Sandbox

Follow this topic Ask about this topic

Momentum

3 papers in the last four weeks, level with the four weeks before. 0.0% of all new papers.

Jul 13Week of Sep 28

Latest papers 24

All topics

Inference-Engine Fingerprinting Attacks are Practical: Exploring Model-Driven Environmental Discovery, Exploitation, and Escape
Sep 17, 2026Sarah Radway, Andrew Cheng, Vijay Janapa Reddi +1Exploitation Fingerprint
Harvard University
Memory Compression for High-Fanout Agent Sandboxes
Sep 12, 2026Mengming Li, Ceyu XU, Qijun Zhang +4Sandbox Task-Aware Compression
HKUST
CityPlanner: A Sandbox Agent for Executable Urban Planning
Sep 10, 2026Wentao Zhang, Jingyuan Wang, Zetong Zhou +2Classical Planning Urban Environments
School of Computer Science and Engineering, Beihang University, Beijing, China · MIIT Key Laboratory of Data and Decision Intelligence, Beihang University, Beijing, China
Spawn Freely, Act Sparingly: Progressive Risk Vesting for Recursive LLM-Agent Trees
Sep 1, 2026Molly WangAgentic Deployments Authority
Imperial Business School
Science sandboxes measure the scientific capability of AI agents
Aug 31, 2026Arya S. Rao, Rodrigo I. Castro, Sager J. Gosai +8Scientific Discovery Sandbox
The Broad Institute of MIT and Harvard; Cambridge, MA 02142, USA. · Department of Biomedical Informatics, Harvard Medical School; Boston, MA 02115, USA. · The Jackson Laboratory; Bar Harbor, ME 04609, USA. +10
One Success Isn't Reliability: Thinkingbox, a Sandbox and Benchmark for Agents in Stateful Business Workflows
Aug 20, 2026Zhuochun Li, Youngmin Ko, Ali Keramati +11Agentic Workflow Design Sandbox
University of Pittsburgh · Northwestern University · University of California, Irvine +1
OBLIVION: Workflow-Level Operational Skill Unlearning for Deployed Agents
Aug 8, 2026Zhengyang Shan, Xu Qian, Jiayun Xin +3Skills Remediation
Shandong University
WeClawArena: An Auditable Sandbox and Benchmark for Cross-User Agents Collaboration and Security in Human-Centered Agent Networks
Aug 4, 2026Prince Zizhuang Wang, Aojie Yuan, Haiyue Zhang +3Openclaw Sandbox
Carnegie Mellon University · University of Southern California · Arizona State University
AI Sandbox: Technical Report
Aug 2, 2026Muhammad Waseem, Md Aidul Islam, Md Nasir Uddin Shuvo +8Sandbox Artificial Intelligence Governance
GPT Lab, Faculty of Information Technology and Communication Sciences, Tampere University, Tampere, Finland · DIMECC Oy, Tampere, Finland · University of Oulu, Oulu, Finland
Permission Denied: Policy-Graded Evaluation of Coding Agents in Hardened Environments
Aug 2, 2026Dotan Davidovich, Yair Amar, Hai Rozencwajg +1Kernel-Resident Tool Governance Gateway Security Evaluation
Accomplish AI
SpecBox: Speculative Sandbox Scheduling for Efficient LLM Agent Serving
Jul 27, 2026Yihui Zhang, Tianyu Wo, Jinghao Wang +7Sandbox Large Language Model Agents
Beihang University · University of Leeds · The University of Sydney
Branching Policy Optimization: Sandbox-Native Language Agent Reinforcement Learning
Jul 15, 2026Bowei He, Yankai Chen, Xiaokun Zhang +1Frictive Policy Optimization Offline Reinforcement Learning
Mohamed bin Zayed University of Artificial Intelligence, Abu Dhabi, UAE · McGill Univeristy, Montreal, Canada · City University of Hong Kong, Hong Kong SAR.
Seduced by the Narrative: Assessing Rule Adherence in Semi-Open Textual Sandboxes
Jul 2, 2026Weiying Chen, Junlong Shen, Zhanyuan Guo +1Rhetoric Sandbox
University of Alberta, Edmonton, AB, Canada · N-Dice Association · Qilu University of Technology, Shandong, China
Code Isn't Memory: A Structural Codebase Index Inside a Coding Agent
Jun 21, 2026Ishaan Bhola, Adithyan Krishnan, Sravanth Kurmala +1Codebases Coding Agents
SuperAGI Research
Boltzmann MapReduce: A Partition-Function Reduce for Forkable Sandboxes
Jun 17, 2026Yossi EliazBoltzmann Distributions Unnormalized Probability Densities
Incredibuild · HIT CS Department, Israel
AI Sandboxes: A Threat Model, Taxonomy, and Measurement Framework
Jun 16, 2026Inderjeet Singh, Haitham Mahmoud, Andrés MurilloSandbox Artificial Intelligence Risk
Fujitsu Research of Europe, United Kingdom
AI Code Sandboxes: A Comparative Security Study. Part 1 of 2 -- Engine-Level Properties (Attack Surface, Leakage, Stackability, CVE History, Patch Cadence, Fuzzing)
Jun 7, 2026George Andronchik, Pavel LokhmakovCommon Vulnerabilities And Exposure Fuzzing
fellows.tech, orbitalab.dev
DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback
May 21, 2026Yunpeng Dong, Jingkai He, Shiqi Liu +7Sandbox Rollback
Institute of Parallel and Distributed Systems, Shanghai Jiao Tong University · Engineering Research Center for Domain-specific Operating Systems, Ministry of Education, China · Huawei Technologies Co., Ltd.
Plan in Sandbox, Navigate in Open Worlds: Learning Physics-Grounded Abstracted Experience for Embodied Navigation
May 11, 2026Zhixuan Shen, Jiawei Du, Ziyu Guo +5Open-World Grounding
School of Computing and Artificial Intelligence, Southwest Jiaotong University, China · Centre for Frontier AI Research, A*STAR, Singapore · School of Computer Science, University of Leeds, UK
Crab: A Semantics-Aware Checkpoint/Restore Runtime for Agent Sandboxes
Apr 30, 2026Tianyuan Wu, Chaokun Chang, Lunxi Cao +2Sandbox Intermediate Checkpoints
HKUST Hong Kong SAR, China
ClawGym: A Scalable Framework for Building Effective Claw Agents
Apr 29, 2026Fei Bai, Huatong Song, Shuang Sun +11Claw-Like Agent Agentic Learning
Gaoling School of Artificial Intelligence, Renmin University of China · IQuest Research · Beihang University
Mythos and the Unverified Cage: Z3-Based Pre-Deployment Verification for Frontier-Model Sandbox Infrastructure
Apr 22, 2026Dominik BlainPre-Deployment Safety Assessments Sandbox
COBALT Formal Verification, QreativeLab Inc. Montr´eal, Qu´ebec, Canada
Context: Proactive Goal-Directed Intelligence via Composable Sandboxed Programs, Declarative Wiring, and Structured Interaction
Apr 21, 2026Gregory MagarshakChatbots Interaction Data
Qbix, Inc. & Intercoin, Inc. · New York, USA · Also with IE University NYC.
Operationalising AI Regulatory Sandboxes: Activities, Requirements, and Technical Assessment under the EU AI Act
Sep 27, 2025Alessio Buscemi, Thibault Simonetto, Daniele Pagani +3Eu Artificial Intelligence Act Sandbox
Luxembourg Institute of Science and Technology (LIST) · University of Luxembourg

