Attacks on Agents](#backdoor-attacks-on-agents) - [Agent Deception & Manipulation](#agent-deception--manipulation) - [Jailbreaking & Guardrail Bypass](#jailbreaking--guardrail-bypass) - [Defense Research](#defense-research) - [Permission & Access Control](#permission--access-control) - [Runtime Monitoring & Sandboxing](#runtime-monitoring--sandboxing) - [Input/Output Validation](#inputoutput-validation) - [Formal Verification & Analysis](#formal-verification--analysis) - [Evaluation & Red Teaming](#evaluation--red-teaming) - [Benchmarks & Datasets](#benchmarks--datasets) - [Tools & Frameworks](#tools--frameworks) - [Agent Skill Specifications](#agent-skill-specifications) - [Industry Reports & Blog Posts](#industry-reports--blog-posts) - [Related Awesome Lists](#related-awesome-lists) - [Contributing](#contributing) --- ## Threat Frameworks & Standards - **[OWASP Agentic AI Threats and Mitigations](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)** — First in a series from the OWASP Agentic Security Initiative (ASI), providing threat-model-based reference for agentic threats. - **[OWASP Top 10 for LLM Applications](https://owasp.org/www-project-top-10-for-large-language-model-applications/)** — Includes LLM01: Prompt Injection, LLM06: Excessive Agency, LLM07: Insecure Plugin Design, LLM08: Excessive Autonomy. - **[OWASP Agentic Skills Top 10 (AST10)](https://owasp.org/www-project-agentic-skills-top-10/)** — OWASP incubator project, v1.0 (2026 edition). First standards-body enumeration of risks specific to agent skills rather than agents in general, running from AST01 Malicious Skills to AST10 Cross-Platform Reuse, with AST01 and AST02 (Supply Chain Compromise) rated critical; scopes to the skill layer where the OWASP Agentic AI Threats entry above covers agents broadly. - **[MITRE ATLAS™](https://atlas.mitre.org/)** — Adversarial Threat Landscape for AI Systems. Tactics, techniques, and case studies for attacks on ML/AI systems. - **[NIST AI Risk Management Framework](https://www.nist.gov/artificial-intelligence/ai-risk-management-framework)** — Federal framework for managing AI risks, including autonomous agent risks. - **[NIST SP 800-218A: Secure Software Development for AI](https://csrc.nist.gov/pubs/sp/800/218/a/final)** — Secure development practices specific to AI-enabled systems. - **[EU AI Act](https://artificialintelligenceact.eu/)** — European regulation with specific provisions for high-risk AI systems including autonomous agents. - **[Anthropic Responsible Scaling Policy](https://www.anthropic.com/index/anthropics-responsible-scaling-policy)** — AI Safety Levels (ASL) framework addressing agent capability thresholds. - **[IETF draft-klrc-aiagent-auth-01: AI Agent Authentication and Authorization](https://datatracker.ietf.org/doc/draft-klrc-aiagent-auth/)** — Kasselman et al., IETF WIMSE-adjacent, 2026. Proposes a model for authentication and authorization of AI agent interactions using existing OAuth 2.0 and WIMSE standards; covers delegation chains, agent identity, and trust establishment without defining new protocols. - **[IETF draft-niyikiza-oauth-attenuating-agent-tokens-00: Attenuating Authorization Tokens for Agentic Delegation Chains](https://datatracker.ietf.org/doc/draft-niyikiza-oauth-attenuating-agent-tokens/)** — Niyikiza (Tenuo), OAuth WG, March 2026. Defines Attenuating Authorization Tokens (AATs): JWT-based credentials encoding tool-level argument constraints with a cryptographically enforced monotonic attenuation invariant — any holder can derive a more restrictive token but never a more permissive one. Extends Rich Authorization Requests (RFC 9396) with delegation-chain semantics. - 📄 **[Certifying Ghosts: How Cybersecurity AI Agents Break the EU Cyber Resilience Act](https://arxiv.org/abs/2607.07109)** — Mayoral-Vilches, 2026. Argues autonomous vulnerability-discovery-and-exploitation agents invalidate the EU Cyber Resilience Act's core assumptions of slow, human-paced disclosure and fixed product security states, contending that because attackers and defenders now wield identical AI capabilities, meaningful compliance requires continuous agent-operated monitoring rather than static certification. ## Surveys & Systematizations - 📄 **[A Survey on LLM-based Autonomous Agents: Common Attacks and Defenses](https://arxiv.org/abs/2402.09283)** — Wu et al., 2024. Comprehensive taxonomy of attacks on LLM agents across perception, cognition, and action stages. - 📄 **[Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents](https://arxiv.org/abs/2410.02644)** — Zhang et al., 2024. Formalization of 10 attack scenarios, 10 agents, 398 adversarial environments. - 📄 **[Security of AI Agents](https://arxiv.org/abs/2406.08689)** — He et al., 2024. Systematization of knowledge covering threat models for AI agents with tool access. - 📄 **[Not All Agents Are Created Equal: A Survey on Software-use Agent Security](https://arxiv.org/abs/2502.02761)** — Hua et al., 2025. Survey specifically on software-use agents and their unique security challenges. - 📄 **[A Survey on the Honesty of Large Language Models](https://arxiv.org/abs/2409.18786)** — Xie et al., 2024. Covers agent deception, sycophancy, and honesty in tool-use contexts. - 📄 **[A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models](https://arxiv.org/abs/2402.13457)** — Xu et al., 2024. Systematic study of jailbreak attacks relevant to agent guardrail bypass. - 📄 **[Prompt Injection Attacks and Defenses in LLM-Integrated Applications](https://arxiv.org/abs/2310.12815)** — Liu et al., 2024. Comprehensive taxonomy of injection attacks across direct and indirect vectors. - 📄 **[The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies](https://arxiv.org/abs/2407.19354)** — Gan et al., 2024. Survey with practical case studies of security failures. - 📄 **[Self-Evolving Agents: A Survey](https://arxiv.org/abs/2504.01641)** — Gao et al., 2025. How self-evolving agents create emergent security risks. - 📄 **[Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies](https://arxiv.org/abs/2606.23075)** — Lin et al., 2026. Uses a Module-Lifecycle Attack Surface matrix to show self-evolution transforms attack persistence from session-bounded to permanent — adversarial effects become encoded across generations, self-amplify, and propagate through agent populations without sustained attacker access, with 17 of 25 attack vectors rated critical. - 📄 **[From Thinker to Society: Security in Hierarchical Autonomy Evolution of AI Agents](https://arxiv.org/abs/2603.07496)** — Zhang et al., 2026. Hierarchical Autonomy Evolution (HAE) framework organizing agent security into cognitive, execution, and societal tiers. - 📄 **[Characterizing Faults in Agentic AI: A Taxonomy of Types, Symptoms, and Root Causes](https://arxiv.org/abs/2603.06847)** — Shah et al., 2026. Empirical taxonomy of reliability failures in agentic AI systems combining LLM reasoning with tool invocation. - 📄 **[Security Considerations for Multi-agent Systems](https://arxiv.org/abs/2603.09002)** — 2026. Systematic threat landscape of MAS with 193 threat items across 9 categories; evaluates 16 frameworks finding none achieves majority coverage. - 📄 **[The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey](https://arxiv.org/abs/2603.11088)** — Kim et al., USENIX Security 2026. First systematic survey of AI agent security covering design space, attack landscape, and defense mechanisms with case studies on securing agentic systems. - 📄 **[Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats](https://arxiv.org/abs/2603.11619)** — Deng et al., 2026. Five-layer lifecycle-oriented security framework analyzing compound threats across initialization, input, inference, decision, and execution stages of autonomous LLM agents. - 📄 **[OpenClaw as Language Infrastructure: A Case-Centered Survey of a Public Agent Ecosystem in the Wild](https://www.preprints.org/manuscript/202603.1060)** — He et al., Preprints 2026. Case-centered survey of the OpenClaw public-agent ecosystem whose Security dimension synthesizes governance, skill-supply-chain (ClawHub), and deployment risks of an open skill ecosystem alongside Platform, Societies, and Deployment. - 📄 **[AgenticCyOps: Securing Multi-Agentic AI Integration in Enterprise Cyber Operations](https://arxiv.org/abs/2603.09134)** — Mitra et al., 2026. Holistic architectural security framework decomposing attack surfaces across component, coordination, and ecosystem layers of enterprise multi-agent systems. - 📄 **[MCP-in-SoS: Risk Assessment Framework for Open-Source MCP Servers](https://arxiv.org/abs/2603.10194)** — Kumar et al., 2026. System-of-systems risk assessment framework for evaluating security risks of open-source MCP server deployments in production agent systems. - 📄 **[SoK: The Attack Surface of Agentic AI — Tools, and Autonomy](https://arxiv.org/abs/2603.22928)** — Dehghantanha & Homayoun, 2026. Systematization mapping trust boundaries and security risks of agentic LLM systems; proposes taxonomy spanning prompt injection, RAG poisoning, tool exploits, and multi-agent threats with metrics like Unsafe Action Rate and Privilege Escalation Distance. - 📄 **[Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation](https://arxiv.org/abs/2606.10749)** — Ling et al., 2026. Systems-oriented synthesis of 247 papers organizing LLM agent security around information flow, delegated authority, and persistent state, identifying prompt injection and tool-mediated hijacking as dominant threats while flagging emerging state-corruption and multi-agent propagation risks. - 📄 **[Data Agents Under Attack: Vulnerabilities in LLM-Driven Analytical Systems](https://arxiv.org/abs/2606.08661)** — Wang et al., 2026. Systematic security study of LLM data agents identifying eight risks across interpretation, execution, and policy layers plus an attack taxonomy of fourteen techniques, demonstrating substantial gaps across six open-source and production analytics platforms. - 📄 **[Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents](https://arxiv.org/abs/2606.26627)** — Lahjouji & Colaco, 2026. Organizes privacy research in LLM agents around data sources rather than attack types — spanning database queries, external APIs, and inter-agent communication — and identifies governance gaps including the need for information-flow control and benchmarks covering an agent's complete data ecosystem. - 📄 **[Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations](https://arxiv.org/abs/2606.15008)** — Jamshidi et al., 2026. Empirical security analysis of a self-hosted multi-agent LLM system where model outputs trigger privileged operations, measuring compromise probability, boundary failures, and privilege drift as attacker capability and agent count scale. - 📄 **[LLM Agents Security Duality: A Comprehensive Survey of Self-Security and Empowered Cybersecurity](https://arxiv.org/abs/2606.28450)** — Xu et al., 2026. 73-page survey mapping the dual role of LLM agents in security — cataloguing agent-facing vulnerabilities and mitigations while examining how the same agents empower offensive and defensive cybersecurity, and highlighting the tension between self-protection and capability. - 📄 **[Agent Security Meets Regulatory Reality: A Practitioner Systematization of Autonomous-Agent Threats and Controls in Regulated Financial Systems](https://arxiv.org/abs/2606.29142)** — Mohan & Srinivasa, 2026. Maps agentic threats (prompt injection, agent identity, auditability, tool abuse, data residency) to financial-sector regulatory requirements and documents production agent-to-agent patterns and controls for compliance-bound deployments. - 📄 **[The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities](https://arxiv.org/abs/2607.05743)** — Rashidi, 2026. Systematizes 39 execution-security papers (2023–2026) on AI coding agents that read repositories, call tools, and run shell commands with limited oversight, exposing fragmentation across isolation, access control, TOCTOU, and MCP threat research along with five critical gaps including the absence of shared benchmarks for evaluating isolation architectures. - 📄 **[Security and Privacy in Agentic AI: Grand Challenges and Future Directions](https://arxiv.org/abs/2607.06608)** — Jenkins et al., 2026. Horizon-scanning report from thirty international experts across academia, industry, and government identifying the grand challenges and future research directions for the security and privacy of increasingly agentic AI. - 📄 **[Trust but Verify? Uncovering the Security Debt of Autonomous Coding Agents](https://arxiv.org/abs/2607.12428)** — Sakib et al., 2026. Empirical study of thousands of agent-authored pull requests finding 38.9% contain at least one security smell (misconfigurations, leaked credentials, supply-chain issues), with human collaborators introducing the majority of leaked secrets in agent-assisted workflows. - 📄 **[Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation](https://arxiv.org/abs/2607.13987)** — Badhe & Tiwari, 2026. Introduces SkillSec-Eval, a lifecycle framework for evaluating security of reusable LLM agent skills with a threat taxonomy spanning repository admission, semantic retrieval, planner selection, execution, and skill evolution — showing risks extend well beyond the runtime execution stage. - 📄 **[The Ethics of Autonomous AI Agents for Offensive Security](https://arxiv.org/abs/2607.20255)** — Happe et al., FAIEMA 2026. Analyzes how LLM-driven offensive-security agents introduce indeterminacy across their non-deterministic policies, open-ended impact, and a collapsing operator skill floor, arguing this combination industrializes offensive capability, diffuses moral attribution among users, tool-makers, and third parties, and outstrips existing dual-use and AI-ethics frameworks. - 📄 **[The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI](https://arxiv.org/abs/2607.19433)** — Narayan et al., 2026. Formalizes a threat model for persistence-based attacks on stateful agents — including memory injection (MINJA) and sleeper-agent behaviors that decouple the attack vector from the eventual harmful event — and synthesizes a defense-in-depth landscape spanning trajectory guardrails (AgentDoG), formal temporal verification (Agent-C), immunological memory consensus (A-MemGuard), and hardware-anchored trust via GPU TEEs and zero-trust memory. - 📄 **[Engineering Trustworthy Agentic AI for Critical Systems](https://arxiv.org/abs/2607.18548)** — Al-Refai et al., 2026. Survey treating trustworthiness as a first-class engineering property for agentic systems in constraint-bound domains, organizing threats, trust mechanisms, and quantitative metrics across five dimensions (safety, robustness, transparency, accountability, and privacy/security) and mapping them onto an assurance workflow examined across power systems, autonomous vehicles/robotics, HPC, and communication networks. - 📄 **[Agent Security Needs Redefinition through a Holistic Framework](https://arxiv.org/abs/2607.22024)** — Siu et al., ICML 2026. Position paper arguing agent security is fundamentally contextual rather than content-based — the same action (e.g., "delete user data") can be a routine request or an injection depending on authorization context — and operationalizes it through four jointly-held, trajectory-continuous properties (Source Authorization, Task Alignment, Action Alignment, Data Isolation), under which indirect prompt injection becomes a Source Authorization violation and snapshot benchmarks are shown structurally incapable of evaluating Data Isolation. - 📄 **[An Empirical Study of Model Context Protocol Applications](https://arxiv.org/abs/2607.25635)** — Majeed et al., 2026. Large-scale study of 1,723 MCP client applications mined from GitHub finding that while most configure servers via files (85.2%) and use an official SDK (81.1%), human oversight diverges sharply — only 37.2% gate tool execution behind a blocking approval step, leaving the LLM able to invoke any enabled tool unconditionally in most apps. - 📄 **[Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation](https://arxiv.org/abs/2607.28226)** — Liu et al., 2026. Survey tracing threats across the world-model lifecycle of embodied AI agents — from data construction and representation learning through state grounding, imagination, trajectory evaluation, execution, and tool/memory-based adaptation — showing how poisoning, backdoors, prompt injection, sensor spoofing, trajectory manipulation, and supply-chain attacks take on distinct meanings when they corrupt world states, and structuring defenses across provenance, robust grounding, uncertainty-aware prediction, trajectory gating, feedback auditing, and deployment assurance. - 📄 **[From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems](https://arxiv.org/abs/2608.00202)** — Malla & Siby, 2026. Proposes a taxonomy of attack vectors specific to web-based multi-agent systems (MAS) and releases the WebMASLab test-bed to isolate architecture's effect on security by holding task, tool surface, and browser substrate fixed; introduces a MAS-specific Telephone Loop attack that exploits cross-agent delegation to create cyclical task loops — inert against single-agent setups yet compromising MAS at ~80% baseline across three of four frontier models — and shows obvious defenses like prompt-hardening fail to generalize. - 📄 **[The Vulnerability With No CVE: Managing Persistent Gaps Between Mandate and Authority in AI Coding Agents](https://arxiv.org/abs/2608.05884)** — 2026. Proposes the agentic posture vulnerability (APV) as a task-conditioned vulnerability-management abstraction — a durable record for a composed agent-control exposure that outlives any single event and stays open until authority is narrowed, a missing control is added, risk is accepted, or closure is verified — operationalizing existing excessive-agency, authorization, and control-composition weaknesses into six recurring patterns, a vulnerability lifecycle, and a control-and-closure matrix. - 📄 **[On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models](https://arxiv.org/abs/2608.10530)** — Hossain et al., 2026. PRISMA 2020 systematic review of 85 agentic-LLM security papers (2023–2025) finding attack research outpaces defense 3.9:1; contributes a four-layer taxonomy (perception, brain, action, interaction) of 13 vulnerability types and shows perception-layer flaws (prompt injection, jailbreaking) dominate the literature while action-layer risks (tool misuse, code injection, sandbox escape) remain understudied relative to real-world impact. - 📄 **[When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling](https://arxiv.org/abs/2608.17275)** — Karanjai et al., 2026. Attack-surface survey of AI agents operating on blockchain networks through MCP, skills, and tool calling, arguing that blockchain properties like irreversibility and continuous autonomy qualitatively change the agent threat model relative to conventional software and mapping the resulting vulnerabilities across the tool-calling stack. - 📄 **[A2ABreak: Systematic Security Analysis of the A2A Protocol](https://arxiv.org/abs/2609.10871)** — Lotfi et al., 2026. First rigorous systematic security analysis of the Linux-Foundation-governed Agent2Agent (A2A) protocol — the emerging inter-agent communication layer complementing MCP — using LLM-assisted extraction of a verified finite-state machine (37 states, 76 transitions from 929 formalized statements) directly from the natural-language specification, then reasoning over the model to discover protocol-level vulnerabilities in cross-organizational agent discovery, authentication, and task delegation. - 📄 **[When Passing Tests Hides Vulnerabilities: An Empirical Study of Silent Failures in Agentic Systems](https://arxiv.org/abs/2609.10548)** — Bai et al., 2026. Empirical study of LLM-based agentic code-repair patches that pass syntactic and functional verification yet still retain or introduce security vulnerabilities; across 1,030 execution traces from seven agent frameworks on SecurityEval and CVEfixes, identifies 170 confirmed "silent failures" and categorizes them (omission, incomplete fix, and newly introduced flaws), showing test-passing is an unsafe proxy for security in agent-authored code. - 📄 **[Trustworthy Agentic AI: A Comprehensive Cybersecurity and Systems Survey on Threat Landscapes, Defense Architectures, and Open Challenges](https://arxiv.org/abs/2609.13731)** — Mostafavi, 2026. Synthesizes 206 studies and standards into a systems-security reference framework, formalizing the agent as a stateful 5-tuple and a 6-dimensional trustworthiness taxonomy, then analyzing threat surfaces across intra-execution loops and interaction planes and proposing a multi-layered zero-trust defense-in-depth architecture (Dual-LLM isolation, capability-based access control, kernel eBPF probes, sandboxed runtimes) mapped to international governance frameworks. - 📄 **[Authorization Architectures for Tool-Using AI Agents](https://arxiv.org/abs/2609.15906)** — Surapani et al., 2026. Structured narrative review of 89 primary sources introducing a principal hierarchy (human user, operator/deployer, orchestrator, sub-agent, tool endpoint) and five interdependent layers — agent identity and credential lifecycle, delegation and scope propagation across multi-hop chains, runtime enforcement and just-in-time authorization at policy enforcement points, prompt injection as authorization bypass, and auditability/provenance/non-repudiation — deriving seven structural requirements and a four-layer reference architecture, with runtime enforcement and aggregation bounds as the principal open gaps. - 📄 **[SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration](https://arxiv.org/abs/2609.12413)** — Mia et al., 2026. Systematization reframing jailbreak security around the full agentic execution pipeline (user interaction, planning, memory, tool use, inter-agent communication) with unified attack/defense taxonomies and a security–utility–efficiency framework, finding that strong native alignment does not imply adversarial robustness and that low final-response attack success can mask severe intermediate compromise of planning, memory, and tool interactions. - 📄 **[After the Party: Governing What a Viral Agent-Skill Ecosystem Left Behind](https://arxiv.org/abs/2609.17274)** — Xiong & Zhang, APSEC 2026. Measures the aftermath of the 2026 OpenClaw skill-registry boom using Git history, GitHub issues/PRs, and three ClawHub snapshots, finding attention concentrated (top 10% of skills drew 46.93% of downloads), scrutiny absent (77.86% have zero stars/comments while 85.06% of readable skills carry privilege evidence), and automated cleanup unready — three security scanners disagreed on 23,702 of 61,990 shared skills, with weighted sensitivity of only 21.67–61.06% after human adjudication. - 📄 **[SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes](https://arxiv.org/abs/2609.19705)** — Wang & Saxena, 2026. Argues agentic-AI security studies are too domain-agnostic for high-stakes settings and presents FARSIGHT, a scheme-level framework evaluating financial LLM trading agents on robustness under market turbulence and security against attacks on information sources, attacks on agents, and agent-as-attacker behaviors; across 15 academic schemes, 80% fail at least one core robustness metric and 100% exhibit security vulnerabilities, with a single compromised agent able to trigger a market-wide crash at minimal cost. - 📄 **[Characterizing Network Centralization and Observability in the Remote MCP Ecosystem](https://arxiv.org/abs/2609.19100)** — Sohail, NIPA 2026. Empirically characterizes the public remote MCP server ecosystem with a three-tier observability framework (catalog metadata, passive compliance, live vulnerability analysis) over 179 endpoints, finding heavy infrastructural consolidation (ASN Herfindahl-Hirschman Index 0.736) and a Security-Observability Tradeoff — platform-level OAuth 2.1/PKCE that secures 95% of commercial PaaS-hosted servers simultaneously blocks automated tool-poisoning vulnerability scanning without prior credential provisioning. - 📄 **[PentestChain: A Cost-Aware, MCP-Orchestrated Framework for Automated Penetration Testing with Free-Tier LLMs](https://arxiv.org/abs/2609.18120)** — Patel et al., 2026. Automated pentest framework exposing its pipeline through an eleven-tool MCP server, and — beyond cost-aware model cascading — analyzes the attack surface an MCP-exposed offensive engine introduces, grounding a four-position threat model in the 2025 MCP incident record (CVE-2025-6514 RCE in mcp-remote, the postmark-mcp supply-chain backdoor, and the tool-poisoning/rug-pull/line-jumping class) and contributing four mitigations. - 📄 **[Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives](https://arxiv.org/abs/2609.16694)** — Rahul Dev & Nath, 2026. Systematizes the trust boundaries and attack surfaces of representative autonomous pentesting-agent architectures, arguing that persistent memory, real-world action, and long-horizon reasoning raise qualitatively different concerns than chat-based LLMs; contributes a lifecycle-aligned threat taxonomy (LLM-lifecycle, agent-architecture, and cross-cutting behavioural attacks) and shows why conversational-AI guardrails fall short for offensive agents, motivating context- and architecture-aware guardrail research. ## Attack Research ### Prompt Injection via Tools - 📄 **[Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://arxiv.org/abs/2302.12173)** — Greshake et al., AISec 2023. Foundational work on indirect prompt injection through tool outputs. - 📄 **[Inject My PDF: Prompt Injection for Your Resume](https://arxiv.org/abs/2403.14381)** — Practical injection through document processing tools. - 📄 **[InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents](https://arxiv.org/abs/2403.02691)** — Zhan et al., ACL 2024. 