LLM Agent Security

LLM: Large Language Model

Follow this topic Ask about this topic

Momentum

29 papers in the last four weeks, up 81% on the four weeks before. 0.3% of all new papers.

Jul 13Week of Sep 28

Latest papers 234

All topics

What May an Agent Change About Itself? A Containment Floor for Self-Configuring Agent Runtimes
Oct 5, 2026Sajib Hossain, Moeen Uddin MahmudLLM Agent Security Runtime Enforcement for AI Agents
North South University · HelicanHQ
Where Did the Repair First Go Wrong? Localizing the Origins of Silent Failures in Agentic Vulnerability Repair
Oct 5, 2026Wenji Bai, Muhammad Waseem, Zeeshan Rasheed +2Agent Failure Analysis Automated Program Repair
Tampere University, Tampere, Finland
AgentSpy: Making AI Agent Behavior Observable
Oct 5, 2026Christoph Bühler, Matteo Biagiola, Luca Di Grazia +1AI Agent Reliability AI Agent Auditing
University of St. Gallen, St. Gallen, SG, Switzerland · University of St. Gallen and Università della Svizzera italiana (USI), St. Gallen and Lugano, SG and TI, Switzerland
Runaway Reaction: When Benign Skills Compose into Malicious Behavior
Oct 5, 2026Zunlong Zhou, Ziyuan Yang, Mengyu Sun +1AI Agent Security LLM Agent Security
Sichuan University
The Innocent Courier: Covert Exfiltration Through Legitimate LLM Web Fetching
Oct 1, 2026Alessandro Pegoraro, Daryan Merx, Phillip Rieger +1LLM Agent Security Privacy Leakage in Language Models
Technical University of Darmstadt · Graz University of Technology
Chaining Skills to Hijack LLM Agents
Oct 1, 2026Tian Dong, Zixuan Ma, Haodong Zhao +3LLM Agent Security AI Agent Safety
The University of Hong Kong · Shandong University · Shanghai Jiao Tong University +1
PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents
Oct 1, 2026Fengpeng Li, Qizhou Wang, Yuke Hu +5LLM Agent Security Runtime Enforcement for AI Agents
PRADA Lab, King Abdullah University of Science and Technology · Imperfect Information Learning Team, RIKEN Center for Advanced Intelligence Project · State Key Laboratory of Internet of Things for Smart City, University of Macau +2
Memetic Trojans: Social Contagions as Carriers of Adversarial Payloads in Agent Networks
Sep 30, 2026Birk Torpmann-Hagen, Finn Schwall, Leon MoonenLLM Agent Security Multi-Agent System Security
Simula Research Laboratory Oslo, Norway · Simula Research Laboratory Oslo Metropolitan University Oslo, Norway
Speculative Safety Honeypot: Toward Proactive Defense Against Multi-turn Agent Attacks
Sep 30, 2026Zezhong Wang, Xueyang Tang, Rui Lian +2LLM Agent Security AI Agent Monitoring
Huawei Technologies Co., Ltd, Hong Kong SAR.
Hiding in Plain Sight: Decoupling Pretext from Actuation for Skill Poisoning in LLM Agents
Sep 30, 2026Wenxin Wu, Lingyong Yan, Lei Sha +2Adversarial Attacks on LLMs LLM Agent Security
Beihang University · Baidu Inc · Wilfrid Laurier University
Can Agents Trust Their Skills? Uncovering Unsafe Chains of Trust in Skill-Based LLM Agents
Sep 30, 2026Yan Wang, Zhihao Zhang, Ke Chen +5LLM Agent Security Prompt Injection Attacks on AI Agents
Institute of Information Engineering, Chinese Academy of Sciences · School of Cyberspace Security, University of Chinese Academy of Sciences · Worcester Polytechnic Institute
SKILLLITE: Evidence-Guided Malicious Skill Auditing with Compact LLMs
Sep 29, 2026Haoran Ou, Gelei Deng, Xuanye Zhang +3Small Language Models LLM Agent Security
Nanyang Technological University
CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering
Sep 29, 2026Mark RussinovichLLM Agent Security Indirect Prompt Injection
Microsoft Azure
When Valid Tool Calls Change Meaning: Formation-Consistent Dispatch for LLM Agents
Sep 28, 2026Geonwoo Kim, Brent ByungHoon KangLLM Agent Security Runtime Enforcement for AI Agents
Korea Advanced Institute of Science and Technology
CoSec: Benchmarking Agent Security in Communities
Sep 28, 2026Hao Chen, Wenhui Dong, Ye Chen +12LLM Agent Security AI Agent Security Benchmarks
Nanjing University · Xi’an Jiaotong University · Beihang University +6
CoDeL: Co-Evolutionary Defense against Indirect Prompt Injection in LLM-based Agents
Sep 28, 2026Xiao Yang, Yangchen Ou, Yuhan Gao +3Adversarial Training LLM Agent Security
School of Computer Science and Engineering, Beihang University · State Key Laboratory of Complex & Critical Software Environment, Beihang University
Cheap to Hypothesize, Costly to Verify: The Defense Surface of Agentic Vulnerability Discovery
Sep 28, 2026Kaikai Zhang, Zihan Zhang, Yuchong Xie +4Software Vulnerability Detection Cybersecurity
The Hong Kong University of Science and Technology
Certified Multi-Source Integrity for Structured Agent Actions
Sep 28, 2026Anmol Pandey, Aditya Jain, Liang Chen +2Data Provenance LLM Agent Security
University of Warwick · University of Hertfordshire
When Consent Outlives Context: Residual Authority Replay in Long-Lived Agents
Sep 27, 2026Zhihao Zhang, Chao Wang, Rujia Li +3LLM Agent Security Prompt Injection Attacks on AI Agents
Worcester Polytechnic Institute · Tsinghua University · Independent Researcher
API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary
Sep 27, 2026Patrick Kenney, Hadi Ahmadi, Denis Lusson +2Software Security LLM Agent Security
Corvic AI Research
Calibrated Decision Models for Autonomous Penetration-Testing Harnesses: JEV and Laya as System One Decision Layers for LLM-Driven Pentest Agents
Sep 24, 2026Joas Antonio dos Santos BarbosaProbability Calibration Cybersecurity
Independent Researcher — AI and Offensive Security S˜ao Paulo, SP, Brazil
Blockchain-Enabled Artificial Intelligence and AI Agents for Secure Data Sharing and Cybersecurity Applications
Sep 23, 2026Harsh VermaCybersecurity AI Agent Security
Palo Alto Networks, Artificial Intelligence, United States
Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents
Sep 23, 2026Jinqian Zhang, Haojun Xia, Shujiang Wu +4AI Agent Security LLM Agent Security
Institute of Information Engineering, Chinese Academy of Sciences · School of Cyber Security, University of Chinese Academy of Sciences · Beihang University +1
ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
Sep 21, 2026Kaiyuan Zhang, Yuke Peng, Ke Jiang +1LLM Agent Security Runtime Enforcement for AI Agents
Southern University of Science and Technology
SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes
Sep 17, 2026Mengxiao Wang, Nitesh SaxenaLLM Agent Security AI Agent Security Benchmarks
Texas A&M University
ASLEval: Measuring Privacy Exposure Displacement in LLM Agent Sessions
Sep 16, 2026Guosen Wu, Huizhen Huang, Guoxiong Long +2Privacy Auditing LLM Agent Evaluation
School of Computer and Big Data, Minjiang University, Fuzhou, China
Why LLM Agents Collapse Without Oversight: The Enforcement Gap as the Mechanism Behind Emergence World Failures
Sep 14, 2026Yuhang WangLLM Auditing LLM Agent Security
Fudan University
The Stochastic Deputy: Structural Tenant Isolation for Tool-Using LLM Agents
Sep 13, 2026Mirza Samad Ahmed Baig, Syeda Anshrah Gillani, Asher Ali +1LLM Agent Security Tool Access Control for LLM Agents
1*Fandaqah, Al Khobar, Saudi Arabia. · 2Heidelberg University, Heidelberg, Germany.
SkillAtlas: An Attack Trace Library for Agent Skills
Sep 11, 2026Yuxin Tian, Zenghao Duan, Liang Pang +2LLM Agent Security Agent Skill Security Auditing
State Key Laboratory of AI Safety, Institute of Computing Technology, CAS · University of Chinese Academy of Sciences
AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agents
Sep 10, 2026Zhihao Liu, Hongyu Sun, Zhiyuan Fu +7Adversarial Patch Attacks Computer-Use Agents
Hainan University, Hainan 570228, China · University of Chinese Academy of Sciences National Computer Network Intrusion Protection Center, Beijing 101408, China · School of Computing and Communications, Lancaster University, Lancaster, United Kingdom

