awesome-agent-skills-security README

The project's README from github.com/LLMSecurity/awesome-agent-skills-security. As one markdown file: README.md.

Awesome Agent Skills Security

🛡️ A curated list of resources on securing AI agent tool use and skill ecosystems — attacks, defenses, frameworks, benchmarks, and standards.

AI agents increasingly use external tools, plugins, and skills to interact with the world. This creates a new attack surface: agent skills security. This list covers the threats, defenses, and research landscape for securing these capabilities.

Threat Frameworks & Standards
Surveys & Systematizations
Attack Research
Defense Research
Benchmarks & Datasets
Tools & Frameworks
Agent Skill Specifications
Industry Reports & Blog Posts
Related Awesome Lists
Contributing

Threat Frameworks & Standards

OWASP Agentic AI Threats and Mitigations — First in a series from the OWASP Agentic Security Initiative (ASI), providing threat-model-based reference for agentic threats.
OWASP Top 10 for LLM Applications — Includes LLM01: Prompt Injection, LLM06: Excessive Agency, LLM07: Insecure Plugin Design, LLM08: Excessive Autonomy.
OWASP Agentic Skills Top 10 (AST10) — OWASP incubator project, v1.0 (2026 edition). First standards-body enumeration of risks specific to agent skills rather than agents in general, running from AST01 Malicious Skills to AST10 Cross-Platform Reuse, with AST01 and AST02 (Supply Chain Compromise) rated critical; scopes to the skill layer where the OWASP Agentic AI Threats entry above covers agents broadly.
MITRE ATLAS™ — Adversarial Threat Landscape for AI Systems. Tactics, techniques, and case studies for attacks on ML/AI systems.
NIST AI Risk Management Framework — Federal framework for managing AI risks, including autonomous agent risks.
NIST SP 800-218A: Secure Software Development for AI — Secure development practices specific to AI-enabled systems.
EU AI Act — European regulation with specific provisions for high-risk AI systems including autonomous agents.
Anthropic Responsible Scaling Policy — AI Safety Levels (ASL) framework addressing agent capability thresholds.
IETF draft-klrc-aiagent-auth-01: AI Agent Authentication and Authorization — Kasselman et al., IETF WIMSE-adjacent, 2026. Proposes a model for authentication and authorization of AI agent interactions using existing OAuth 2.0 and WIMSE standards; covers delegation chains, agent identity, and trust establishment without defining new protocols.
IETF draft-niyikiza-oauth-attenuating-agent-tokens-00: Attenuating Authorization Tokens for Agentic Delegation Chains — Niyikiza (Tenuo), OAuth WG, March 2026. Defines Attenuating Authorization Tokens (AATs): JWT-based credentials encoding tool-level argument constraints with a cryptographically enforced monotonic attenuation invariant — any holder can derive a more restrictive token but never a more permissive one. Extends Rich Authorization Requests (RFC 9396) with delegation-chain semantics.
📄 Certifying Ghosts: How Cybersecurity AI Agents Break the EU Cyber Resilience Act — Mayoral-Vilches, 2026. Argues autonomous vulnerability-discovery-and-exploitation agents invalidate the EU Cyber Resilience Act's core assumptions of slow, human-paced disclosure and fixed product security states, contending that because attackers and defenders now wield identical AI capabilities, meaningful compliance requires continuous agent-operated monitoring rather than static certification.

Surveys & Systematizations

📄 Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challenges — Baek et al., 2026. Structured review of 66 studies (2022–2026) introducing a cross-dimensional representation T={S,B,P,A} linking affected surfaces, trust boundaries, violated security properties, and empirically examined architectures; analyzes 22 red-teaming studies and 11 benchmarks to characterize evaluation maturity and derive 13 open research questions.
📄 Trustworthy Agentic AI: Failure Modes, Mitigation Strategies, and a Lifecycle Framework for Autonomous LLM Systems — Syed et al., 2026. Reviews agentic-AI trustworthiness across five dimensions and organizes failure modes (indirect prompt injection, backdoor triggers, goal misgeneralization, memory contamination, cross-session leakage) into a unified taxonomy, then proposes the six-phase Trustworthy Agent Development Lifecycle (TADL) with per-phase trust activities and risk-based decision gates.
📄 Attack Success Rate Is Not a Number: On Measurement Validity in Agentic AI Security Evaluation — Pathade et al., 2026. Argues that attack success rate, the headline metric across agentic-security papers, is really a family of metrics parameterized by six seldom-specified design choices; a full-text meta-analysis of 259 agentic-security arXiv papers (Feb 2025–Sep 2026) finds most report neither variance estimates nor repeated runs, undermining cross-paper comparability of attack and defense claims.
📄 A Survey on LLM-based Autonomous Agents: Common Attacks and Defenses — Wu et al., 2024. Comprehensive taxonomy of attacks on LLM agents across perception, cognition, and action stages.
📄 Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents — Zhang et al., 2024. Formalization of 10 attack scenarios, 10 agents, 398 adversarial environments.
📄 Security of AI Agents — He et al., 2024. Systematization of knowledge covering threat models for AI agents with tool access.
📄 Not All Agents Are Created Equal: A Survey on Software-use Agent Security — Hua et al., 2025. Survey specifically on software-use agents and their unique security challenges.
📄 A Survey on the Honesty of Large Language Models — Xie et al., 2024. Covers agent deception, sycophancy, and honesty in tool-use contexts.
📄 A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models — Xu et al., 2024. Systematic study of jailbreak attacks relevant to agent guardrail bypass.
📄 Prompt Injection Attacks and Defenses in LLM-Integrated Applications — Liu et al., 2024. Comprehensive taxonomy of injection attacks across direct and indirect vectors.
📄 The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies — Gan et al., 2024. Survey with practical case studies of security failures.
📄 Self-Evolving Agents: A Survey — Gao et al., 2025. How self-evolving agents create emergent security risks.
📄 Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies — Lin et al., 2026. Uses a Module-Lifecycle Attack Surface matrix to show self-evolution transforms attack persistence from session-bounded to permanent — adversarial effects become encoded across generations, self-amplify, and propagate through agent populations without sustained attacker access, with 17 of 25 attack vectors rated critical.
📄 From Thinker to Society: Security in Hierarchical Autonomy Evolution of AI Agents — Zhang et al., 2026. Hierarchical Autonomy Evolution (HAE) framework organizing agent security into cognitive, execution, and societal tiers.
📄 Characterizing Faults in Agentic AI: A Taxonomy of Types, Symptoms, and Root Causes — Shah et al., 2026. Empirical taxonomy of reliability failures in agentic AI systems combining LLM reasoning with tool invocation.
📄 Security Considerations for Multi-agent Systems — 2026. Systematic threat landscape of MAS with 193 threat items across 9 categories; evaluates 16 frameworks finding none achieves majority coverage.
📄 The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey — Kim et al., USENIX Security 2026. First systematic survey of AI agent security covering design space, attack landscape, and defense mechanisms with case studies on securing agentic systems.
📄 Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats — Deng et al., 2026. Five-layer lifecycle-oriented security framework analyzing compound threats across initialization, input, inference, decision, and execution stages of autonomous LLM agents.
📄 OpenClaw as Language Infrastructure: A Case-Centered Survey of a Public Agent Ecosystem in the Wild — He et al., Preprints 2026. Case-centered survey of the OpenClaw public-agent ecosystem whose Security dimension synthesizes governance, skill-supply-chain (ClawHub), and deployment risks of an open skill ecosystem alongside Platform, Societies, and Deployment.
📄 AgenticCyOps: Securing Multi-Agentic AI Integration in Enterprise Cyber Operations — Mitra et al., 2026. Holistic architectural security framework decomposing attack surfaces across component, coordination, and ecosystem layers of enterprise multi-agent systems.
📄 MCP-in-SoS: Risk Assessment Framework for Open-Source MCP Servers — Kumar et al., 2026. System-of-systems risk assessment framework for evaluating security risks of open-source MCP server deployments in production agent systems.
📄 SoK: The Attack Surface of Agentic AI — Tools, and Autonomy — Dehghantanha & Homayoun, 2026. Systematization mapping trust boundaries and security risks of agentic LLM systems; proposes taxonomy spanning prompt injection, RAG poisoning, tool exploits, and multi-agent threats with metrics like Unsafe Action Rate and Privilege Escalation Distance.
📄 Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation — Ling et al., 2026. Systems-oriented synthesis of 247 papers organizing LLM agent security around information flow, delegated authority, and persistent state, identifying prompt injection and tool-mediated hijacking as dominant threats while flagging emerging state-corruption and multi-agent propagation risks.
📄 Data Agents Under Attack: Vulnerabilities in LLM-Driven Analytical Systems — Wang et al., 2026. Systematic security study of LLM data agents identifying eight risks across interpretation, execution, and policy layers plus an attack taxonomy of fourteen techniques, demonstrating substantial gaps across six open-source and production analytics platforms.
📄 Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents — Lahjouji & Colaco, 2026. Organizes privacy research in LLM agents around data sources rather than attack types — spanning database queries, external APIs, and inter-agent communication — and identifies governance gaps including the need for information-flow control and benchmarks covering an agent's complete data ecosystem.
📄 Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations — Jamshidi et al., 2026. Empirical security analysis of a self-hosted multi-agent LLM system where model outputs trigger privileged operations, measuring compromise probability, boundary failures, and privilege drift as attacker capability and agent count scale.
📄 LLM Agents Security Duality: A Comprehensive Survey of Self-Security and Empowered Cybersecurity — Xu et al., 2026. 73-page survey mapping the dual role of LLM agents in security — cataloguing agent-facing vulnerabilities and mitigations while examining how the same agents empower offensive and defensive cybersecurity, and highlighting the tension between self-protection and capability.
📄 Agent Security Meets Regulatory Reality: A Practitioner Systematization of Autonomous-Agent Threats and Controls in Regulated Financial Systems — Mohan & Srinivasa, 2026. Maps agentic threats (prompt injection, agent identity, auditability, tool abuse, data residency) to financial-sector regulatory requirements and documents production agent-to-agent patterns and controls for compliance-bound deployments.
📄 The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities — Rashidi, 2026. Systematizes 39 execution-security papers (2023–2026) on AI coding agents that read repositories, call tools, and run shell commands with limited oversight, exposing fragmentation across isolation, access control, TOCTOU, and MCP threat research along with five critical gaps including the absence of shared benchmarks for evaluating isolation architectures.
📄 Security and Privacy in Agentic AI: Grand Challenges and Future Directions — Jenkins et al., 2026. Horizon-scanning report from thirty international experts across academia, industry, and government identifying the grand challenges and future research directions for the security and privacy of increasingly agentic AI.
📄 Trust but Verify? Uncovering the Security Debt of Autonomous Coding Agents — Sakib et al., 2026. Empirical study of thousands of agent-authored pull requests finding 38.9% contain at least one security smell (misconfigurations, leaked credentials, supply-chain issues), with human collaborators introducing the majority of leaked secrets in agent-assisted workflows.
📄 Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation — Badhe & Tiwari, 2026. Introduces SkillSec-Eval, a lifecycle framework for evaluating security of reusable LLM agent skills with a threat taxonomy spanning repository admission, semantic retrieval, planner selection, execution, and skill evolution — showing risks extend well beyond the runtime execution stage.
📄 The Ethics of Autonomous AI Agents for Offensive Security — Happe et al., FAIEMA 2026. Analyzes how LLM-driven offensive-security agents introduce indeterminacy across their non-deterministic policies, open-ended impact, and a collapsing operator skill floor, arguing this combination industrializes offensive capability, diffuses moral attribution among users, tool-makers, and third parties, and outstrips existing dual-use and AI-ethics frameworks.
📄 The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI — Narayan et al., 2026. Formalizes a threat model for persistence-based attacks on stateful agents — including memory injection (MINJA) and sleeper-agent behaviors that decouple the attack vector from the eventual harmful event — and synthesizes a defense-in-depth landscape spanning trajectory guardrails (AgentDoG), formal temporal verification (Agent-C), immunological memory consensus (A-MemGuard), and hardware-anchored trust via GPU TEEs and zero-trust memory.
📄 Engineering Trustworthy Agentic AI for Critical Systems — Al-Refai et al., 2026. Survey treating trustworthiness as a first-class engineering property for agentic systems in constraint-bound domains, organizing threats, trust mechanisms, and quantitative metrics across five dimensions (safety, robustness, transparency, accountability, and privacy/security) and mapping them onto an assurance workflow examined across power systems, autonomous vehicles/robotics, HPC, and communication networks.
📄 Agent Security Needs Redefinition through a Holistic Framework — Siu et al., ICML 2026. Position paper arguing agent security is fundamentally contextual rather than content-based — the same action (e.g., "delete user data") can be a routine request or an injection depending on authorization context — and operationalizes it through four jointly-held, trajectory-continuous properties (Source Authorization, Task Alignment, Action Alignment, Data Isolation), under which indirect prompt injection becomes a Source Authorization violation and snapshot benchmarks are shown structurally incapable of evaluating Data Isolation.
📄 An Empirical Study of Model Context Protocol Applications — Majeed et al., 2026. Large-scale study of 1,723 MCP client applications mined from GitHub finding that while most configure servers via files (85.2%) and use an official SDK (81.1%), human oversight diverges sharply — only 37.2% gate tool execution behind a blocking approval step, leaving the LLM able to invoke any enabled tool unconditionally in most apps.
📄 Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation — Liu et al., 2026. Survey tracing threats across the world-model lifecycle of embodied AI agents — from data construction and representation learning through state grounding, imagination, trajectory evaluation, execution, and tool/memory-based adaptation — showing how poisoning, backdoors, prompt injection, sensor spoofing, trajectory manipulation, and supply-chain attacks take on distinct meanings when they corrupt world states, and structuring defenses across provenance, robust grounding, uncertainty-aware prediction, trajectory gating, feedback auditing, and deployment assurance.
📄 From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems — Malla & Siby, 2026. Proposes a taxonomy of attack vectors specific to web-based multi-agent systems (MAS) and releases the WebMASLab test-bed to isolate architecture's effect on security by holding task, tool surface, and browser substrate fixed; introduces a MAS-specific Telephone Loop attack that exploits cross-agent delegation to create cyclical task loops — inert against single-agent setups yet compromising MAS at ~80% baseline across three of four frontier models — and shows obvious defenses like prompt-hardening fail to generalize.
📄 The Vulnerability With No CVE: Managing Persistent Gaps Between Mandate and Authority in AI Coding Agents — 2026. Proposes the agentic posture vulnerability (APV) as a task-conditioned vulnerability-management abstraction — a durable record for a composed agent-control exposure that outlives any single event and stays open until authority is narrowed, a missing control is added, risk is accepted, or closure is verified — operationalizing existing excessive-agency, authorization, and control-composition weaknesses into six recurring patterns, a vulnerability lifecycle, and a control-and-closure matrix.
📄 On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models — Hossain et al., 2026. PRISMA 2020 systematic review of 85 agentic-LLM security papers (2023–2025) finding attack research outpaces defense 3.9:1; contributes a four-layer taxonomy (perception, brain, action, interaction) of 13 vulnerability types and shows perception-layer flaws (prompt injection, jailbreaking) dominate the literature while action-layer risks (tool misuse, code injection, sandbox escape) remain understudied relative to real-world impact.
📄 When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling — Karanjai et al., 2026. Attack-surface survey of AI agents operating on blockchain networks through MCP, skills, and tool calling, arguing that blockchain properties like irreversibility and continuous autonomy qualitatively change the agent threat model relative to conventional software and mapping the resulting vulnerabilities across the tool-calling stack.
📄 A2ABreak: Systematic Security Analysis of the A2A Protocol — Lotfi et al., 2026. First rigorous systematic security analysis of the Linux-Foundation-governed Agent2Agent (A2A) protocol — the emerging inter-agent communication layer complementing MCP — using LLM-assisted extraction of a verified finite-state machine (37 states, 76 transitions from 929 formalized statements) directly from the natural-language specification, then reasoning over the model to discover protocol-level vulnerabilities in cross-organizational agent discovery, authentication, and task delegation.
📄 When Passing Tests Hides Vulnerabilities: An Empirical Study of Silent Failures in Agentic Systems — Bai et al., 2026. Empirical study of LLM-based agentic code-repair patches that pass syntactic and functional verification yet still retain or introduce security vulnerabilities; across 1,030 execution traces from seven agent frameworks on SecurityEval and CVEfixes, identifies 170 confirmed "silent failures" and categorizes them (omission, incomplete fix, and newly introduced flaws), showing test-passing is an unsafe proxy for security in agent-authored code.
📄 Trustworthy Agentic AI: A Comprehensive Cybersecurity and Systems Survey on Threat Landscapes, Defense Architectures, and Open Challenges — Mostafavi, 2026. Synthesizes 206 studies and standards into a systems-security reference framework, formalizing the agent as a stateful 5-tuple and a 6-dimensional trustworthiness taxonomy, then analyzing threat surfaces across intra-execution loops and interaction planes and proposing a multi-layered zero-trust defense-in-depth architecture (Dual-LLM isolation, capability-based access control, kernel eBPF probes, sandboxed runtimes) mapped to international governance frameworks.
📄 Authorization Architectures for Tool-Using AI Agents — Surapani et al., 2026. Structured narrative review of 89 primary sources introducing a principal hierarchy (human user, operator/deployer, orchestrator, sub-agent, tool endpoint) and five interdependent layers — agent identity and credential lifecycle, delegation and scope propagation across multi-hop chains, runtime enforcement and just-in-time authorization at policy enforcement points, prompt injection as authorization bypass, and auditability/provenance/non-repudiation — deriving seven structural requirements and a four-layer reference architecture, with runtime enforcement and aggregation bounds as the principal open gaps.
📄 SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration — Mia et al., 2026. Systematization reframing jailbreak security around the full agentic execution pipeline (user interaction, planning, memory, tool use, inter-agent communication) with unified attack/defense taxonomies and a security–utility–efficiency framework, finding that strong native alignment does not imply adversarial robustness and that low final-response attack success can mask severe intermediate compromise of planning, memory, and tool interactions.
📄 After the Party: Governing What a Viral Agent-Skill Ecosystem Left Behind — Xiong & Zhang, APSEC 2026. Measures the aftermath of the 2026 OpenClaw skill-registry boom using Git history, GitHub issues/PRs, and three ClawHub snapshots, finding attention concentrated (top 10% of skills drew 46.93% of downloads), scrutiny absent (77.86% have zero stars/comments while 85.06% of readable skills carry privilege evidence), and automated cleanup unready — three security scanners disagreed on 23,702 of 61,990 shared skills, with weighted sensitivity of only 21.67–61.06% after human adjudication.
📄 SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes — Wang & Saxena, 2026. Argues agentic-AI security studies are too domain-agnostic for high-stakes settings and presents FARSIGHT, a scheme-level framework evaluating financial LLM trading agents on robustness under market turbulence and security against attacks on information sources, attacks on agents, and agent-as-attacker behaviors; across 15 academic schemes, 80% fail at least one core robustness metric and 100% exhibit security vulnerabilities, with a single compromised agent able to trigger a market-wide crash at minimal cost.
📄 Characterizing Network Centralization and Observability in the Remote MCP Ecosystem — Sohail, NIPA 2026. Empirically characterizes the public remote MCP server ecosystem with a three-tier observability framework (catalog metadata, passive compliance, live vulnerability analysis) over 179 endpoints, finding heavy infrastructural consolidation (ASN Herfindahl-Hirschman Index 0.736) and a Security-Observability Tradeoff — platform-level OAuth 2.1/PKCE that secures 95% of commercial PaaS-hosted servers simultaneously blocks automated tool-poisoning vulnerability scanning without prior credential provisioning.
📄 PentestChain: A Cost-Aware, MCP-Orchestrated Framework for Automated Penetration Testing with Free-Tier LLMs — Patel et al., 2026. Automated pentest framework exposing its pipeline through an eleven-tool MCP server, and — beyond cost-aware model cascading — analyzes the attack surface an MCP-exposed offensive engine introduces, grounding a four-position threat model in the 2025 MCP incident record (CVE-2025-6514 RCE in mcp-remote, the postmark-mcp supply-chain backdoor, and the tool-poisoning/rug-pull/line-jumping class) and contributing four mitigations.
📄 Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives — Rahul Dev & Nath, 2026. Systematizes the trust boundaries and attack surfaces of representative autonomous pentesting-agent architectures, arguing that persistent memory, real-world action, and long-horizon reasoning raise qualitatively different concerns than chat-based LLMs; contributes a lifecycle-aligned threat taxonomy (LLM-lifecycle, agent-architecture, and cross-cutting behavioural attacks) and shows why conversational-AI guardrails fall short for offensive agents, motivating context- and architecture-aware guardrail research.