Sep 17, 2026, cs.CRJ/K move · Enter open · S save

Inference-Engine Fingerprinting Attacks are Practical: Exploring Model-Driven Environmental Discovery, Exploitation, and Escape

Sarah Radway, Andrew Cheng, Vijay Janapa Reddi, James Mickens

Harvard University

Exploitation Fingerprint Artificial Intelligence Models Sandbox

Open paper AskPDF arXiv

Frontier AI models are rapidly gaining the ability to exploit vulnerabilities in complex pieces of software. The risk is not theoretical, as evidenced by recent sandbox escapes performed by frontier models at OpenAI and Anthropic. Discussions of how to sandbox inference stack components often focus on components other than the inference engine itself (e.g., network proxies or code execution environments). However, the inference engine is an attractive target for a misaligned model. For example, if a model can trigger exploits in that engine merely by generating specially-crafted output tokens, the model can initiate a multi-step, to-the-bare-metal exploit chain in the engine, without relying on vulnerabilities in other components of the inference stack, and without assistance from externally-provided, maliciously-crafted input tokens. In this paper, we show that a misaligned model can perform inference engine fingerprinting to determine the specific engine (e.g., vLLM, SGLang) which executes the model. Once the engine has been fingerprinted, the model can leverage engine-specific exploits to take control of the engine using only carefully-selected output tokens. We provide concrete examples of model fingerprints in five popular engines, and demonstrate how realistic agentic harnesses allow a model to leverage those fingerprints to identify the local engine. We also describe a proof-of-concept, to-the-bare-metal exploit chain that originates from a fingerprinted (and subsequently compromised) inference engine. We conclude by discussing several ways that inference engines could be changed to make fingerprinting attacks more difficult.

Momentum

Related topics

Latest papers 24