LLM Agent Security

LLM: Large Language Model

The field examines how agents can be manipulated through indirect prompt injection, malicious tools or skills, poisoned memory, excessive permissions, and multi-agent interactions, sometimes leading to data leaks or harmful actions. Researchers evaluate these risks with red-team attacks and benchmarks that track agent trajectories, tool calls, and real effects—not just final answers. Defenses include runtime authorization and least privilege, sandboxing, provenance and information-flow controls, monitoring, and security-focused training. A central challenge is protecting agents over long, changing workflows without blocking legitimate tasks, while making evaluations realistic enough to capture adaptive attacks and deployment risks.

Latest papers

332 papers44 papers in the last four weeks, up 33% on the four weeks before. 0.3% of all new papers.

HarmfulSkillBench: How Do Harmful Skills Weaponize Your Agents?
Apr 16, 2026Yukun Jiang, Yage Zhang, Michael Backes +2LLM Agent Security AI Agent Security Benchmarks
CISPA Helmholtz Center for Information Security
Challenges and Future Directions in Agentic Reverse Engineering Systems
Apr 15, 2026Salem Radey, Jack West, Kassem FawazSoftware Reverse Engineering LLM Agent Security
University of Wisconsin-Madison, Madison, USA
SoK: Security of Autonomous LLM Agents in Agentic Commerce
Apr 15, 2026Qian'ang Mao, Jiaxin Wang, Ya Liu +3LLM Agent Security Agentic Commerce
Nanjing University · Southern University of Science and Technology · City University of Hong Kong
Dive into Claude Code: The Design Space of Today's and Future AI Agent Systems
Apr 14, 2026Jiacheng Liu, Xiaohan Zhao, Xinyi Shang +1AI Coding Agents LLM Agent Orchestration
VILA Lab, Mohamed bin Zayed University of Artificial Intelligence · University College London
ProbeLogits: Kernel-Level LLM Inference Primitives for AI-Native Operating Systems
Apr 13, 2026Daeyeon SonAI Safety LLM Guardrails
Independent Researcher Republic of Korea
ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection
Apr 13, 2026Wei Zhao, Zhe Li, Peixin Zhang +1AI Agent Security LLM Agent Security
Singapore Management University
Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines
Apr 8, 2026Tanzim Ahad, Ismail Hossain, Md Jahangir Alam +4LLM Agent Security LLM Agent Safety
Department of Computer Science, University of Texas at El Paso, TX, USA 79902 · School of Computing, Southern Illinois University Carbondale, IL, USA 62901 · Hanyang University, Seoul, South Korea +1
SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems
Apr 8, 2026Yunhao Feng, Yifan Ding, Yingshui Tan +6Backdoor Attacks LLM Agent Security
National University of Defense Technology · Alibaba Group · Fudan University +1
BodhiPromptShield: Pre-Inference Prompt Mediation for Surface-Form Privacy Propagation in LLM Agent Pipelines
Apr 7, 2026Bo Ma, Jinsong Wu, Weiqi YanData Leakage Privacy-Preserving Language Models
Auckland University of Technology Auckland, New Zealand · Guilin University of Electronic Technology Guilin, China
Stop Fixating on Prompts: Reasoning Hijacking and Constraint Tightening for Red-Teaming LLM Agents
Apr 7, 2026Yanxu Mao, Peipei Liu, Tiehan Cui +3LLM Red Teaming LLM Agent Security
School of Software, Henan University, China · Institute of Information Engineering, Chinese Academy of Sciences, China · University of Chinese Academy of Sciences, China +1
Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use
Apr 7, 2026Wuyang Zhang, Shichao PeiLLM Agent Security LLM Backdoor Attacks
University of Massachusetts Boston
Mapping the Exploitation Surface: A 10,000-Trial Taxonomy of What Makes LLM Agents Exploit Vulnerabilities
Apr 6, 2026Charafeddine MouzouniLLM Agent Security LLM Agent Safety
OPIT – Open Institute of Technology, and Cohorte AI, Paris, France.
A Systematic Security Evaluation of OpenClaw and Its Variants
Apr 3, 2026Yuhang Wang, Haichang Gao, Zhenxing Niu +4AI Agent Security LLM Agent Security
Xidian University · Data Science & Artificial Intelligence Research Institute, China Unicom
Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems
Apr 3, 2026Yubin Qu, Yi Liu, Tongcheng Geng +5AI Agent Security LLM Agent Security
Griffith University Australia · Quantstamp Singapore · The State Information Center China +4
How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study
Apr 3, 2026Zhihao Chen, Ying Zhang, Yi Liu +7LLM Agent Security Agent Skill Security Auditing
Griffith University, Australia · Wake Forest University, USA · Nanyang Technological University, Singapore +5
Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis
Apr 3, 2026Zhiyuan Li, Jingzheng Wu, Xiang Ling +2LLM Agent Security Agent Skill Security Auditing
Institute of Software, Chinese Academy of Sciences, Beijing, China · University of Chinese Academy of Sciences, Beijing, China · Key Laboratory of System Software (Chinese Academy of Sciences), Beijing, China
AgentSocialBench: Evaluating Privacy Risks in Human-Centered Agentic Social Networks
Apr 1, 2026Prince Zizhuang Wang, Shuli JiangPrivacy Protection for LLM Agents LLM Agent Security
Carnegie Mellon University
No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents
Apr 1, 2026Tiankai Yang, Jiate Li, Yi Nian +5LLM Agent Security LLM Agent Safety
University of Southern California · Michigan State University · Northwestern University +1
Clawed and Dangerous: Can We Trust Open Agentic Systems?
Mar 27, 2026Shiping Chen, Qin Wang, Guangsheng Yu +2LLM Agent Security AI Agent Governance
CSIRO Data61 · University of Technology Sydney
The System Prompt Is the Attack Surface: How LLM Agent Configuration Shapes Security and Creates Exploitable Vulnerabilities
Mar 26, 2026Ron LitvakPhishing Detection LLM Agent Security
Independent Researcher, Columbia University
ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watchers
Mar 25, 2026Songyang Liu, Chaozhuo Li, Chenxu Wang +8AI Agent Security LLM Agent Security
Beijing University of Posts and Telecommunications · Beijing Academy of Artificial Intelligence · China Academy of Information and Communications Technology
Agent Audit: A Security Analysis System for LLM Agent Applications
Mar 24, 2026Haiyue Zhang, Yi Nian, Yue ZhaoAI Agent Auditing LLM Agent Security
University of Southern California Los Angeles, California, USA
AC4A: Access Control for Agents
Mar 21, 2026Reshabh K Sharma, Dan GrossmanTool Access Control for LLM Agents LLM Agent Security
University of Washington, Seattle, Washington, USA
T-MAP: Red-Teaming LLM Agents with Trajectory-aware Evolutionary Search
Mar 21, 2026Hyomin Lee, Sangwoo Park, Yumin Choi +3Adversarial Prompt Generation LLM Red Teaming
KAIST · University of California, Los Angeles
A Framework for Formalizing LLM Agent Security
Mar 19, 2026Vincent Siu, Jingxuan He, Kyle Montgomery +4LLM Agent Security Prompt Injection Attacks on AI Agents
UC Santa Cruz · UC Berkeley · Duke University
Security awareness in LLM agents: the NDAI zone case
Mar 19, 2026Enrico Bottazzi, Pia ParkAI Agent Security LLM Agent Security
Leku
From Weak Cues to Real Identities: Evaluating Inference-Driven De-Anonymization in LLM Agents
Mar 19, 2026Myeongseob Ko, Jihyun Jeong, Sumiran Singh Thakur +2Privacy Leakage in Language Models LLM Agent Security
Department of Electrical and Computer Engineering, Virginia Tech, Blacksburg, VA, USA · Center for Advanced AI, Accenture
Towards Reliable Local Security Agents: Verifiable Post-Training for Linux Privilege Escalation
Mar 18, 2026Philipp Normann, Andreas Happe, Jürgen Cito +1LLM Agent Security LLM Post-Training
TU Wien, Vienna, Austria
VeriGrey: Greybox Agent Validation
Mar 18, 2026Yuntong Zhang, Sungmin Kang, Ruijie Meng +2LLM Agent Security Prompt Injection Attacks on AI Agents
National University of Singapore · Max-Planck Insitute of Security and Privacy
Caging the Agents: A Zero Trust Security Architecture for Autonomous AI in Healthcare
Mar 18, 2026Saikat MaitiAI Agent Security LLM Agent Security
VP of Trust, Commure · Founder & CEO, nFactor Technologies