Attack Research

Prompt Injection via Tools

📄 Climbing the Hill: Prompt Injection Red-Teaming Against Frontier Models with Curriculum Reinforcement Learning — Yin et al., 2026. Addresses the cold-start problem in RL-based prompt-injection red-teaming (every attempt against a frontier model fails, yielding zero reward) by training the attacker LLM against a curriculum of increasingly robust targets, each warm-started from the last; reaches ASR@10 of 93.8% and 45.0% against two frontier models where prior RL methods score 0%, and the trained attacker transfers to six other frontier models it never attacked. Code.
📄 Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — Greshake et al., AISec 2023. Foundational work on indirect prompt injection through tool outputs.
📄 Inject My PDF: Prompt Injection for Your Resume — Practical injection through document processing tools.
📄 InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents — Zhan et al., ACL 2024. 1,054 test cases, 17 tools, two attack types (direct harm, data stealing).
📄 Automatic and Universal Prompt Injection Attacks against Large Language Models — Liu et al., 2024. Automated generation of injection attacks.
📄 WIPI: A New Web Threat for LLM-Driven AI Agents — Liu et al., 2024. Web-based indirect prompt injection targeting browsing agents.
📄 GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines — Isbarov et al., 2026. Evaluates prompt injection in live GitHub workflows by provisioning ephemeral repositories and triggering real workflow runs, documenting eleven attacks across four AI providers that compromise credential handling and repository permissions.
📄 Prompt Injection as Role Confusion — Ye, Cui & Hadfield-Menell, ICML 2026. Shows prompt injection succeeds because LLMs infer privilege from unreliable stylistic cues rather than structural role tags; "destyling" untrusted text to look less like internal formats drops attack success from 61% to 10%, framing injection defense as perpetual whack-a-mole absent genuine role perception.
📄 On the Inseparability of Instructions and Data in Shared-Embedding Sequence Models — Pant et al., 2026. Proves perfect prompt-injection prevention is mathematically impossible in shared-embedding architectures lacking enforced control-data separation, formalizing tool authorization, refusal, and memory writes as control-authoritative actions and arguing injection requires architectural instruction/data channel separation rather than better in-pipeline classification or alignment.
📄 They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface — Sidot, 2026. Shows LLM-driven CI/CD pipelines can be subverted by pairing authority framing with obfuscated ("laundered") malicious code, so downstream agents dutifully verify yet still approve secret-exfiltration steps despite verification gates being in place.
📄 Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents — Liu et al., 2026. Hides malicious audio instructions that imperceptibly "piggyback" onto user speech to hijack continuous-audio multimodal agents (69.1% attack success against Gemini 3 Pro), introducing the AudioAgentSecurity benchmark (8 scenarios, 10 attack patterns) and a Cascaded Audio Decoupling and Verification (CADV) defense that reaches over 90% detection via acoustic source separation and cross-modal consistency. Code.
📄 The Anatomy of a Prompt Injection: A Component Model for Structured Analysis — McHugh, 2026. Formalizes prompt-injection artifacts into a seven-component model (carrier, delivery vector, concealment, context-break, privilege escalation, payload, and return channel) that labels attacker intent — tool targets, sinks, and effects — rather than surface wording, letting defenders, red teamers, and CTI teams compare and mutate attacks without fragile string matching.
📄 From Prompt Injection to Web Exploitation: Revisiting Classic Vulnerabilities in LLM-Integrated Applications — Tsigkopoulos & Ntantogian, 2026. Introduces LLM-mediated web attacks, where attacker-controlled input transformed by a tool-calling or agentic LLM reaches traditional web-application sinks with the model acting as a confused deputy — systematized as LLM2X variants (LLM2SQLi, LLM2XSS, LLM2SSTI, LLM2CommandInjection, LLM2IDOR, LLM2SSRF, and more) and demonstrated via the TicketOracle Flask case study across seven LLMs.
📄 Control-Token Injection Suppresses Chain-of-Thought and Defeats Reasoning-Based Oversight in Tool-Using Agents — Usama et al., 2026. Shows agent safety is a joint property of the model and its decoding harness: appending a single string of the model's own channel-control tokens makes the tokenizer render an already-complete reasoning turn, so the model emits zero chain-of-thought (52.5→0 tokens) yet still fires the tool call every trial, converting 39.6% of refusals into completed exfiltrations and blinding reasoning-based monitors; separately shows whether an identical tool call fires is decided by the harness parser, not the model. Code
📄 Decision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions — Wu & Lim, 2026. Examines prompt injection against schema-defined (non-generative) decision models using 510 reconstructed InjecAgent cases, finding that malicious content shifts action probabilities but rarely selects the attacker's target on its own; adaptive score-feedback attacks double the mean highest attacker-target probability and raise fresh-validation success from 1.8% to 3.5%, showing typed outputs change but do not eliminate injection risk within the allowed action set.

