AI Threat AlertAn AI Agent Execution Environment to Safeguard User Data
serious risk to security and privacy. Adversaries may attack the AI model (e.g., via prompt injection) to exfiltrate user data. Furthermore, sharing private data with an AI agent requires users
ScamWorld: An Interactive Environment for Evaluating Web Agents Against Online Fraud
users. Prior work has shown that they can be misled by adversarial content, including prompt injections and deceptive interfaces. Beyond such attacks, agents operating on the open web also encounter
ScamWorld: An Interactive Environment for Evaluating Web Agents Against Online Fraud
users. Prior work has shown that they can be misled by adversarial content, including prompt injections and deceptive interfaces. Beyond such attacks, agents operating on the open web also encounter
From Guidelines to Practice: Defining Requirements for AI Red-Teaming Tools
However, AI also introduces additional attack surfaces for threat actors to perform attacks like prompt injection and jailbreaking, making security a great concern. AI security testing aims to imitate adversarial
ATrust: Adaptive Trust Boundary Expansion for Securing LLM Agents
require complex exploitation of operating system vulnerabilities, attackers can easily hijack agents through indirect prompt injection (IPI), leading to privacy leakage, financial loss, and destructive operations. However, existing defenses often
Where Does MCP Security End? A Three-Tier Mitigation Mapping Framework for the OWASP MCP Top 10
control planes into a single natural language channel. This introduces confused deputy and prompt injection vulnerabilities that cannot be completely mitigated in the software development lifecycle (SDLC
Benchmark of THReD: Evaluating an LLM Agent and Its Preprocessing Tools for Turning Electronic Health Records into AI-Ready Datasets
including goal-level requests, failure recovery, requests calling for no action, schema variation and prompt injection through the data, on synthetic tables calibrated to a regional health information exchange; success
LEANGUARD: Lean-Verified Guardrails for Tool-Using Agents
none; with feedback, task success does not change significantly. On DTap, LeanGuard reduces direct prompt-injection success from 57.9% to 5.9%, and in telecom, where benign tasks need no writes
Beyond Prompt Injection: The Tool Update Gap in LLM Agent Security
Large language model based agents increasingly rely on external tools
Understanding and Mitigating Role Spoofing in LLMs
Despite growing capabilities, LLMs remain susceptible to prompt injections: malicious inputs that can manipulate or hijack models. In particular, it has recently been observed that LLMs can exhibit role confusion
REALM: Identifying Minimal Task Assets for LLM Agents
agents often receive access to more files, accounts, and services than a task requires. Prompt injection turns this excess access into an opportunity to redirect execution toward unrelated resources. Applying
PCM: A Proof-Carrying Message Protocol for Verifiable Multi-Agent Communication
authenticate the channel, but the sender is the party in doubt, so a prompt-injected agent can launder fabricated facts and authority through a multi-agent system. We present Proof
FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models
with different data types and application scenarios. The results show that Jev resists common prompt injections: no strategy changes a correct answer in 10,240 paired tests. In contrast
Then there is prompt injection, a malicious email, ...: The Wild Wide West of OpenClaw Agentic System Security
AI-powered personal assistant frameworks such as OpenClaw combine LLM
SentryBench: A Cost-Sensitive Benchmark for Adversarial Robustness of Tool-Using LLM Agents in Public-Safety Deployments
tool call carries real-world cost. Existing agent-safety benchmarks measure generic harm or prompt-injection success and implicitly treat refusing as the safe default. In public-safety deployments that
Where AI Vulnerability Discovery Harnesses Go Quiet: Structural False Negatives and Hidden Vulnerabilities
work on intrusion detection evasion. The paper also covers content-steered verdicts and prompt injection, and gives design principles and tests for harnesses that report accurately what they analyzed
RAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented Generation
introduces new attack surfaces. Existing data extraction attacks against RAG systems rely on either prompt injection, which heavily depends on the generator's instruction-following capability, or backdoors that reproduce
AgentSafeEvo: Adversarial Co-Evolution for LLM Agent Safety
strengthening LLM safety, but existing work primarily focuses on language-level safety or indirect prompt injection in web tasks. In this paper, we introduce AgentSafeEvo, a co-evolutionary reinforcement learning
Policy-Verified Self-Training: Learning Agent Compliance from Verifiable Policy Rewards
collected in the benchmark's attacked environment. On held-out AgentDojo tasks under prompt injection, policy-verified preference training of Qwen3-8B reduces violating trajectories from
Towards Safe Autonomy for Computer Use
training and safety classifiers, neither of which can rule out that a sophisticated indirect prompt injection (IPI) goes through and causes significant harm. Recent work therefore builds agents with information