LLM Agent Security

LLM: Large Language Model

Follow this topic Ask about this topic

Momentum

29 papers in the last four weeks, up 81% on the four weeks before. 0.3% of all new papers.

Jul 13Week of Sep 28

Latest papers 234

All topics

ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?
Sep 8, 2026Moonwon Choi, Seokho Jeong, Sian Choi +1LLM Agent Security Access Control
Graduate School of Data Science, Seoul National University
Staying on the Attack Path: Structured State for Long-Horizon Automated Penetration Testing
Sep 7, 2026Weizhe Wang, Yitong Zhang, Yao Zhang +4LLM Agent Memory LLM Agent Security
Tianjin University, Tianjin, 300072, China · Changchun University of Science and Technology, Changchun, 130022, China · Jilin Province Key Laboratory of Network and Information Security, Changchun, 130022, China +1
AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealing
Sep 7, 2026Xiaoting Lyu, Yuhong Wu, Yufei Han +6LLM Agent Security LLM Agent Skill Learning
Xi’an Jiaotong University · INRIA · University of Warwick +1
SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center
Sep 3, 2026Uday Vallabhaneni, Cassie L. Cagwin, David J. WildReinforcement Learning Cybersecurity
Luddy School of Informatics, Computing and Engineering · Indiana University, Bloomington, IN, USA
Agent Memory Is a Surface for Endogenous Authorization Laundering
Sep 1, 2026Tommaso Cerruti, Mika Okamoto, Ansel Kaplan ErolLLM Agent Memory LLM Agent Security
ETH Zurich · Georgia Institute of Technology
Public-Sharing Labels and Verbatim Field Egress in an MCP-to-A2A Agent Configuration: A Controlled Multi-Model Study
Sep 1, 2026Arpan Kumar MahapatraMCP Security LLM Agent Security
Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems
Aug 31, 2026Panduranga Sai Varma Dantuluri, Jyotirmoy SundiMulti-Agent LLM Systems LLM Agent Security
VotalAI
Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents
Aug 31, 2026Yunseok Lee, Yunji Kim, Woojin LeeLLM Agent Security AI Agent Security Benchmarks
Dongguk University-Seoul
Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection
Aug 30, 2026Wujie Xiong, Rabimba Karanjai, Yang Lu +2LLM Agent Security Information Flow Control
Kent State Univeristy · PayPal AI Labs · University of Houston
Influence Is Not Authority: When Causal Guardrail Signals Make Legitimate Tool Use Look Like an Attack in Tool-Using LLM Agents
Aug 30, 2026Tanzim Ahad, Ismail Hossain, Md Jahangir Alam +3LLM Guardrails LLM Agent Security
Department of Computer Science, University of Texas at El Paso, TX, USA 79902 · Department of Computer Science and Engineering, New Mexico Tech, Socorro, NM, USA 87801 · University of Illinois Urbana-Champaign, IL, USA
Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit
Aug 27, 2026Yisen XiLLM Agent Security Runtime Enforcement for AI Agents
Independent Researcher, Beijing, China.
SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents
Aug 22, 2026Yuanjin Zheng, Jingbang ChenLLM Agent Security LLM Agents
CUHK-Shenzhen & SLAI
Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents
Aug 13, 2026Jiajun Ruan, Peiyang Li, Yukun Chen +2LLM Agent Security LLM Agent Safety
University of Minnesota · Ant Group · Tsinghua University +1
Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation
Aug 13, 2026Rana Muhammad Ahmed, Sabahat AbbasMCP Security LLM Agent Security
Department of Computer Science, Bahria University, Islamabad, Pakistan
Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents
Aug 12, 2026Junliang Liu, Ruoyu Li, Wenxin Tang +4Adversarial Attacks on LLMs LLM Agent Security
School of Computer Science and Software Engineering, Shenzhen University · The Chinese University of Hong Kong · The Chinese University of Hong Kong, Shenzhen
Backdoor Decontamination Dynamics in LLM Agents
Aug 11, 2026Gabriel Huang, Abhay Puri, Léo Boisvert +4LLM Backdoor Attacks Backdoor Defense in LLMs
ServiceNow Research · Mila – Quebec AI Institute · Polytechnique Montréal +3
On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models
Aug 11, 2026Md Jafrin Hossain, Mohammad Arif Hossain, Nirwan AnsariLLM Agent Security LLM Security
Florida International University, Miami, Florida, USA · Middle Tennessee State University, Murfreesboro, Tennessee, USA · New Jersey Institute of Technology, Newark, NJ, USA
ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
Aug 10, 2026Puyu Zeng, Simeng Qin, Jingzhi Li +3AI Agent Security LLM Agent Security
College of Cryptology and Cyber Science, Nankai University, China · Northeastern University, China · University of Science and Technology Beijing, China +2
ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization
Aug 10, 2026Hao Sui, Simeng Qin, Jie Liao +3LLM Backdoor Attacks LLM Agent Security
Nanjing University of Aeronautics and Astronautics, China · Northeastern University, China · Chongqing University, China +1
Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection
Aug 9, 2026Rahul Deivasigamani, Sayeda Faatin Alvi, Derqui Andrea +2AI Agent Security LLM Agent Security
Radboud University · Nijmegen, The Netherlands
Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario
Aug 8, 2026Satoshi MatsuokaLLM Agent Security Agent Memory Poisoning
RIKEN Center for Computational Science, Kobe, Japan
Persistent Semantic Entities in Tool-Augmented LLM Systems
Aug 8, 2026Zhaohui WangAgent Memory Tool-Augmented Language Model Agents
USC Viterbi School of Engineering, University of Southern California, Los Angeles, CA, USA.
Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture
Aug 6, 2026Leo Sambrook, Sampo SovioMCP Security AI Agent Security
Hardware Systems Security Lab (HSSL) Huawei Technologies & EPITA Helsinki, Finland
Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills
Aug 4, 2026Peichun Hua, Haoxuan Xu, Mengyuan LiLLM Agent Security
University of Southern California
AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection
Aug 4, 2026Shihao Weng, Yang Feng, Xiaofei Xie +1Continual Learning for LLM Agents LLM Agent Security
Nanjing University · Singapore Management University · Nanyang Technological University
MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication
Aug 3, 2026Jinghan Xu, Longze Fan, Zeyuan Wang +2Multi-Agent LLM Systems LLM Agent Security
1Nankai University, China · 2China University of Petroleum, China · 3Sun Yat-sen University, China +1
Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions
Aug 3, 2026Jinghan Xu, Longze Fan, Zeyuan Wang +2LLM Agent Security Access Control
1Nankai University, China · 2China University of Petroleum, China · 3Sun Yat-sen University, China +1
Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
Aug 3, 2026Alireza Lotfi, Subangkar Karmaker Shanto, Imtiaz Karim +1AI Agent Security LLM Agent Security
Purdue University · Department of Computer Science · West Lafayette, IN, USA +2
CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents
Jul 31, 2026Blaise Delattre, Cong Wang, Yang CaoLLM Agent Security Tool-Using Agents
Department of Computer Science, School of Computing, Institute of Science Tokyo, Tokyo, Japan · City University of Hong Kong
FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs
Jul 29, 2026Yifan Zhang, Xinkui Zhao, Sai Liu +3LLM Agent Security Tool Access Control for LLM Agents
Zhejiang University