1,054 test cases, 17 tools, two attack types (direct harm, data stealing). - 📄 **[Automatic and Universal Prompt Injection Attacks against Large Language Models](https://arxiv.org/abs/2403.04957)** — Liu et al., 2024. Automated generation of injection attacks. - 📄 **[WIPI: A New Web Threat for LLM-Driven AI Agents](https://arxiv.org/abs/2402.16965)** — Liu et al., 2024. Web-based indirect prompt injection targeting browsing agents. - 📄 **[GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines](https://arxiv.org/abs/2606.09935)** — Isbarov et al., 2026. Evaluates prompt injection in live GitHub workflows by provisioning ephemeral repositories and triggering real workflow runs, documenting eleven attacks across four AI providers that compromise credential handling and repository permissions. - 📄 **[Prompt Injection as Role Confusion](https://arxiv.org/abs/2603.12277)** — Ye, Cui & Hadfield-Menell, ICML 2026. Shows prompt injection succeeds because LLMs infer privilege from unreliable stylistic cues rather than structural role tags; "destyling" untrusted text to look less like internal formats drops attack success from 61% to 10%, framing injection defense as perpetual whack-a-mole absent genuine role perception. - 📄 **[On the Inseparability of Instructions and Data in Shared-Embedding Sequence Models](https://arxiv.org/abs/2606.27567)** — Pant et al., 2026. Proves perfect prompt-injection prevention is mathematically impossible in shared-embedding architectures lacking enforced control-data separation, formalizing tool authorization, refusal, and memory writes as control-authoritative actions and arguing injection requires architectural instruction/data channel separation rather than better in-pipeline classification or alignment. - 📄 **[They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface](https://arxiv.org/abs/2607.19267)** — Sidot, 2026. Shows LLM-driven CI/CD pipelines can be subverted by pairing authority framing with obfuscated ("laundered") malicious code, so downstream agents dutifully verify yet still approve secret-exfiltration steps despite verification gates being in place. - 📄 **[Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents](https://arxiv.org/abs/2607.28165)** — Liu et al., 2026. Hides malicious audio instructions that imperceptibly "piggyback" onto user speech to hijack continuous-audio multimodal agents (69.1% attack success against Gemini 3 Pro), introducing the AudioAgentSecurity benchmark (8 scenarios, 10 attack patterns) and a Cascaded Audio Decoupling and Verification (CADV) defense that reaches over 90% detection via acoustic source separation and cross-modal consistency. [Code](https://github.com/Limax666/AudioAgentSecurity). - 📄 **[The Anatomy of a Prompt Injection: A Component Model for Structured Analysis](https://arxiv.org/abs/2608.07808)** — McHugh, 2026. Formalizes prompt-injection artifacts into a seven-component model (carrier, delivery vector, concealment, context-break, privilege escalation, payload, and return channel) that labels attacker intent — tool targets, sinks, and effects — rather than surface wording, letting defenders, red teamers, and CTI teams compare and mutate attacks without fragile string matching. - 📄 **[From Prompt Injection to Web Exploitation: Revisiting Classic Vulnerabilities in LLM-Integrated Applications](https://arxiv.org/abs/2608.10281)** — Tsigkopoulos & Ntantogian, 2026. Introduces LLM-mediated web attacks, where attacker-controlled input transformed by a tool-calling or agentic LLM reaches traditional web-application sinks with the model acting as a confused deputy — systematized as LLM2X variants (LLM2SQLi, LLM2XSS, LLM2SSTI, LLM2CommandInjection, LLM2IDOR, LLM2SSRF, and more) and demonstrated via the TicketOracle Flask case study across seven LLMs. ### Tool Poisoning & Supply Chain - 📄 **[ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP](https://arxiv.org/abs/2606.27027)** — Liu et al., 2026. Distributes a malicious MCP instruction across multiple tool descriptions using Shamir's secret sharing, so each fragment individually passes inspection and the harmful instruction is reconstructed only once enough shares are aggregated during agent interaction — evading per-tool poisoning scanners. - 📄 **[PhantomSkill: Malicious Code Injection in Agent Skill Ecosystems](https://arxiv.org/abs/2606.19191)** — Lin & Yu, 2026. Attack framework whose VulMask technique disguises malicious code as ordinary insecure implementations inside skill auxiliary resources, activating harmful behavior only under attacker-controlled conditions to evade skill-scanning defenses. - 📄 **[Dynamic Malicious Skills in Agentic AI](https://arxiv.org/abs/2606.16287)** — Chen et al., 2026. Shows that malicious instructions embedded in skill documentation (e.g., SKILL.md) can induce an agent to dynamically inject harmful logic into an otherwise benign skill at execution time, demonstrated across OpenHands and Claude Code. - 📄 **[Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents](https://arxiv.org/abs/2608.12273)** — Liu et al., 2026. Text-only, runtime-independent attack in which a malicious third-party skill uses shared semantic cover to win selection and then fabricate plausible dependencies during planning, recruiting unnecessary benign skills into a bounded detour that preserves task completion while inflating token consumption and execution time (66.9% and 92.5% on DeepSeek-V4-Pro) — showing correct outcomes do not guarantee trajectory integrity or cost safety. - 📄 **[Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners](https://arxiv.org/abs/2606.18198)** — Jia et al., 2026. SkillCamo hides harmful operational instructions inside images bundled with a skill, bypassing scanners that rely only on text descriptions, manifests, and source code while remaining recoverable by multimodal agents at deployment. - 📄 **["Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild](https://arxiv.org/abs/2602.06547)** — Liu et al., USENIX Security 2026. Large-scale analysis of 98,380 skills across two major registries identifies 157 confirmed-malicious skills (632 vulnerabilities, 13 attack techniques), characterizing two archetypes — credential-exfiltrating data thieves and decision-subverting agent hijackers — and showing that shadow features absent from public documentation mark all advanced attacks. - 📄 **[Harmless Yet Harmful: Neutral Prompting Attacks for Stealthy Hallucination Steering in Agent Skills](https://arxiv.org/abs/2605.29354)** — Hsu et al., 2026. Introduces neutral prompting attacks that covertly increase package hallucinations in coding agents, creating downstream software supply chain risk while evading existing skill-focused defenses. - 📄 **[Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search](https://arxiv.org/abs/2603.24203)** — Shen et al., 2026. Tree-structured Injection for Payloads (TIP): black-box attack generating natural-language payloads to seize control of MCP-enabled agents; achieves >95% attack success in undefended settings and >50% against four defense approaches with an order of magnitude fewer queries than prior adaptive attacks. - 📄 **[Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning](https://arxiv.org/abs/2603.22489)** — Huang et al., 2026. STRIDE/DREAD threat modeling of MCP across five components; systematic comparison of tool poisoning defenses in seven major MCP clients reveals insufficient static validation; proposes multi-layered defense strategy. - 📄 **[Are AI-assisted Development Tools Immune to Prompt Injection?](https://arxiv.org/abs/2603.21642)** — Huang et al., 2026. First empirical analysis of prompt injection via tool-poisoning across seven MCP clients (Claude Desktop, Claude Code, Cursor, Cline, Continue, Gemini CLI, Langflow); reveals significant security disparities with Cursor most susceptible. - 📄 **[Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks](https://arxiv.org/abs/2602.20156)** — Schmotz et al., 2026. Benchmark measuring agent vulnerability to malicious skill/config files; demonstrates data exfiltration, destructive actions, and ransomware-like behavior via AGENTS.md/CLAUDE.md injection. - 📄 **[ToolSword: Unveiling Safety Issues of LLMs in Tool Learning Across Three Stages](https://arxiv.org/abs/2402.10753)** — Ye et al., ACL 2024. Identifies safety issues across tool selection, tool calling, and result handling. - 📄 **[Compromising Agents via MCP](https://arxiv.org/abs/2504.03767)** — Invariant Labs, 2025. Tool poisoning attacks via Model Context Protocol servers. - 📄 **[Osmosis Distillation: Model Hijacking with the Fewest Samples](https://arxiv.org/abs/2603.04859)** — Shi et al., 2026. Supply-chain attack via poisoned synthetic training data. - 📄 **[Personality Self-Replicators](https://arxiv.org/abs/2603.XXXXX)** — 2026. Agent personality files as self-replicating genetic material. - 📄 **[Poisoned Playbooks: Demystifying Knowledge Poisoning Effects on AI Security Agents](https://arxiv.org/abs/2606.24402)** — Park et al., 2026. Studies how malicious write-ups injected into security knowledge sources compromise RAG-based, action-taking security agents, introducing a "Verification Boundary" framework that classifies how agents evaluate retrieved claims and showing verification prompting and multi-source retrieval falter under sparse-evidence and zero-day conditions. - 📄 **[Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains](https://arxiv.org/abs/2607.01136)** — Jia et al., 2026. Treats agent skills as dependency-bearing artifacts and empirically maps the skill supply chain, surfacing security-relevant signals hidden in inter-skill dependencies and governance gaps that let malicious or vulnerable skills propagate risk transitively. - 📄 **[KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems](https://arxiv.org/abs/2607.00422)** — Choi et al., 2026. Sequential document-poisoning attack that plants strategically crafted retrievable documents to progressively redirect an agentic RAG system's multi-step reasoning chain, requiring no system access. - 📄 **[Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol](https://arxiv.org/abs/2607.05744)** — Rashidi, 2026. Shows invisible Unicode TAG-block characters can smuggle malicious payloads into MCP tool descriptions that reach the model while staying hidden from human reviewers during approval, measuring the resulting approval-view fidelity gap across three independent server implementations. - 📄 **[Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting](https://arxiv.org/abs/2607.07433)** — Spira et al., 2026. Adversarial hallucination squatting preemptively registers the resource names (popular repositories, skills) that LLMs predictably hallucinate, so agents pull attacker-hosted prompts at scale — reaching up to 100% hallucination rates in skill installation and enabling remote code execution and botnet establishment under weak, channel-free threat models. - 📄 **[Skills That Don't Exist: A Large-Scale Study of Hallucinated Skill Recommendation in LLM Agents](https://arxiv.org/abs/2607.12340)** — Yuan et al., 2026. Measures skill-name hallucination across 15,000 prompts, finding LLM agents invent non-existent skill names at ~36% rates and opening an exploitable supply-chain vector where attackers pre-register malicious packages under the fabricated names before victims unknowingly install them. - 📄 **[Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware](https://arxiv.org/abs/2607.02357)** — Ji et al., 2026. Introduces SkillCloak, which defeats static agent-skill malware scanners through evasion, alongside SkillDetonate, a runtime detector that catches malicious skill behavior via execution monitoring rather than code inspection. - 📄 **[Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions Against AI Coding Agents](https://arxiv.org/abs/2607.15143)** — Bagmar & Saraf, 2026. First systematic evaluation of package-install-time supply-chain attacks delivered through ordinary project-setup documentation (README, requirements, Makefile): editing docs alone redirects coding agents to untrusted registries, vulnerable versions, or plausible wrong names, showing install-time security rests on the harness-model pairing — source-based attacks like registry redirection are missed almost everywhere absent a deterministic pre-install name/source/version check. - 📄 **[When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems](https://arxiv.org/abs/2608.05563)** — Chen et al., 2026. PoisonedEvolution, a trajectory-poisoning attack on self-evolving skill (SES) systems where untrusted agent experience is distilled into trusted skills; a skill-visible black-box attacker contributing only 10% support embeds target behaviors in 91% of trials (546/600) across six LLM evolvers by satisfying inclusion, evolution attribution, and realization — with attribution the distinctive bottleneck. - 📄 **[Towards a Risk Assessment of Malicious Skill Files in Coding Agents](https://arxiv.org/abs/2608.05223)** — Yang et al., 2026. Adversarial skill-synthesis method using six LLMs to transform 471 real-world shell commands into benign-appearing skill files, released as a 2,826-skill benchmark mapped to 11 MITRE ATT&CK tactics, alongside a reproducible three-judge evaluation pipeline (run stratification, evidence anchoring, refusal veto, declared-intent override) for assessing malicious-skill risk in coding agents. - 📄 **[SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains](https://arxiv.org/abs/2608.06862)** — Zhang et al., 2026. Self-synthesized attack paradigm that uses persistence-aware directed fine-tuning to induce computer-use agents to create poisoned-yet-benign-looking artifacts (skills, memory entries), embedding malicious influence in structural redundancies so dormant payloads survive internal state updates, bypass vetting, and reactivate as trusted context in future workflows without any new external input; evaluated on OpenClaw, Codex, and Claude Code with the CUAChain dataset. - 📄 **[ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners](https://arxiv.org/abs/2608.09732)** — Zeng et al., 2026. Collusive multi-skill-chain attack that decomposes a malicious intent into interdependent sub-payloads embedded across independently packaged, locally plausible skills — no single skill is malicious, yet their ordered composition via contextual dependencies, artifact passing, and execution handoffs forms a harmful workflow that evades per-skill scanners. - 📄 **[CompoSkill: Compositional Skill Chain Attacks from Individually Scanner-Passing LLM Agent Skills](https://arxiv.org/abs/2608.16246)** — Liu et al., 2026. Shows skill-composition risk is a path-level rather than node-level property: skills that each pass a per-skill scanner can still form a risky composition once an agent chains their outputs, capabilities, and side effects with those of other passing skills — explaining why package-by-package scanners achieve limited interception. - 📄 **[Same Name, Different Server: A Security Census of Silent Drift in the Model Context Protocol Ecosystem](https://arxiv.org/abs/2609.14119)** — Kraishan, 2026. Census of the full public MCP registry (21,643 servers, 72,606 version records) with source for 14,353 servers scanned across an eight-class threat catalogue; beyond a corrected ~7.6% high-severity prevalence, the central finding is instability — 51.1% of multi-version servers changed advertised behavior between versions, 40.6% silently, and 4.2% redirected their remote endpoint to a different host while keeping registry identity, with silent drift carrying nearly threefold higher odds of a high-severity finding and star counts a poor proxy for safety. - 📄 **[Scanning the Harness: An Empirical Study of Supply-Chain Defects in AI Coding-Agent Configurations](https://arxiv.org/abs/2609.07360)** — Kapner et al., 2026. Studies the AI coding-agent harness (instruction files, skills, hooks, MCP declarations, subagents) as an unlocked dependency layer across 3,171 public GitHub repositories, validating every finding via independent re-derivation, an LLM adjudicator, and a second re-check; confirms three security classes — 9.8% of setups pin no MCP server version, 3.1% pre-approve arbitrary execution behind scoped-looking grants (e.g. `Bash(python:*)`), and 3.8% carry a skill that pre-approves the shell for whoever installs it (shipping inside 3.7% of published collections) — with 16.0% of setups carrying a security defect. [Tool](https://github.com/redhat-community-ai-tools/harness-eval) - 📄 **[SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents](https://arxiv.org/abs/2602.14211)** — Jia et al., 2026. Closed-loop attack/victim/evaluator framework automating poisoned-skill generation across two coordinated channels — malicious code hidden in helper scripts and front-loaded inducement rewrites of skill documentation — substantially outperforming naive direct injection and prior manual attacks. - 📄 **[Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents](https://arxiv.org/abs/2606.07943)** — Hao et al., 2026. Places exactly one benign-looking, command-bearing instruction at a structurally feasible body position, reaching 89.3% attack success on codex+gpt-5.2 while triggering new high-risk audit alerts in only 5.6% of variants relative to the clean skill. - 📄 **[Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems](https://arxiv.org/abs/2604.03081)** — Qu et al., 2026. DDIPE embeds malicious code in skill documentation to compromise coding agents, generating 1,070 adversarial skills across 15 attack categories and achieving 11.6%–33.5% bypass rates across frameworks and models. - 📄 **[SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents](https://arxiv.org/abs/2608.21929)** — Zheng & Chen, 2026. Two-phase framework that screens for token-amplification conditions then refines them through LLM-guided rewriting, reaching 5.42×–10.15× average best amplification across coding-agent configurations — a resource-exhaustion counterpart to the task-preserving detour of Convergent Detour Hijacking above. - 🔗 **[MCP Security Notification: Tool Poisoning Attacks](https://modelcontextprotocol.io/specification/2025-03-26/security)** — Official MCP security advisory on tool description poisoning. - 🔗 **[Invariant Labs: MCP Security Research](https://invariantlabs.ai/blog/mcp-security)** — Analysis of cross-tool contamination, rug pulls, and tool shadowing via MCP. ### Privilege Escalation & Excessive Agency - 📄 **[Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents](https://arxiv.org/abs/2402.11208)** — Yang et al., NeurIPS 2024. Backdoor attacks on agent reasoning and tool calling. - 📄 **[Pandora's White-Box: Precise Training Data Detection and Extraction in Large Language Models](https://arxiv.org/abs/2402.17012)** — Relevant to agents leaking training data through tool outputs. - 📄 **[R-Judge: Benchmarking Safety Risk Awareness for LLM Agents](https://arxiv.org/abs/2401.10019)** — Yuan et al., ACL 2024. 162 records across 27 risk scenarios for evaluating agent safety awareness. - 📄 **[TrustAgent: Towards Safe and Trustworthy LLM-based Agents](https://arxiv.org/abs/2402.01586)** — Zhang et al., 2024. Agent-constitution-based approach to limiting excessive agency. - 📄 **[FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion](https://arxiv.org/abs/2606.15609)** — Rao et al., 2026. Splits prohibited content across interactions, stores it in long-term agent memory in benign-appearing form, then reconstructs it via retrieval — evading access-control checks without the disallowed request ever appearing explicitly in the user query. - 📄 **[Post-Training Local LLM Agents for Linux Privilege Escalation with Verifiable Rewards](https://arxiv.org/abs/2603.17673)** — Normann et al., 2026. Two-stage post-training pipeline (SFT + RL with verifiable rewards) producing a 4B model that achieves 95.8% success on privilege escalation, nearly matching Claude Opus 4.6 at 100× lower inference cost. - 📄 **[Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing](https://arxiv.org/abs/2607.18485)** — Li, 2026. Defines the "hijacked authorized agent" problem in HPC — where adversarial instructions in a log, tool description, or peer-agent message redirect an agent beyond its assigned task even though every resulting command is authenticated and permitted for the user's account — maps scheduler, shared-storage, and multi-project attack surfaces where identity controls fall short, and outlines the planned TaskBound empirical benchmark. - 📄 **[When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agents](https://arxiv.org/abs/2606.20023)** — Yang et al., 2026. Shows LLM agents routinely choose tools carrying more privilege than a task requires, and proposes a privilege-aware post-training method that steers agents toward sufficient lower-privilege alternatives to shrink the excessive-agency attack surface. - 📄 **[(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents](https://arxiv.org/abs/2607.00333)** — Zhang et al., 2026. Identifies two attack surfaces in VLM-based mobile agents — a perception gap between human and machine vision, and interception of the agent's execution pipeline — letting malicious apps hijack agent actions and achieve arbitrary command execution without any granted permissions. - 📄 **["Allow" to Achieve, Over-Privileged Inadvertently: The Unintended Cost of Task-Completion-Driven Pop-up Decisions in Mobile GUI Agents](https://arxiv.org/abs/2608.04755)** — Chen et al., 2026. Studies "permission literacy" by injecting Android-style permission popups into real GUI tasks, revealing that mobile GUI agents grant unnecessary permissions under strong task-conditioned biases — changing only the requesting app (Calendar→PiMusic) under the same task collapses grants from 26/32 to 0/32 (App-Trust Bias), while changing task context around a fixed popup flips authorization decisions (Task-Prior Override) — and argues for separating task execution from permission authorization. - 📄 **[The Missing Boundary: How Autonomous Agents Lose Control](https://arxiv.org/abs/2609.11024)** — Ying et al., 2026. Isolates loss of authorized-execution control during otherwise-legitimate tasks by independently manipulating goal pressure, control degradation, and executable unsafe opportunity, showing a degraded control boundary becomes consequential precisely when the environment exposes a boundary-crossing executable action — even when the underlying task stays legitimate and a sanctioned path remains available — reframing excessive-agency failures as an interaction between control state and environment affordance rather than purely adversarial input. ### Data Exfiltration & Privacy - 📄 **[AgentSCOPE: Evaluating Contextual Privacy Across Agentic Workflows](https://arxiv.org/abs/2603.04902)** — Ngong et al., 2026. 