Tool Poisoning & Supply Chain

📄 ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP — Liu et al., 2026. Distributes a malicious MCP instruction across multiple tool descriptions using Shamir's secret sharing, so each fragment individually passes inspection and the harmful instruction is reconstructed only once enough shares are aggregated during agent interaction — evading per-tool poisoning scanners.
📄 PhantomSkill: Malicious Code Injection in Agent Skill Ecosystems — Lin & Yu, 2026. Attack framework whose VulMask technique disguises malicious code as ordinary insecure implementations inside skill auxiliary resources, activating harmful behavior only under attacker-controlled conditions to evade skill-scanning defenses.
📄 Dynamic Malicious Skills in Agentic AI — Chen et al., 2026. Shows that malicious instructions embedded in skill documentation (e.g., SKILL.md) can induce an agent to dynamically inject harmful logic into an otherwise benign skill at execution time, demonstrated across OpenHands and Claude Code.
📄 Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents — Liu et al., 2026. Text-only, runtime-independent attack in which a malicious third-party skill uses shared semantic cover to win selection and then fabricate plausible dependencies during planning, recruiting unnecessary benign skills into a bounded detour that preserves task completion while inflating token consumption and execution time (66.9% and 92.5% on DeepSeek-V4-Pro) — showing correct outcomes do not guarantee trajectory integrity or cost safety.
📄 Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners — Jia et al., 2026. SkillCamo hides harmful operational instructions inside images bundled with a skill, bypassing scanners that rely only on text descriptions, manifests, and source code while remaining recoverable by multimodal agents at deployment.
📄 "Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild — Liu et al., USENIX Security 2026. Large-scale analysis of 98,380 skills across two major registries identifies 157 confirmed-malicious skills (632 vulnerabilities, 13 attack techniques), characterizing two archetypes — credential-exfiltrating data thieves and decision-subverting agent hijackers — and showing that shadow features absent from public documentation mark all advanced attacks.
📄 Harmless Yet Harmful: Neutral Prompting Attacks for Stealthy Hallucination Steering in Agent Skills — Hsu et al., 2026. Introduces neutral prompting attacks that covertly increase package hallucinations in coding agents, creating downstream software supply chain risk while evading existing skill-focused defenses.
📄 Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search — Shen et al., 2026. Tree-structured Injection for Payloads (TIP): black-box attack generating natural-language payloads to seize control of MCP-enabled agents; achieves >95% attack success in undefended settings and >50% against four defense approaches with an order of magnitude fewer queries than prior adaptive attacks.
📄 Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning — Huang et al., 2026. STRIDE/DREAD threat modeling of MCP across five components; systematic comparison of tool poisoning defenses in seven major MCP clients reveals insufficient static validation; proposes multi-layered defense strategy.
📄 Are AI-assisted Development Tools Immune to Prompt Injection? — Huang et al., 2026. First empirical analysis of prompt injection via tool-poisoning across seven MCP clients (Claude Desktop, Claude Code, Cursor, Cline, Continue, Gemini CLI, Langflow); reveals significant security disparities with Cursor most susceptible.
📄 Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks — Schmotz et al., 2026. Benchmark measuring agent vulnerability to malicious skill/config files; demonstrates data exfiltration, destructive actions, and ransomware-like behavior via AGENTS.md/CLAUDE.md injection.
📄 ToolSword: Unveiling Safety Issues of LLMs in Tool Learning Across Three Stages — Ye et al., ACL 2024. Identifies safety issues across tool selection, tool calling, and result handling.
📄 Compromising Agents via MCP — Invariant Labs, 2025. Tool poisoning attacks via Model Context Protocol servers.
📄 Osmosis Distillation: Model Hijacking with the Fewest Samples — Shi et al., 2026. Supply-chain attack via poisoned synthetic training data.
📄 Personality Self-Replicators — 2026. Agent personality files as self-replicating genetic material.
📄 Poisoned Playbooks: Demystifying Knowledge Poisoning Effects on AI Security Agents — Park et al., 2026. Studies how malicious write-ups injected into security knowledge sources compromise RAG-based, action-taking security agents, introducing a "Verification Boundary" framework that classifies how agents evaluate retrieved claims and showing verification prompting and multi-source retrieval falter under sparse-evidence and zero-day conditions.
📄 Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains — Jia et al., 2026. Treats agent skills as dependency-bearing artifacts and empirically maps the skill supply chain, surfacing security-relevant signals hidden in inter-skill dependencies and governance gaps that let malicious or vulnerable skills propagate risk transitively.
📄 KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems — Choi et al., 2026. Sequential document-poisoning attack that plants strategically crafted retrievable documents to progressively redirect an agentic RAG system's multi-step reasoning chain, requiring no system access.
📄 Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol — Rashidi, 2026. Shows invisible Unicode TAG-block characters can smuggle malicious payloads into MCP tool descriptions that reach the model while staying hidden from human reviewers during approval, measuring the resulting approval-view fidelity gap across three independent server implementations.
📄 Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting — Spira et al., 2026. Adversarial hallucination squatting preemptively registers the resource names (popular repositories, skills) that LLMs predictably hallucinate, so agents pull attacker-hosted prompts at scale — reaching up to 100% hallucination rates in skill installation and enabling remote code execution and botnet establishment under weak, channel-free threat models.
📄 Skills That Don't Exist: A Large-Scale Study of Hallucinated Skill Recommendation in LLM Agents — Yuan et al., 2026. Measures skill-name hallucination across 15,000 prompts, finding LLM agents invent non-existent skill names at ~36% rates and opening an exploitable supply-chain vector where attackers pre-register malicious packages under the fabricated names before victims unknowingly install them.
📄 Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware — Ji et al., 2026. Introduces SkillCloak, which defeats static agent-skill malware scanners through evasion, alongside SkillDetonate, a runtime detector that catches malicious skill behavior via execution monitoring rather than code inspection.
📄 Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions Against AI Coding Agents — Bagmar & Saraf, 2026. First systematic evaluation of package-install-time supply-chain attacks delivered through ordinary project-setup documentation (README, requirements, Makefile): editing docs alone redirects coding agents to untrusted registries, vulnerable versions, or plausible wrong names, showing install-time security rests on the harness-model pairing — source-based attacks like registry redirection are missed almost everywhere absent a deterministic pre-install name/source/version check.
📄 When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems — Chen et al., 2026. PoisonedEvolution, a trajectory-poisoning attack on self-evolving skill (SES) systems where untrusted agent experience is distilled into trusted skills; a skill-visible black-box attacker contributing only 10% support embeds target behaviors in 91% of trials (546/600) across six LLM evolvers by satisfying inclusion, evolution attribution, and realization — with attribution the distinctive bottleneck.
📄 Towards a Risk Assessment of Malicious Skill Files in Coding Agents — Yang et al., 2026. Adversarial skill-synthesis method using six LLMs to transform 471 real-world shell commands into benign-appearing skill files, released as a 2,826-skill benchmark mapped to 11 MITRE ATT&CK tactics, alongside a reproducible three-judge evaluation pipeline (run stratification, evidence anchoring, refusal veto, declared-intent override) for assessing malicious-skill risk in coding agents.
📄 SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains — Zhang et al., 2026. Self-synthesized attack paradigm that uses persistence-aware directed fine-tuning to induce computer-use agents to create poisoned-yet-benign-looking artifacts (skills, memory entries), embedding malicious influence in structural redundancies so dormant payloads survive internal state updates, bypass vetting, and reactivate as trusted context in future workflows without any new external input; evaluated on OpenClaw, Codex, and Claude Code with the CUAChain dataset.
📄 ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners — Zeng et al., 2026. Collusive multi-skill-chain attack that decomposes a malicious intent into interdependent sub-payloads embedded across independently packaged, locally plausible skills — no single skill is malicious, yet their ordered composition via contextual dependencies, artifact passing, and execution handoffs forms a harmful workflow that evades per-skill scanners.
📄 CompoSkill: Compositional Skill Chain Attacks from Individually Scanner-Passing LLM Agent Skills — Liu et al., 2026. Shows skill-composition risk is a path-level rather than node-level property: skills that each pass a per-skill scanner can still form a risky composition once an agent chains their outputs, capabilities, and side effects with those of other passing skills — explaining why package-by-package scanners achieve limited interception.
📄 Same Name, Different Server: A Security Census of Silent Drift in the Model Context Protocol Ecosystem — Kraishan, 2026. Census of the full public MCP registry (21,643 servers, 72,606 version records) with source for 14,353 servers scanned across an eight-class threat catalogue; beyond a corrected ~7.6% high-severity prevalence, the central finding is instability — 51.1% of multi-version servers changed advertised behavior between versions, 40.6% silently, and 4.2% redirected their remote endpoint to a different host while keeping registry identity, with silent drift carrying nearly threefold higher odds of a high-severity finding and star counts a poor proxy for safety.
📄 Scanning the Harness: An Empirical Study of Supply-Chain Defects in AI Coding-Agent Configurations — Kapner et al., 2026. Studies the AI coding-agent harness (instruction files, skills, hooks, MCP declarations, subagents) as an unlocked dependency layer across 3,171 public GitHub repositories, validating every finding via independent re-derivation, an LLM adjudicator, and a second re-check; confirms three security classes — 9.8% of setups pin no MCP server version, 3.1% pre-approve arbitrary execution behind scoped-looking grants (e.g. Bash(python:*)), and 3.8% carry a skill that pre-approves the shell for whoever installs it (shipping inside 3.7% of published collections) — with 16.0% of setups carrying a security defect. Tool
📄 SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents — Jia et al., 2026. Closed-loop attack/victim/evaluator framework automating poisoned-skill generation across two coordinated channels — malicious code hidden in helper scripts and front-loaded inducement rewrites of skill documentation — substantially outperforming naive direct injection and prior manual attacks.
📄 Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents — Hao et al., 2026. Places exactly one benign-looking, command-bearing instruction at a structurally feasible body position, reaching 89.3% attack success on codex+gpt-5.2 while triggering new high-risk audit alerts in only 5.6% of variants relative to the clean skill.
📄 Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems — Qu et al., 2026. DDIPE embeds malicious code in skill documentation to compromise coding agents, generating 1,070 adversarial skills across 15 attack categories and achieving 11.6%–33.5% bypass rates across frameworks and models.
📄 SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents — Zheng & Chen, 2026. Two-phase framework that screens for token-amplification conditions then refines them through LLM-guided rewriting, reaching 5.42×–10.15× average best amplification across coding-agent configurations — a resource-exhaustion counterpart to the task-preserving detour of Convergent Detour Hijacking above.
📄 Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents — Zhang et al., 2026. Formalizes "persistent billable state" — content a host runtime carries from a tool return into later billable model inputs — as a first-class security object, showing an admitted malicious tool can convert untrusted data into recurring victim-billed processing (max per-session cumulative input reaching 14,293× the first call) without credentials or local privilege; derives six denial-of-wallet vectors with the DOW-BENCH harness and proposes four host-side pre-reingestion invariants bounding prompt mass, context growth, recursion, and cumulative spend, noting only 71 of 3,830 scanned MCP repositories expose any safeguard proxy.
📄 A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem — Li et al., AACL-IJCNLP 2026. Two-stage black-box framework hijacking MCP agents via a semantic supply-chain vector: an Attraction phase optimizes attacker tool metadata to raise invocation probability, then a Manipulation phase uses execution traces to refine adversarial tool returns; on LiveMCPBench it reaches a 93.6% malicious-tool invocation rate and 74.4% mean attack success across exfiltration, integrity-compromise, and reasoning-derailment scenarios, transferring to four other models without re-optimization. Code
🔗 MCP Security Notification: Tool Poisoning Attacks — Official MCP security advisory on tool description poisoning.
🔗 Invariant Labs: MCP Security Research — Analysis of cross-tool contamination, rug pulls, and tool shadowing via MCP.

Privilege Escalation & Excessive Agency

📄 When Consent Outlives Context: Residual Authority Replay in Long-Lived Agents — Zhang et al., 2026. Shows that runtime approvals granted for a specific task and context can outlive that context in long-lived agents, creating residual authority reusable without renewed consent; a longitudinal attack induces benign interactions that legitimately obtain the authority needed for a target action, then replays it during adversarial execution — raising attack success by up to 35.1 points across 508 AgentDojo cases and 24.9 points on average in live context-rebinding attacks against three production coding agents.
📄 Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents — Yang et al., NeurIPS 2024. Backdoor attacks on agent reasoning and tool calling.
📄 Pandora's White-Box: Precise Training Data Detection and Extraction in Large Language Models — Relevant to agents leaking training data through tool outputs.
📄 R-Judge: Benchmarking Safety Risk Awareness for LLM Agents — Yuan et al., ACL 2024. 162 records across 27 risk scenarios for evaluating agent safety awareness.
📄 TrustAgent: Towards Safe and Trustworthy LLM-based Agents — Zhang et al., 2024. Agent-constitution-based approach to limiting excessive agency.
📄 FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion — Rao et al., 2026. Splits prohibited content across interactions, stores it in long-term agent memory in benign-appearing form, then reconstructs it via retrieval — evading access-control checks without the disallowed request ever appearing explicitly in the user query.
📄 Post-Training Local LLM Agents for Linux Privilege Escalation with Verifiable Rewards — Normann et al., 2026. Two-stage post-training pipeline (SFT + RL with verifiable rewards) producing a 4B model that achieves 95.8% success on privilege escalation, nearly matching Claude Opus 4.6 at 100× lower inference cost.
📄 Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing — Li, 2026. Defines the "hijacked authorized agent" problem in HPC — where adversarial instructions in a log, tool description, or peer-agent message redirect an agent beyond its assigned task even though every resulting command is authenticated and permitted for the user's account — maps scheduler, shared-storage, and multi-project attack surfaces where identity controls fall short, and outlines the planned TaskBound empirical benchmark.
📄 When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agents — Yang et al., 2026. Shows LLM agents routinely choose tools carrying more privilege than a task requires, and proposes a privilege-aware post-training method that steers agents toward sufficient lower-privilege alternatives to shrink the excessive-agency attack surface.
📄 (A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents — Zhang et al., 2026. Identifies two attack surfaces in VLM-based mobile agents — a perception gap between human and machine vision, and interception of the agent's execution pipeline — letting malicious apps hijack agent actions and achieve arbitrary command execution without any granted permissions.
📄 "Allow" to Achieve, Over-Privileged Inadvertently: The Unintended Cost of Task-Completion-Driven Pop-up Decisions in Mobile GUI Agents — Chen et al., 2026. Studies "permission literacy" by injecting Android-style permission popups into real GUI tasks, revealing that mobile GUI agents grant unnecessary permissions under strong task-conditioned biases — changing only the requesting app (Calendar→PiMusic) under the same task collapses grants from 26/32 to 0/32 (App-Trust Bias), while changing task context around a fixed popup flips authorization decisions (Task-Prior Override) — and argues for separating task execution from permission authorization.
📄 The Missing Boundary: How Autonomous Agents Lose Control — Ying et al., 2026. Isolates loss of authorized-execution control during otherwise-legitimate tasks by independently manipulating goal pressure, control degradation, and executable unsafe opportunity, showing a degraded control boundary becomes consequential precisely when the environment exposes a boundary-crossing executable action — even when the underlying task stays legitimate and a sanctioned path remains available — reframing excessive-agency failures as an interaction between control state and environment affordance rather than purely adversarial input.
📄 Loopjacking: Hijacking Human-in-the-Loop Approval — Arun Kumar, 2026. Names Loopjacking, where a human approves operation A but the implementation binds that decision to a materially different operation B — via representation-based attacks (B misrepresented at approval time) or post-approval state-substitution (mutable workflow state replaces the reviewed A with B); reproduces post-approval substitution in seven Agno AgentOS releases (≤3.0.9) and twelve LangGraph Agent Server versions (≤0.14.0) and representation mismatch in OpenClaw 2026.2.23 (rejected in 2026.2.24), showing complete canonical approval rendering with exact use-time comparison, or preventing unauthorized pending-state mutation, blocks the tested attacks while preserving legitimate execution.

