AI Threat AlertThen there is prompt injection, a malicious email, ...: The Wild Wide West of OpenClaw Agentic System Security
AI-powered personal assistant frameworks such as OpenClaw combine LLM
SentryBench: A Cost-Sensitive Benchmark for Adversarial Robustness of Tool-Using LLM Agents in Public-Safety Deployments
tool call carries real-world cost. Existing agent-safety benchmarks measure generic harm or prompt-injection success and implicitly treat refusing as the safe default. In public-safety deployments that
Where AI Vulnerability Discovery Harnesses Go Quiet: Structural False Negatives and Hidden Vulnerabilities
work on intrusion detection evasion. The paper also covers content-steered verdicts and prompt injection, and gives design principles and tests for harnesses that report accurately what they analyzed
RAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented Generation
introduces new attack surfaces. Existing data extraction attacks against RAG systems rely on either prompt injection, which heavily depends on the generator's instruction-following capability, or backdoors that reproduce
AgentSafeEvo: Adversarial Co-Evolution for LLM Agent Safety
strengthening LLM safety, but existing work primarily focuses on language-level safety or indirect prompt injection in web tasks. In this paper, we introduce AgentSafeEvo, a co-evolutionary reinforcement learning
Policy-Verified Self-Training: Learning Agent Compliance from Verifiable Policy Rewards
collected in the benchmark's attacked environment. On held-out AgentDojo tasks under prompt injection, policy-verified preference training of Qwen3-8B reduces violating trajectories from
Towards Safe Autonomy for Computer Use
training and safety classifiers, neither of which can rule out that a sophisticated indirect prompt injection (IPI) goes through and causes significant harm. Recent work therefore builds agents with information
The Agent Knew: Internal States Forecast Unauthorized Actions and Stop Them, and the Lies That Follow
times less than a chain-of-thought monitor. On AgentDojo, an external prompt-injection benchmark, the same readout calibrated on 29 tasks, with the steering unchanged, cuts attack success
One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails
fail-closed error blocks a permitted one and is only a cost. On prompt-injection, jailbreak and toxic-content screening, accuracy at the allow-or-block decision ranges from
BRANCH: Bypassing Multi-Scanner AI Guardrails
rely on Large Language Models (LLMs) as core reasoning engines, making them targets for prompt injection and jailbreaks. Guardrails monitor and validate model inputs and outputs, yet their isolated, task
AdvSim2Real : Training Web Agents Against Adaptive Prompt Injection in a Web World Model
Web agents complete user requests by reading and acting on
Secure Speculative Decoding for Large Language Models
disproportionately high cost to security, with attack success rates for jailbreak and prompt injection attacks increasing much faster than utility degrades. We then propose SecureSD, a new theory-guided speculative
Towards a Unified Misuse Monitoring Benchmark
sources: decomposition attacks, where a harmful request is split into innocuous sub-requests, and prompt injection attacks, where a compromised tool delivers a malicious instruction. Existing evaluations treat these threats
TrustMI: Causally controlling how assistants trust their users
whether this effect extends to several safety-related agent settings involving harmful requests, prompt injections, and insider threats, while using benign-task and reasoning as controls. Our findings provide evidence
Aletheia: Permission-Minimality Testing for Coding-Agent Rules
Repository instruction files guide coding agents, but also expose them to prompt injection. Malicious rules can request credential access or data transfer while the agent produces a correct patch
Towards Efficient HPC Systems for Agents: Challenges and Opportunities
bandwidth-provisioned filesystems, repeated rediscovery of what earlier sessions already learned, and new prompt-injection and policy-enforcement surfaces. Neither banning agents nor treating them as ordinary users is sustainable
ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents
Tool-using LLM agents remain vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context, allowing malicious content to steer consequential input-filtering defenses. Multi-path
Selecting The Most Informative Tokens in Natural Language Autoencoders
understand a potential threat? We study this question across $4.7$ million explanations on prompt injection and concealment. We compare signals from model computation with a ranker trained only on chat
Tracekit: Tamper-Evident Intent-Reasoning-Action Auditing for Autonomous Coding Agents
real Claude Code runs, the agent never acted on four planted indirect prompt injections and disclosed each. The provider withheld the text of all 27 thinking blocks, so self-report
Nudgeability: Reasoning Models Follow Confidence Signals Without Tracking Their Own Competence
separate predictor), how it is presented to the model (numerical prediction, confidence token, prompt injection), and whether it changes the model's subsequent action. We isolate the third question