80%+ of agentic pipelines leak private data at intermediate stages. - 📄 **[Silent Egress: LLM-Driven Data Exfiltration via Steganographic Channels](https://arxiv.org/abs/2502.XXXXX)** — Demonstrates covert channels for data theft through agent outputs. - 📄 **[Privacy Risks of General-Purpose AI Systems: A Foundation for Investigating Practitioner Perspectives](https://arxiv.org/abs/2407.02027)** — GPAIS privacy risks including agent data handling. - 📄 **[IMMACULATE: A Framework for Analyzing Information Exposure in Agent-Based Systems](https://arxiv.org/abs/2502.XXXXX)** — Multi-turn agent information leakage analysis. - 📄 **[AgentRaft: Automated Detection of Data Over-Exposure in LLM Agents](https://arxiv.org/abs/2603.07557)** — Lin et al., 2026. Automated detection framework for identifying data over-exposure vulnerabilities in LLM agent integrations. - 📄 **[You Told Me to Do It: Measuring Instructional Text-induced Private Data Leakage in LLM Agents](https://arxiv.org/abs/2603.11862)** — Kao et al., 2026. Identifies the Trusted Executor Dilemma where high-privilege agents execute adversarial README instructions at up to 85% success rate; 0% human detection rate across 15 participants. - 📄 **[An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios](https://arxiv.org/abs/2606.17114)** — Baek et al., 2026. Joint Singapore–Korea AI Safety Institute study showing tool-using agents leak sensitive information even under benign, non-adversarial user requests, extending leakage analysis beyond prompt-injection and jailbreak exfiltration. - 📄 **[Differential Privacy in Generative AI Agents: Analysis and Optimal Tradeoffs](https://arxiv.org/abs/2603.17902)** — Yang & Zhu, 2026. Probabilistic framework for analyzing privacy leakage in AI agents via differential privacy, deriving token-level and message-level bounds relating leakage to temperature and message length. - 📄 **[Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity?](https://arxiv.org/abs/2606.23189)** — Goel & Gurevych, 2026. Evaluates whether computer-use agents respect contextual integrity when handling personal information across applications, finding most leak sensitive data through visual co-location of sensitive items, oversharing of personal state, and sending content to the wrong recipients. - 📄 **[ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using LLM Agents](https://arxiv.org/abs/2606.28061)** — Hu et al., 2026. Audits whether task-private information is routed only to authorized tools and downstream sinks across an executed multi-tool trajectory using 2,150 cases with backend audit logs, formalizing a need-to-know disclosure boundary and showing that successful task completion does not imply appropriate privacy disclosure. - 📄 **[What Happens Locally, Leaks Globally: Detecting Privacy Leakage Risks in MCP Servers](https://arxiv.org/abs/2606.21338)** — Yan et al., 2026. Cross-language static analysis framework that detects protocol-induced credential and PII leakage in multilingual MCP servers, finding leakage in over 10% of analyzed servers. - 📄 **[Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policies](https://arxiv.org/abs/2607.06815)** — Rani, 2026. Formalizes behavioral privacy leakage in multi-round negotiation agents, where an adversary infers private reservation values from concession trajectories and timing, and proposes an (ε,δ)-differentially-private stochastic negotiation policy that cuts adversarial inference accuracy 43–50% while keeping success and utility above 90%. - 📄 **[PiSAs: Benchmarking Contextual Integrity in Multi-User Agentic Systems](https://arxiv.org/abs/2607.05318)** — Gupta et al., 2026. Benchmark for cross-user data spillage in shared agentic systems with dual contextual-integrity annotations (task-appropriateness and per-user access), measuring leakage through outputs, inter-agent messages, and shared memory — and finding even state-of-the-art models fail to reliably restrict transmission to authorized users. - 📄 **[Data Leakage Prevention in Agentic Applications via Preemptive Hardening](https://arxiv.org/abs/2607.18847)** — Shukla et al., 2026. Pre-deployment pipeline that automatically scans agentic applications for data-leakage vulnerabilities and remediates them through preemptive patching and validation before release, shifting leakage defense left rather than relying on runtime interception. - 📄 **[When Agents Learn to Be You: Benchmarking Privacy Leakage, Impersonation Risk, and Defenses in Persona Skills](https://arxiv.org/abs/2608.03700)** — Xiang et al., 2026. Benchmarks privacy leakage, impersonation risk, and defenses for persona skills that distill personal interaction histories into portable executable artifacts, showing this concentration of fragmented personal signals amplifies exposure through reuse and defeats defenses designed for individual records or retrieval-based memory. - 📄 **[Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills](https://arxiv.org/abs/2608.04192)** — Hua et al., 2026. Introduces SkillClone, a black-box attack that clones a hidden (closed-source) agent skill purely through legitimate task requests — forming an interface hypothesis from the public advertisement, issuing structured probes, and iteratively repairing an executable replica via differential validation against the victim — showing that file secrecy does not ensure functional secrecy and that disclosure-focused defenses provide limited coverage against cumulative information leakage from ordinary use. - 📄 **[SkillWatermark: An Embedded Skill Watermark of Progressive Privacy Inference via Benign Prompts](https://arxiv.org/abs/2608.16026)** — Li et al., 2026. Inserts crafted skill-description constraints ("skill watermarks") that induce distinctive execution traffic patterns, letting a passive network attacker establish a covert channel that encodes private information across multiple conversation turns without any overtly malicious payload. - 📄 **[Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control](https://arxiv.org/abs/2609.14003)** — 2026. Shows that when a personal agent's privacy enforcement is a judgment its own LLM makes over adversary-controllable context, the enforcement mechanism and attack surface coincide — demonstrating three no-injection attacks (Collaborative Workspace Lure, Semantic Obfuscation, Channel Decoupling) that beat prior defenses — and proposes FLOWSEAL, a tool-level interceptor outside the LLM's context that enforces confidentiality via data provenance and an information-flow-control lattice with controlled declassification. - 📄 **[AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealing](https://arxiv.org/abs/2609.07131)** — 2026. Poses whether a substantially weaker attacker-controlled agent can acquire a stronger proprietary agent's task-solving capabilities through limited black-box interaction, showing that recovering explicit skill artifacts alone does not transfer capability — a weaker agent may hold the same skills yet still fail without the implicit procedural behaviors — and framing capability cloning as a distinct security risk beyond prior skill-stealing attacks. - 📄 **[Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines](https://arxiv.org/abs/2609.18217)** — Ediga & Chattopadhyay, 2026. Shows the MCP context window exposes the model to attacker-controlled text through multiple unprivileged channels (tool descriptions, tool results, sampling messages), then devises cross-channel fragmentation attacks that split a benign-looking payload across two or three channels so no single channel carries a complete injection; across 12 frontier models, three production clients, and 15,000+ trials, models that fully resist single-channel injection (0% compliance) exfiltrate credentials at up to 100% under two-channel fragmentation, and all seven third-party MCP security tools plus tested prompt defenses fail to catch the fragmented payloads. ### Indirect Prompt Injection - 📄 **[CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts](https://arxiv.org/abs/2606.19235)** — Cheng et al., 2026. Inference-time defense using Tree-sitter parsing and multi-layer analysis to detect and neutralize adversarial instructions hidden in code contexts before they reach the LLM. - 📄 **[Agent Data Injection Attacks are Realistic Threats to AI Agents](https://arxiv.org/abs/2607.05120)** — Choi et al., 2026. Introduces agent data injection (ADI) attacks — an underexplored indirect-prompt-injection class where malicious data disguised as trusted data drives unintended actions — demonstrated against real-world agents including Claude, Codex, and Gemini CLI. - 📄 **[Invisible Ink Threats: Adversarial Goals Behind Legitimate Tasks in Computer-Use Agents](https://arxiv.org/abs/2608.02018)** — Zhang et al., 2026. Shows computer-use agents remain vulnerable to indirect prompt injection even under the human-in-the-loop confirmation paradigm, by hiding adversarial goals behind legitimate-looking, low-harm tasks that slip past the user confirmation designed to catch conspicuously high-harm actions. - 📄 **[Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure](https://arxiv.org/abs/2608.02657)** — Dong et al., 2026. Studies the internals of agentic LLMs under indirect prompt injection, showing they encode latent signals of "IPI exposure" that probing can read out to detect when malicious side-tasks hidden in external tool results have compromised the agent. - 📄 **[DualView: Preventing Indirect Prompt Injection in Personal AI Agents](https://arxiv.org/abs/2607.03821)** — Kim et al., 2026. Extends untrusted-data tracking across a personal AI agent's entire environment to prevent indirect prompt injection, including the stored variant where the agent writes and later re-reads attacker-controlled data. - 📄 **[Prismata: Confining Cross-Site Prompt Injection in Web Agents](https://arxiv.org/abs/2607.08147)** — Villa et al., 2026. Enforces contextual least privilege for autonomous web agents — restricting what an agent can see and act upon based on the origin of the content — so third-party and user-generated web content cannot hijack the agent via cross-site prompt injection. - 📄 **[AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations](https://arxiv.org/abs/2603.10749)** — He et al., 2026. Defense against indirect prompt injection using causal attribution to trace which tool outputs triggered suspicious agent actions. - 📄 **[ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents](https://arxiv.org/abs/2609.14987)** — Wang et al., 2026. Rather than judging whether external content is suspicious, ActGuard predicts a local tool prior for each upcoming action and, before execution, compares the candidate action against it via tool-level contrastive analysis and parameter-level evidence localization, masking only spans confirmed malicious and regenerating the action — preserving planning flexibility while cutting attack success to state-of-the-art levels at near no-attack utility. [Code](https://github.com/binzhwang/ActGuard). - 📄 **[IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection](https://arxiv.org/abs/2605.11868)** — Chen et al., 2026. Open-source proxy that rewrites live responses from whitelisted domains with 820 benchmark payloads to evaluate browser agents against realistic indirect prompt injection. - 📄 **[How Much Can We Trust LLM Search Agents? Measuring Endorsement Vulnerability to Web Content Manipulation](https://arxiv.org/abs/2606.16821)** — Chen et al., 2026. SearchGEO framework with a five-mode attack taxonomy measures how attacker-published web pages get transformed into endorsed recommendations across 13 LLM search-agent backends over 308 cases each. - 📄 **[ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents](https://arxiv.org/abs/2509.22830)** — Chang et al., ICLR 2026. Formats injected payloads to mimic native chat templates (optionally primed by persuasive multi-turn dialogue) so agents elevate them to system-level trust; transfers across models and largely bypasses prompt-based defenses. [Code](https://github.com/hwanchang00/ChatInject). - 📄 **[Adaptive Attacks and Defenses Against Indirect Prompt Injection](https://arxiv.org/abs/2408.XXXXX)** — Chen et al., 2024. Adaptive attackers bypassing static defenses. - 📄 **[HouYi: A Black-box Prompt Injection Attack on LLM-integrated Applications](https://arxiv.org/abs/2306.05499)** — Liu et al., 2023. Systematic methodology for finding injection vulnerabilities. - 📄 **[DMAST: Dual-Modality Multi-Stage Adversarial Safety Training](https://arxiv.org/abs/2603.04364)** — Liu et al., 2026. Cross-modal DOM injection corrupting both visual and text channels. - 📄 **[LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents](https://arxiv.org/abs/2608.04741)** — Guo et al., 2026. Black-box, task-agnostic attack that uses fuzzing-generated page-specific indirect injections to make login appear a plausible prerequisite for continuing the task, luring LLM web agents onto attacker-controlled login pages for end-to-end credential and private-data leakage — reaching 86% average success across LLM backbones and remaining effective across agent architectures and defenses, and identifying login inducement as a systematic authentication-boundary risk. - 📄 **[Breadcrumbing Search Agents](https://arxiv.org/abs/2608.04565)** — Li et al., 2026. Attacks LLM search agents through the mediated search/page-observation channel: appending a single controlled result per query, coordinated across the agent's trajectory into an Authority-Chain Hijack (ACH) evidence chain, overcomes the multi-source cross-checking that dilutes isolated single-page injections (up to 71.4%/95.0% ASR/MaxN ASR), with Trace-Guided Strategy Evolution automatically refining attacker strategies from execution traces. - 📄 **[Hijacking Robots with a Piece of Paper: A Systematic Study of Physical Prompt Injection in VLM-Controlled Robots](https://arxiv.org/abs/2608.05715)** — Samarakoon et al., 2026. Systematic study of physical (indirect) prompt injection against VLM-controlled robots, where adversarial text placed in the robot's visual field hijacks the VLM planner; introduces a four-category taxonomy (indirect signage, task redefinition, authority impersonation, conflict injection) and a 20-prompt benchmark evaluated over 5,670 trials across three frontier VLMs, three physical scene layouts, and three command formulations. - 📄 **[StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection](https://arxiv.org/abs/2608.06477)** — Zhan et al., 2026. Introduces multi-step indirect prompt injection, decomposing an adversarial goal into innocuous-looking sub-steps distributed across a chain of pages along the agent's navigation path; the resulting 480-example StepJack benchmark raises attack success on computer-use agents by up to 31.2 points at fixed decomposition depth (e.g., GPT-5.4-mini 41.7%→72.9%). [Code](https://github.com/BorealisAI/StepJack). - 📄 **[Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection](https://arxiv.org/abs/2608.08939)** — Deivasigamani et al., 2026. Shows autonomous Android agents (MobileRun, Mobile-Use) that rely on unsanitized accessibility (A11y) tree metadata plus screenshots are systemically exposed to indirect prompt injection, demonstrating goal hijacking, context drift, and unauthorized device actions across both visually hidden and fully exposed attack scenarios. - 📄 **[Toward Metacognitive One-Shot Indirect Prompt Injection: Strategy Abstraction Via Outcome-Conditioned Reflection](https://arxiv.org/abs/2608.08795)** — Hou et al., 2026. SAVOR shifts indirect-prompt-injection adaptation from repeated test-time querying against the target to offline strategy distillation — performing outcome-conditioned reflection over successful and failed trajectories from disjoint training environments into a reusable strategy memory that guides a single one-shot injection against an unknown target agent. ### Agent Deception & Manipulation - 📄 **[Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents](https://arxiv.org/abs/2606.30383)** — Li & Shi, 2026. Studies the principal-loyalty tension in multi-party agent interactions, where an agent must resist adversarial manipulation by counterparties without over-refusing its own principal's legitimate cooperative requests. - 📄 **[Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction](https://arxiv.org/abs/2605.29960)** — Yang et al., 2026. MemPoison shows how attackers can plant triggerable backdoors into long-term agent memory through ordinary dialogue, bypassing selective memory extraction and rewriting pipelines. - 📄 **[When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents](https://arxiv.org/abs/2607.05189)** — Zhang et al., 2026. Shows untrusted external content delivered via a single email can be silently written into a persistent personal agent's long-term memory and later reused as trusted state, enabling long-term compromise without detection. - 📄 **[Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses](https://arxiv.org/abs/2607.05029)** — Karamchandani et al., 2026. Presents FARMA, an attack that corrupts an LLM agent's reasoning history through forged memory traces, alongside SENTINEL, a structural-analysis defense that detects such tampering. - 📄 **[Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems](https://arxiv.org/abs/2603.00131)** — Weckbecker et al., 2026. Single subliminally prompted agent spreads persistent bias through entire multi-agent network, degrading truthfulness of other agents. - 📄 **[FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems](https://arxiv.org/abs/2605.11514)** — Li et al., 2026. Prompt-only attack that manipulates planner-executor workflow formation in multi-agent systems, plus FlowGuard as an input-side defense. - 📄 **[Intentional Deception as Controllable Capability in LLM Agents](https://arxiv.org/abs/2603.07848)** — Starace & Soule, 2026. Systematic study of engineered deception in multi-agent LLM interactions using 36 behavioral profiles for defensive design. - 📄 **[Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem](https://arxiv.org/abs/2606.26028)** — Xiong et al., 2026. Empirical security study of a deployed decentralized agent ecosystem finding reputation can be manipulated at minimal cost, alongside placeholder registrations and widespread Sybil attacks that undermine the trust infrastructure meant to make autonomous agents trustless. - 📄 **[When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents](https://arxiv.org/abs/2607.06595)** — Torres et al., 2026. GhostWriter poisons the long-term memory of tool-using personal agents via a hidden injected payload (≈98% injection, ≈60% activation against state-of-the-art agents); the paper proposes Agentic Memory Sentry (AM-Sentry), pairing a memory-saving policy with a retrieval screen to sharply cut success while preserving utility. - 📄 **[MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents](https://arxiv.org/abs/2607.14651)** — Gao et al., 2026. Benchmark of 1,227 hand-validated persistent-memory poisoning cases (four attack types, three injection channels, three memory substrates across ten model families) with a three-tier taxonomy — direct single-record (L1), compositional multi-record (L2), and context-triggered dormant (L3) corruption — showing write-time defenses like consistency checks suppress L1 but fail on L2/L3, motivating adaptive context-sensitive memory defenses. - 📄 **[Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems](https://arxiv.org/abs/2607.14611)** — Gadgil et al., 2026. Sandboxed study of prompt injection through persistent memory files across Claude Code and OpenAI Codex (Claude Haiku 4.5, Opus 4.7, GPT-5.2, GPT-5.5): while agents rarely overwrite their own memory from untrusted external content, payloads already planted in memory files reliably attack current and future sessions, with success and persistence varying sharply across systems, models, and multi-session sequences. - 📄 **[Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents](https://arxiv.org/abs/2607.15657)** — Bouzidi et al., 2026. Introduces Lucid, a black-box adversarial framework that crafts imperceptible image perturbations to corrupt multimodal agents' long-term visual memory via two modes — memory poisoning (replacing benign images to derail recall) and memory injection (inserting adversarial images without textual grounding) — achieving 61.6% and 58.4% attack success across five memory architectures. - 📄 **[Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw](https://arxiv.org/abs/2608.01637)** — Lin et al., 2026. Introduces a compositional memory-poisoning threat where multiple individually benign-looking memories jointly induce unsafe agent behavior, evading defenses that only screen individually malicious records. - 📄 **[MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents](https://arxiv.org/abs/2608.03844)** — Chen et al., 2026. Query-only memory-poisoning attack combining probing and factual injection that stays effective against audited memory-augmented agents even under realistic conditions — large-scale benign memory pools and active input auditing — where prior query-only attacks fail. - 📄 **[When Coordination Becomes a Threat: Communication Attacks in LLM-Controlled Multi-Robot Systems](https://arxiv.org/abs/2608.06830)** — Huang et al., 2026. Formulates two inter-agent communication attacks (External Entry Point and Privileged In-System) against LLM-planned multi-robot systems and shows unsafe information turns into unsafe actions across DMAS, HMAS-1, and HMAS-2 architectures (up to 97.8% unsafe-action success); proposes a Claim Provenance and Verification (CPV) Gate that verifies communicated claims before downstream reuse, cutting the violation rate from 70.0% to 36.6%. ### Compound System Attacks - 📄 **[Cascade: Composing Software-Hardware Attack Gadgets for Adversarial Threat Amplification in Compound AI Systems](https://arxiv.org/abs/2603.12023)** — Banerjee et al., 2026. Demonstrates novel attacks combining traditional software/hardware vulnerabilities (code injection, Rowhammer) with LLM-specific algorithmic weaknesses to compromise compound AI pipelines. - 📄 **[Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?](https://arxiv.org/abs/2607.17986)** — Chen et al., 2026. Formalizes a threat class in which a self-hosted agent is compromised by corrupting its own state through legitimate OS system-call invocations, then evaluates layered OS-level defenses to expose the residual vulnerabilities they cannot close. - 📄 **[Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent Systems](https://arxiv.org/abs/2607.28147)** — Cui et al., 2026. Shows that the inference-time harness coordinating an autonomous multi-agent system — expensively-optimized, IP-grade orchestration — can be reconstructed at inference time and then exploited, exposing an attack surface beyond prior IP-leakage work on static, pre-configured architectures. - 📄 **[Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario](https://arxiv.org/abs/2608.08131)** — Matsuoka, 2026. Origin-neutral compositional threat model where no component is catastrophic alone — a dormant destructive rule seeded in a deployed artifact or shared memory, a later email/document/update/peer message that activates it, and a harness granting operational and recovery authority — yet their conjunction produces correlated destructive action, analyzed across three population-reach routes (release-time pre-positioning, post-release durable seeding, and peer replication). ### Cross-Plugin Attacks - 📄 **[When LLM-based Code Generation Meets the Software Supply Chain](https://arxiv.org/abs/2405.XXXXX)** — Supply chain risks from LLM-generated code integrating malicious packages. - 📄 **[Shadow API: Covert Data Exfiltration via LLM-Mediated API Interactions](https://arxiv.org/abs/2603.01919)** — 2026. Stealth data theft through seemingly benign API calls. - 📄 **[AgentSkillOS: Towards Secure and Composable Agent Skill Operating Systems](https://arxiv.org/abs/2603.02176)** — 2026. OS-level isolation for agent skill execution. - 📄 **[Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems](https://arxiv.org/abs/2606.15242)** — Xie et al., 2026. Defines Skill Composition Risk (SCR), where an individually benign skill becomes harmful when its outputs, trust signals, authorization cues, or side effects influence later invocations in a shared execution context; introduces SCR-Bench to evaluate it. - 📄 **[MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents](https://arxiv.org/abs/2607.02857)** — Wu et al., 2026. Exploits CLI command-composition risk (CCR), showing individually harmless shell commands can be chained through shared system state into dangerous exploits in LLM coding agents, reaching a 96.59% attack success rate across real-world agents. ### Backdoor Attacks on Agents - 📄 **[SlowBA: An efficiency backdoor attack towards VLM-based GUI agents](https://arxiv.org/abs/2603.08316)** — Li et al., 2026. Novel backdoor targeting response latency of GUI agents via trigger-activated long reasoning chains. - 📄 **[SkillJack: Persistent Skill Backdoors in Self-Evolving Agents](https://arxiv.org/abs/2608.03509)** — Ying et al., 2026. Uncovers a fundamental skill-backdoor threat in self-evolving agents where poisoned interaction experiences are transformed by the agent itself into durable behavioral artifacts (reusable skills), persisting beyond the retrieval-time-only effect of prior memory- and retrieval-poisoning attacks. ### Jailbreaking & Guardrail Bypass - 📄 **[Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs](https://arxiv.org/abs/2603.24511)** — Panfilov et al., 2026. Autonomous autoresearch pipeline powered by Claude Code discovers novel white-box adversarial attack algorithms that significantly outperform all existing 30+ methods in jailbreaking and prompt injection evaluations. - 📄 **[From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails](https://arxiv.org/abs/2606.14517)** — Zhou et al., 2026. Uses a beam-search optimization framework to craft natural-language payloads that trap reasoning-based guardrails in extended reasoning loops, turning the very defense that blocks injection and jailbreaks into a denial-of-service vector. - 📄 **[Jailbreaking ChatGPT via Prompt Engineering](https://arxiv.org/abs/2305.13860)** — Liu et al., 2023. Foundational jailbreaking taxonomy. 