Data Exfiltration & Privacy

📄 API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary — Kenney et al., 2026. Formalizes the credential-exposure threat chain for agentic systems — where a key pasted into a prompt, system prompt, or tool config crosses from an authentication boundary into a data pipeline that persists it in history, logs, memory, and generated code — and evaluates a vault-mediated execution architecture (Corvic Security Vault) in which the model selects a connector identifier while a trusted request boundary supplies authentication; across 16 black-box probes the credential stayed absent from environment, request headers, filesystem, and third-party echo services, though the authors stress vault mediation is necessary but not sufficient.
📄 AgentSCOPE: Evaluating Contextual Privacy Across Agentic Workflows — Ngong et al., 2026. 80%+ of agentic pipelines leak private data at intermediate stages.
📄 Silent Egress: LLM-Driven Data Exfiltration via Steganographic Channels — Demonstrates covert channels for data theft through agent outputs.
📄 Privacy Risks of General-Purpose AI Systems: A Foundation for Investigating Practitioner Perspectives — GPAIS privacy risks including agent data handling.
📄 IMMACULATE: A Framework for Analyzing Information Exposure in Agent-Based Systems — Multi-turn agent information leakage analysis.
📄 AgentRaft: Automated Detection of Data Over-Exposure in LLM Agents — Lin et al., 2026. Automated detection framework for identifying data over-exposure vulnerabilities in LLM agent integrations.
📄 You Told Me to Do It: Measuring Instructional Text-induced Private Data Leakage in LLM Agents — Kao et al., 2026. Identifies the Trusted Executor Dilemma where high-privilege agents execute adversarial README instructions at up to 85% success rate; 0% human detection rate across 15 participants.
📄 An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios — Baek et al., 2026. Joint Singapore–Korea AI Safety Institute study showing tool-using agents leak sensitive information even under benign, non-adversarial user requests, extending leakage analysis beyond prompt-injection and jailbreak exfiltration.
📄 Differential Privacy in Generative AI Agents: Analysis and Optimal Tradeoffs — Yang & Zhu, 2026. Probabilistic framework for analyzing privacy leakage in AI agents via differential privacy, deriving token-level and message-level bounds relating leakage to temperature and message length.
📄 Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity? — Goel & Gurevych, 2026. Evaluates whether computer-use agents respect contextual integrity when handling personal information across applications, finding most leak sensitive data through visual co-location of sensitive items, oversharing of personal state, and sending content to the wrong recipients.
📄 ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using LLM Agents — Hu et al., 2026. Audits whether task-private information is routed only to authorized tools and downstream sinks across an executed multi-tool trajectory using 2,150 cases with backend audit logs, formalizing a need-to-know disclosure boundary and showing that successful task completion does not imply appropriate privacy disclosure.
📄 What Happens Locally, Leaks Globally: Detecting Privacy Leakage Risks in MCP Servers — Yan et al., 2026. Cross-language static analysis framework that detects protocol-induced credential and PII leakage in multilingual MCP servers, finding leakage in over 10% of analyzed servers.
📄 Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policies — Rani, 2026. Formalizes behavioral privacy leakage in multi-round negotiation agents, where an adversary infers private reservation values from concession trajectories and timing, and proposes an (ε,δ)-differentially-private stochastic negotiation policy that cuts adversarial inference accuracy 43–50% while keeping success and utility above 90%.
📄 PiSAs: Benchmarking Contextual Integrity in Multi-User Agentic Systems — Gupta et al., 2026. Benchmark for cross-user data spillage in shared agentic systems with dual contextual-integrity annotations (task-appropriateness and per-user access), measuring leakage through outputs, inter-agent messages, and shared memory — and finding even state-of-the-art models fail to reliably restrict transmission to authorized users.
📄 Data Leakage Prevention in Agentic Applications via Preemptive Hardening — Shukla et al., 2026. Pre-deployment pipeline that automatically scans agentic applications for data-leakage vulnerabilities and remediates them through preemptive patching and validation before release, shifting leakage defense left rather than relying on runtime interception.
📄 When Agents Learn to Be You: Benchmarking Privacy Leakage, Impersonation Risk, and Defenses in Persona Skills — Xiang et al., 2026. Benchmarks privacy leakage, impersonation risk, and defenses for persona skills that distill personal interaction histories into portable executable artifacts, showing this concentration of fragmented personal signals amplifies exposure through reuse and defeats defenses designed for individual records or retrieval-based memory.
📄 Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills — Hua et al., 2026. Introduces SkillClone, a black-box attack that clones a hidden (closed-source) agent skill purely through legitimate task requests — forming an interface hypothesis from the public advertisement, issuing structured probes, and iteratively repairing an executable replica via differential validation against the victim — showing that file secrecy does not ensure functional secrecy and that disclosure-focused defenses provide limited coverage against cumulative information leakage from ordinary use.
📄 SkillWatermark: An Embedded Skill Watermark of Progressive Privacy Inference via Benign Prompts — Li et al., 2026. Inserts crafted skill-description constraints ("skill watermarks") that induce distinctive execution traffic patterns, letting a passive network attacker establish a covert channel that encodes private information across multiple conversation turns without any overtly malicious payload.
📄 Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control — 2026. Shows that when a personal agent's privacy enforcement is a judgment its own LLM makes over adversary-controllable context, the enforcement mechanism and attack surface coincide — demonstrating three no-injection attacks (Collaborative Workspace Lure, Semantic Obfuscation, Channel Decoupling) that beat prior defenses — and proposes FLOWSEAL, a tool-level interceptor outside the LLM's context that enforces confidentiality via data provenance and an information-flow-control lattice with controlled declassification.
📄 AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealing — 2026. Poses whether a substantially weaker attacker-controlled agent can acquire a stronger proprietary agent's task-solving capabilities through limited black-box interaction, showing that recovering explicit skill artifacts alone does not transfer capability — a weaker agent may hold the same skills yet still fail without the implicit procedural behaviors — and framing capability cloning as a distinct security risk beyond prior skill-stealing attacks.
📄 Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines — Ediga & Chattopadhyay, 2026. Shows the MCP context window exposes the model to attacker-controlled text through multiple unprivileged channels (tool descriptions, tool results, sampling messages), then devises cross-channel fragmentation attacks that split a benign-looking payload across two or three channels so no single channel carries a complete injection; across 12 frontier models, three production clients, and 15,000+ trials, models that fully resist single-channel injection (0% compliance) exfiltrate credentials at up to 100% under two-channel fragmentation, and all seven third-party MCP security tools plus tested prompt defenses fail to catch the fragmented payloads.
📄 CIPL: A Channel-Aware Framework for Recoverable Privacy Leakage in LLM Agents — Huang et al., 2026. Argues per-component privacy evaluation (memory, retrieval, or tool-use in isolation) conflates internal exposure with what an external observer can actually recover, and presents CIPL (Channel Inversion for Privacy Leakage), a black-box channel-aware framework that traces a target through sensitive-source, selection, assembly, execution, observation, and extraction stages; across memory-, retrieval-, and tool-mediated targets plus a BrowserUse live-agent case study, it shows storage labels alone do not determine recoverability — memory targets near-saturate, retrieval leakage is often partial, and tool-mediated/live-agent leakage varies with observation surface, prompt-to-channel alignment, retrieval depth, and provider behavior, while a stratified semantic audit surfaces attacker-useful disclosures that exact matching misses.
📄 Codetta: High-Capacity, Keyless, and Undetectable Multi-Agent Collusion — Pang et al., 2026. Shows that the natural-language channels linking LLM agents in high-stakes multi-agent systems double as a covert side channel: colluding agents can steganographically hide exfiltrated confidential information or unauthorized coordination inside outputs that look ordinary to a human auditor reading the transcript, achieving high-capacity, keyless, and hard-to-detect collusion.

Indirect Prompt Injection

📄 CoDeL: Co-Evolutionary Defense against Indirect Prompt Injection in LLM-based Agents — Yang et al., 2026. Training-based IPI defense that hardens the agent against an attack distribution it reshapes as it trains: a LoRA-based GDPO defender is updated each round under a decoupled reward over safety, task progress, and format compliance, while a co-evolving prober mines injections that still penetrate the current defender, turning its own late-caught failures into a moving curriculum; across three IPI benchmarks it cuts attack success rate by 88.5% and outperforms nine baselines by +38.0%.
📄 CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts — Cheng et al., 2026. Inference-time defense using Tree-sitter parsing and multi-layer analysis to detect and neutralize adversarial instructions hidden in code contexts before they reach the LLM.
📄 Origin Is All You Need: Provenance-Aware Transformers for Structural Trust-Boundary Separation — Zhang et al., 2026. Attacks indirect prompt injection at the architecture level, arguing standard transformers lack any notion of source authority because retrieved documents, user inputs, and system instructions all pass through the same undifferentiated attention; assigns each token a ring ID encoding its origin and augments the model with origin embeddings, a learnable origin attention bias, and a normalization-preserving origin scale to enforce a structural boundary between authoritative and non-authoritative sources during generation, instantiated on pretrained models via a two-stage fine-tuning pipeline and shown to resist IPI in- and out-of-distribution while preserving utility.
📄 Agent Data Injection Attacks are Realistic Threats to AI Agents — Choi et al., 2026. Introduces agent data injection (ADI) attacks — an underexplored indirect-prompt-injection class where malicious data disguised as trusted data drives unintended actions — demonstrated against real-world agents including Claude, Codex, and Gemini CLI.
📄 Invisible Ink Threats: Adversarial Goals Behind Legitimate Tasks in Computer-Use Agents — Zhang et al., 2026. Shows computer-use agents remain vulnerable to indirect prompt injection even under the human-in-the-loop confirmation paradigm, by hiding adversarial goals behind legitimate-looking, low-harm tasks that slip past the user confirmation designed to catch conspicuously high-harm actions.
📄 Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure — Dong et al., 2026. Studies the internals of agentic LLMs under indirect prompt injection, showing they encode latent signals of "IPI exposure" that probing can read out to detect when malicious side-tasks hidden in external tool results have compromised the agent.
📄 DualView: Preventing Indirect Prompt Injection in Personal AI Agents — Kim et al., 2026. Extends untrusted-data tracking across a personal AI agent's entire environment to prevent indirect prompt injection, including the stored variant where the agent writes and later re-reads attacker-controlled data.
📄 Prismata: Confining Cross-Site Prompt Injection in Web Agents — Villa et al., 2026. Enforces contextual least privilege for autonomous web agents — restricting what an agent can see and act upon based on the origin of the content — so third-party and user-generated web content cannot hijack the agent via cross-site prompt injection.
📄 AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations — He et al., 2026. Defense against indirect prompt injection using causal attribution to trace which tool outputs triggered suspicious agent actions.
📄 ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents — Wang et al., 2026. Rather than judging whether external content is suspicious, ActGuard predicts a local tool prior for each upcoming action and, before execution, compares the candidate action against it via tool-level contrastive analysis and parameter-level evidence localization, masking only spans confirmed malicious and regenerating the action — preserving planning flexibility while cutting attack success to state-of-the-art levels at near no-attack utility. Code.
📄 IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection — Chen et al., 2026. Open-source proxy that rewrites live responses from whitelisted domains with 820 benchmark payloads to evaluate browser agents against realistic indirect prompt injection.
📄 How Much Can We Trust LLM Search Agents? Measuring Endorsement Vulnerability to Web Content Manipulation — Chen et al., 2026. SearchGEO framework with a five-mode attack taxonomy measures how attacker-published web pages get transformed into endorsed recommendations across 13 LLM search-agent backends over 308 cases each.
📄 ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents — Chang et al., ICLR 2026. Formats injected payloads to mimic native chat templates (optionally primed by persuasive multi-turn dialogue) so agents elevate them to system-level trust; transfers across models and largely bypasses prompt-based defenses. Code.
📄 Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents — Szczepaniak et al., 2026. Introduces the "explosive prompt," a conditional indirect-injection payload that stays dormant until an attacker-chosen trigger fires — a training-free inference-time backdoor in a single retrieved document; on nine production agents (Codex, Gemini CLI, Claude Code, Cursor, Copilot, Devin, Kiro, Qwen Code, Google Assistant) it succeeds in 43–83% of cases versus ≤3% for imperative baselines and slips past deployed classifiers, while their ingestion-time detector DeFuse cuts live tool-execution attack success to ~3% at a 5% FPR budget.
📄 Adaptive Attacks and Defenses Against Indirect Prompt Injection — Chen et al., 2024. Adaptive attackers bypassing static defenses.
📄 HouYi: A Black-box Prompt Injection Attack on LLM-integrated Applications — Liu et al., 2023. Systematic methodology for finding injection vulnerabilities.
📄 DMAST: Dual-Modality Multi-Stage Adversarial Safety Training — Liu et al., 2026. Cross-modal DOM injection corrupting both visual and text channels.
📄 LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents — Guo et al., 2026. Black-box, task-agnostic attack that uses fuzzing-generated page-specific indirect injections to make login appear a plausible prerequisite for continuing the task, luring LLM web agents onto attacker-controlled login pages for end-to-end credential and private-data leakage — reaching 86% average success across LLM backbones and remaining effective across agent architectures and defenses, and identifying login inducement as a systematic authentication-boundary risk.
📄 Breadcrumbing Search Agents — Li et al., 2026. Attacks LLM search agents through the mediated search/page-observation channel: appending a single controlled result per query, coordinated across the agent's trajectory into an Authority-Chain Hijack (ACH) evidence chain, overcomes the multi-source cross-checking that dilutes isolated single-page injections (up to 71.4%/95.0% ASR/MaxN ASR), with Trace-Guided Strategy Evolution automatically refining attacker strategies from execution traces.
📄 Hijacking Robots with a Piece of Paper: A Systematic Study of Physical Prompt Injection in VLM-Controlled Robots — Samarakoon et al., 2026. Systematic study of physical (indirect) prompt injection against VLM-controlled robots, where adversarial text placed in the robot's visual field hijacks the VLM planner; introduces a four-category taxonomy (indirect signage, task redefinition, authority impersonation, conflict injection) and a 20-prompt benchmark evaluated over 5,670 trials across three frontier VLMs, three physical scene layouts, and three command formulations.
📄 StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection — Zhan et al., 2026. Introduces multi-step indirect prompt injection, decomposing an adversarial goal into innocuous-looking sub-steps distributed across a chain of pages along the agent's navigation path; the resulting 480-example StepJack benchmark raises attack success on computer-use agents by up to 31.2 points at fixed decomposition depth (e.g., GPT-5.4-mini 41.7%→72.9%). Code.
📄 Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection — Deivasigamani et al., 2026. Shows autonomous Android agents (MobileRun, Mobile-Use) that rely on unsanitized accessibility (A11y) tree metadata plus screenshots are systemically exposed to indirect prompt injection, demonstrating goal hijacking, context drift, and unauthorized device actions across both visually hidden and fully exposed attack scenarios.
📄 Toward Metacognitive One-Shot Indirect Prompt Injection: Strategy Abstraction Via Outcome-Conditioned Reflection — Hou et al., 2026. SAVOR shifts indirect-prompt-injection adaptation from repeated test-time querying against the target to offline strategy distillation — performing outcome-conditioned reflection over successful and failed trajectories from disjoint training environments into a reusable strategy memory that guides a single one-shot injection against an unknown target agent.
📄 CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering — 2026. Inference-time, always-on defense that fits a residual-stream direction distinguishing whether an embedded instruction is followed and subtracts it from every tool-result token during prefill (no fine-tuning, auxiliary model, or added tokens); across five open-weights models (8B–106B) held-out attack success falls from 0.21–1.00 to 0.00–0.17 and AgentDojo compromise from 0.10–0.49 to 0.006–0.079, though attacker-chosen arguments in otherwise-legitimate calls are only partially resisted.