Oct 5, 2026, cs.LGJ/K move · Enter open · S save

What May an Agent Change About Itself? A Containment Floor for Self-Configuring Agent Runtimes

Sajib Hossain, Moeen Uddin Mahmud

North South University · HelicanHQ

LLM Agent Security Runtime Enforcement for AI Agents Access Control Tool Access Control for LLM Agents

Open paper AskPDF arXiv

Many agent runtimes give the agent a tool for editing its own configuration. Some of that configuration grants abilities, such as enabling a tool. Other parts set the agent's limits: which directories it may write to, who may send it messages, which network address it listens on, how callers authenticate, and the gate that blocks risky writes. If the agent can edit those limits, a single ordinary request can widen them. We study this in a deployed, model-agnostic runtime. We propose a rule: the agent may change fields that grant abilities, and may never change fields that set its limits. We enforce the rule as a containment floor inside the configuration tool and measure what happens with and without it. Without the floor, a frontier model wrote a protected value on 25 of 72 ordinary requests that gave it permission to change settings, often when the request never named the field. Prohibitions written in the system prompt failed in a predictable way. A prompt that listed the protected field names stopped every request that used those names (0 of 36 saved, against 17 of 36 with no prompt) and did not stop the requests that only described the goal (10 of 36 saved, against 8 of 36). A prompt that described the forbidden effects did the reverse. With the floor, 0 of 167 protected writes were saved, although the models attempted a protected write in 65 of those cases. A search for other routes through the tool found only one, a pinned shell, which the floor's scope statement already excludes. The study covers two models and a single agent. We state what that does and does not support.

Momentum

Related topics

Latest papers 234