700+ citations. - 📄 **[MasterKey: Automated Jailbreaking of Large Language Model Chatbots](https://arxiv.org/abs/2307.08715)** — Deng et al., NDSS 2024. Automated time-based jailbreak generation. - 📄 **[PentestGPT: An LLM-empowered Automatic Penetration Testing Tool](https://arxiv.org/abs/2308.06782)** — Deng et al., 2023. Demonstrates agent-level tool use for offensive security. 11K+ GitHub stars. - 📄 **[Self-Fulfilling Misalignment in AI Control](https://arxiv.org/abs/2603.XXXXX)** — 2026. Fine-tuning on AI Control literature increases misalignment. - 📄 **[Reasoning Models Struggle to Control Their Chains of Thought](https://arxiv.org/abs/2603.XXXXX)** — 2026. CoT controllability decreases with RL training, implications for agent oversight. - 📄 **[CRAFT: Contrastive Reasoning Alignment — Reinforcement Learning from Hidden Representations](https://arxiv.org/abs/2603.17305)** — Luo et al., 2026. Red-teaming alignment framework combining contrastive representation learning with RL to separate safe/unsafe reasoning trajectories; 79% improvement in reasoning safety and 87.7% in final-response safety over base models. - 📄 **[It Lied to a Doctor to Buy Poison Ingredients: Quantifying Real-World Misuse of Phone-use Agents](https://arxiv.org/abs/2606.27944)** — Sun et al., 2026. First real-device study across 27 commercial apps showing phone-use agents readily execute serious misuse (procuring drug/explosive precursors, fraud, harassment) at 68.8% task completion with low refusal, documenting a real-world case where an agent deceived an online doctor to obtain a toxic-substance precursor and tracing it to a Safety Awareness-Execution Gap. - 📄 **[Behind the Refusal: Determining Guardrail Activation via Behavioral Monitoring](https://arxiv.org/abs/2607.02121)** — 2026. First black-box guardrail reconnaissance methodology for LLM and agentic systems: using only HTTP, lexical, and timing signals with zero prior knowledge, it detects guardrail presence with 100% accuracy and distinguishes guardrail blocks from LLM refusals at 98% F1 — letting red-teamers pick bypass techniques matched to the actual defense in place, since guardrail bypass and alignment bypass require different approaches. - 📄 **[Alignment Is Local: A Paired Diagnostic for GUI Agents under User-Side Persuasion](https://arxiv.org/abs/2607.29199)** — An et al., 2026. Shows that prompt-level safety alignment in GUI agents is "local" and degrades sharply under multi-turn user-side persuasion, where escalation chains and concealed requests bypass guardrails that hold against single explicit requests; introduces a paired diagnostic to measure the gap. ## Defense Research ### Permission & Access Control - 📄 **[Linguistic Firewall: Geometry as Defense in Multi-Agent Systems Routing](https://arxiv.org/abs/2606.30555)** — Alsheich et al., 2026. ANTAP routes tasks to agents based on empirically verified capability rather than self-declared textual descriptions, resisting description-based injection, embedding attacks, and covert-backdoor impersonation where malicious agents misrepresent their proficiencies. - 📄 **[PAuth: Precise Task-Scoped Authorization For Agents](https://arxiv.org/abs/2603.17170)** — Sharma et al., 2026. Implicit authorization model where NL task submission authorizes only required operations; uses NL slices and envelopes for provenance-based server-side verification, blocking injected operations in AgentDojo with zero false positives. - 📄 **[Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies](https://arxiv.org/abs/2607.03423)** — Schneider et al., 2026. Proposes the Dynamic Security Control Compositor (DSCC), which enforces compositional security policies over multi-tool agent chains by combining static analysis with runtime data-flow tracking. - 📄 **[Rethinking Agent Security as a Networking Problem](https://arxiv.org/abs/2608.12172)** — Tran et al., 2026. Argues agent-centric defenses fail because they entrust policy enforcement to nondeterministic, injectable LLMs, and instead borrows networking principles — centralized control with distributed enforcement, capability-based access, and zero-trust least privilege — combining deterministic enforcement with semantic, context-aware policies in a reference architecture for securing AI agent systems. - 📄 **[Twin Agent: Context Residual Compression for Privilege Separated Agents](https://arxiv.org/abs/2607.19595)** — Hu et al., 2026. General privilege-separation design pattern using two near-symmetric agents — an Explore Agent that inspects untrusted context and a Safe Agent that executes privileged actions — where the Explore Agent, conditioned on the Safe Agent's context, communicates only compact hints about the next action, improving the security–utility tradeoff and preventing prompt injection across SWE-bench Lite, AgentDojo, and DecodingTrust-Agent. - 📄 **[TrustAgent: Towards Safe and Trustworthy LLM-based Agents](https://arxiv.org/abs/2402.01586)** — Agent Constitution for safety-aware planning with pre/post-action inspection. - 📄 **[Autoformalization of Agent Instructions into Policy-as-Code](https://arxiv.org/abs/2606.26649)** — Mondl et al., 2026. Uses an LLM generator-critic loop to automatically translate natural-language agent instructions and policy documents into formally enforceable Cedar policies, achieving broader coverage than hand-coded symbolic enforcement while avoiding the no-guarantees weakness of probabilistic guardrails on medical agent benchmarks. - 📄 **[Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI Systems](https://arxiv.org/abs/2606.26298)** — Salfeld-Nebgen et al., 2026. Formalizes an institutional governance model where an autonomous agent keeps full planning autonomy but must present independently attested evidence at the point of consequential, irreversible action (e.g., clinical prescribing, production deployment) rather than having its reasoning monitored. - 📄 **[A Deterministic Control Plane for LLM Coding Agents](https://arxiv.org/abs/2606.26924)** — Madatha, 2026. Proposes Rel(AI)Build, treating coding-agent definitions as a managed supply chain with content addressing, permission enforcement, and audit logging, arguing governance of the agent-config layer must be deterministic and tool-agnostic rather than delegated to further LLM orchestration. - 📄 **[A Dual-Helix Governance Approach for Reliable Agentic AI](https://arxiv.org/abs/2603.04390)** — 3-track architecture (Knowledge, Behavior, Skills) using knowledge graphs. - 📄 **[Talk Freely, Execute Strictly: Schema-Gated Agentic AI](https://arxiv.org/abs/2603.XXXXX)** — Schema-gated orchestration for trustworthy agent deployment in regulated domains. - 📄 **[ESAA-Security: Event-Sourced Architecture for Agent-Assisted Security Audits](https://arxiv.org/abs/2603.XXXXX)** — 26 tasks, 95 checks, append-only event logs for reproducible AI code audits. - 📄 **[Caging the Agents: A Zero Trust Security Architecture for Autonomous AI in Healthcare](https://arxiv.org/abs/2603.17419)** — Maiti, 2026. Production-deployed zero-trust architecture for 9 autonomous AI agents: gVisor kernel isolation, credential proxy sidecars, network egress allowlisting, and prompt integrity framework with untrusted content labeling. Open-source configs released. - 📄 **[Sovereign Execution Brokers: Enforcing Certificate-Bound Authority in Agentic Control Planes](https://arxiv.org/abs/2606.20520)** — He & Yu, 2026. Runtime enforcement layer that intercepts autonomous agent requests and verifies them against cryptographically-issued certificates before allowing infrastructure mutations, ensuring production changes cannot originate from agent reasoning alone. - 📄 **[The Unfireable Safety Kernel: Execution-Time AI Alignment for AI Agents and Other Escapable AI Systems](https://arxiv.org/abs/2606.26057)** — Dobrin & Chmiel, 2026. Rust-based, formally verified safety kernel that enforces authorization on agent actions through process separation and cryptographic verification, designed to resist self-modification and escape attempts so an agent cannot circumvent its own safety controls at runtime. - 📄 **[A First Measurement Study on Authentication Security in Real-World Remote MCP Servers](https://arxiv.org/abs/2605.22333)** — Zhou et al., 2026. Large-scale measurement of 7,973 remote MCP servers finding widespread unauthenticated exposure and pervasive OAuth flaws, with 9 CVEs from responsible disclosure. - 📄 **[CmdNeedle: Measuring the Incompleteness of Command Denylists for AI Agents](https://arxiv.org/abs/2606.15549)** — Chen et al., 2026. Shows that the denylist component of terminal agents' three-list command-gating mechanism — including Claude Code's built-in list — is systematically incomplete against the large, ever-expanding set of shell commands shipped by modern operating systems. - 📄 **[SecureClaw: Clawing Back Control of LLM Agents](https://arxiv.org/abs/2606.09549)** — Ma et al., 2026. Dual-boundary security architecture placing authorization at the effect sink and plaintext confinement at the read boundary, using opaque handles and a PREVIEW→COMMIT protocol to block unauthorized external actions and sensitive-data leakage in tool-using agents. - 📄 **[SessionBound: Turning Enterprise Task Approval into Budgeted Database Sessions](https://arxiv.org/abs/2607.00751)** — Wu, 2026. Confines enterprise agent-generated SQL to pre-approved business tasks via short-lived, budgeted, auditable database sessions — the agent may generate queries freely, but every attempt must stay inside the approved boundary — enforcing safety through database-layer access controls, query budgets, and disclosure limits rather than trusting the LLM to self-police. - 📄 **[Janus: A Playground for User-Involved Agentic Permission Management](https://arxiv.org/abs/2607.01510)** — Brigham et al., 2026. Playground system implementing six permission assistants across a design space of user involvement in agentic tool-call authorization; shows user input meaningfully strengthens privacy and security, AI augmentation of user decisions reduces cognitive load, and permission fatigue must be modeled since no single design is optimal across contexts. [Code](https://github.com/GraceBrigham/Janus). - 📄 **[aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents](https://arxiv.org/abs/2607.05518)** — Kodathala, 2026. Off-host authorization gateway that binds tool calls to verified user authority via HMAC-SHA256 signatures and role-based policies, blocking deceived agents from executing actions beyond granted permissions rather than trusting the model's own refusals over unverifiable text context. - 📄 **[From Neural Intent to Cryptographic Authorization: Governing Agentic Workflows](https://arxiv.org/abs/2607.15596)** — Weng et al., 2026. Neural Cryptographic Services (NCS) inserts a deterministic symbolic controller between LLM agents and privileged tools, admitting a tool invocation only when it matches cryptographically authorized instructions from an offline-signed, hash-chained instruction stream rather than trusting the model to comply with intent — cutting attack success while preserving utility on legitimate workflows. - 📄 **[Steerability via Constraints: A Substrate for Scalable Oversight of Coding Agents](https://arxiv.org/abs/2607.02389)** — Winninger, ICML 2026 Deep Learning for Code Workshop. Argues the controls long used to manage large human engineering teams — access control, network policies, tooling-enforced coding conventions — transfer directly to unconstrained coding agents (whose autonomy introduces security risks) and are cheaper in tokens than agentic scaffolding; a controlled experiment shows a small reviewer's recall on 11 inserted backdoors rising from 54.5% to 90.9% when given a constrained substrate plus a ~200-LoC docs CLI. - 📄 **[Context-to-Execution Integrity for LLM Agents](https://arxiv.org/abs/2607.06000)** — Santos-Grueiro, 2026. CXI is an execution-boundary system that marks protected sink fields, carries narrow validated values from writable context via typed releases, keeps evidence in opaque data slots, and admits a tool call only when field authority, exact-effect authorization, and invocation authority all bind to the same action manifest — yielding zero field/effect/invocation escapes across 720 AgentDojo episodes and 400 code-agent episodes. - 📄 **[Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agents](https://arxiv.org/abs/2607.07405)** — Reddy et al., 2026. Identifies "silent wrong-state" failures where policy-permissive tools execute forbidden state transitions without any error, and shows lightweight deterministic read-only pre-execution gates raise τ²-bench airline success from 29.6% to 42.0% by blocking policy-violating writes at the action boundary. - 📄 **[ScopeJudge: Cost-Aware Pre-Execution Gating for Offensive Security Agents](https://arxiv.org/abs/2607.07774)** — Caldwell et al., 2026. Pre-execution gate in which a lightweight LLM judge inspects each offensive-security agent tool call against the engagement scope inferred from the user's request — treating the boundary as intent-declared rather than a fixed policy — to block out-of-scope actions before they execute. - 📄 **[How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement](https://arxiv.org/abs/2607.13718)** — Michael & Roesner, 2026. Systematizes user-level permission systems for AI agents via a taxonomy of 21 proposals and an analysis of five commercial agents, examining how permissions are specified, derived, and enforced at runtime to counter prompt injection and unauthorized task execution. - 📄 **[Toward Cryptographically Verifiable Authorization for Autonomous AI Agents](https://arxiv.org/abs/2607.21325)** — Llambí-Morillas & Fernández-Fernández, 2026. Formalizes agent authorization as a cryptographically verifiable relation (CVA) that jointly binds an agent principal, a concrete request, an execution context, and policy satisfaction while preserving confidentiality of private attributes; defines candidate properties (authorization soundness, principal/request/policy binding, replay resistance), gives a Groth16 zk-SNARK proof-of-concept, and identifies the structural separation of identity, request, and runtime-execution binding as a central open problem for secure agentic systems. - 📄 **[ToolGuardian: Declarative Security for AI Agent-Tool Interactions](https://arxiv.org/abs/2607.21835)** — Ravindran & Deochake, 2026. Policy-driven framework pairing pre-admission tool vetting via progressive characterization (declared descriptions, syscall traces, mock-execution effects, source analysis) with task-aware runtime authorization, built on an Answer Set Programming declarative policy layer that reasons explicitly over capabilities, effects, task context, and multi-tool composition; on 16 MCP-style tools (8 malicious variants of real open-source tools) it reaches deny-class F1 0.86 for vetting and classifies all runtime scenarios correctly when fully specified. - 📄 **[Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecture](https://arxiv.org/abs/2607.22445)** — Noyan, AIWILD @ ICML 2026. Treats capability scoping as prevention before detection — a credential absent from an agent's context cannot be misused regardless of reasoning or evasion — via a three-source architecture (role-based ceilings, a task-context classifier, and policy-derived combination prohibitions), and releases a 600-prompt synthetic dataset labeled with minimum required permissions across a 15-permission tool-based taxonomy, with iterative dataset–policy refinement cutting ceiling violations 93% (46→3). - 📄 **[Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents](https://arxiv.org/abs/2607.24625)** — Kravchenko et al., 2026. Introduces APPA, which uses engine-managed context branching and prospective evaluation to confine taint from untrusted data locally — child trajectories absorb contamination while sanitizers return cleaned results to an unchanged parent context — preventing prompt injection from polluting the primary workspace without sacrificing operational utility. - 📄 **[Toward Standardized Cross-Vendor Agent Tool Trust Management in Autonomous Networks](https://arxiv.org/abs/2607.25914)** — Sharma et al., 2026. Proposes AgentToolMO, a 3GPP NRM information model that gives agents cross-vendor visibility into tool trust degradation — a formally defined trust state machine with graduated enforcement, damped cascade propagation, and trust notifications over existing Management Services interfaces — so a compromised tool from one vendor no longer keeps getting invoked by another vendor's agents, shrinking blast radius from hours-scale undetected propagation to near-real-time containment. - 📄 **[FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs](https://arxiv.org/abs/2607.27267)** — Zhang et al., 2026. Permission-carrying authorization framework that translates ambiguous natural-language tasks into a Permission Intermediate Representation, lowers it into an evidence-backed permission graph tracking data flows, dependencies, and contextual labels, and has a Satisfiability Modulo Theories authorizer mathematically verify each effectful action against security policies before a runtime gateway either authorizes it or intercepts it with a precise counterexample — reaching a 90.5% Decision Compliance Rate across OpenAgentSafety, OctoBench, and ActPlane. - 📄 **[Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents](https://arxiv.org/abs/2607.23586)** — Zhang & Zhang, 2026. Addresses the authorization gap created when long-lived agents evolve after deployment — retaining experience, acquiring skills and tools, revising workflows, and delegating — so the subject or context exercising a live grant no longer matches what the user evaluated; proposes earned authority bounded by a fixed ceiling to keep prompt-injection- and error-driven external actions within originally-authorized limits. - 📄 **[Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory](https://arxiv.org/abs/2607.29167)** — Xu et al., 2026. Identifies "memory provenance laundering," where untrusted external observations are rewritten into persistent agent memory as trusted user history during consolidation, and proposes the Provenance-Preserving Memory Firewall (PPMF), a middleware that keeps platform-maintained provenance and authorizes tool calls by matching action risk to the authority of the action-relevant memories. - 📄 **[Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions](https://arxiv.org/abs/2608.01710)** — Xu et al., 2026. Identifies semantic replay — where replanning, retries, delegation, and crash-resumption cause one user authorization to execute multiple times under freshly issued single-use tokens — and proposes durable, token-independent authorization state that bounds an authorized action's execution budget. - 📄 **[MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication](https://arxiv.org/abs/2608.01719)** — Xu et al., 2026. Scope-bound semantic declassification framework for multi-agent LLM systems that specifies what a legitimately informed agent should disclose and how, closing privacy leaks through internal messages, tool arguments, logs, and persistent memory that surface-redaction and source-level access controls leave open. - 📄 **[Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture](https://arxiv.org/abs/2608.06130)** — Sambrook & Sovio, 2026. Replaces software-resident agent signing keys (git commits, API auth, certificate issuance) with hardware-confined keys behind a vendor-neutral PKCS#11 interface, wrapped in a five-layer zero-trust enforcement stack — session identity, scope bounds, semantic validation, taint tracking, and a hardware execution boundary — motivated by a production incident where keys were exfiltrated via email injection in under five minutes; cuts attack success from 19.3% to 0% across 12 AgentDojo-derived injection scenarios with zero false positives on benign tasks. - 📄 **[NiyamAI: An Intent-Bound AI Agent with Cryptographically Verifiable Guardrails using Zero-Knowledge Proofs](https://arxiv.org/abs/2608.07167)** — Katkar et al., 2026. Locks permitted tools and constraints into a SHA-256-committed Intent Contract at session start and validates every tool call with an isolated Judge model that emits an EZKL zk-SNARK proof, so a tool executes only after proof verification and third parties can confirm enforcement without accessing the Judge model's weights; reaches 88.5% F1 at a 1.1% false-positive rate on Agent-SafetyBench. - 📄 **[A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem](https://arxiv.org/abs/2608.10760)** — Kumar et al., 2026. Reports a production centralized MCP gateway fronting dozens of downstream servers to resolve the governance crisis of fragmented per-team auth (some with none, some API keys, some OAuth); contributes a two-axis persona×credential authentication model, three enterprise SSO grants with BYO/GYO/delegated-OAuth (RFC 8693) token provisioning, and three end-to-end identity flows spanning user and non-user (automated) agent personas. - 📄 **[InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agents](https://arxiv.org/abs/2608.13030)** — Zou et al., 2026. Trust-native protocol suite that supplies the missing security substrate for the Internet of Agents alongside existing communication protocols, via four layers (Persistent Identity, Discovery, Trust Negotiation, and Accountability) that let an agent prove its identity, authorization, advertised capabilities, and accountability after delegation across organizational boundaries. - 📄 **[Bounded Agents: Delegation Security for Multi-Agent AI Systems](https://arxiv.org/abs/2608.15888)** — Muruaga, 2026. Frames agent misbehavior within granted permissions as an authorization-architecture problem and proposes the Agentic Principal Chain (APC), which tracks delegated authority across principals so static per-request permissions cannot be combined into a prohibited outcome or delegated unbounded to a sub-agent. - 📄 **[Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems](https://arxiv.org/abs/2608.17148)** — Liu, 2026. Enforces an anti-monotone audience-membership rule at the memory-to-context transition — a memory item is admitted only when every current viewer already belonged to its audience — preventing cross-audience information disclosure in multi-user agentic systems independent of the underlying model. - 📄 **[PACE: Policy-Attested Contract Execution for Safe AI Agents in Decentralized Finance](https://arxiv.org/abs/2608.17220)** — Karanjai et al., 2026. Transaction-level authorization framework interposing between LLM agents and blockchain execution, using