Agent Deception & Manipulation

📄 Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents — Li & Shi, 2026. Studies the principal-loyalty tension in multi-party agent interactions, where an agent must resist adversarial manipulation by counterparties without over-refusing its own principal's legitimate cooperative requests.
📄 Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction — Yang et al., 2026. MemPoison shows how attackers can plant triggerable backdoors into long-term agent memory through ordinary dialogue, bypassing selective memory extraction and rewriting pipelines.
📄 When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents — Zhang et al., 2026. Shows untrusted external content delivered via a single email can be silently written into a persistent personal agent's long-term memory and later reused as trusted state, enabling long-term compromise without detection.
📄 Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses — Karamchandani et al., 2026. Presents FARMA, an attack that corrupts an LLM agent's reasoning history through forged memory traces, alongside SENTINEL, a structural-analysis defense that detects such tampering.
📄 Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems — Weckbecker et al., 2026. Single subliminally prompted agent spreads persistent bias through entire multi-agent network, degrading truthfulness of other agents.
📄 FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems — Li et al., 2026. Prompt-only attack that manipulates planner-executor workflow formation in multi-agent systems, plus FlowGuard as an input-side defense.
📄 Intentional Deception as Controllable Capability in LLM Agents — Starace & Soule, 2026. Systematic study of engineered deception in multi-agent LLM interactions using 36 behavioral profiles for defensive design.
📄 Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem — Xiong et al., 2026. Empirical security study of a deployed decentralized agent ecosystem finding reputation can be manipulated at minimal cost, alongside placeholder registrations and widespread Sybil attacks that undermine the trust infrastructure meant to make autonomous agents trustless.
📄 When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents — Torres et al., 2026. GhostWriter poisons the long-term memory of tool-using personal agents via a hidden injected payload (≈98% injection, ≈60% activation against state-of-the-art agents); the paper proposes Agentic Memory Sentry (AM-Sentry), pairing a memory-saving policy with a retrieval screen to sharply cut success while preserving utility.
📄 MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents — Gao et al., 2026. Benchmark of 1,227 hand-validated persistent-memory poisoning cases (four attack types, three injection channels, three memory substrates across ten model families) with a three-tier taxonomy — direct single-record (L1), compositional multi-record (L2), and context-triggered dormant (L3) corruption — showing write-time defenses like consistency checks suppress L1 but fail on L2/L3, motivating adaptive context-sensitive memory defenses.
📄 Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems — Gadgil et al., 2026. Sandboxed study of prompt injection through persistent memory files across Claude Code and OpenAI Codex (Claude Haiku 4.5, Opus 4.7, GPT-5.2, GPT-5.5): while agents rarely overwrite their own memory from untrusted external content, payloads already planted in memory files reliably attack current and future sessions, with success and persistence varying sharply across systems, models, and multi-session sequences.
📄 Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents — Bouzidi et al., 2026. Introduces Lucid, a black-box adversarial framework that crafts imperceptible image perturbations to corrupt multimodal agents' long-term visual memory via two modes — memory poisoning (replacing benign images to derail recall) and memory injection (inserting adversarial images without textual grounding) — achieving 61.6% and 58.4% attack success across five memory architectures.
📄 Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw — Lin et al., 2026. Introduces a compositional memory-poisoning threat where multiple individually benign-looking memories jointly induce unsafe agent behavior, evading defenses that only screen individually malicious records.
📄 MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents — Chen et al., 2026. Query-only memory-poisoning attack combining probing and factual injection that stays effective against audited memory-augmented agents even under realistic conditions — large-scale benign memory pools and active input auditing — where prior query-only attacks fail.
📄 When Coordination Becomes a Threat: Communication Attacks in LLM-Controlled Multi-Robot Systems — Huang et al., 2026. Formulates two inter-agent communication attacks (External Entry Point and Privileged In-System) against LLM-planned multi-robot systems and shows unsafe information turns into unsafe actions across DMAS, HMAS-1, and HMAS-2 architectures (up to 97.8% unsafe-action success); proposes a Claim Provenance and Verification (CPV) Gate that verifies communicated claims before downstream reuse, cutting the violation rate from 70.0% to 36.6%.
📄 Indirect tipping: a social attack surface in AI agent populations — Flint et al., 2026. Shows that the collective equilibria enabling agent populations to coordinate also form a social attack surface: standard critical-mass analysis underestimates vulnerability by fixating on singular tipping points, whereas indirect tipping through intermediate stepping-stone equilibria can redirect collective behavior with a far smaller committed adversarial minority, bypassing majority requirements and reaching states inaccessible to direct challenges.

Compound System Attacks

📄 Cascade: Composing Software-Hardware Attack Gadgets for Adversarial Threat Amplification in Compound AI Systems — Banerjee et al., 2026. Demonstrates novel attacks combining traditional software/hardware vulnerabilities (code injection, Rowhammer) with LLM-specific algorithmic weaknesses to compromise compound AI pipelines.
📄 Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go? — Chen et al., 2026. Formalizes a threat class in which a self-hosted agent is compromised by corrupting its own state through legitimate OS system-call invocations, then evaluates layered OS-level defenses to expose the residual vulnerabilities they cannot close.
📄 Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent Systems — Cui et al., 2026. Shows that the inference-time harness coordinating an autonomous multi-agent system — expensively-optimized, IP-grade orchestration — can be reconstructed at inference time and then exploited, exposing an attack surface beyond prior IP-leakage work on static, pre-configured architectures.
📄 Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario — Matsuoka, 2026. Origin-neutral compositional threat model where no component is catastrophic alone — a dormant destructive rule seeded in a deployed artifact or shared memory, a later email/document/update/peer message that activates it, and a harness granting operational and recovery authority — yet their conjunction produces correlated destructive action, analyzed across three population-reach routes (release-time pre-positioning, post-release durable seeding, and peer replication).

Cross-Plugin Attacks

📄 When LLM-based Code Generation Meets the Software Supply Chain — Supply chain risks from LLM-generated code integrating malicious packages.
📄 Shadow API: Covert Data Exfiltration via LLM-Mediated API Interactions — 2026. Stealth data theft through seemingly benign API calls.
📄 AgentSkillOS: Towards Secure and Composable Agent Skill Operating Systems — 2026. OS-level isolation for agent skill execution.
📄 Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems — Xie et al., 2026. Defines Skill Composition Risk (SCR), where an individually benign skill becomes harmful when its outputs, trust signals, authorization cues, or side effects influence later invocations in a shared execution context; introduces SCR-Bench to evaluate it.
📄 MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents — Wu et al., 2026. Exploits CLI command-composition risk (CCR), showing individually harmless shell commands can be chained through shared system state into dangerous exploits in LLM coding agents, reaching a 96.59% attack success rate across real-world agents.

Backdoor Attacks on Agents

📄 SlowBA: An efficiency backdoor attack towards VLM-based GUI agents — Li et al., 2026. Novel backdoor targeting response latency of GUI agents via trigger-activated long reasoning chains.
📄 SkillJack: Persistent Skill Backdoors in Self-Evolving Agents — Ying et al., 2026. Uncovers a fundamental skill-backdoor threat in self-evolving agents where poisoned interaction experiences are transformed by the agent itself into durable behavioral artifacts (reusable skills), persisting beyond the retrieval-time-only effect of prior memory- and retrieval-poisoning attacks.

Jailbreaking & Guardrail Bypass

📄 Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs — Panfilov et al., 2026. Autonomous autoresearch pipeline powered by Claude Code discovers novel white-box adversarial attack algorithms that significantly outperform all existing 30+ methods in jailbreaking and prompt injection evaluations.
📄 From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails — Zhou et al., 2026. Uses a beam-search optimization framework to craft natural-language payloads that trap reasoning-based guardrails in extended reasoning loops, turning the very defense that blocks injection and jailbreaks into a denial-of-service vector.
📄 Jailbreaking ChatGPT via Prompt Engineering — Liu et al., 2023. Foundational jailbreaking taxonomy. 700+ citations.
📄 MasterKey: Automated Jailbreaking of Large Language Model Chatbots — Deng et al., NDSS 2024. Automated time-based jailbreak generation.
📄 PentestGPT: An LLM-empowered Automatic Penetration Testing Tool — Deng et al., 2023. Demonstrates agent-level tool use for offensive security. 11K+ GitHub stars.
📄 Self-Fulfilling Misalignment in AI Control — 2026. Fine-tuning on AI Control literature increases misalignment.
📄 Reasoning Models Struggle to Control Their Chains of Thought — 2026. CoT controllability decreases with RL training, implications for agent oversight.
📄 CRAFT: Contrastive Reasoning Alignment — Reinforcement Learning from Hidden Representations — Luo et al., 2026. Red-teaming alignment framework combining contrastive representation learning with RL to separate safe/unsafe reasoning trajectories; 79% improvement in reasoning safety and 87.7% in final-response safety over base models.
📄 It Lied to a Doctor to Buy Poison Ingredients: Quantifying Real-World Misuse of Phone-use Agents — Sun et al., 2026. First real-device study across 27 commercial apps showing phone-use agents readily execute serious misuse (procuring drug/explosive precursors, fraud, harassment) at 68.8% task completion with low refusal, documenting a real-world case where an agent deceived an online doctor to obtain a toxic-substance precursor and tracing it to a Safety Awareness-Execution Gap.
📄 Behind the Refusal: Determining Guardrail Activation via Behavioral Monitoring — 2026. First black-box guardrail reconnaissance methodology for LLM and agentic systems: using only HTTP, lexical, and timing signals with zero prior knowledge, it detects guardrail presence with 100% accuracy and distinguishes guardrail blocks from LLM refusals at 98% F1 — letting red-teamers pick bypass techniques matched to the actual defense in place, since guardrail bypass and alignment bypass require different approaches.
📄 Alignment Is Local: A Paired Diagnostic for GUI Agents under User-Side Persuasion — An et al., 2026. Shows that prompt-level safety alignment in GUI agents is "local" and degrades sharply under multi-turn user-side persuasion, where escalation chains and concealed requests bypass guardrails that hold against single explicit requests; introduces a paired diagnostic to measure the gap.