Sep 8, 2026, cs.AIJ/K move · Enter open · S save

ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?

Moonwon Choi, Seokho Jeong, Sian Choi, Seunggeun Lee

Graduate School of Data Science, Seoul National University

LLM Agent Security Access Control Agent Memory Management LLM Agent Reliability

Open paper AskPDF arXiv

With revocable delegation, two histories can yield identical current permissions yet require opposite decisions for the same query after the same revocation. We introduce ResidualAuth, a theory-grounded framework characterizing the authorization state agent systems must preserve and evaluating its maintenance and use. Its formal core, residual authorization state, equates histories exactly when every future sequence of grants, revocations, and uses is valid after both or neither. We prove that exponentially many distinct residual states can nevertheless agree on who can reach whom through delegation paths. The analysis also yields exact or tight memory bounds as delegation redundancy varies and an average decision-error lower bound under an explicit bound on retained information. ResidualAuth evaluates information access, online state maintenance, and information use through a restricted executable benchmark and separate diagnostics. The benchmark pairs episodes differing in authorization-relevant history and requiring opposite decisions; pair accuracy requires both answers to be correct. To test use of supplied decisions, four open-weight models received trusted current-query Allow/Deny decisions alongside deterministic 256-token event extracts, achieving 15-16/16 correct pairs versus 0-2/16 with extracts alone. Memory diagnostics identified invalid reconstructions; models also answered incorrectly from valid memories that passed fixed future authorization tests. Together, these results distinguish what future authorization requires a system to retain from whether agents can access relevant information, maintain state across updates, and use available information to make correct decisions.

Momentum

Related topics

Latest papers 234