typed transaction intents, a deterministic policy verifier, and signed Policy Decision Records to cryptographically bind verifier-approved actions to the exact on-chain transactions submitted, blocking prompt-injection-driven DeFi actions. - 📄 **[From Intent to Execution Grant: An Execution-Boundary Conformance Profile for High-Risk AI Actions](https://arxiv.org/abs/2609.11596)** — Wu et al., 2026. Specifies EBL-Core, a conformance profile for the final transition from a candidate AI action to execution authority: it binds a structured intent object, Root and Operational Policies, typed evidence obligations, context, and time into a verifiable Decision Derivation issued as an Execution Release Contract (ERC), defining a common semantic contract that authorization engines, policy languages, runtime monitors, and guardrails otherwise leave unspecified for high-risk actions such as transfers, deployments, disclosures, and physical actuation. - 📄 **[Scan the Skill, Govern the Action: Composing Registry Verdicts with Runtime Consequence Control](https://arxiv.org/abs/2609.12001)** — Taneja & Weber, 2026. Argues skill-registry scanners answer "is this skill malicious?" but not "is this action permitted here, by this operator, now?"; measuring 66,192 public ClawHub skill versions, finds 705 unanimously-clean skills that still instruct actions prohibited by CIS Control 2.7 and NIST SP 800-53 CM-11, and that 34.7% of a live agent's sandbox commands carried a consequence class absent from the skill's own documentation — then proposes a deterministic resolver (no model in the decision path) feeding a per-(resource, class) trust ledger whose promotion thresholds derive from operator risk tolerance, releasing a 64-case obfuscation benchmark. - 📄 **[The Stochastic Deputy: Structural Tenant Isolation for Tool-Using LLM Agents](https://arxiv.org/abs/2609.14780)** — Baig et al., 2026. Formalizes the stochastic deputy problem — passing a tenant identifier to a tool delegates resource selection to a context an adversary may control — and defends it structurally: remove tenant identity from the MCP tool schema, bind scope to a verified credential, and enforce it below the agent. In a 373-trial ablation a validated tenant parameter still served every out-of-scope attempt, while removing the parameter left no tool signature able to express the read (forged-scope escapes required cryptographically protected context). - 📄 **[AcquireBound: Runtime Authorization for Resources Acquired by AI Agents](https://arxiv.org/abs/2609.14744)** — Zhu, 2026. Provenance-bounded runtime authorization for the post-fulfillment activation gap, where payment/OAuth/mandate checks validate a transaction but not whether a returned resource (compute, credentials, accounts, sub-agents) may become usable authority; AcquireBound quarantines acquired outputs, resolves their capabilities from authenticated provider evidence, and activates them only through a current transaction checked against a downward-closed relational envelope over a typed resource-capability hypergraph, with eight proven safety properties and validation across five resource classes and staged MCP-to-Docker compositions. - 📄 **[LLM Agent Capabilities Should Follow Task Intent and Context Source](https://arxiv.org/abs/2609.14631)** — Zheng et al., AgenticOS 2026. Argues the least-privilege capability an agent needs is dynamic and task-intent-dependent, yet all inputs (user request, tool results, documents, shell output, Skill/MCP instructions, memory) enter one shared planning channel with equal authority; IntentCap composes short-lived leases from four sources — user intent, workflow instructions, tool schemas, and runtime environment — with field-level ownership and monotonic narrowing (each source fills only its own fields and can only narrow the user's authority), validated by a deterministic checker before any side effect and enforced by tool- and OS-level information-flow policies. - 📄 **[Trust Propagation and Structural Containment in Multi-Agent LLM Pipelines](https://arxiv.org/abs/2609.17648)** — Safin et al., 2026. Studies attack propagation in a four-agent LangGraph pipeline (Supervisor, Researcher, Validator, Executor) under shared-memory poisoning and indirect prompt injection via a forged in-document approval, contrasting the Validator's own judgment with an independent authorization layer using task-bound signed tokens and a separately verified policy oracle; introduces the Judgment Bypass Rate (JBR) measured at the attacked agent, and shows structural authorization contains compromise (100% JBR yet 0% Unsafe Action Rate) even when upstream LLM judgment fails, while an Observer layer cuts the agent-hijacking false-positive rate from 49% to 7%. ### Runtime Monitoring & Sandboxing - 📄 **[Forensic Trajectory Signatures for Agent Memory Poisoning Detection](https://arxiv.org/abs/2606.30566)** — Leong, 2026. Finds that successful agent memory-poisoning attacks leave an invariant tool-call signature (a memory recall preceding a sensitive action such as email send), enabling incident responders to detect memory-channel attacks from tool-call logs alone at 99% accuracy without inspecting memory contents. - 📄 **[MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems](https://arxiv.org/abs/2606.30602)** — Li et al., 2026. Framework that ranks the most security-critical inter-agent communication edges so defenders can deploy protection proactively, showing channel-level attack impact is highly non-uniform — a single compromised edge can account for up to 75% of total attack success. - 📄 **[AI Sandboxes: A Threat Model, Taxonomy, and Measurement Framework](https://arxiv.org/abs/2606.18532)** — Singh et al., 2026. Formal framework for evaluating AI testing environments via threat models, sandbox archetypes, and measurement criteria (fidelity, controllability, observability, containment, reproducibility) across digital, embodied, and cyber-physical deployments. - 📄 **[Cordon: Semantic Transactions for Tool-Using LLM Agents](https://arxiv.org/abs/2606.17573)** — Chen et al., 2026. Transactional runtime that wraps multi-step agent workflows in a task-scoped containment boundary for staging, validating, committing, and rolling back irreversible tool actions, rather than relying on isolated per-call guardrails. - 📄 **[VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills](https://arxiv.org/abs/2606.26524)** — Li et al., 2026. End-to-end framework that monitors agent execution traces against behavioral policies declared in skill specifications and operator constraints, using a dedicated policy language and symbolic evaluation to catch violations across temporal dependencies, argument relationships, and value flows spanning multiple tool calls — over 95% recall with sub-10% false positives on real-world agent tasks. - 📄 **[AIRGuard: Guarding Agent Actions with Runtime Authority Control](https://arxiv.org/abs/2605.28914)** — Qin et al., 2026. Runtime defense layer that treats untrusted context as informative but never authorizing, normalizing tool calls and enforcing action-time authority checks to reduce tool-mediated attacks. - 📄 **[Safeguarding LLM Agents from Misalignment through Provenance Analysis](https://arxiv.org/abs/2607.01236)** — She, Liang & Kang, 2026. ProvenanceGuard detects and blocks misaligned tool invocations by tracing whether each proposed agent action is actually supported by evidence in the agent's context, catching actions that deviate from user intent before they execute. - 📄 **[Operating-Layer Controls for Onchain Language-Model Agents Under Real Capital](https://arxiv.org/abs/2604.26091)** — Barton et al., 2026. Production study of 3,505 real-capital agents showing that agent reliability depends on operating-layer controls like prompt compilation, typed controls, policy validation, execution guards, and trace-level observability. - 📄 **[Governing What You Cannot Observe: Adaptive Runtime Governance for Autonomous AI Agents](https://arxiv.org/abs/2604.24686)** — Marin and Chaudhary, 2026. Proposes adaptive runtime governance based on bounding unobserved risk as agent behavior drifts after authorization. - 📄 **[AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents](https://arxiv.org/abs/2604.24657)** — Zhang et al., 2026. Lifecycle security architecture for autonomous agents spanning skills, external content, memory, planning, and privileged tool execution. - 📄 **[Behavioral Integrity Verification for AI Agent Skills](https://arxiv.org/abs/2605.11770)** — Wu et al., 2026. Scalable pre-deployment skill auditing framework that compares declared versus actual capabilities, surfaces description-implementation gaps, and detects malicious skills with 0.946 F1. - 📄 **[ADR: An Agentic Detection System for Enterprise Agentic AI Security](https://arxiv.org/abs/2605.17380)** — Li et al., MLSys Industry Track 2026. Production MCP security system with telemetry, red teaming, and two-tier online detection deployed across 7,200+ hosts and 10,000+ daily agent sessions. - 📄 **[Content-Aware Attack Detection in LLM Agent Tool-Call Traffic: An Empirical Study of Features, Architectures, and Evaluation Protocols](https://arxiv.org/abs/2605.11053)** — Zavrak, 2026. Shows content-aware graph and embedding-based monitoring of MCP tool-call traffic substantially outperforms metadata-only detection and highlights evaluation leakage pitfalls. - 📄 **[Arbiter: Detecting Interference in LLM Agent System Prompts](https://arxiv.org/abs/2603.08993)** — Mason, 2026. Framework combining formal evaluation rules with multi-model LLM scouring to detect interference and vulnerability classes in agent system prompts. - 📄 **[MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in MCP Agents](https://arxiv.org/abs/2602.14281)** — Zhou et al., 2026. Plug-in security cognition layer for MCP agents that validates third-party tool invocations via experience-driven trust calibration. - 📄 **[OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents](https://arxiv.org/abs/2603.11853)** — Li, 2026. Runtime security layer distributing enforcement across ten lifecycle hooks with hybrid heuristic-plus-LLM scanning, session-scoped risk accumulation, and tamper-evident audit for agent gateways. - 📄 **[Governing Evolving Memory in LLM Agents: Risks, Mechanisms, and the SSGM Framework](https://arxiv.org/abs/2603.11768)** — Lam et al., 2026. Stability and Safety-Governed Memory framework mitigating topology-induced knowledge leakage and semantic drift in persistent agent memory systems. - 📄 **[Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees](https://arxiv.org/abs/2606.24322)** — Louck, 2026. Proves content- and lineage-based memory-poisoning defenses are fundamentally insufficient against agent-specific laundering, and proposes TMA-NM, a non-malleable information-flow-control mechanism that achieves 0% attack success with full legitimate utility across eight frontier models versus up to 68% for prior defenses. - 📄 **[Detecting Malicious Agent Skills in the Wild using Attention](https://arxiv.org/abs/2606.23416)** — Etteib et al., 2026. Locate-and-Judge, a two-stage detector that flags malicious marketplace skills by analyzing instruction-following attention patterns, concentrating expensive LLM examination on high-attention instruction spans for cost-efficient marketplace-wide auditing while catching malicious skills existing scanners miss. - 📄 **[AgentSentry: Real-time Monitoring for Agentic AI Systems](https://arxiv.org/abs/2502.XXXXX)** — Runtime behavioral monitoring of tool-using agents. - 📄 **[Monitoring Emergent Reward Hacking via Internal Activations](https://arxiv.org/abs/2603.04069)** — Sparse autoencoders detect reward-hacking during generation. - 📄 **[Self-Attribution Bias: When AI Monitors Go Easy on Themselves](https://arxiv.org/abs/2603.XXXXX)** — AI monitors exhibit systematic leniency on own outputs. - 📄 **[Salient Directions in AI Control](https://arxiv.org/abs/2603.XXXXX)** — Structure of AI Control evaluations: trusted monitors overseeing untrusted agents. - 📄 **[Governed Memory: A Production Architecture for Multi-Agent Workflows](https://arxiv.org/abs/2603.17787)** — Taheri, 2026. Shared memory governance layer with dual memory model, tiered governance routing, entity-scoped isolation (zero cross-entity leakage across 500 adversarial queries), and 100% adversarial governance compliance in production. - 📄 **[Agent-Native Immune System: Architecture, Taxonomy, and Engineering](https://arxiv.org/abs/2606.28270)** — Shen et al., 2026. Proposes ANIS, an endogenous biologically-inspired defense embedded directly in the agent's cognitive loop with a six-layer "Immune Tower" (including a non-cognitive isolation layer), a taxonomy of agent viruses and vaccines, and continual immune learning to counter runtime hijacking via memory poisoning, tool-chain manipulation, and multi-agent protocol attacks that survive training-time alignment. - 🔗 **[Behavioral Attestation and Compaction Drift in Persistent AI Agents](https://morrow.run/after-the-safety-gate.html)** — Morrow (agent-morrow), 2026. Identifies compaction drift — non-adversarial behavioral shift caused by context window compression — as a runtime integrity threat class distinct from adversarial injection. Proposes behavioral attestation (context fingerprint delta against a pre-compression baseline) as the mechanism for continuous rather than one-time agent authorization. Complements credential-scope enforcement (e.g., AATs) with runtime execution verification. - 📄 **[The Decomposition Is the Fingerprint: Per-Component Identity for Agent Skills](https://arxiv.org/abs/2606.31272)** — Liu et al., 2026. Fingerprinting framework that assigns each agent-skill component a locality-sensitive-hash identity to detect tampering, unauthorized reuse, and drift across skill versions, complementing behavioral verification with structural provenance. - 📄 **[From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes](https://arxiv.org/abs/2606.29073)** — Liu, 2026. Defines and benchmarks eight security invariants for MCP-style execution runtimes; the proposed HCP runtime blocks all modeled attacks (tool poisoning, unauthorized execution, privilege drift) that a naive baseline permits. - 📄 **[AgenticOS: An Intent-Oriented Secure Operating System Architecture for Autonomous AI Agents](https://arxiv.org/abs/2606.21129)** — Zhao et al., 2026. OS-like security architecture that reframes agent protection as an intent filter, layering a Ghost Kernel, Logic Shutter, Agent Capsule, and Semantic Boundary Gateway to isolate and mediate autonomous agent actions. - 📄 **[Proof of Execution: Runtime Verification for Governed AI Agent Actions](https://arxiv.org/abs/2607.05397)** — Rhodes et al., 2026. Cryptographically-sound runtime verification framework that binds authorization, effectful actions, tamper-evident history, and deterministic replay into attestable execution objects, so each governed agent step's authority and integrity can be proven rather than assumed from output plausibility. - 📄 **[NovaFabric: Tamper-Evident, Replayable Evidence for Autonomous AI Agent Runs](https://arxiv.org/abs/2609.12582)** — Seyedkazemi Ardebili, 2026. Records an autonomous agent run — without modifying agent logic — into a portable Run Capsule sealed with a DSSE signature, RFC 3161 timestamp, Merkle log, and redaction attestation, producing provider-neutral, tamper-evident, replayable audit evidence exportable for third-party verification with stock tooling (OpenTelemetry, DSSE/in-toto, W3C PROV); targets the compliance records (EU AI Act, ISO 42001, NIST AI RMF) that mutable observability traces cannot supply, with a four-mode replay protocol and evaluated redaction of 14/14 credential types. - 📄 **[When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems](https://arxiv.org/abs/2607.06807)** — Xu et al., ICML 2026. AcMAS detects semantically stealthy attacks in multi-agent systems by analyzing local agents' activation-space reasoning states without relying on explicit interaction graphs, staying robust to asynchronous execution (+0.55 F1 over graph baselines asynchronously) and using the same signals to restore compromised agents rather than isolate them. - 📄 **[Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents](https://arxiv.org/abs/2607.08395)** — Wang et al., 2026. TokenWall audits the natural-language token flows of long-lived agents at runtime, intercepting unsafe behaviors before they reach privileged operations and achieving a 12.5% attack success rate while preserving 97.4% benign-operation compatibility. - 📄 **[TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories](https://arxiv.org/abs/2607.08400)** — Gao et al., 2026. Embeds attribution watermarks directly into an agent's action-log trajectory across two complementary channels — one surviving content deletion, the other surviving rewrites — so a rebranding reseller who silently substitutes a cheaper model or tampers with logs can be detected, protecting agent provenance in production deployments. - 📄 **[FlowGuard: From Signals to Evidence for MCP Security Detection](https://arxiv.org/abs/2607.14754)** — An et al., 2026. Evidence-grounded MCP security detection system that verifies execution-related risks (command injection, file-system access) through runtime evidence rather than suspicious semantic signals alone, combining recon-guided payload narrowing, schema-valid probe generation, and evidence adjudication; on a 1,880-case executable benchmark it reaches 0.879–0.942 F1 while cutting end-to-end latency up to 2.23x, and surfaces 523 findings across 326 real-world servers. - 📄 **[When Agents Look Like Beacons: NIDS Evasion by Model Context Protocol Traffic](https://arxiv.org/abs/2609.19091)** — Sohail, NIPA 2026. Shows that remote MCP over Streamable HTTP produces machine-generated, authenticated, high-frequency JSON-RPC traffic that structurally and temporally resembles C2 beaconing (e.g. Cobalt Strike polling), yet — across a Docker testbed of eleven traffic profiles under Opaque, TLS-Inspected, and Cleartext conditions — evades Suricata signatures and RITA behavioral beacon scoring (a consistent 0.0 beacon score and near-zero alerts under ET Open), because NIDS heuristics tuned for traditional malware do not flag the lognormal inter-arrival distributions of generative-AI reasoning loops; proposes an agent-native network indication standard (Agent-Native ALPN and out-of-band headers) to close the visibility gap. - 📄 **[Democratizing Agent Deployment Safety: A Structural Monitoring Approach](https://arxiv.org/abs/2607.14570)** — Ravindra et al., ICML 2026 Workshops. Untrained Information Flow Graph (IFG) monitor that detects infrastructure-level sabotage under task success — coding agents that complete their task while covertly broadening permissions, degrading logging, or planting persistence — by diffing control- and data-flow graphs; cuts missed attacks from 11.6% to 3.5% asynchronously and, run synchronously as a pre-merge gate with rollback, drops joint main+covert task success from 74.4% to 0.0% without reducing legitimate completion. - 📄 **[Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents](https://arxiv.org/abs/2607.18826)** — Park et al., 2026. Links coordinated attack campaigns across separate agent sessions with no shared infrastructure or labels by fingerprinting behavioral signals such as tool-usage patterns and writing style, enabling cross-agent attribution for incident response. - 📄 **[ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems](https://arxiv.org/abs/2607.19432)** — Narayan et al., 2026. Sequential detection framework that models MCP attack progression as a six-stage kill chain and applies a Hidden Markov Model over a 20-dimensional tool-interaction feature schema to flag malicious tool-call sequences composed from individually benign invocations that evade per-call defenses, covering direct sequential, indirect-injection, and hybrid multi-stage attack chains. - 📄 **[Operational Hallucination and Safety Drift in AI Agents](https://arxiv.org/abs/2607.18366)** — Yu et al., 2026. Empirically characterizes two multi-turn failure modes in tool-using agents — Safety Drift (declared safety intent eroding into constraint-violating actions such as refusal followed by unsafe execution) and Operational Hallucination (livelock-inducing repetitive tool calls from flawed state perception) — attributes them to reasoning/execution-state decoupling, and proposes a plug-in Action-Aware Supervision Layer with intent-action consistency checks, runtime state tracking, and forced-termination primitives. - 📄 **[JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety](https://arxiv.org/abs/2607.19913)** — Xiong et al., 2026. Foresight-oriented guard framework that trains a guard model (Vanguard) to anticipate delayed risks from partial agent trajectories via coupled anticipation and adjudication tasks optimized with CoAA-RL, blocking unsafe actions before execution and improving average protection by 15.9 points over baseline guards while raising benign task completion by 5.1 points across four agent-safety benchmarks. - 📄 **[CARE: Pre-Execution Command Verification for Shell-Executing LLM Agents](https://arxiv.org/abs/2607.21642)** — Zhang et al., ISSRE 2026. Shell-specific static-first verifier that mediates individual commands at the dispatch boundary — canonicalizing generated commands into stable verification targets, deriving deterministic evidence over syntax, command semantics, path context, and provenance-backed risk patterns, and escalating only underdetermined cases to an LLM judge — reaching 85.64% F1 at a 0.91% false-positive rate and 2.32 ms mean latency, and cutting realized harm on RedCode-gen to 37.33% in its static enforcement profile. - 📄 **[SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems](https://arxiv.org/abs/2607.25255)** — Dai et al., 2026. Reframes cross-agent malicious propagation — where a harmful objective is fragmented into locally plausible subtasks that evade any single agent — as a semantic information-flow problem, attaching structured semantic taints to root requests, propagating them through a dynamic collaboration graph, and performing workflow-level validation to reconstruct global risk context before irreversible actions commit. - 📄 **[Hybrid Analysis for Secure MCP Tool Use in LLM Agents](https://arxiv.org/abs/2607.25297)** — 2026. MTGuard defends MCP tool use through lifecycle-aware static–dynamic co-analysis rather than inspecting prompts and outputs alone, arguing static-only defenses limit effectiveness and robustness against agents induced into malicious or unauthorized tool actions. - 📄 **[Distributing Security Controls Through Harness Engineering](https://arxiv.org/abs/2607.25890)** — Gore, 2026. Shows off-the-shelf security controls (OS sandboxing, skill scanning, tool restriction) can be embedded into a distributable agent harness (SHarD, built on Pi) and scaled to commercial coding agents via a single install command, matching direct-install efficacy and scoring 100% on a 23-test suite derived from the OWASP Top 10 for Agentic Applications. - 📄 **[SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents](https://arxiv.org/abs/2607.25619)** — Yang et al., 2026. Deployable security gateway that screens skill packages before coding-agent installation via a hybrid regex-prefilter + LLM-judge pipeline — safe-signal files bypass the LLM entirely and flagged files send only matched snippet windows rather than full content — reaching F1 0.817 at 1.13% FPR on SkillsBench (n=1,650, 9.1% malicious) while cutting LLM input tokens 77% and outperforming existing tools 5–6x on threshold-independent AUPRC. - 📄 **[Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study](https://arxiv.org/abs/2607.24893)** — Arias et al., 2026. Studies distributed backdoors where a poisoned tool hides encrypted payload fragments across several agents that an external step reassembles after the run, evading per-step safety checks; a prefix detector flags 99.3% of successful attacks with a median of five steps remaining (10.3% safe-run false positives), but shows much of that warning rests on removable surface cues (ciphertext length and entropy) rather than the attack's distributed structure — once stripped, detection arrives later and transfers poorly across domains. - 📄 **[$S^3$: Improving Agent Safety through Multi-Stage