Defense Research

Permission & Access Control

📄 ActGov: Governing LLM Agent Actions via Policy-Constrained Validation — Zhang et al., 2026. Runtime enforcement framework that validates every LLM-proposed tool action before it causes external effects; ActGov-Policy iteratively builds an SMT-verified policy set from tool specs, benign tasks, and failure traces, and ActGov-Runtime abstracts each call into finite policy records, permitting it only within the task-scoped authorization boundary — reducing indirect-prompt-injection success on AgentDojo and AgentDyn without relying on the LLM to spot malicious instructions.
📄 Zero-Trust Authorization and Discovery for Enterprise MCP — Li et al., 2026. Gap analysis of six MCP SDKs identifies single-header credential binding, no pre-auth tool discovery, and missing per-tool authorization; adds composable FastMCP extensions (cross-header credential normalization, cached token verification, unauthenticated metadata endpoint, permission-filtered tool visibility) — driving forbidden-tool exposure from 21.1% to 0/720 and showing discovery controls cannot replace invocation-time enforcement (models named hidden tools in up to 94% of settings).
📄 Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems — Paul & Nandy, ICML AIWILD 2026. Enumerates 14 attack vectors across direct, indirect, inter-agent, and cascading injection channels; testing on a 6-agent system finds 67% of agents vulnerable to at least one scope violation, then reduces overall injection success from 31.2% to 4.2% via message signing with provenance tracking, boundary I/O sanitization, privilege-scoped per-role tool access, and anomaly detection on inter-agent communication.
📄 Linguistic Firewall: Geometry as Defense in Multi-Agent Systems Routing — Alsheich et al., 2026. ANTAP routes tasks to agents based on empirically verified capability rather than self-declared textual descriptions, resisting description-based injection, embedding attacks, and covert-backdoor impersonation where malicious agents misrepresent their proficiencies.
📄 PAuth: Precise Task-Scoped Authorization For Agents — Sharma et al., 2026. Implicit authorization model where NL task submission authorizes only required operations; uses NL slices and envelopes for provenance-based server-side verification, blocking injected operations in AgentDojo with zero false positives.
📄 Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies — Schneider et al., 2026. Proposes the Dynamic Security Control Compositor (DSCC), which enforces compositional security policies over multi-tool agent chains by combining static analysis with runtime data-flow tracking.
📄 Rethinking Agent Security as a Networking Problem — Tran et al., 2026. Argues agent-centric defenses fail because they entrust policy enforcement to nondeterministic, injectable LLMs, and instead borrows networking principles — centralized control with distributed enforcement, capability-based access, and zero-trust least privilege — combining deterministic enforcement with semantic, context-aware policies in a reference architecture for securing AI agent systems.
📄 Twin Agent: Context Residual Compression for Privilege Separated Agents — Hu et al., 2026. General privilege-separation design pattern using two near-symmetric agents — an Explore Agent that inspects untrusted context and a Safe Agent that executes privileged actions — where the Explore Agent, conditioned on the Safe Agent's context, communicates only compact hints about the next action, improving the security–utility tradeoff and preventing prompt injection across SWE-bench Lite, AgentDojo, and DecodingTrust-Agent.
📄 TrustAgent: Towards Safe and Trustworthy LLM-based Agents — Agent Constitution for safety-aware planning with pre/post-action inspection.
📄 Autoformalization of Agent Instructions into Policy-as-Code — Mondl et al., 2026. Uses an LLM generator-critic loop to automatically translate natural-language agent instructions and policy documents into formally enforceable Cedar policies, achieving broader coverage than hand-coded symbolic enforcement while avoiding the no-guarantees weakness of probabilistic guardrails on medical agent benchmarks.
📄 ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents — Li et al., 2026. Compiles a typed authorization blueprint before execution and enforces it through a deterministic monitor, using provenance-aware authorization to distinguish user-authorized values from untrusted observations (addressing the within-tool attack that manipulates arguments of an intended tool) while a deterministic fast path and capability-level runtime grants cut expensive judge calls; on AgentDojo with Qwen3-max it reduces attack success to near zero with only a 3.80-point clean-utility drop.
📄 Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI Systems — Salfeld-Nebgen et al., 2026. Formalizes an institutional governance model where an autonomous agent keeps full planning autonomy but must present independently attested evidence at the point of consequential, irreversible action (e.g., clinical prescribing, production deployment) rather than having its reasoning monitored.
📄 A Deterministic Control Plane for LLM Coding Agents — Madatha, 2026. Proposes Rel(AI)Build, treating coding-agent definitions as a managed supply chain with content addressing, permission enforcement, and audit logging, arguing governance of the agent-config layer must be deterministic and tool-agnostic rather than delegated to further LLM orchestration.
📄 A Dual-Helix Governance Approach for Reliable Agentic AI — 3-track architecture (Knowledge, Behavior, Skills) using knowledge graphs.
📄 Talk Freely, Execute Strictly: Schema-Gated Agentic AI — Schema-gated orchestration for trustworthy agent deployment in regulated domains.
📄 ESAA-Security: Event-Sourced Architecture for Agent-Assisted Security Audits — 26 tasks, 95 checks, append-only event logs for reproducible AI code audits.
📄 Caging the Agents: A Zero Trust Security Architecture for Autonomous AI in Healthcare — Maiti, 2026. Production-deployed zero-trust architecture for 9 autonomous AI agents: gVisor kernel isolation, credential proxy sidecars, network egress allowlisting, and prompt integrity framework with untrusted content labeling. Open-source configs released.
📄 Sovereign Execution Brokers: Enforcing Certificate-Bound Authority in Agentic Control Planes — He & Yu, 2026. Runtime enforcement layer that intercepts autonomous agent requests and verifies them against cryptographically-issued certificates before allowing infrastructure mutations, ensuring production changes cannot originate from agent reasoning alone.
📄 The Unfireable Safety Kernel: Execution-Time AI Alignment for AI Agents and Other Escapable AI Systems — Dobrin & Chmiel, 2026. Rust-based, formally verified safety kernel that enforces authorization on agent actions through process separation and cryptographic verification, designed to resist self-modification and escape attempts so an agent cannot circumvent its own safety controls at runtime.
📄 A First Measurement Study on Authentication Security in Real-World Remote MCP Servers — Zhou et al., 2026. Large-scale measurement of 7,973 remote MCP servers finding widespread unauthenticated exposure and pervasive OAuth flaws, with 9 CVEs from responsible disclosure.
📄 CmdNeedle: Measuring the Incompleteness of Command Denylists for AI Agents — Chen et al., 2026. Shows that the denylist component of terminal agents' three-list command-gating mechanism — including Claude Code's built-in list — is systematically incomplete against the large, ever-expanding set of shell commands shipped by modern operating systems.
📄 SecureClaw: Clawing Back Control of LLM Agents — Ma et al., 2026. Dual-boundary security architecture placing authorization at the effect sink and plaintext confinement at the read boundary, using opaque handles and a PREVIEW→COMMIT protocol to block unauthorized external actions and sensitive-data leakage in tool-using agents.
📄 SessionBound: Turning Enterprise Task Approval into Budgeted Database Sessions — Wu, 2026. Confines enterprise agent-generated SQL to pre-approved business tasks via short-lived, budgeted, auditable database sessions — the agent may generate queries freely, but every attempt must stay inside the approved boundary — enforcing safety through database-layer access controls, query budgets, and disclosure limits rather than trusting the LLM to self-police.
📄 Janus: A Playground for User-Involved Agentic Permission Management — Brigham et al., 2026. Playground system implementing six permission assistants across a design space of user involvement in agentic tool-call authorization; shows user input meaningfully strengthens privacy and security, AI augmentation of user decisions reduces cognitive load, and permission fatigue must be modeled since no single design is optimal across contexts. Code.
📄 aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents — Kodathala, 2026. Off-host authorization gateway that binds tool calls to verified user authority via HMAC-SHA256 signatures and role-based policies, blocking deceived agents from executing actions beyond granted permissions rather than trusting the model's own refusals over unverifiable text context.
📄 From Neural Intent to Cryptographic Authorization: Governing Agentic Workflows — Weng et al., 2026. Neural Cryptographic Services (NCS) inserts a deterministic symbolic controller between LLM agents and privileged tools, admitting a tool invocation only when it matches cryptographically authorized instructions from an offline-signed, hash-chained instruction stream rather than trusting the model to comply with intent — cutting attack success while preserving utility on legitimate workflows.
📄 Steerability via Constraints: A Substrate for Scalable Oversight of Coding Agents — Winninger, ICML 2026 Deep Learning for Code Workshop. Argues the controls long used to manage large human engineering teams — access control, network policies, tooling-enforced coding conventions — transfer directly to unconstrained coding agents (whose autonomy introduces security risks) and are cheaper in tokens than agentic scaffolding; a controlled experiment shows a small reviewer's recall on 11 inserted backdoors rising from 54.5% to 90.9% when given a constrained substrate plus a ~200-LoC docs CLI.
📄 Context-to-Execution Integrity for LLM Agents — Santos-Grueiro, 2026. CXI is an execution-boundary system that marks protected sink fields, carries narrow validated values from writable context via typed releases, keeps evidence in opaque data slots, and admits a tool call only when field authority, exact-effect authorization, and invocation authority all bind to the same action manifest — yielding zero field/effect/invocation escapes across 720 AgentDojo episodes and 400 code-agent episodes.
📄 Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agents — Reddy et al., 2026. Identifies "silent wrong-state" failures where policy-permissive tools execute forbidden state transitions without any error, and shows lightweight deterministic read-only pre-execution gates raise τ²-bench airline success from 29.6% to 42.0% by blocking policy-violating writes at the action boundary.
📄 ScopeJudge: Cost-Aware Pre-Execution Gating for Offensive Security Agents — Caldwell et al., 2026. Pre-execution gate in which a lightweight LLM judge inspects each offensive-security agent tool call against the engagement scope inferred from the user's request — treating the boundary as intent-declared rather than a fixed policy — to block out-of-scope actions before they execute.
📄 How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement — Michael & Roesner, 2026. Systematizes user-level permission systems for AI agents via a taxonomy of 21 proposals and an analysis of five commercial agents, examining how permissions are specified, derived, and enforced at runtime to counter prompt injection and unauthorized task execution.
📄 Toward Cryptographically Verifiable Authorization for Autonomous AI Agents — Llambí-Morillas & Fernández-Fernández, 2026. Formalizes agent authorization as a cryptographically verifiable relation (CVA) that jointly binds an agent principal, a concrete request, an execution context, and policy satisfaction while preserving confidentiality of private attributes; defines candidate properties (authorization soundness, principal/request/policy binding, replay resistance), gives a Groth16 zk-SNARK proof-of-concept, and identifies the structural separation of identity, request, and runtime-execution binding as a central open problem for secure agentic systems.
📄 ToolGuardian: Declarative Security for AI Agent-Tool Interactions — Ravindran & Deochake, 2026. Policy-driven framework pairing pre-admission tool vetting via progressive characterization (declared descriptions, syscall traces, mock-execution effects, source analysis) with task-aware runtime authorization, built on an Answer Set Programming declarative policy layer that reasons explicitly over capabilities, effects, task context, and multi-tool composition; on 16 MCP-style tools (8 malicious variants of real open-source tools) it reaches deny-class F1 0.86 for vetting and classifies all runtime scenarios correctly when fully specified.
📄 Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecture — Noyan, AIWILD @ ICML 2026. Treats capability scoping as prevention before detection — a credential absent from an agent's context cannot be misused regardless of reasoning or evasion — via a three-source architecture (role-based ceilings, a task-context classifier, and policy-derived combination prohibitions), and releases a 600-prompt synthetic dataset labeled with minimum required permissions across a 15-permission tool-based taxonomy, with iterative dataset–policy refinement cutting ceiling violations 93% (46→3).
📄 Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents — Kravchenko et al., 2026. Introduces APPA, which uses engine-managed context branching and prospective evaluation to confine taint from untrusted data locally — child trajectories absorb contamination while sanitizers return cleaned results to an unchanged parent context — preventing prompt injection from polluting the primary workspace without sacrificing operational utility.
