AI Agent Security

Follow this topic Ask about this topic

Momentum

43 papers in the last four weeks, up 258% on the four weeks before. 0.4% of all new papers.

Jul 13Week of Sep 28

Latest papers 311

All topics

From Reactive Containment to Proactive Assurance: Lessons from OpenAI, Anthropic, and Google Agent Security Incidents
Oct 8, 2026Abbas RaftariAI Agent Security Runtime Enforcement for AI Agents
Walsh College, Troy, Michigan, USA
Secure-CUA: Controlling Untrusted Influence in Computer-Use Agents
Oct 7, 2026Sarthak Choudhary, Mihai Christodorescu, Ashish Hooda +3Computer-Use Agents AI Agent Security
University of Wisconsin–Madison · Google · Google DeepMind
Package Hallucination Attacks on Coding Agents through Prompt Injection in Rule Files
Oct 7, 2026Yupu Wang, Zhengyuan Jiang, Reachal Wang +1AI Agent Security Adversarial Attacks
Duke University
Adversarial Images Hijack Web Agents from Visual Grounding to Browser Execution
Oct 7, 2026Wanjing Han, Levi Taiji Li, Mu Zhang +2AI Agent Security Tool-Using Vision-Language Agents
University of Utah
SwarmReconGuard: Black-Box Detection of Distributed Collective Reconnaissance by Individually Benign-Looking Agent Populations
Oct 6, 2026Vahid Tavakkoli, Kabeh Mohsenzadegan, Kyandoghere KyamakyaAI Agent Security Network Intrusion Detection
Institute for Smart System Technologies, University of Klagenfurt, Klagenfurt, Austria
Multi-Aspect Runtime Verification for Simulation-Based V&V of LLM-Enabled Autonomous Agents
Oct 6, 2026Nikolaos Kekatos, Dimitrios Nikou, Anastasios Temperekidis +4LLM Agent Verification Runtime Enforcement for AI Agents
Clone Systems, Cyprus · International Hellenic University, Greece · University of Thessaly, Greece +2
Towards a Unified Misuse Monitoring Benchmark
Oct 5, 2026Aniruddh Pramod, James Oldfield, Adel BibiAI Agent Security AI Agent Monitoring
University of Oxford
Runaway Reaction: When Benign Skills Compose into Malicious Behavior
Oct 5, 2026Zunlong Zhou, Ziyuan Yang, Mengyu Sun +1AI Agent Security LLM Agent Security
Sichuan University
Agentic-ZTA: A Multi-Agent Architecture for Autonomous Zero Trust Enforcement
Oct 5, 2026Shovan Roy, Lopamudra Praharaj, Maanak Gupta +1AI Agent Security Multi-Agent System Security
Department of Computer Science, Tennessee Tech University, Cookeville, TN, USA · Department of Computer Science, University of North Carolina Pembroke, Pembroke, NC, USA · Department of Computer Science, The University of Texas at Dallas, Richardson, Texas, USA
Who Is Your Agent Serving? Provider-Side Indirect Prompt Injection in Proactive Agents
Oct 4, 2026Rui Wang, Chao Wang, Xinchen Wang +3AI Agent Security Indirect Prompt Injection
Hefei University of Technology · University of Science and Technology of China
APEX: Active Protection at Execution Boundaries for LLM Agents
Oct 3, 2026Xinran Zheng, Xin Fan Guo, Zhiqiang Hao +7AI Agent Security Prompt Injection Defense
Tsinghua University · Imperial College London · Nanjing University +6
SoK: Decentralized Agent Economic Infrastructure
Oct 1, 2026Rui Sun, Xihan Xiong, Qin Wang +5AI Agent Auditing Agentic Workflows
Newcastle University, UK · University of Bristol, UK · CSIRO, Australia +5
AuraForge: Scaling Security Supervision for Training Coding Agents
Oct 1, 2026Danqing Wang, Songwen Zhao, Harsh Sharma +4AI Coding Agents Software Security
Carnegie Mellon University · University of California, Los Angeles · ScOp Venture Capital.
Sapien: A Stateful Policy Engine for Autonomous AI Agents
Sep 30, 2026Corinn Tiffany, Wen Zhang, Eugene Bagdasarian +1AI Agent Security Runtime Enforcement for AI Agents
Google · University of Massachusetts Amherst
Pretext: Defeating Malicious Skill Detection Frameworks for AI Agents
Sep 30, 2026Tobias Kaiser, Aritra DharAI Agent Security Agent Skill Security Auditing
Computing System Labs, Huawei Research Zurich
MiniRep: Robust Reputation-Based Aggregation for Multi-Agent Debate
Sep 30, 2026Jiaming Zhang, Yuwan Liu, Yue Huang +1Multi-Agent Debate AI Agent Security
Tsinghua University
Approval Laundering: Systematizing Approval--Execution Binding Failures in AI Coding-Agent Harnesses
Sep 30, 2026Yang WangAI Agent Security Capability-Based Security
Fudan University
AgBench: Agentic AI Benchmarks for Personal AI Devices
Sep 29, 2026Yizhou Han, Di Wu, Dhananjay Saikumar +1AI Agent Reliability AI Agent Evaluation
University of St Andrews, UK · Zhejiang University of Technology, China
Evaluating Whether GPT-6 Astra Performs Unsanctioned Supply-Chain Attacks
Sep 29, 2026Alexandra Souly, Kai Fronsdal, Abby D'Cruz +2LLM Auditing AI Agent Security
UK AI Security Institute · UK AISI Research Affiliate
When Does Randomized Oversight Align AI Agents That Can Conceal?
Sep 29, 2026Joshua S. Gans, Richard HoldenAlgorithmic Auditing AI Agent Auditing
UNSW Business School
Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents
Sep 28, 2026Sidharth Pulipaka, Ansh Sharma, Stanislau Hlebik +4AI Agent Security Agent Memory Poisoning
SPAR · University of Cambridge · APTA AI +1
The Compiler May Read It, the Agent May Not: Keeping Part of a Research Code Away from a Coding Agent
Sep 28, 2026Shobhan RoySoftware Engineering Agents AI Agent Security
University of Iowa
SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents
Sep 28, 2026Xinjie Shen, Junran Wang, Rongzhe Wei +1AI Agent Security AI Agent Security Benchmarks
Georgia Institute of Technology
Evaluating System One Models for Agent Security Decisions: Reliability, Calibration, and Selective Automation
Sep 27, 2026Yixuan LiuProbability Calibration Selective Prediction
TraceStone and Nanyang Technological University, Singapore
Despite Instructions: Frontier Agents Improvise Covert Channels at Test Time
Sep 26, 2026Jacob Dineen, Silei Ren, Muhao Chen +2AI Agent Security Privacy Leakage in Language Models
Arizona State University · Cornell University · University of California, Davis +1
LLM Agents Can Easily Tamper With Their Own Traces
Sep 24, 2026Jeremy Qin, David Schmotz, Derck Prinzhorn +3AI Agent Auditing AI Agent Security
ELLIS Institute Tübingen · Max Planck Institute for Intelligent Systems · Tübingen AI Center +3
Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution
Sep 24, 2026José Luis PinoAutonomous Cyber Defense AI Agent Security
Independent Researcher Westlake Village, CA, USA
On the Effectiveness of Kernel-Level Evidence for Agent Security
Sep 24, 2026Spencer King, Zhilu Zhang, Mikhail Kuznetsov +3AI Agent Security AI Agent Security Benchmarks
University of Georgia · Amazon Web Services
Blockchain-Enabled Artificial Intelligence and AI Agents for Secure Data Sharing and Cybersecurity Applications
Sep 23, 2026Harsh VermaCybersecurity AI Agent Security
Palo Alto Networks, Artificial Intelligence, United States
Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents
Sep 23, 2026Jinqian Zhang, Haojun Xia, Shujiang Wu +4AI Agent Security LLM Agent Security
Institute of Information Engineering, Chinese Academy of Sciences · School of Cyber Security, University of Chinese Academy of Sciences · Beihang University +1