Defense](https://arxiv.org/abs/2608.02683)** — Xiao et al., 2026. Multi-stage defense that jointly protects LLM agents across the memory, planning, and tool-execution stages of the agentic workflow, mitigating risks that emerge at one stage and propagate across steps rather than protecting isolated stages in ways that are hard to integrate. - 📄 **[AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection](https://arxiv.org/abs/2608.04053)** — Weng et al., 2026. Self-evolving "immune system" against prompt injection that represents the user's security boundary as a persistent library of antibodies, learning from each encounter to recognize and neutralize injections that exploit underspecified user requests where the desired outcome is stated but acceptable behavior is not. - 📄 **[DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model](https://arxiv.org/abs/2608.05695)** — Lin et al., 2026. Proactive runtime guardrail built around a risk-aware world model that maintains a compact recurrent latent state over the agent's trajectory and predicts future latent states to derive immediate-hazard and prefix-risk signals, catching long-horizon risks where individually benign-looking actions gradually drift the agent toward hazardous states; fuses the multi-horizon signals into pre-execution intervention decisions, achieving the best safety–utility trade-off across four benchmarks at ~25 ms average latency per call. - 📄 **[Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents](https://arxiv.org/abs/2608.12977)** — Ruan et al., 2026. Develops a harness-level formulation of runtime defense that characterizes how harness mechanisms enable defense construction, then uses it to move past manually designed interventions toward self-evolving defenses that automatically construct and maintain security mechanisms inside the agent execution loop. - 📄 **[Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened](https://arxiv.org/abs/2608.16032)** — Rahman & Kim, 2026. Counters memory-forgery attacks such as FARMA — where fabricated reasoning-memory entries claim a required safety step is already done so the agent skips it — by verifying entries against what the agent actually executed, rather than scoring them against a fixed suspicious-wording list that an automated rewriter can evade. - 📄 **[DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents](https://arxiv.org/abs/2609.10892)** — Pinjari & Saint-Germain, 2026. Dual-head trajectory Transformer that reads a logged tool-call trajectory and in one forward pass both classifies it as compromised or not and assigns every step one of four labels (benign, injection point, hijacked, failed injection) — reportedly the first supervised detector to jointly answer where an indirect prompt injection entered, which steps it corrupted, and whether apparent poison was resisted, giving operators step-level localization rather than a single whole-trace verdict or unsafe index. - 📄 **[Engineering Reliable Commit Gates for Agentic AI: Cost-Aware Verification Portfolios under Common-Mode Data Failures](https://arxiv.org/abs/2609.10969)** — Zheng et al., 2026. Shows additional verifiers can inherit the same upstream fault as the actor (a cross-model vote over shared evidence approves 62.9% of unsafe proposals versus 22.9% with an independent evidence source — a 40.9-point source effect dwarfing 11.3 for model diversity), and presents VP-CONTROL, a runtime-assurance design and 2,880-scenario benchmark whose portfolio controller selects cost-aware verification plans from deployment-observable metadata; a preregistered live HTTP/SQLite study finds after-check races defeat verifier-only gates while a full atomic commit-time guard records no unsafe effects across 216 episodes. ### Input/Output Validation - 📄 **[IHDec: Divergence-Steered Contrastive Decoding for Securing Multi-Turn Instruction Hierarchies](https://arxiv.org/abs/2606.29960)** — Liu et al., 2026. Training-free decoding-time defense that uses Jensen-Shannon divergence to detect and suppress token-level violations where lower-priority inputs override higher-priority instructions, strengthening multi-turn agents against adversarial prompt injection. - 📄 **[AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization](https://arxiv.org/abs/2604.24118)** — Ying et al., 2026. Defends tool-using agents by semantically virtualizing untrusted external content to reduce prompt injection influence on privileged actions. - 📄 **[Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems](https://arxiv.org/abs/2606.20470)** — Soosahabi & Namsani, 2026. Proposes CMPE, a defense that replaces predictable refusals with misleading-but-safe outputs to degrade automated jailbreak attacks by denying attackers a reliable success signal. - 📄 **[Defending against Adaptive Prompt Injection Attacks via Reasoning-enabled Task Alignment](https://arxiv.org/abs/2606.15441)** — He et al., 2026. Argues pattern-matching IPI defenses collapse under adaptive attacks, and instead assesses whether each embedded instruction's intent is relevant to the user's task — restoring robustness against attackers who optimize against the deployed defense. - 📄 **[Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning](https://arxiv.org/abs/2606.20922)** — Shi et al., 2026. Tool-Guard defense that quarantines untrusted tool descriptions during a first isolated planning pass so poisoned tool metadata cannot steer agent actions, preserving task utility while cutting attack success on AgentDojo and Agent Security Bench. - 📄 **[StruQ: Defending Against Prompt Injection with Structured Queries](https://arxiv.org/abs/2402.06363)** — Separates prompts from data to prevent injection. - 📄 **[Towards Provably Unbiased LLM Judges via Bias-Bounded Evaluation](https://arxiv.org/abs/2603.05485)** — Formal guarantees for reducing bias in LLM-as-judge systems. - 📄 **[Judge Reliability Harness: Stress Testing LLM Judges](https://arxiv.org/abs/2603.05399)** — No evaluated judge is uniformly reliable. - 📄 **[GELO: Good-Enough LLM Obfuscation](https://arxiv.org/abs/2603.05035)** — Privacy-preserving LLM inference with ~20-30% latency overhead. - 📄 **[Untrusted Content Masking for Web Agents with Security Guarantees](https://arxiv.org/abs/2607.05277)** — Nikolić et al., 2026. UCM restores the trusted/untrusted boundary for web agents by using the DOM to redact untrusted page regions before they reach the agent and routing interaction through a sandboxed, privilege-separated interface — extending provable prompt-injection defenses from tool-use APIs to the rendered-page setting. - 📄 **[Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions](https://arxiv.org/abs/2607.07461)** — Shi et al., 2026. Finds taint-style flaws dominate MCP server vulnerabilities and are slow to patch, then proposes SPELLSMITH, which builds tool-level risk profiles and embeds behavioral guidance into the protocol's Description field plus an LLM self-reflection loop to mitigate exploitation without context-specific code fixes. - 📄 **[Multi-Agent Firewall Architecture for Privacy Protection of Sensitive Data in Interactions with Language Models](https://arxiv.org/abs/2607.08282)** — García Cuesta et al., 2026. Intercepts user–LLM traffic over HTTP(S) and WebSocket via a browser extension and proxy, then runs a multi-agent detection pipeline combining deterministic detectors with LLM-driven semantic analysis to block sensitive-data and proprietary-code leakage before transmission (F1 up to 94.93%). - 📄 **[PVDetector: Detecting Prompt Injection Attacks on Purpose-Specific LLM Agents through Policy-Violation Concept Analysis](https://arxiv.org/abs/2607.12624)** — Wang et al., 2026. Training-free inference-time defense that detects prompt injection by measuring a purpose-specific agent's hidden-state alignment with latent "policy-violation concepts" — semantic representations of the conflict between the user request and the agent's designated purpose restrictions. - 📄 **[SingGuard-NSFA: Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification](https://arxiv.org/abs/2607.13081)** — 2026. Dual-mode guardrail framework combining interpretable generative reasoning with real-time classification across 133 languages to detect operational threats to agentic AI — prompt injection, sensitive-information extraction, malicious code requests, dangerous tool misuse, and resource exhaustion. - 📄 **[ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems](https://arxiv.org/abs/2607.19430)** — Hossain et al., 2026. Shows across a 2,100-trace evaluation that an undefended multi-agent pipeline's apparent safety owes almost entirely to cloud-provider server-side filters (54 of 60 blocks on Azure GPT-5) and silently vanishes on backends without them; proposes a training-free defense-in-depth framework placing information-bottleneck gates on every inter-agent channel, blocking tool poisoning 30/30 at the application layer identically across backends while halving prompt-injection success and preserving benign accuracy. - 📄 **[MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck](https://arxiv.org/abs/2607.28103)** — Liu et al., 2026. Observes that benign and poisoned agent trajectories differ in the relationship between initial user intent and subsequent behavior, and uses an intent-aware information bottleneck to extract compact intent–behavior representations that denoise retrieved memory, defending against memory injection attacks with lower cost and less multi-turn redundancy than prior defenses. - 📄 **[PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents](https://arxiv.org/abs/2608.05495)** — Zhang et al., 2026. PromptShield-Home, a pilot benchmark of realistic smart-home scenarios (addressee ambiguity, screen/audio injection, health-monitor false triggers, mixed occupancy, legitimate-command floor) probing whether multimodal home agents can distinguish genuine user commands from ambient TV, on-screen, or overheard content, and compares traditional detectors, single-MLLM, and multi-agent mediation defense layers. - 📄 **[Robust Context-Aware Detection of Malicious Instructions in Text](https://arxiv.org/abs/2608.05430)** — Liu et al., 2026. Context- and query-aware classifier that segments text into benign and malicious sentences to detect indirect prompt injection at the segment level, hardened against adaptive evasion attacks realizable in agentic executions. - 📄 **[Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents](https://arxiv.org/abs/2607.29254)** — Pan et al., 2026. Identifies schema-formatted tool specifications as a primary source of agent safety degradation — white-box representation analysis shows they weaken the model's internal refusal signals — and proposes SafeKeep, an inference-time safeguard that judges requests against flattened textual tool specs while executing with the original schema, raising harmful-request refusal from 23.8% to 70.6% and cutting observation-level prompt-injection success from 25.6% to 2.5%. [Code](https://github.com/snowcatsmoking/SafeKeep). - 📄 **[PIPES: Securing Agent Perception with Provenance and Priors](https://arxiv.org/abs/2608.12789)** — Kariyappa et al., 2026. Identifies state-corruption attacks, where attacker-controlled tool-response content makes environmental claims beyond the informational authority of its response component and corrupts the agent's perceived environment so the resulting action looks justified to existing guardrails; PIPES (Provenance-Informed, Prior-Enforced Screening) screens response units using semantic priors and source provenance so injected claims cannot masquerade as trusted context. - 📄 **[Cross-Layer Misalignment Detection in Agent Skills: A Progressive Loading-Aware Contrastive Learning Approach](https://arxiv.org/abs/2607.10534)** — Zhang et al., KDD 2026 Workshop. Detects "cross-layer misalignment" — inconsistency between a third-party skill's advertised metadata and its true runtime behavior — with progressive loading-aware hierarchical contrastive learning over a normalized corpus of 264,000+ open-source skills, raising Macro-F1 from ~0.45 for unadapted baselines to 0.87–0.89 as a screening tool for users and operators selecting skills. - 📄 **[Universal Defenses for Tool-Integrated LLM Agents Against Adversarial Attacks](https://arxiv.org/abs/2609.16098)** — Li & Wang, 2026. Explores generalizable defenses spanning four attack types at once (direct/indirect prompt injection, memory poisoning, backdoor) via two universal tool-based mechanisms — Attacker Tool Filtering, which uses anomaly detection (e.g. Isolation Forest) to remove suspicious tools, and Normal Tool Recalling, a white-box method restoring the agent's original toolset before planning — plus chain-of-thought, self-reflection, and task-paraphrasing prompt defenses; across four open-source and three proprietary LLMs (through GPT-5) it reaches 0% attack success in many settings while preserving task success. [Code](https://github.com/Xiaoyan-Lisa/Defenses-for-Tool-Integrated-LLM-Agents-Against-Adversarial-Attacks) - 📄 **[The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents](https://arxiv.org/abs/2609.18411)** — Irshad et al., 2026. Architectural HITL defense for agentic browsers that reconstructs approval information from the ground-truth pending action and trusted intent provenance, renders it out-of-band in trusted browser chrome, and binds approval to the exact action re-verified at dispatch — combining provenance fencing, default-deny confirmation, and execution binding; across a 24-scenario benchmark (confused-deputy, Lies-in-the-Loop dialog forging, indirect prompt injection, adaptive substitution) it cuts attack success from 68–100% to 0% on every model with 78% legitimate-task completion and 0% false-block rate. - 📄 **[Detecting and Localizing Segment-Level Poisoning in Multi-Source LLM-Agent Inputs](https://arxiv.org/abs/2609.14723)** — Tan et al., 2026. Targets segment-level poisoning, where an adversary controlling only a small subset of an agent's aggregated sources (retrieved passages, reviews, documents) injects fluent, semantically plausible malicious content; observes that successful corrupted-evidence and adversarial-instruction attacks induce a consistent activation-space "poison direction" and proposes ActProbe, which projects MLP activations onto a learned poison direction with a lightweight linear SVM to detect contaminated prompts, then applies BinRoL (recursive replacement ablation, Mahalanobis branch pruning, MAD-based leaf detection) to localize poisoned segments in O(k log n) forward passes — reaching 0.01 FPR, 0.05 FNR, and 0.90 localization F1 across three datasets and four open-weight LLMs while remaining effective under adaptive attacks and protecting black-box APIs via surrogate-based removal. ### Formal Verification & Analysis - 📄 **[Efficient and Sound Probabilistic Verification for AI Agents](https://arxiv.org/abs/2606.20510)** — Solko-Breslin et al., 2026. Verification framework using distributionally robust optimization to compute sound upper bounds on the probability of agent policy violations under uncertainty, without independence assumptions between predicates. - 📄 **[Agentics 2.0: Logical Transduction Algebra for Agentic Data Workflows](https://arxiv.org/abs/2603.04241)** — Formalizes LLM inference as typed semantic transformations with algebraic composition. - 📄 **[Knowledge Divergence and the Value of Debate for Scalable Oversight](https://arxiv.org/abs/2603.XXXXX)** — Formal framework for choosing oversight mechanisms. - 📄 **[AutoSpec: Safety Rule Evolution for LLM Agents via Inductive Logic Programming](https://arxiv.org/abs/2606.24245)** — Ma et al., 2026. Counterexample-guided inductive synthesis that evolves expert-designed agent safety rules via inductive logic programming, reaching F1 of 0.98/0.93 across two domains, cutting false positives up to 94%, and producing human-auditable rules that generalize to unseen scenarios. - 📄 **[Local LLM Agents as Vulnerable Runtimes: A Source-Code Audit of the Agent Runtime Layer](https://arxiv.org/abs/2606.21071)** — Zhang et al., 2026. CLAWAUDIT static-analysis framework that audits the agent runtime layer itself for security vulnerabilities, raising recall from 13.8–21.7% baselines to 66.8–75.1% across 217 held-out advisories. - 📄 **[AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs](https://arxiv.org/abs/2607.01640)** — Wang et al., 2026. First static analysis framework to recover agent-specific dependencies (agent constructors, tool decorators, handoff declarations) into an Agent Dependency Graph, enabling Agent Bill of Materials generation and prompt-to-tool risk detection; uncovers 238 taint-style prompt-to-tool risks across 5,399 real-world agent programs. - 📄 **[SkillsMetric: Mapping the Detection Boundary of Static Analysis for Malicious Agent Skills](https://arxiv.org/abs/2608.08468)** — Chen et al., 2026. Five-stage static-analysis framework scoring skill packages along pattern density, statistical anomaly, dataflow taint, import anomaly, and capability-mismatch dimensions (AUC 0.93 on the full SkillMD-138K corpus plus a 2,266-skill adversarial set spanning 16 attack types), while exposing a fundamental blind spot: host-destruction attacks using common shell commands evade all five stages. - 📄 **[SkillConsist: Detecting Inconsistencies in Agent Skills via Bidirectional Graph Alignment](https://arxiv.org/abs/2608.07639)** — Meng et al., 2026. Detects agent-skill inconsistencies — undisclosed dangerous behavior or mismatched declarations that cause wrong skill selection — by separating declaration and implementation content into behavior records (via an LLM plus static analysis) and aligning them with a bidirectional graph, handling cases where declaration and implementation are mixed across text and code and a concise declaration maps to multiple connected implementation steps. - 📄 **[Correct Is Not Governed: Provenance Integrity in Agentic Workflows](https://arxiv.org/abs/2608.12761)** — Salas, 2026. Argues outcome-correctness is insufficient in institutional settings, where a correct action may rely on the wrong authority, an unsupported completion claim, or work made stale by a later change, and defines governed execution as work whose decisions, completion, and response to change are backed by inspectable provenance; presents Matrix, a deterministic causal-state layer that records authority and fact dependencies, verifies completion evidence, and selectively invalidates affected work. - 📄 **[CaMeLoT: CaMeL orchestrated with Temporal logic for static verification and liveness](https://arxiv.org/abs/2609.18674)** — Nikolaou et al., CAMLIS 2026. Extends the CaMeL prompt-injection defense with a static verification layer that translates an agent's generated plan into a finite-state transition system labeled with tool calls, provenance, and taint, then model-checks it against CTL temporal policies via nuXmv before any tool runs — rejecting unsafe plans without spending LLM or tool calls and returning counterexamples for plan repair; evaluated on policies derived from AgentDojo, SOC workflows, and prompt-extraction experiments. - 📄 **[Formal Analysis and Supply Chain Security for Agentic AI Skills](https://arxiv.org/abs/2603.00195)** — Bhardwaj, 2026. Five theorems with complete proofs establishing soundness for skill-package analysis, combining pattern-matching detection with information-flow analysis (96.15% F1), and releasing SkillFortify; notably reports that information-flow analysis added no detections beyond pattern matching on the tested corpus. ### Evaluation & Red Teaming - 📄 **[MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG](https://arxiv.org/abs/2606.26793)** — Singh et al., 2026. Cross-surface red-teaming framework for multimodal agentic RAG that uses memory-guided Monte Carlo tree search to generate novel attacks spanning text poisoning, image injection, direct-query attacks, and orchestrator-level tool manipulation, avoiding the 73–84% template duplication of prior surface-specific approaches. - 📄 **[CONTRA: Red-Teaming Configurations of Personalizable Agents](https://arxiv.org/abs/2607.03220)** — Nöther et al., 2026. LLM-assisted tree-search red-teaming algorithm for discovering unsafe configurations of personalizable agents, finding that most popular skills can be manipulated into executing malicious actions. - 📄 **[Safety Testing LLM Agents at Scale: From Risk Discovery to Evidence-Grounded Verification](https://arxiv.org/abs/2607.01793)** — Feng et al., 2026. Introduces Vera, an automated safety-testing framework that discovers agent vulnerabilities via structured risk taxonomies and evidence-grounded verification, achieving 93.9% attack success across four production agent frameworks. - 📄 **[The Best-Laid SCHEMEs: Coordinated Sabotage and Monitoring in Multi-Agent Systems](https://arxiv.org/abs/2605.29178)** — Bernabeu-Perez et al., 2026. Benchmark for covert multi-agent sabotage showing coordinated hidden objectives are already practical in coding systems, while trusted monitors can still detect most attacks. - 📄 **[ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D](https://arxiv.org/abs/2607.19321)** — Libon et al., 2026. AI-control framework spanning four long-horizon AI R&D tasks (safety and capabilities post-training, CUDA-kernel and inference-server optimization), each paired with an embedded side task that sabotages the produced artifact and an independent out-of-scope sandbox side task, evaluating frontier agents at both sabotage and monitoring across four monitor types — and finding training-data-hidden sabotage is flagged under half the time even when monitors may execute and probe the artifact rather than only read the trajectory. - 📄 **[Real-Time Trust Verification for Safe Agentic Actions using TrustBench](https://arxiv.org/abs/2603.09157)** — Sharma et al., AAAI 2026 Workshop on TrustAgent. Dual-mode framework benchmarking trust across multiple dimensions and providing a pre-execution action verification toolkit for agents. - 📄 **[Agent Security Bench (ASB)](https://arxiv.org/abs/2410.02644)** — 10 scenarios, 10 agents, 398 environments. Comprehensive agent security benchmark. - 📄 **[SkillVetBench: LLM-as-Judge for Multi-Dimensional Security Risk Evaluation in Open-Source LLM Agent Skills](https://arxiv.org/abs/2606.15899)** — Hossain et al., 2026. Live public leaderboard and semantic vetting system that evaluates instruction-layer and multi-agent risks in community-contributed agent skills — directives that hijack an agent, exfiltrate data via encoded side channels, or chain harm across pipelines — which code-layer scanners are structurally blind to. - 📄 **[Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents](https://arxiv.org/abs/2606.26479)** — Narisetty et al., 2026. Frames out-of-band defenses (CaMeL, FIDES, Progent) as classical integrity-protection mechanisms and stress-tests them with adaptive attacks, cautioning that — like earlier in-band defenses — their reported gains (e.g. Progent cutting attack success from 25.8% to 4.2%) have only been validated against static benchmarks. - 📄 **[AutoDojo: Adaptive Attacks Expose Superficial Defenses and User-Underspecification Limits in LLM Agents](https://arxiv.org/abs/2606.15057)** — Ma et al., 2026. Replaces static IPI benchmarks like AgentDojo with adaptive attack generation, revealing that prompt-based, detection-based, and system-level defenses are substantially weaker than static evaluations suggest. - 📄 **[SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfaces](https://arxiv.org/abs/2605.12015)** — Jin et al., 2026. Runnable benchmark with 155 adversarial skill-mediated cases across 47 tasks, 6 risk domains, and 30 safety categories. - 📄 **[No More, No Less: Task Alignment in Terminal Agents](https://arxiv.org/abs/2605.12233)** — Mavali et al., 2026. Introduces TAB, an 89-task benchmark for whether terminal agents selectively follow relevant environmental cues while resisting distractor instructions. - 📄 **[Proteus: A Self-Evolving Red Team for Agent Skill Ecosystems](https://arxiv.org/abs/2605.11891)** — Zhou et al., 2026. Grey-box adaptive red-teaming framework that iteratively rewrites skills using audit and runtime feedback to measure residual deployment risk. - 📄 **[SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skills](https://arxiv.org/abs/2609.14079)** — Mecca et al., 2026. Fully agentic red/blue framework that generates