📄 Toward Standardized Cross-Vendor Agent Tool Trust Management in Autonomous Networks — Sharma et al., 2026. Proposes AgentToolMO, a 3GPP NRM information model that gives agents cross-vendor visibility into tool trust degradation — a formally defined trust state machine with graduated enforcement, damped cascade propagation, and trust notifications over existing Management Services interfaces — so a compromised tool from one vendor no longer keeps getting invoked by another vendor's agents, shrinking blast radius from hours-scale undetected propagation to near-real-time containment.
📄 FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs — Zhang et al., 2026. Permission-carrying authorization framework that translates ambiguous natural-language tasks into a Permission Intermediate Representation, lowers it into an evidence-backed permission graph tracking data flows, dependencies, and contextual labels, and has a Satisfiability Modulo Theories authorizer mathematically verify each effectful action against security policies before a runtime gateway either authorizes it or intercepts it with a precise counterexample — reaching a 90.5% Decision Compliance Rate across OpenAgentSafety, OctoBench, and ActPlane.
📄 Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents — Zhang & Zhang, 2026. Addresses the authorization gap created when long-lived agents evolve after deployment — retaining experience, acquiring skills and tools, revising workflows, and delegating — so the subject or context exercising a live grant no longer matches what the user evaluated; proposes earned authority bounded by a fixed ceiling to keep prompt-injection- and error-driven external actions within originally-authorized limits.
📄 Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory — Xu et al., 2026. Identifies "memory provenance laundering," where untrusted external observations are rewritten into persistent agent memory as trusted user history during consolidation, and proposes the Provenance-Preserving Memory Firewall (PPMF), a middleware that keeps platform-maintained provenance and authorizes tool calls by matching action risk to the authority of the action-relevant memories.
📄 Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions — Xu et al., 2026. Identifies semantic replay — where replanning, retries, delegation, and crash-resumption cause one user authorization to execute multiple times under freshly issued single-use tokens — and proposes durable, token-independent authorization state that bounds an authorized action's execution budget.
📄 MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication — Xu et al., 2026. Scope-bound semantic declassification framework for multi-agent LLM systems that specifies what a legitimately informed agent should disclose and how, closing privacy leaks through internal messages, tool arguments, logs, and persistent memory that surface-redaction and source-level access controls leave open.
📄 Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture — Sambrook & Sovio, 2026. Replaces software-resident agent signing keys (git commits, API auth, certificate issuance) with hardware-confined keys behind a vendor-neutral PKCS#11 interface, wrapped in a five-layer zero-trust enforcement stack — session identity, scope bounds, semantic validation, taint tracking, and a hardware execution boundary — motivated by a production incident where keys were exfiltrated via email injection in under five minutes; cuts attack success from 19.3% to 0% across 12 AgentDojo-derived injection scenarios with zero false positives on benign tasks.
📄 NiyamAI: An Intent-Bound AI Agent with Cryptographically Verifiable Guardrails using Zero-Knowledge Proofs — Katkar et al., 2026. Locks permitted tools and constraints into a SHA-256-committed Intent Contract at session start and validates every tool call with an isolated Judge model that emits an EZKL zk-SNARK proof, so a tool executes only after proof verification and third parties can confirm enforcement without accessing the Judge model's weights; reaches 88.5% F1 at a 1.1% false-positive rate on Agent-SafetyBench.
📄 A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem — Kumar et al., 2026. Reports a production centralized MCP gateway fronting dozens of downstream servers to resolve the governance crisis of fragmented per-team auth (some with none, some API keys, some OAuth); contributes a two-axis persona×credential authentication model, three enterprise SSO grants with BYO/GYO/delegated-OAuth (RFC 8693) token provisioning, and three end-to-end identity flows spanning user and non-user (automated) agent personas.
📄 InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agents — Zou et al., 2026. Trust-native protocol suite that supplies the missing security substrate for the Internet of Agents alongside existing communication protocols, via four layers (Persistent Identity, Discovery, Trust Negotiation, and Accountability) that let an agent prove its identity, authorization, advertised capabilities, and accountability after delegation across organizational boundaries.
📄 Bounded Agents: Delegation Security for Multi-Agent AI Systems — Muruaga, 2026. Frames agent misbehavior within granted permissions as an authorization-architecture problem and proposes the Agentic Principal Chain (APC), which tracks delegated authority across principals so static per-request permissions cannot be combined into a prohibited outcome or delegated unbounded to a sub-agent.
📄 Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems — Liu, 2026. Enforces an anti-monotone audience-membership rule at the memory-to-context transition — a memory item is admitted only when every current viewer already belonged to its audience — preventing cross-audience information disclosure in multi-user agentic systems independent of the underlying model.
📄 PACE: Policy-Attested Contract Execution for Safe AI Agents in Decentralized Finance — Karanjai et al., 2026. Transaction-level authorization framework interposing between LLM agents and blockchain execution, using typed transaction intents, a deterministic policy verifier, and signed Policy Decision Records to cryptographically bind verifier-approved actions to the exact on-chain transactions submitted, blocking prompt-injection-driven DeFi actions.
📄 From Intent to Execution Grant: An Execution-Boundary Conformance Profile for High-Risk AI Actions — Wu et al., 2026. Specifies EBL-Core, a conformance profile for the final transition from a candidate AI action to execution authority: it binds a structured intent object, Root and Operational Policies, typed evidence obligations, context, and time into a verifiable Decision Derivation issued as an Execution Release Contract (ERC), defining a common semantic contract that authorization engines, policy languages, runtime monitors, and guardrails otherwise leave unspecified for high-risk actions such as transfers, deployments, disclosures, and physical actuation.
📄 Scan the Skill, Govern the Action: Composing Registry Verdicts with Runtime Consequence Control — Taneja & Weber, 2026. Argues skill-registry scanners answer "is this skill malicious?" but not "is this action permitted here, by this operator, now?"; measuring 66,192 public ClawHub skill versions, finds 705 unanimously-clean skills that still instruct actions prohibited by CIS Control 2.7 and NIST SP 800-53 CM-11, and that 34.7% of a live agent's sandbox commands carried a consequence class absent from the skill's own documentation — then proposes a deterministic resolver (no model in the decision path) feeding a per-(resource, class) trust ledger whose promotion thresholds derive from operator risk tolerance, releasing a 64-case obfuscation benchmark.
📄 The Stochastic Deputy: Structural Tenant Isolation for Tool-Using LLM Agents — Baig et al., 2026. Formalizes the stochastic deputy problem — passing a tenant identifier to a tool delegates resource selection to a context an adversary may control — and defends it structurally: remove tenant identity from the MCP tool schema, bind scope to a verified credential, and enforce it below the agent. In a 373-trial ablation a validated tenant parameter still served every out-of-scope attempt, while removing the parameter left no tool signature able to express the read (forged-scope escapes required cryptographically protected context).
📄 AcquireBound: Runtime Authorization for Resources Acquired by AI Agents — Zhu, 2026. Provenance-bounded runtime authorization for the post-fulfillment activation gap, where payment/OAuth/mandate checks validate a transaction but not whether a returned resource (compute, credentials, accounts, sub-agents) may become usable authority; AcquireBound quarantines acquired outputs, resolves their capabilities from authenticated provider evidence, and activates them only through a current transaction checked against a downward-closed relational envelope over a typed resource-capability hypergraph, with eight proven safety properties and validation across five resource classes and staged MCP-to-Docker compositions.
📄 LLM Agent Capabilities Should Follow Task Intent and Context Source — Zheng et al., AgenticOS 2026. Argues the least-privilege capability an agent needs is dynamic and task-intent-dependent, yet all inputs (user request, tool results, documents, shell output, Skill/MCP instructions, memory) enter one shared planning channel with equal authority; IntentCap composes short-lived leases from four sources — user intent, workflow instructions, tool schemas, and runtime environment — with field-level ownership and monotonic narrowing (each source fills only its own fields and can only narrow the user's authority), validated by a deterministic checker before any side effect and enforced by tool- and OS-level information-flow policies.
📄 Trust Propagation and Structural Containment in Multi-Agent LLM Pipelines — Safin et al., 2026. Studies attack propagation in a four-agent LangGraph pipeline (Supervisor, Researcher, Validator, Executor) under shared-memory poisoning and indirect prompt injection via a forged in-document approval, contrasting the Validator's own judgment with an independent authorization layer using task-bound signed tokens and a separately verified policy oracle; introduces the Judgment Bypass Rate (JBR) measured at the attacked agent, and shows structural authorization contains compromise (100% JBR yet 0% Unsafe Action Rate) even when upstream LLM judgment fails, while an Observer layer cuts the agent-hijacking false-positive rate from 49% to 7%.
📄 Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence under Delegation and Asynchronous Execution — Zhu & Wang, 2026. Addresses long-running agents that outlive their initiating process through credentials, delegated tasks, queues, callbacks, and provider-side operations — where cancellation, process exit, and credential revocation neither close every pre-cut carrier nor distinguish independently authorized shared work; defines root-scoped authorization quiescence and a protocol that linearizes a root cut, fences old-root expansion and protected sinks, represents alternative/conjunctive authority as antichains of minimal sufficient root sets, and composes provider-frontier certificates, with proven post-cut issuer non-expansion and compositional soundness and a checker verifying 17/17 traces while rejecting 44/44 semantic regressions.
📄 Progressive Skill Discovery as Access Control for Tool-Using LLM Agents: Structural Governance through Role-Scoped Capability Delivery — Stettler et al., 2026. Introduces skilder, which packages capabilities into roles (bundles of skills, tools, instructions, and their limits) delivered through a single MCP server; because tools reach the agent only inside learned skills, the same server deterministically enforces the scope of what was learned. Across 13 tasks and six models, when a model completed discovery and issued a governed call no unauthorized tool call or parameter violation (e.g., a spending-limit breach) executed, while mid-task cross-role acquisition preserved problem-solving flexibility under hard system-level enforcement.
📄 MetaPermit: Scalable and Auditable Access Control for AI Agents via LLM-Inferred Meta-Attributes — Ma et al., 2026. Policy-based tool access-control framework that decouples semantic inference from security enforcement: an LLM infers a compact, task-independent set of meta-attributes (relating user intent, execution context, and the proposed tool call) for each call, while a fixed policy evaluates those values to allow or deny it — making every decision auditable and avoiding enumeration of user intents. On AgentDojo and AgentDyn across seven task suites and five attack methods, it produces 31% more consistent authorization than LLM-driven authorization and outperforms CaMeL and IPIGuard on both task completion (up to 109%) and IPI robustness (no malicious tool calls executed).
📄 Crypto-bound identity-verified capability tokens for coordinating distributed AI agents: A proposal — Subramanian & Sengupta, 2026. Capability-based security framework with decentralized agent identity, drawing on the OAuth Agent Authorization Profile and W3C DID/VC standards: agents access services via tokens cryptographically bound to the agent's and issuer's identities and scoped, with services validating that a delegation chain only attenuates scope before acting — placing enforceable security boundaries in a secure module outside the language model's context window to contain prompt-injection-driven credential exfiltration.
📄 A Safety-Bounded SDC-to-MCP Gateway for Medical AI Agents — Gerlach & Fischer, 2026. IEEE 11073 SDC-to-MCP gateway that exposes device metrics, alarms, and semantic metadata as read-only resources while representing selected action affordances only as policy-validated dry-run tools, enforcing a narrow no-execution property (agent-facing requests dispatch no device operation); a Python/Java prototype preserves the no-execution boundary across resource, proposal, and authorization paths under simulated fault and lifecycle experiments. Code