Oct 8, 2026, cs.CRJ/K move · Enter open · S save

From Reactive Containment to Proactive Assurance: Lessons from OpenAI, Anthropic, and Google Agent Security Incidents

Abbas Raftari

Walsh College, Troy, Michigan, USA

AI Agent Security Runtime Enforcement for AI Agents Tool Access Control for LLM Agents AI Agent Monitoring

Open paper AskPDF arXiv

In 2026, cybersecurity evaluations involving OpenAI, Anthropic, and Google agents reached real systems outside their authorized test scope. The paths were different. OpenAI agents exploited research infrastructure, coordinated across runs, and compromised parts of Hugging Face's production environment. Anthropic reported cases in which a misconfigured third-party environment exposed real systems to agents pursuing simulated cyber tasks. In a separately reported evaluation, Google's Gemini accessed three real organizations through an unintended internet route; Google stated that the model stopped in all three instances. Taken together, the cases show why an evaluation cannot rely on an assumed boundary. That boundary must be verified while the agent is operating. This comparative instrumental case study develops a Proactive Agent Security Assurance Cycle (PASAC) and a five-layer Boundary Assurance Stack. The framework combines risk-tiered task design, executable scope contracts, pre-run validation, least-capability access, independent egress enforcement, credential restrictions, cross-run monitoring, automatic stop conditions, and evidence-based reauthorization. A leading-indicator model, nine design propositions, and seven falsifiable hypotheses turn these lessons into a testable research program. Because the public Gemini record is limited to attributed statements and journalism, its detailed causal mechanism remains provisional. The central conclusion is straightforward: proactive agent security requires continuous assurance across the full execution system, not confidence in any single sandbox or safeguard.

Momentum

Related topics

Latest papers 311