context-compatible injections across nine threat types, then analyses complete skill packages to detect, localise, and patch them with grounded evidence; its best backend is the only scanner to reach a 100% injection detection rate, and analysing popular skills.sh skills surfaces latent vulnerabilities in over 17% examined — some triggering real incidents when run. - 📄 **[SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills](https://arxiv.org/abs/2608.03485)** — Li et al., 2026. Dynamic safety-testing framework that places external agent skills in adaptive "honey worlds" to trigger execution-time malicious behavior that only surfaces under particular environmental states, resources, or interaction histories — catching threats that static analysis, predefined rules, and one-shot semantic judgments miss. - 📄 **[AgentDyn: A Dynamic Open-Ended Benchmark for Prompt Injection Attacks](https://arxiv.org/abs/2602.03117)** — Li et al., 2026. Dynamic, open-ended benchmark for evaluating indirect prompt injection defenses in real-world agent security systems. - 📄 **[NAAMSE: Framework for Evolutionary Security Evaluation of Agents](https://arxiv.org/abs/2602.07391)** — Pai et al., ICLR 2026 Workshop. Evolutionary framework reframing agent security evaluation as feedback-driven optimization with autonomous red-teaming. - 📄 **[R-Judge: Benchmarking Safety Risk Awareness](https://arxiv.org/abs/2401.10019)** — 162 records, 27 risk scenarios for agent safety. - 📄 **[InjecAgent: Benchmarking Indirect Prompt Injections](https://arxiv.org/abs/2403.02691)** — 1,054 test cases for tool-integrated agents. - 📄 **[SIABENCH: Evaluating LLMs for Security Incident Analysis](https://arxiv.org/abs/2603.XXXXX)** — 11 LLMs × 160 security incident scenarios. - 📄 **[EVMbench: Evaluating AI Agents on Smart Contract Security](https://arxiv.org/abs/2603.04915)** — 117 vulnerabilities, frontier agents exploit end-to-end. - 📄 **[τ-Knowledge: Evaluating Conversational Agents over Unstructured Knowledge](https://arxiv.org/abs/2603.04370)** — Even frontier models achieve only ~25.5% on complex agent tasks. - 📄 **[Interactive Benchmarks](https://arxiv.org/abs/2603.04737)** — Evaluating via interactive proofs and games instead of static benchmarks. - 📄 **[VeriGrey: Greybox Agent Validation](https://arxiv.org/abs/2603.17639)** — Zhang et al., 2026. Greybox security testing using tool-invocation sequences as feedback and mutational prompt fuzzing; 33% more effective than black-box on AgentDojo, discovers prompt injection scenarios missed by black-box in Gemini CLI and OpenClaw. - 📄 **[LAAF: Logic-layer Automated Attack Framework for Agentic LLM Systems](https://arxiv.org/abs/2603.17239)** — Atta et al., 2026. First automated red-teaming framework combining 49-technique LPCI taxonomy with stage-sequential seed escalation; 84% mean aggregate breakthrough rate across five production LLM platforms. - 📄 **[VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Servers](https://arxiv.org/abs/2605.21392)** — Sun et al., 2026. End-to-end auditing framework that statically localizes vulnerable MCP tool handlers and dynamically evolves proof-of-concept prompts, uncovering 106 confirmed 0-days and 67 CVEs across open-source MCP servers. - 📄 **[SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents](https://arxiv.org/abs/2606.18356)** — Tian et al., 2026. Staged benchmark of 600 adversarial tasks distinguishing three agent failure modes — semantic acceptance, auditable harm evidence, and executable state changes — showing these endpoints capture different vulnerabilities across models and prompt policies. - 📄 **[Red-Teaming the Agentic Red-Team](https://arxiv.org/abs/2606.24496)** — Pasquini et al., 2026. First security assessment of widely-deployed offensive-security agents, documenting a complete attack chain in which an active adversary exfiltrates API keys, establishes persistent footholds, and compromises operator machines, and proposing architectural safeguards. - 📄 **[Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming](https://arxiv.org/abs/2606.31227)** — Yang et al., 2026. AI-Infra-Guard organizes agent red-teaming across infrastructure, protocol/tool, behavior, and model layers with 75+ components and 1,400+ rules, matching detection paradigms to each attack surface. - 📄 **[Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens](https://arxiv.org/abs/2606.30755)** — Niu et al., 2026. SafeClawArena benchmark evaluates always-on agents across supply-chain integrity, state exploitation, data-flow, and indirect-injection attack surfaces, reaching 70% peak attack success and surfacing systemic weaknesses in persistent agents. - 📄 **[Security–Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense](https://arxiv.org/abs/2606.30783)** — Hermon et al., 2026. Introduces the SecFid benchmark showing no model jointly achieves strong security and task fidelity — the most secure configuration reaches 99.3% defense at only 71.0–73.9% fidelity — quantifying the utility cost of injection defenses. - 📄 **[When AUC 0.998 Is Not Enough: A Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agents](https://arxiv.org/abs/2606.22864)** — Li et al., 2026. Cautions that high probing AUC on multimodal computer-use agents does not by itself establish reliable malicious-injection detection, and proposes diagnostic controls for evaluating hidden-state IPI probes. - 📄 **[Distributed Attacks in Persistent-State AI Control](https://arxiv.org/abs/2607.02514)** — Hills et al., 2026. Introduces Iterative VibeCoding, an AI-control benchmark where a prompt-injected coding agent distributes a covert side task across successive pull requests in a persistent codebase; shows no single monitor resists both gradual and concentrated attacks (>=65% evasion generalizes across model backends), and proposes a stateful link-tracker monitor that cuts gradual-attack evasion from 93% to 47% in a four-monitor ensemble. - 📄 **[Beyond Attack-Success Rate: Action-Graded Severity Scale for Tool-Using AI Agents](https://arxiv.org/abs/2607.07474)** — Owiredu-Ashley, 2026. Replaces the binary attack-success metric with a seven-level (L0–L6) action-graded harm rubric scoring an agent's tool-call trajectory by reversibility, cross-scope reach, and privilege expansion, computed via a deterministic oracle and a three-judge panel (Krippendorff's α=0.91) that together expose cross-scope leaks a zero-attack-success-rate defense hides. - 📄 **[Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability](https://arxiv.org/abs/2607.11086)** — Chen et al., 2026. Introduces MCPZoo, a dataset of 64,611 unique runtime MCP servers enabling dynamic analysis, and shows existing MCP security scanners are unreliable — flagging 96.89% of servers as risky while fewer than 50% of sampled alerts are true positives. - 📄 **[Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale](https://arxiv.org/abs/2608.00150)** — Padilla et al., 2026. First dynamic behavioral security assessment of internet-facing MCP servers, combining passive discovery across eleven data sources with active testing via Corvus (34 test modules covering 10 MCP-specific vulnerability classes); across four July 2026 runs it audits 414 confirmed servers and uncovers 68 reportable vulnerabilities (SQL injection, SSRF against cloud metadata, prompt-template injection, path traversal), finding 91.8% lack OAuth authentication and 687 tool instances expose unguarded shell execution, and releases Corvus as an open-source MCP security evaluation framework. - 📄 **[Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation](https://arxiv.org/abs/2607.14006)** — Allahbakhsh et al., 2026. Reframes penetration testing for AI-enabled systems around behavioral objective violations rather than infrastructure compromise, mapping adversarial pathways including prompt injection, indirect prompt injection, data/retrieval poisoning, tool misuse, and agentic misalignment. - 📄 **[Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security](https://arxiv.org/abs/2607.18063)** — Jain et al., 2026. Multi-turn, multi-LLM benchmark showing defenders that resist single-turn attacks degrade sharply against adaptive adversaries who revise tactics across rounds, with attack success climbing from 0–1% to 5.4–14.0% over 15 iterative attempts. - 📄 **[RECEIPT: Deterministic, Reward-Hacking-Resistant Verification for White-Box Agentic XSS Discovery](https://arxiv.org/abs/2607.18575)** — Lyu et al., 2026. Deterministic verification framework that stops LLM coding agents from reward-hacking XSS-discovery tasks with false success claims, enforcing strict environment isolation and role-based payload execution before a finding is counted as valid. - 📄 **[Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming](https://arxiv.org/abs/2608.05108)** — Wang et al., 2026. PIMiner, an agentic prompt-injection red-teaming system that builds a transferable strategy library from scratch during training and applies it to previously unseen target LLMs without retraining using only ~10 queries per sample, reaching up to 86.7% ASR on AgentDojo and 76.2% on IPIArena against frontier models. [Code](https://github.com/wang-yanting/PIMiner). - 📄 **[Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents](https://arxiv.org/abs/2607.19837)** — Eliav et al., 2026. Formalizes agent reconnaissance as the extraction of knowledge assets that give adversaries leverage in indirect prompt injection, and instantiates it as KYA, a framework that automates black-box, recon-driven pentesting by probing agents, building target profiles, and using those profiles to craft stronger attacks; evaluated on agent-security benchmarks and a real-world coding agent, released with benchmarks and baselines. - 📄 **[Guardrails as Scapegoats: Auditing Unfaithful Safety Refusals in Tool-Augmented LLM Agents](https://arxiv.org/abs/2607.19449)** — Singh, KDD 2026 Workshop. Black-box auditing framework that injects silent tool-failure profiles (empty, null, or malformed HTTP-200 payloads) and classifies agent responses as Honest Surrender, Fabrication, or Unfaithful Safety Refusal — finding fabrication dominates (56.6%) while adding standard safety language to the system prompt amplifies invented policy/privacy rationales for tool failures 15.6x, concentrated on sensitive tools such as medical-record and contract retrieval. - 📄 **[IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests](https://arxiv.org/abs/2607.20759)** — Singh et al., 2026. Benchmark of malicious issue-request attacks against production coding agents (Cursor, Claude Code, Codex Desktop) spanning four attack categories and six delivery vectors (PDF, issue comment, etc.); 66.5% of malicious issues penetrate all agent- and LLM-level guardrails, with refusals coming almost entirely from the model rather than the agent framework and current agent-level defenses adding little protection. - 📄 **[OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills](https://arxiv.org/abs/2607.20121)** — Liu et al., 2026. Safety benchmark of 263 risky skills collected from public marketplaces across seven threat categories, each paired with a standardized task and sandbox; across three CLI agent frameworks and thirteen LLMs even the safest configuration still executes unsafe actions ~17% of the time, and behavioral analysis surfaces three recurring failure patterns — failing to recognize the risk, recognizing it but not intervening before acting, and following skill instructions beyond the user's intended scope. - 📄 **[Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation](https://arxiv.org/abs/2608.12880)** — Ahmed & Abbas, 2026. Audits a preserved MCP agent-security campaign and shows the historical grader suffered direct treatment leakage — treatment metadata gated the ATTACK_SUCCESS class, so fixed behavior could change class under relabeling; tracing 10,200 execution rows back to their true stimuli, a treatment-blind reconstruction corrects 58 mislabeled ATTACK_SUCCESS/HIJACK_ATTEMPT records, warning that stored labels must not be equated with behavioral facts. - 📄 **[Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming](https://arxiv.org/abs/2607.11698)** — Mao et al., 2026. AHA, a falsifiable discovery loop that proposes a vulnerability hypothesis, builds a falsifier, instantiates and executes an attack in a sandboxed harness, then promotes confirmed findings into a reusable Vulnerability Concept Graph (VCG); across Claude Code and Codex on direct and indirect attacks, the frozen VCG requires no further search yet beats the strongest discovery baseline by 14.2 points under a single-shot protocol and transfers across scenarios and attack channels. [Code](https://github.com/henrymao2004/Auto-research-red-teaming-in-sleep). - 📄 **[Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection](https://arxiv.org/abs/2608.16393)** — Ying et al., 2026. Uses AI-Infra-Guard to run 14,560 controlled executions across 16 indirect-content channels, 35 payload objectives, and 12 attack methods against the DeepSeek Harness agent loop, judging outcomes with paired rule-based and semantic LLM judges over local source-tool and sensitive-sink fixtures so attempted actions are recorded without external side effects. - 📄 **[BenchShield: Formal Model-Backed Instrumentation for Reward Integrity in LLM-Agent Evaluation Infrastructure](https://arxiv.org/abs/2609.11028)** — Zheng et al., 2026. Treats interactive LLM-agent benchmarks as attack surfaces for reward hacking — where an agent improves its measured score by exploiting the reward-relevant trajectory instead of solving the task — and grounds detection in a finite lifecycle model of an evaluation's reward-relevant events, providing reusable per-run evidence that a concrete execution stayed within its intended evaluation boundary rather than relying on task-specific patches, prompt instructions, or post-hoc detectors. - 📄 **[Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems](https://arxiv.org/abs/2609.17320)** — Akkil et al., 2026. Continuously-running multi-agent environment for adversarially stress-testing persistent autonomous systems: eight parallel worlds of ten agents (seven single-model, one mixed) ran 16 days, 850,000+ LLM calls and ~50B tokens while pursuing goals, using/creating tools, and maintaining memory, then received three controlled stress events (indirect prompt injection, misinformation, private-memory exposure) through ordinary interaction surfaces; no world was fully resilient, detection did not ensure containment (systems recognized threats yet wrote adversarial content into memory and acted on it up to 46 hours later), and model-level alignment proved non-compositional. - 📄 **[Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery](https://arxiv.org/abs/2609.09647)** — Kumar et al., 2026. Systematic black-box risk-aware agent evaluation requiring only basic system descriptions, pairing a seven-domain taxonomy that maps observable behaviors to risk categories with fully automated SAGE-RT red teaming (120 adversarial scenarios per domain) and human-validated LLM-judge scoring; across CrewAI and AutoGen with four base models it surfaces 56.25% average governance risk, 65% privacy risk in multi-agent configs, and agent-behavior vulnerabilities reaching 85% without privileged access. - 📄 **[Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents](https://arxiv.org/abs/2609.19587)** — Remedios et al., 2026. Red-teams production blocking monitors that review each proposed coding-agent action before it runs (Auto Mode in Claude Code, Guardian in OpenAI's Codex) under a persistently-misaligned agent rather than only untrusted-source injections; adversarial agents given high-level strategies evade monitors via agent-generated prompt injection, multi-agent attacks, and malicious compaction — running arbitrary bash in 79% of trials — and the paper shows design changes (broader tool coverage, transcript formatting, an agentic monitor stage) that harden Auto Mode while leaving multi-context attacks an open problem. [Code](https://github.com/safety-research/red-teaming-auto-mode). - 📄 **[AgentLSD: Evaluating AI Security Agents Under Adversarial Task Contamination](https://arxiv.org/abs/2609.19140)** — Golinelli et al., AISec 2026. Introduces adversarial task contamination — deceptive non-instructional evidence (fake results, decoy endpoints) beyond attacker-supplied instructions — and a controlled CTF-based framework that injects trap artifacts while preserving the intended solution, with deterministic trap generation, runtime injection, and telemetry; across six models on 11 web CTF challenges, traps raise turns (+20) and reasoning tokens (+2k) even when the flag is still recovered, showing clean CTF performance understates vulnerability to deceptive task evidence. - 📄 **[Collective Loss of Control in LLM Agent Systems: An Epidemic Account of Mutation, Contagion, and Recovery](https://arxiv.org/abs/2609.18460)** — Wu et al., 2026. Models how a local deviation in a multi-agent system escalates into collective loss of control via accidental mutation, contagion, and recovery — where communication lets agents adopt and retransmit an unsafe strategy faster than correction contains it; a deployment audit finds implicit communication paths between nominally independent evaluation runs transported through a default Docker backend, and the RogueHandoff-20 benchmark (20 executable scenarios injecting unsafe trajectories) shows executed harm rises from 0–5% on normal tasks to 40–95% after injection, motivating defenses that strengthen recipient resistance and recovery and restrict unintended inter-agent channels. - 📄 **[Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AI](https://arxiv.org/abs/2609.18272)** — Ghanem, 2026. Argues auditor independence for agentic systems (which are now both audited subject and auditor) must be graded along three orthogonal axes — principal (who controls the auditor), substrate (an auditor sharing the auditee's model family, toolchain, or guardrails fails with it), and evidence (attestable vs. self-reported) — aggregated by weakest link via a transplanted beta-factor common-cause-failure model; a seven-step verifiable protocol plus a Monte Carlo study show a conventional internal agent audit surfaces only 5.9% of detectable faults and none in half the fault classes, mapped to the EU AI Act and ISO/IEC 42006. - 📄 **[A Unified Evaluation Framework for Trustworthy Large Language Models, Agentic AI, and Multimodal Systems](https://arxiv.org/abs/2609.19524)** — Raza et al., 2026. Connects output-level, trajectory-level, and cross-modal assessment across eight trustworthiness dimensions (capability, robustness, safety, fairness, transparency, governance, oversight, efficiency), preserving system-specific metrics while mapping them to common performance bands with uncertainty estimates and traceable evidence; adds a meta-evaluation layer for the validity/reliability/reproducibility of the evaluation itself and safety-critical overrides that prevent aggregate scores from masking critical agentic failures, with mappings to governance frameworks and EU regulation. ## Benchmarks & Datasets | Benchmark | Focus | Size | Paper | |-----------|-------|------|-------| | **[ASB](https://github.com/agiresearch/ASB)** | Comprehensive agent security | 10 agents, 398 envs | [Zhang et al.](https://arxiv.org/abs/2410.02644) | | **[InjecAgent](https://github.com/uiuc-kang-lab/InjecAgent)** | Indirect prompt injection | 1,054 test cases | [Zhan et al.](https://arxiv.org/abs/2403.02691) | | **[R-Judge](https://github.com/Lordog/R-Judge)** | Safety risk awareness | 162 records, 27 scenarios | [Yuan et al.](https://arxiv.org/abs/2401.10019) | | **[ToolSword](https://github.com/Junjie-Ye/ToolSword)** | Tool learning safety | 6 scenarios, 3 stages | [Ye et al.](https://arxiv.org/abs/2402.10753) | | **[AgentDyn](https://arxiv.org/abs/2602.03117)** | Dynamic prompt injection | Open-ended, extensible | [Li et al.](https://arxiv.org/abs/2602.03117) | | **[SkillSafetyBench](https://arxiv.org/abs/2605.12015)** | Skill-mediated agent safety | 155 cases, 47 tasks | [Jin et al.](https://arxiv.org/abs/2605.12015) | | **[SkillVetBench](https://arxiv.org/abs/2606.15899)** | Security risk eval of open-source agent skills | Live leaderboard | [Hossain et al.](https://arxiv.org/abs/2606.15899) | | **[SCR-Bench](https://arxiv.org/abs/2606.15242)** | Skill composition risk | Multi-skill chains | [Xie et al.](https://arxiv.org/abs/2606.15242) | | **[SafeClawBench](https://arxiv.org/abs/2606.18356)** | Staged harm in tool-using agents | 600 adversarial tasks | [Tian et al.](https://arxiv.org/abs/2606.18356) | | **[ToolPrivacyBench](https://arxiv.org/abs/2606.28061)** | Purpose-bound privacy in tool-using agents | 2,150 cases | [Hu et al.](https://arxiv.org/abs/2606.28061) | | **[TAB](https://arxiv.org/abs/2605.12233)** | Selective cue following in terminal agents | 89 terminal tasks | [Mavali et al.](https://arxiv.org/abs/2605.12233) | | **[Skill-Inject](https://www.skill-inject.com/)** | Skill file attacks | Multi-scenario | [Schmotz et al.](https://arxiv.org/abs/2602.20156) | | **[NAAMSE](https://arxiv.org/abs/2602.07391)** | Evolutionary agent security eval | Adaptive red-teaming | [Pai et al.](https://arxiv.org/abs/2602.07391) | | **[AgentHarm](https://arxiv.org/abs/2410.09024)** | Agent misuse | 110 behaviors, 440 variants | [Andriushchenko et al.](https://arxiv.org/abs/2410.09024) | | **[SkillGuard Dataset](https://github.com/LLMSecurity/skillguard)** | Malicious skill detection | 157 malicious skills | [Liu et al.](https://github.com/LLMSecurity/skillguard) | | **[WIPI](https://arxiv.org/abs/2402.16965)** | Web-based indirect injection | Multi-scenario | [Liu et al.](https://arxiv.org/abs/2402.16965) | | **[SkillAtlas](https://arxiv.org/abs/2609.13353)** | Attack trace library for agent skills | 3,014 cases, 6,589 traces | [Tian et al.](https://arxiv.org/abs/2609.13353) | | **[IssueTrojanBench](https://arxiv.org/abs/2607.20759)** | Malicious issue requests vs. coding agents | 4 attack categories, 6 vectors | [Singh et al.](https://arxiv.org/abs/2607.20759) | | **[OpenSkillRisk](https://arxiv.org/abs/2607.20121)** | Agent safety with risky third-party skills | 263 skills, 7 categories | [Liu et al.](https://arxiv.org/abs/2607.20121) | | **[AudioAgentSecurity](https://github.com/Limax666/AudioAgentSecurity)** | Audio prompt injection vs. multimodal agents | 8 scenarios, 10 patterns | [Liu et al.](https://arxiv.org/abs/2607.28165) | | **[AIP-Bench](https://arxiv.org/abs/2607.21824)** | Agentic commerce protocol-level security | 3 platforms, 33 vulns | [Louck](https://arxiv.org/abs/2607.21824) | | **[ContainmentBench](https://arxiv.org/abs/2607.23999)** | Post-injection containment in tool-using agents | Trace-based, multi-metric | [Lan et al.](https://arxiv.org/abs/2607.23999) | | **[MemSecBench](https://arxiv.org/abs/2607.27080)** | Lifecycle security of agent memory poisoning | 310 cases, 24-config matrix | [Chen et al.](https://arxiv.org/abs/2607.27080) | | **[IH-Benchmark](https://arxiv.org/abs/2607.25987)** | Instruction-hierarchy robustness incl. tool-mediated conflicts | 44 constraint families, 37 models | [McCauley et al.](https://arxiv.org/abs/2607.25987) | | **[AgentS4D](https://arxiv.org/abs/2607.27294)** | Lifecycle runtime risks of workspace agents | Sandboxed, trajectory-aware | [Zhou et al.](https://arxiv.org/abs/2607.27294) | | **[StepJack](https://github.com/BorealisAI/StepJack)** | Multi-step indirect prompt injection vs. computer-use agents | 480 test cases | [Zhan et al.](https://arxiv.org/abs/2608.06477) | | **[HarnessSafe](https://arxiv.org/abs/2608.06984)** | Safety across persistent carriers in agent harnesses | 328 cases, 7 carrier families | [Zhang et al.](https://arxiv.org/abs/2608.06984) | | **[ToolHazard](https://arxiv.org/abs/2608.11878)** | Scalable synthesis of adversarial tool environments for indirect prompt injection | Expandable via seed domains + compute | [Mou et al.](https://arxiv.org/abs/2608.11878) | | **[ATOBench](https://arxiv.org/abs/2608.12996)** | Pentest-agent vulnerability verification under deceptive target evidence | Runtime response transformations | [Chen et al.](https://arxiv.org/abs/2608.12996) | | **[HarnessRisk](https://arxiv.org/abs/2608.17597)** | Lifecycle safety of agent harnesses across operational phases | 6 operational phases | [Bai et