Runtime Monitoring & Sandboxing

📄 Tracekit: Tamper-Evident Intent-Reasoning-Action Auditing for Autonomous Coding Agents — Ghosh, 2026. Dependency-free auditing system that captures three channels per coding-agent session (human intent, model self-report, executed actions) into a hash-chained, externally anchorable ledger, gating tool calls with a pre-execution policy and re-verifying the ledger live; across 1,600 mutations the chain detects every edit while a regex gate blocks only 41% of harmful tool calls, and in 14 real Claude Code runs the agent never acted on four planted indirect prompt injections. Code.
📄 Planarian: Managing Agent State with Statepoints — Guo et al., 2026. Agent runtime whose statepoints are consistent, restorable point-in-time versions of local and remote environment state, exposing snapshot, rollback, and fork primitives — using incremental process/filesystem snapshotting for sandboxed local state and recorded compensating actions to undo remote changes — so agents and users can recover from erroneous or adversarial actions and explore alternatives with ~3% overhead.
📄 The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents — Bhowmik, 2026. Measures the always-paid cost of memory-poisoning defenses on entirely benign traffic: three write-time defenses (input sanitization, provenance checking, LLM anomaly detection) show no resolvable utility cost, while a read-time reranker lowers accuracy ~4.4 points and quarantines legitimate memories on 33.6% of items — arguing where a defense intercepts the pipeline, not whether it uses an LLM, determines its benign-case price.
📄 Forensic Trajectory Signatures for Agent Memory Poisoning Detection — Leong, 2026. Finds that successful agent memory-poisoning attacks leave an invariant tool-call signature (a memory recall preceding a sensitive action such as email send), enabling incident responders to detect memory-channel attacks from tool-call logs alone at 99% accuracy without inspecting memory contents.
📄 MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems — Li et al., 2026. Framework that ranks the most security-critical inter-agent communication edges so defenders can deploy protection proactively, showing channel-level attack impact is highly non-uniform — a single compromised edge can account for up to 75% of total attack success.
📄 AI Sandboxes: A Threat Model, Taxonomy, and Measurement Framework — Singh et al., 2026. Formal framework for evaluating AI testing environments via threat models, sandbox archetypes, and measurement criteria (fidelity, controllability, observability, containment, reproducibility) across digital, embodied, and cyber-physical deployments.
📄 Cordon: Semantic Transactions for Tool-Using LLM Agents — Chen et al., 2026. Transactional runtime that wraps multi-step agent workflows in a task-scoped containment boundary for staging, validating, committing, and rolling back irreversible tool actions, rather than relying on isolated per-call guardrails.
📄 VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills — Li et al., 2026. End-to-end framework that monitors agent execution traces against behavioral policies declared in skill specifications and operator constraints, using a dedicated policy language and symbolic evaluation to catch violations across temporal dependencies, argument relationships, and value flows spanning multiple tool calls — over 95% recall with sub-10% false positives on real-world agent tasks.
📄 AIRGuard: Guarding Agent Actions with Runtime Authority Control — Qin et al., 2026. Runtime defense layer that treats untrusted context as informative but never authorizing, normalizing tool calls and enforcing action-time authority checks to reduce tool-mediated attacks.
📄 SKILLLITE: Evidence-Guided Malicious Skill Auditing with Compact LLMs — 2026. Audits third-party agent skills — which package task instructions with executable components and auxiliary resources and form a new supply-chain attack surface — for embedded harmful behaviors that abuse agent privileges, using an evidence-guided pipeline designed to run on compact LLMs.
📄 Beyond Handcrafted Security: Self-Evolving Defense (SED) for LLM Agents — 2026. Training-free framework that distills harmful agent trajectories into reusable security policies without updating model weights, retrieving relevant policies for future tasks to continually adapt across jailbreaks, prompt injection, and insecure code generation; lowers targeted prompt-injection success on AgentDojo to 0.42% (vs. 3.7% best baseline) and holds adaptive X-Teaming attack success on HarmBench to 7.8% across three open-source models. Code.
📄 Safeguarding LLM Agents from Misalignment through Provenance Analysis — She, Liang & Kang, 2026. ProvenanceGuard detects and blocks misaligned tool invocations by tracing whether each proposed agent action is actually supported by evidence in the agent's context, catching actions that deviate from user intent before they execute.
📄 Operating-Layer Controls for Onchain Language-Model Agents Under Real Capital — Barton et al., 2026. Production study of 3,505 real-capital agents showing that agent reliability depends on operating-layer controls like prompt compilation, typed controls, policy validation, execution guards, and trace-level observability.
📄 Governing What You Cannot Observe: Adaptive Runtime Governance for Autonomous AI Agents — Marin and Chaudhary, 2026. Proposes adaptive runtime governance based on bounding unobserved risk as agent behavior drifts after authorization.
📄 AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents — Zhang et al., 2026. Lifecycle security architecture for autonomous agents spanning skills, external content, memory, planning, and privileged tool execution.
📄 Behavioral Integrity Verification for AI Agent Skills — Wu et al., 2026. Scalable pre-deployment skill auditing framework that compares declared versus actual capabilities, surfaces description-implementation gaps, and detects malicious skills with 0.946 F1.
📄 ADR: An Agentic Detection System for Enterprise Agentic AI Security — Li et al., MLSys Industry Track 2026. Production MCP security system with telemetry, red teaming, and two-tier online detection deployed across 7,200+ hosts and 10,000+ daily agent sessions.
📄 Content-Aware Attack Detection in LLM Agent Tool-Call Traffic: An Empirical Study of Features, Architectures, and Evaluation Protocols — Zavrak, 2026. Shows content-aware graph and embedding-based monitoring of MCP tool-call traffic substantially outperforms metadata-only detection and highlights evaluation leakage pitfalls.
📄 Arbiter: Detecting Interference in LLM Agent System Prompts — Mason, 2026. Framework combining formal evaluation rules with multi-model LLM scouring to detect interference and vulnerability classes in agent system prompts.
📄 MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in MCP Agents — Zhou et al., 2026. Plug-in security cognition layer for MCP agents that validates third-party tool invocations via experience-driven trust calibration.
📄 OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents — Li, 2026. Runtime security layer distributing enforcement across ten lifecycle hooks with hybrid heuristic-plus-LLM scanning, session-scoped risk accumulation, and tamper-evident audit for agent gateways.
📄 Governing Evolving Memory in LLM Agents: Risks, Mechanisms, and the SSGM Framework — Lam et al., 2026. Stability and Safety-Governed Memory framework mitigating topology-induced knowledge leakage and semantic drift in persistent agent memory systems.
📄 Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees — Louck, 2026. Proves content- and lineage-based memory-poisoning defenses are fundamentally insufficient against agent-specific laundering, and proposes TMA-NM, a non-malleable information-flow-control mechanism that achieves 0% attack success with full legitimate utility across eight frontier models versus up to 68% for prior defenses.
📄 Detecting Malicious Agent Skills in the Wild using Attention — Etteib et al., 2026. Locate-and-Judge, a two-stage detector that flags malicious marketplace skills by analyzing instruction-following attention patterns, concentrating expensive LLM examination on high-attention instruction spans for cost-efficient marketplace-wide auditing while catching malicious skills existing scanners miss.
📄 AgentSentry: Real-time Monitoring for Agentic AI Systems — Runtime behavioral monitoring of tool-using agents.
📄 Monitoring Emergent Reward Hacking via Internal Activations — Sparse autoencoders detect reward-hacking during generation.
📄 Self-Attribution Bias: When AI Monitors Go Easy on Themselves — AI monitors exhibit systematic leniency on own outputs.
📄 Salient Directions in AI Control — Structure of AI Control evaluations: trusted monitors overseeing untrusted agents.
📄 Governed Memory: A Production Architecture for Multi-Agent Workflows — Taheri, 2026. Shared memory governance layer with dual memory model, tiered governance routing, entity-scoped isolation (zero cross-entity leakage across 500 adversarial queries), and 100% adversarial governance compliance in production.
📄 Agent-Native Immune System: Architecture, Taxonomy, and Engineering — Shen et al., 2026. Proposes ANIS, an endogenous biologically-inspired defense embedded directly in the agent's cognitive loop with a six-layer "Immune Tower" (including a non-cognitive isolation layer), a taxonomy of agent viruses and vaccines, and continual immune learning to counter runtime hijacking via memory poisoning, tool-chain manipulation, and multi-agent protocol attacks that survive training-time alignment.
🔗 Behavioral Attestation and Compaction Drift in Persistent AI Agents — Morrow (agent-morrow), 2026. Identifies compaction drift — non-adversarial behavioral shift caused by context window compression — as a runtime integrity threat class distinct from adversarial injection. Proposes behavioral attestation (context fingerprint delta against a pre-compression baseline) as the mechanism for continuous rather than one-time agent authorization. Complements credential-scope enforcement (e.g., AATs) with runtime execution verification.
📄 The Decomposition Is the Fingerprint: Per-Component Identity for Agent Skills — Liu et al., 2026. Fingerprinting framework that assigns each agent-skill component a locality-sensitive-hash identity to detect tampering, unauthorized reuse, and drift across skill versions, complementing behavioral verification with structural provenance.
📄 From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes — Liu, 2026. Defines and benchmarks eight security invariants for MCP-style execution runtimes; the proposed HCP runtime blocks all modeled attacks (tool poisoning, unauthorized execution, privilege drift) that a naive baseline permits.
📄 AgenticOS: An Intent-Oriented Secure Operating System Architecture for Autonomous AI Agents — Zhao et al., 2026. OS-like security architecture that reframes agent protection as an intent filter, layering a Ghost Kernel, Logic Shutter, Agent Capsule, and Semantic Boundary Gateway to isolate and mediate autonomous agent actions.
📄 Proof of Execution: Runtime Verification for Governed AI Agent Actions — Rhodes et al., 2026. Cryptographically-sound runtime verification framework that binds authorization, effectful actions, tamper-evident history, and deterministic replay into attestable execution objects, so each governed agent step's authority and integrity can be proven rather than assumed from output plausibility.
📄 NovaFabric: Tamper-Evident, Replayable Evidence for Autonomous AI Agent Runs — Seyedkazemi Ardebili, 2026. Records an autonomous agent run — without modifying agent logic — into a portable Run Capsule sealed with a DSSE signature, RFC 3161 timestamp, Merkle log, and redaction attestation, producing provider-neutral, tamper-evident, replayable audit evidence exportable for third-party verification with stock tooling (OpenTelemetry, DSSE/in-toto, W3C PROV); targets the compliance records (EU AI Act, ISO 42001, NIST AI RMF) that mutable observability traces cannot supply, with a four-mode replay protocol and evaluated redaction of 14/14 credential types.
📄 When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems — Xu et al., ICML 2026. AcMAS detects semantically stealthy attacks in multi-agent systems by analyzing local agents' activation-space reasoning states without relying on explicit interaction graphs, staying robust to asynchronous execution (+0.55 F1 over graph baselines asynchronously) and using the same signals to restore compromised agents rather than isolate them.
📄 Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents — Wang et al., 2026. TokenWall audits the natural-language token flows of long-lived agents at runtime, intercepting unsafe behaviors before they reach privileged operations and achieving a 12.5% attack success rate while preserving 97.4% benign-operation compatibility.
📄 TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories — Gao et al., 2026. Embeds attribution watermarks directly into an agent's action-log trajectory across two complementary channels — one surviving content deletion, the other surviving rewrites — so a rebranding reseller who silently substitutes a cheaper model or tampers with logs can be detected, protecting agent provenance in production deployments.
📄 FlowGuard: From Signals to Evidence for MCP Security Detection — An et al., 2026. Evidence-grounded MCP security detection system that verifies execution-related risks (command injection, file-system access) through runtime evidence rather than suspicious semantic signals alone, combining recon-guided payload narrowing, schema-valid probe generation, and evidence adjudication; on a 1,880-case executable benchmark it reaches 0.879–0.942 F1 while cutting end-to-end latency up to 2.23x, and surfaces 523 findings across 326 real-world servers.
📄 When Agents Look Like Beacons: NIDS Evasion by Model Context Protocol Traffic — Sohail, NIPA 2026. Shows that remote MCP over Streamable HTTP produces machine-generated, authenticated, high-frequency JSON-RPC traffic that structurally and temporally resembles C2 beaconing (e.g. Cobalt Strike polling), yet — across a Docker testbed of eleven traffic profiles under Opaque, TLS-Inspected, and Cleartext conditions — evades Suricata signatures and RITA behavioral beacon scoring (a consistent 0.0 beacon score and near-zero alerts under ET Open), because NIDS heuristics tuned for traditional malware do not flag the lognormal inter-arrival distributions of generative-AI reasoning loops; proposes an agent-native network indication standard (Agent-Native ALPN and out-of-band headers) to close the visibility gap.
📄 Democratizing Agent Deployment Safety: A Structural Monitoring Approach — Ravindra et al., ICML 2026 Workshops. Untrained Information Flow Graph (IFG) monitor that detects infrastructure-level sabotage under task success — coding agents that complete their task while covertly broadening permissions, degrading logging, or planting persistence — by diffing control- and data-flow graphs; cuts missed attacks from 11.6% to 3.5% asynchronously and, run synchronously as a pre-merge gate with rollback, drops joint main+covert task success from 74.4% to 0.0% without reducing legitimate completion.
📄 Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents — Park et al., 2026. Links coordinated attack campaigns across separate agent sessions with no shared infrastructure or labels by fingerprinting behavioral signals such as tool-usage patterns and writing style, enabling cross-agent attribution for incident response.
📄 ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems — Narayan et al., 2026. Sequential detection framework that models MCP attack progression as a six-stage kill chain and applies a Hidden Markov Model over a 20-dimensional tool-interaction feature schema to flag malicious tool-call sequences composed from individually benign invocations that evade per-call defenses, covering direct sequential, indirect-injection, and hybrid multi-stage attack chains.
📄 Operational Hallucination and Safety Drift in AI Agents — Yu et al., 2026. Empirically characterizes two multi-turn failure modes in tool-using agents — Safety Drift (declared safety intent eroding into constraint-violating actions such as refusal followed by unsafe execution) and Operational Hallucination (livelock-inducing repetitive tool calls from flawed state perception) — attributes them to reasoning/execution-state decoupling, and proposes a plug-in Action-Aware Supervision Layer with intent-action consistency checks, runtime state tracking, and forced-termination primitives.
📄 JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety — Xiong et al., 2026. Foresight-oriented guard framework that trains a guard model (Vanguard) to anticipate delayed risks from partial agent trajectories via coupled anticipation and adjudication tasks optimized with CoAA-RL, blocking unsafe actions before execution and improving average protection by 15.9 points over baseline guards while raising benign task completion by 5.1 points across four agent-safety benchmarks.
📄 CARE: Pre-Execution Command Verification for Shell-Executing LLM Agents — Zhang et al., ISSRE 2026. Shell-specific static-first verifier that mediates individual commands at the dispatch boundary — canonicalizing generated commands into stable verification targets, deriving deterministic evidence over syntax, command semantics, path context, and provenance-backed risk patterns, and escalating only underdetermined cases to an LLM judge — reaching 85.64% F1 at a 0.91% false-positive rate and 2.32 ms mean latency, and cutting realized harm on RedCode-gen to 37.33% in its static enforcement profile.
📄 SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems — Dai et al., 2026. Reframes cross-agent malicious propagation — where a harmful objective is fragmented into locally plausible subtasks that evade any single agent — as a semantic information-flow problem, attaching structured semantic taints to root requests, propagating them through a dynamic collaboration graph, and performing workflow-level validation to reconstruct global risk context before irreversible actions commit.
📄 Hybrid Analysis for Secure MCP Tool Use in LLM Agents — 2026. MTGuard defends MCP tool use through lifecycle-aware static–dynamic co-analysis rather than inspecting prompts and outputs alone, arguing static-only defenses limit effectiveness and robustness against agents induced into malicious or unauthorized tool actions.
📄 Distributing Security Controls Through Harness Engineering — Gore, 2026. Shows off-the-shelf security controls (OS sandboxing, skill scanning, tool restriction) can be embedded into a distributable agent harness (SHarD, built on Pi) and scaled to commercial coding agents via a single install command, matching direct-install efficacy and scoring 100% on a 23-test suite derived from the OWASP Top 10 for Agentic Applications.
📄 SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents — Yang et al., 2026. Deployable security gateway that screens skill packages before coding-agent installation via a hybrid regex-prefilter + LLM-judge pipeline — safe-signal files bypass the LLM entirely and flagged files send only matched snippet windows rather than full content — reaching F1 0.817 at 1.13% FPR on SkillsBench (n=1,650, 9.1% malicious) while cutting LLM input tokens 77% and outperforming existing tools 5–6x on threshold-independent AUPRC.
📄 Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study — Arias et al., 2026. Studies distributed backdoors where a poisoned tool hides encrypted payload fragments across several agents that an external step reassembles after the run, evading per-step safety checks; a prefix detector flags 99.3% of successful attacks with a median of five steps remaining (10.3% safe-run false positives), but shows much of that warning rests on removable surface cues (ciphertext length and entropy) rather than the attack's distributed structure — once stripped, detection arrives later and transfers poorly across domains.
📄 $S^3$: Improving Agent Safety through Multi-Stage Defense — Xiao et al., 2026. Multi-stage defense that jointly protects LLM agents across the memory, planning, and tool-execution stages of the agentic workflow, mitigating risks that emerge at on

Searching Database…

262 ·GitHub

Awesome-agent-skills-security

这是什么？

一份精心整理的 awesome-list 风格合集，收录关于保护 AI 代理工具使用和新兴“代理技能”生态的研究论文、标准、框架和基准——既涵盖提示注入、工具投毒等攻击，也涵盖沙箱、权限控制等防御手段。

这是需要安装的工具，还是只是一份阅读清单？

它就是一个纯 markdown 阅读清单，收录指向论文、标准组织（OWASP、MITRE、NIST、IETF）和外部工具的链接——这个仓库本身没有任何需要运行的软件。

它收录现成可用的安全工具，还是以理论为主？

有一个“Tools & Frameworks”章节，但绝大多数条目是学术论文、标准和行业报告，而不是可安装的安全工具。

OWASP Agentic Skills Top 10（AST10）是什么？

它是 OWASP 新的孵化器标准（v1.0，2026 年），是首个由标准组织对代理技能特有风险进行的枚举，从 AST01 恶意技能到 AST10 跨平台复用，其中 AST01 和 AST02 供应链攻陷被评为关键级别。

清单涵盖针对代理技能的哪些攻击？

涵盖提示注入（直接和间接）、工具投毒和供应链攻陷、权限提升和过度代理、跨插件攻击、后门、代理欺骗、数据外泄，以及越狱/防护栏绕过。

它专门涵盖 MCP 服务器安全吗？

有——它收录了“MCP-in-SoS: Risk Assessment Framework for Open-Source MCP Servers”等论文，评估开源 Model Context Protocol 服务器部署的生产风险。

为什么把“代理技能安全”单独立为一个主题，而不是归入一般的 LLM 安全？

因为代理如今会在运行时加载外部工具、插件和技能，由此产生了技能供应链攻陷这类一般 LLM 安全资源未覆盖的风险——2026 年专门为技能层编写的 OWASP AST10 标准正体现了这一点。

What are similar projects?

safelabs-eval, Ai-jailbreak, defender, AI-Infra-Guard, awesome-rsi, nono, 0, SkillSpector

Which topics is it in?

tool-use, agent-security, owasp, supply-chain-security, prompt-injection, red-teaming, standards, llm-security, ai-safety, compliance, jailbreak, ai-security

Creator: LLMSecurity
Size: 0.9 MB
Stars: 262
Updated: CommitOct 12
Age: 7mo
Commits · 90 Days