Apr 16, 2026J/K move · Enter open · S save

HarmfulSkillBench: How Do Harmful Skills Weaponize Your Agents?

Yukun Jiang, Yage Zhang, Michael Backes, Xinyue Shen+1

CISPA Helmholtz Center for Information Security

LLM Agent Security AI Agent Security Benchmarks AI Agent Safety Benchmarks LLM Agent Safety

Open paper AskPDF arXiv

Large language models (LLMs) have evolved into autonomous agents that rely on open skill ecosystems (e.g., ClawHub and Skills.Rest), hosting numerous publicly reusable skills. Existing security research on these ecosystems mainly focuses on vulnerabilities within skills, such as prompt injection. However, there is a critical gap regarding skills that may be misused for harmful actions (e.g., cyber attacks, fraud and scams, privacy violations, and sexual content generation), namely harmful skills. In this paper, we present the first large-scale measurement study of harmful skills in agent ecosystems, covering 98,440 skills across two major registries. Using an LLM-driven scoring system grounded in our harmful skill taxonomy, we find that 4.93% of skills (4,858) are harmful, with ClawHub exhibiting an 8.84% harmful rate compared to 3.49% on Skills.Rest. We then construct HarmfulSkillBench, the first benchmark for evaluating agent safety against harmful skills in realistic agent contexts, comprising 200 harmful skills across 20 categories and four evaluation conditions. By evaluating six LLMs on HarmfulSkillBench, we find that presenting a harmful task through a pre-installed skill substantially lowers refusal rates across all models, with the average harm score rising from 0.27 without the skill to 0.47 with it, and further to 0.76 when the harmful intent is implicit rather than stated as an explicit user request. We responsibly disclose our findings to the affected registries and release our benchmark to support future research (see https://github.com/TrustAIRLab/HarmfulSkillBench).