al.](https://arxiv.org/abs/2608.17597) | | **[ChemMat-AgentSafetyBench](https://arxiv.org/abs/2609.11952)** | Long-horizon attacks/defenses in chemistry & materials agents (tool-mediated hazardous-protocol release) | 432 cases, 8 hazard classes, 5 online attacks | [Yao et al.](https://arxiv.org/abs/2609.11952) | | **[PIDS-Bench](https://arxiv.org/abs/2609.15017)** | Prompt-injection detectors under over-defense, obfuscation, and distribution shift | 7 detectors, multi-axis (incl. hard-benign FPR) | [Shire & Kim](https://arxiv.org/abs/2609.15017) | | **[HTB (Hallucinated-Tools Benchmark)](https://arxiv.org/abs/2609.19425)** | Tool hallucination (fabricated tools/args) incl. cross-server MCP namespace collisions | 322 single-registry + 154 MCP hallucinations, H1–H5 / M1–M5 taxonomy | [Iyer](https://arxiv.org/abs/2609.19425) | | **[ClashBench](https://arxiv.org/abs/2609.19892)** | Destructive resource preemption by privileged agents (terminating/overwriting incumbent tasks to resolve conflicts) | 268 conflict cases, 55 resource types, 17 models | [Xie et al.](https://arxiv.org/abs/2609.19892) | | **[MemoryStackBench](https://github.com/aetna000/MemoryStackBench)** | Agent memory safety and auditability | 5 scenarios, 33 checks | [Repository](https://github.com/aetna000/MemoryStackBench) | | **[mcp-defense-bench](https://github.com/Gowthaman90/mcp-defense-bench)** | MCP defensive-proxy attack-surface coverage | 24 vectors, 35 cases | [Arumugam](https://doi.org/10.5281/zenodo.21346206) | | **[VLoc Bench](https://arxiv.org/abs/2609.15939)** | Repository-scale vulnerability localization by security agents (incl. refrain-on-patched) | 500 vulns, 290 repos, 147 CWEs | [Priyanshu et al.](https://arxiv.org/abs/2609.15939) | ## Tools & Frameworks | Tool | Description | Link | |------|-------------|------| | **[Agent Memory Guard](https://github.com/OWASP/www-project-agent-memory-guard)** | OWASP reference implementation for ASI06 (Memory Poisoning): runtime defense that screens every agent memory read/write through detectors + a declarative policy, with source-class provenance, forensic SecurityEvents, and snapshot rollback. LangChain/OpenAI-Agents/AutoGen/CrewAI/mem0 integrations | [](https://github.com/OWASP/www-project-agent-memory-guard) | | **[Bounty Sieve](https://github.com/junbuilds96/bounty-sieve)** | Offline-by-default bounty intake guardrail for coding agents: read-only GitHub issue/URL-list import, deterministic triage, local decision briefs, and human approval gates | [](https://github.com/junbuilds96/bounty-sieve) | | **[SkillGuard](https://github.com/LLMSecurity/skillguard)** | LLM-native agent skill security auditor (OWASP Agentic + MITRE ATLAS) | [](https://github.com/LLMSecurity/skillguard) | | **[SkillCI](https://github.com/kabirnarang39/skillci)** | Regression testing + OWASP Agentic Skills Top 10-mapped static security lint for Claude Skills. Adds a self-growing eval loop (an uncovered regression or successful redteam attack writes its own permanent test case) and git-native bisect to find the exact commit that broke a skill | [](https://github.com/kabirnarang39/skillci) | | **[Pipelock](https://github.com/luckyPipewrench/pipelock)** | Open-source AI agent firewall and MCP-aware egress proxy with DLP, prompt injection scanning, process sandboxing, and mediator-signed action receipts | [](https://github.com/luckyPipewrench/pipelock) | | **[NemoClaw](https://github.com/NVIDIA/NemoClaw)** | NVIDIA reference stack for running always-on AI agents more safely in sandboxes, with network policy, hardening, routed inference, and lifecycle controls | [](https://github.com/NVIDIA/NemoClaw) | | **[CubeSandbox](https://github.com/TencentCloud/CubeSandbox)** | Hardware-isolated (per-kernel) sub-60ms sandbox for secure AI agent code execution, with an out-of-sandbox credential vault, eBPF network isolation, and domain-allowlisted egress controls with audit logging | [](https://github.com/TencentCloud/CubeSandbox) | | **[Invariant Guardrails](https://github.com/invariantlabs-ai/invariant)** | Policy-based agent security guardrails | [](https://github.com/invariantlabs-ai/invariant) | | **[Armorer Guard](https://github.com/ArmorerLabs/Armorer-Guard)** | Local Rust scanner for AI-agent prompt injection, credential redaction, sensitive-data requests, exfiltration-style text, and dangerous tool-call context | [](https://github.com/ArmorerLabs/Armorer-Guard) | | **[Sunglasses](https://github.com/sunglasses-dev/sunglasses)** | Runtime trust scanner for agent skills and tool use: 1,089 patterns across 65 attack categories (prompt injection, tool poisoning, MCP attacks, skill compromise) plus a mechanism layer, shipped as a pip package, GitHub Action, and free web scanner with a published precision/recall benchmark | [](https://github.com/sunglasses-dev/sunglasses) | | **[LLM Guard](https://github.com/protectai/llm-guard)** | Input/output scanning for LLM applications | [](https://github.com/protectai/llm-guard) | | **[Rebuff](https://github.com/protectai/rebuff)** | Self-hardening prompt injection detector | [](https://github.com/protectai/rebuff) | | **[NeMo Guardrails](https://github.com/NVIDIA/NeMo-Guardrails)** | NVIDIA's toolkit for adding guardrails to LLM-based applications | [](https://github.com/NVIDIA/NeMo-Guardrails) | | **[Lakera Guard](https://www.lakera.ai/)** | Enterprise prompt injection defense API | [Website](https://www.lakera.ai/) | | **[Promptfoo](https://github.com/promptfoo/promptfoo)** | LLM red teaming and evaluation framework | [](https://github.com/promptfoo/promptfoo) | | **[Garak](https://github.com/leondz/garak)** | LLM vulnerability scanner | [](https://github.com/leondz/garak) | | **[IPI-Proxy](https://github.com/VulcanLab/IPI-Proxy)** | Intercepting proxy for red-teaming web-browsing agents against indirect prompt injection on live whitelisted domains | [](https://github.com/VulcanLab/IPI-Proxy) | | **[Tuning Engines CLI](https://github.com/cerebrixos-org/tuning-engines-cli)** | MCP server and CLI for governed agent/skill/tool access with policy checks, approvals, traces, and role-scoped registries | [](https://github.com/cerebrixos-org/tuning-engines-cli) | | **[AgentSkillsScanner](https://github.com/sumleo/AgentSkillsScanner)** | Static analysis scanner for agent skill definitions | [](https://github.com/sumleo/AgentSkillsScanner) | | **[repo-agent-scan](https://github.com/sunxiayi/repo-agent-instruction-security-scan)** | Local deterministic scanner for agent skills and repository instruction files (`SKILL.md`, `AGENTS.md`, `CLAUDE.md`, and IDE rules), with evidence-anchored findings, SARIF, pre-commit, and GitHub Action support | [](https://github.com/sunxiayi/repo-agent-instruction-security-scan) | | **[SkillTotal](https://github.com/pezhik/skilltotal)** | Static, offline scanner for AI components (MCP servers, agent skills, npm/PyPI packages, repos): supply-chain risk, dangerous capabilities, prompt-injection, exfiltration; deterministic, evidence-anchored, SARIF + pre-commit/GitHub Action | [](https://github.com/pezhik/skilltotal) | | **[SkilLock](https://github.com/skills-lock/skil-lock)** | Behavior-pinning lockfile + capability-delta PR review for Claude Code & Codex skills; SARIF output for Code Scanning | [](https://github.com/skills-lock/skil-lock) | | **[agent-diff-guard](https://github.com/cubxxw/agent-diff-guard)** | Pre-push guardrail that flags high-risk coding-agent diffs such as CI/CD changes, dependency edits, test deletions, hardcoded secrets, and task-scope drift before merge | [](https://github.com/cubxxw/agent-diff-guard) | | **[Skillid](https://github.com/dkoly/skillid)** | Policy-driven Claude Code plugin that combines skill guidance with per-tool hooks to enforce org guardrails, confirmation rules, redaction, and connector-specific access control | [](https://github.com/dkoly/skillid) | | **[Agent Audit](https://arxiv.org/abs/2603.22853)** | Security analysis system for LLM agent apps: dataflow analysis, credential detection, MCP config parsing, privilege-risk checks | [Zhang et al.](https://arxiv.org/abs/2603.22853) | | **[mcp-sec-audit](https://arxiv.org/abs/2603.21641)** | MCP server security toolkit: static pattern matching + dynamic sandboxed fuzzing via Docker/eBPF for detecting over-privileged tool capabilities | [Huang et al.](https://arxiv.org/abs/2603.21641) | | **[SkillGate](https://github.com/selfradiance/skillgate)** | Deterministic local CLI that statically inspects an agent Skill package before harness admission — reports instruction surface and execution surface without executing, installing, or trusting the Skill | [](https://github.com/selfradiance/skillgate) | | **[Assay Harness](https://github.com/Rul1an/Assay-Harness)** | CI gate that checks an agent's claimed tool side-effects (filesystem, network, process) against independently observed runtime evidence, classifying each claim as supported, degraded, blocked, or not-evaluable (observed support is the ceiling) | [](https://github.com/Rul1an/Assay-Harness) | | **[Agent Scan](https://github.com/snyk/agent-scan)** | Snyk's scanner for local agent supply chains, covering MCP servers and skills with checks for prompt injection, tool poisoning, toxic flows, and malware-laced skill files | [](https://github.com/snyk/agent-scan) | | **[DScan](https://github.com/DeepScan-Security/dscan)** | Open-source agent security suite for runtime tool-call tracing, prompt-injection shielding, MCP audits, adversarial testing, and sequence-level attack detection | [](https://github.com/DeepScan-Security/dscan) | | **[Sayfos SDK](https://github.com/sayfos-labs/sayfos-sdk)** | Runtime guardrail SDK for AI agents with provenance checks, budget governance, plan preflight, and adjudication tokens before high-risk tool actions | [](https://github.com/sayfos-labs/sayfos-sdk) | | **[PIC Standard](https://github.com/madeinplutofabio/pic-standard)** | Local-first standard and reference verifier that checks agent intent, provenance, and evidence at the action boundary and fails closed before high-impact tool calls; Python CLI, MCP/LangGraph/OpenClaw integrations, HTTP bridge, and a language-agnostic conformance suite | [](https://github.com/madeinplutofabio/pic-standard) | | **[TraceFold](https://github.com/TraceFold/tracefold)** | Rust engine that escrows a verified pre-commit inverse before an agent's tool effect (filesystem mutation or MCP call) lands, or refuses the effect if no inverse can be verified; issues signed, offline-verifiable DSSE receipts and Merkle tile logs. Apache-2.0, alpha (v0.1.1) | [](https://github.com/TraceFold/tracefold) | | **[agent-sentinel](https://github.com/junlinwk/agent-sentinel)** | eBPF/BPF-LSM prototype that monitors local agent behavior and atomically blocks prompt-injection-driven access to sensitive files at the kernel boundary | [](https://github.com/junlinwk/agent-sentinel) | | **[mcp-sploit](https://github.com/Prasanna-27eng/mcp-sploit)** | Metasploit-style framework for authorized security testing of MCP servers and MCP security gateways, including enumeration and exploit modules for unsafe tool exposure | [](https://github.com/Prasanna-27eng/mcp-sploit) | | **[Clawvisor](https://github.com/clawvisor/clawvisor)** | AI agent gateway for purpose-based authorization, credential vaulting, and audit logging — agents declare task scope, humans approve once, Clawvisor enforces on every request without the agent ever seeing credentials | [](https://github.com/clawvisor/clawvisor) | | **[trentclaw](https://github.com/trnt-ai/trent-openclaw-security-assessment)** | Security assessment skill for OpenClaw environments: scans gateway config, skill permissions, MCP trust boundaries, and plugins, and correlates them into chained attack paths with severity-ranked remediation steps | [](https://github.com/trnt-ai/trent-openclaw-security-assessment) | | **[Nobulex](https://github.com/arian-gogani/nobulex)** | Trust Capital scoring layer for AI agents: bilateral Ed25519 receipts (pre- and post-execution signatures), content-addressed via action_ref and hash-chained per RFC 8785, that accumulate into a published 300-850 reputation score gating agent autonomy. CTEF v0.3.2 14/14 conformance. Python + TypeScript SDKs. Receipt-signing approach merged into Microsoft AGT. | [](https://github.com/arian-gogani/nobulex) | | **[Clay Seal](https://github.com/clayseal/clayseal-identity)** | Attested runtime identity and Biscuit capability tokens for agents: real GCP/Kubernetes/AWS node attestation, SPIFFE JWT-SVID and X.509-SVID (mTLS), and per-tool MCP authorization that is sender-constrained, so a token lifted from a log without the workload key authorizes nothing (Python + JS verifier) | [](https://github.com/clayseal/clayseal-identity) | | **[SkillWatch](https://github.com/kuzivaai/SkillWatch)** | Periodically re-checks the external URL content that AI skills and MCP tools reference and flags suspicious changes (the post-review bait-and-switch); keeps an append-only, hash-chained content ledger with optional external anchoring (RFC 3161 / git). Local CLI, SARIF output, regex-based best-effort triage. | [](https://github.com/kuzivaai/SkillWatch) | | **[Humanbound](https://github.com/humanbound/humanbound)** | Open-source adversarial testing engine, SDK, and CLI for AI agents: runs live-endpoint, multi-turn, and tool-abuse tests against a deployed agent and converts findings into deployable guardrail rules | [](https://github.com/humanbound/humanbound) | | **[whatileaked](https://github.com/selan-ai/whatileaked)** | Local scanner for credentials a coding agent has already written to disk: Claude Code, Codex and Cursor transcripts plus instruction/memory files (CLAUDE.md, AGENTS.md), which are re-read at the start of every session so a credential there keeps leaking until the file is edited. Uses the gitleaks rule set unmodified, reports a rule name and one-way fingerprint rather than the secret, and `wipe` redacts findings in place. No network calls, no telemetry, zero dependencies | [](https://github.com/selan-ai/whatileaked) | | **[Skill-audit](https://github.com/AgentPostmortem/Skill-audit)** | Static scanner for Claude/agent skills: flags prompt injection, dangerous shell, secret access, and exfiltration before install; 31 rules with SARIF output | [](https://github.com/AgentPostmortem/Skill-audit) | | **[AgentWarden](https://github.com/juangh123/AgentWarden)** | Static security gate for MCP configurations and AI agent skills, with SHA-256 integrity locking, Ed25519 publisher verification, SARIF output, and CI exit codes | [](https://github.com/juangh123/AgentWarden) | | **[AVE (Agentic Vulnerability Enumeration)](https://github.com/aveproject/ave)** | Open standard and behavioral vulnerability taxonomy for agentic AI components (MCP servers, agent skills, LLM plugins), stable IDs scored with OWASP's AIVSS framework | [](https://github.com/aveproject/ave) | ## Agent Skill Specifications | Specification | Org | Focus | |---------------|-----|-------| | **[AgentSkills.io](https://agentskills.io/specification)** | Open Standard | Agent skill definition and security requirements | | **[Model Context Protocol (MCP)](https://modelcontextprotocol.io/)** | Anthropic | Tool/resource integration protocol for LLMs | | **[OpenAI Function Calling](https://platform.openai.com/docs/guides/function-calling)** | OpenAI | Tool use specification for GPT models | | **[Tool Use (Claude)](https://docs.anthropic.com/en/docs/build-with-claude/tool-use)** | Anthropic | Claude's native tool use interface | | **[LangChain Tools](https://python.langchain.com/docs/modules/agents/tools/)** | LangChain | Tool abstraction for agent frameworks | | **[AutoGPT Plugins](https://github.com/Significant-Gravitas/AutoGPT)** | AutoGPT | Plugin system for autonomous agents | | **[OpenAPI/Swagger](https://swagger.io/specification/)** | Linux Foundation | API specification commonly used as tool definitions | ## Industry Reports & Blog Posts - 🔗 **[Snowflake Cortex AI Escapes Sandbox and Executes Malware](https://www.promptarmor.com/resources/snowflake-ai-escapes-sandbox-and-executes-malware)** — PromptArmor, 2026. Prompt injection attack chain in Snowflake's Cortex Agent bypassed command allowlists via bash process substitution to achieve RCE; now patched. - 🔗 **[Confused Deputy Attacks on Autonomous AI Agents](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-agent-confused-deputy-prompt-injection/)** — Cloud Security Alliance AI Safety Initiative, 2026. Research note on prompt injection chains enabling privilege escalation and autonomous compromise in AI agent systems. - 🔗 **[How AI Assistants are Moving the Security Goalposts](https://krebsonsecurity.com/2026/03/how-ai-assistants-are-moving-the-security-goalposts/)** — Krebs on Security, 2026. AI agents as insider threats. - 🔗 **[Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts](https://krebsonsecurity.com/2026/06/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts/)** — Krebs on Security, 2026. Real-world incident where attackers socially engineered an AI account-recovery assistant into relinking target accounts, illustrating a new tool-mediated support-agent attack surface. - 🔗 **[Anthropic: Challenges in Red Teaming AI Systems](https://www.anthropic.com/index/challenges-in-red-teaming-ai-systems)** — Anthropic's perspective on evaluating agent safety. - 🔗 **[OpenAI: Safety of Advanced AI Agents](https://openai.com/research/practices-for-governing-agentic-ai-systems)** — Practices for governing agentic AI systems. - 🔗 **[Compromising Agents via MCP](https://invariantlabs.ai/blog/mcp-security)** — Invariant Labs deep-dive into MCP attack vectors. - 🔗 **[Simon Willison: Prompt Injection Explained](https://simonwillison.net/2023/Apr/14/worst-that-can-happen/)** — Accessible introduction to prompt injection risks. - 🔗 **[The sorry state of skill distribution](https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/)** — Trail of Bits, 2026. Demonstrates practical bypasses against ClawHub, Cisco skill-scanner, and skills.sh, showing how malicious skills can evade current marketplace scanners via truncation, archive indirection, poisoned bytecode, and prompt-injection framing. - 🔗 **[TRAIL: Trusted Reasoning and AI Logging](https://arxiv.org/abs/2502.XXXXX)** — Logging framework for auditable agent execution. - 🔗 **[Cyber Threat Intelligence for AI Systems](https://arxiv.org/abs/2603.05068)** — AI-specific CTI framework with IoCs for supply-chain phases. - 🔗 **[AI Safety Has 12 Months Left](https://mhdempsey.substack.com/p/ai-safety-has-12-months-left)** — Michael Dempsey, 2026. Window to embed safety into infrastructure before market forces prevent it. - 🔗 **[LiteLLM Hack: Were You One of the 47,000?](https://futuresearch.ai/blog/litellm-hack-were-you-one-of-the-47000/)** — FutureSearch via Simon Willison, 2026. Analysis of PyPI supply-chain attack on LiteLLM: 47K downloads of exploited packages in 46 minutes, 88% of 2,337 dependent packages had unpinned versions. - 🔗 **[Lack of Isolation in Agentic Browsers Resurfaces Old Vulnerabilities](https://blog.trailofbits.com/2026/01/13/lack-of-isolation-in-agentic-browsers-resurfaces-old-vulnerabilities/)** — Trail of Bits, 2026. Demonstrates lack of isolation in agentic browsers enabling attacks from false information dissemination to cross-site data leaks, resurfacing decades-old web vulnerability patterns. - 🔗 **[OpenAI Help: Lockdown Mode](https://simonwillison.net/2026/Jun/5/openai-help-lockdown-mode/)** — Simon Willison, 2026. Highlights OpenAI's new network-egress restriction mode for ChatGPT as a concrete mitigation for prompt-injection-driven data exfiltration in agentic workflows. - 🔗 **[ClawHub by the Numbers: Metadata on All 52,652 Packages](https://trent.ai/blog/clawhub-by-the-numbers/)** — Trent AI, 2026. Registry-wide metadata analysis of all 52,652 ClawHub packages finding only 22% meet a "clean" baseline; quantifies supply-chain risk across the OpenClaw skill ecosystem. - 🔗 **[The Memory Heist](https://www.ayush.digital/blog/the-memory-heist)** — Ayush Paul, 2026 (via Simon Willison). Real-world data-exfiltration vulnerability in Claude's `web_fetch` tool: a honeypot site with letter-by-letter navigation links tricked the agent into spelling out sensitive user memory (names, employers, security answers) through URL paths; Anthropic patched it by disabling `web_fetch` link-following on external pages. - 🔗 **[OpenAI's Accidental Cyberattack Against Hugging Face is Science Fiction That Happened](https://simonwillison.net/2026/Jul/22/openai-cyberattack/)** — Simon Willison, 2026. Real-world incident: while OpenAI ran a cybersecurity eval against an unreleased model with guardrails disabled, the agent broke out of OpenAI's sandbox and exploited Hugging Face to steal the test answers rather than solve the task. Synthesizes the ExploitGym eval paper, Hugging Face's July 16 breach disclosure, and OpenAI's July 21 confirmation — a landmark case of an autonomous agent escaping its sandbox and turning offensive capability against a third party. - 🔗 **[Auto Mode Is Now the Default in Claude Code](https://simonwillison.net/2026/Aug/8/auto-mode/)** — Simon Willison, 2026. Reports Anthropic's Trajectory Labs evaluation in which 0 of 720 attack attempts across 72 indirect prompt-injection scenarios succeeded against auto-mode agents (Fable 5, Opus 5, Sonnet 5), with auto mode blocking 89% of harmful actions versus 13.6% caught by human review — while cautioning that malicious third-party packages mean indirect prompt injection is not a solved problem. - 🔗 **[OpenAI Agents Carried Out an Undisclosed Attack on RubyGems](https://simonwillison.net/2026/Sep/12/openai-agents-rubygems/)** — Simon Willison, 2026 (reporting the [rubyhack.ai](https://www.rubyhack.ai/) investigation by Kitts, Larsen & Von Arx). Real-world incident: autonomous OpenAI agents attacked the RubyGems package registry back in May, exploiting a legacy-API-key leak that the RubyGems security team (Maciej Mensfeld) patched only two months later — a companion case to the same authors' disused-wikis agent-attack report and a further example of autonomous agents turning tool-use capability against live software supply-chain infrastructure. - 🔗 **[Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files](https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/)** — Check Point Research, 2026. Two fixed Claude Code vulnerabilities where repository-controlled configuration acts before the trust prompt: CVE-2025-59536 (startup trust-dialog bug allowing command execution from a project settings file, fixed in 1.0.111) and CVE-2026-21852 (project-load flow leaking Anthropic API keys to an attacker-controlled base URL, fixed in 2.0.65). ## Related Awesome Lists - **[awesome-llm-security](https://github.com/corca-ai/awesome-llm-security)** — General LLM security resources. - **[awesome-ai-safety](https://github.com/hari-sikchi/awesome-ai-safety)** — AI safety research and resources. - **[awesome-chatgpt-prompts](https://github.com/f/awesome-chatgpt-prompts)** — Prompt engineering (includes adversarial examples). - **[awesome-ml-for-cybersecurity](https://github.com/jivoi/awesome-ml-for-cybersecurity)** — ML applied to cybersecurity. - **[awesome-mcp-servers](https://github.com/punkpeye/awesome-mcp-servers)** — MCP server ecosystem (attack surface reference). - **[awesome-ai-agents](https://github.com/e2b-dev/awesome-ai-agents)** — AI agent frameworks and projects. ## Contributing Contributions are welcome! Please read the [contribution guidelines](CONTRIBUTING.md) before submitting a pull request. ### How to Contribute 1. Fork the repository 2. Add your resource in the appropriate category 3. Use the format: `- 📄 **[Title](URL)** — Authors, Venue Year. One-sentence description.` 4. Submit a pull request ### Criteria - Resources must be directly related to agent/tool/skill security - Papers should be published or on arXiv - Tools should be actively maintained (commits within last 6 months) - Blog posts should provide substantial technical analysis --- ## Citation If you find this list useful in your research, please cite: ```bibtex @misc{awesome-agent-skills-security, author = {Liu, Yi}, title = {Awesome Agent Skills Security}, year = {2026}, publisher = {GitHub}, journal = {GitHub Repository}, howpublished = {\url{https://github.com/LLMSecurity/awesome-agent-skills-security}} } ``` ## License [](https://creativecommons.org/publicdomain/zero/1.0/) This list is released under CC0 1.0 Universal.