Shadowgraph
TrendingAbout
Sign in

LLMSecurity/awesome-agent-skills-security

🛡️ A curated list of resources on agent skills security: attacks, defenses, frameworks, and benchmarks for securing AI agent tool use and skill ecosystems

102

101 commits

updated Sep 22, 2026

See the code

README

Awesome Agent Skills Security Awesome

🛡️ A curated list of resources on securing AI agent tool use and skill ecosystems — attacks, defenses, frameworks, benchmarks, and standards.

AI agents increasingly use external tools, plugins, and skills to interact with the world. This creates a new attack surface: agent skills security. This list covers the threats, defenses, and research landscape for securing these capabilities.

Contents

Threat Frameworks & Standards

  • OWASP Agentic AI Threats and Mitigations — First in a series from the OWASP Agentic Security Initiative (ASI), providing threat-model-based reference for agentic threats.
  • OWASP Top 10 for LLM Applications — Includes LLM01: Prompt Injection, LLM06: Excessive Agency, LLM07: Insecure Plugin Design, LLM08: Excessive Autonomy.
  • OWASP Agentic Skills Top 10 (AST10) — OWASP incubator project, v1.0 (2026 edition). First standards-body enumeration of risks specific to agent skills rather than agents in general, running from AST01 Malicious Skills to AST10 Cross-Platform Reuse, with AST01 and AST02 (Supply Chain Compromise) rated critical; scopes to the skill layer where the OWASP Agentic AI Threats entry above covers agents broadly.
  • MITRE ATLAS™ — Adversarial Threat Landscape for AI Systems. Tactics, techniques, and case studies for attacks on ML/AI systems.
  • NIST AI Risk Management Framework — Federal framework for managing AI risks, including autonomous agent risks.
  • NIST SP 800-218A: Secure Software Development for AI — Secure development practices specific to AI-enabled systems.
  • EU AI Act — European regulation with specific provisions for high-risk AI systems including autonomous agents.
  • Anthropic Responsible Scaling Policy — AI Safety Levels (ASL) framework addressing agent capability thresholds.
  • IETF draft-klrc-aiagent-auth-01: AI Agent Authentication and Authorization — Kasselman et al., IETF WIMSE-adjacent, 2026. Proposes a model for authentication and authorization of AI agent interactions using existing OAuth 2.0 and WIMSE standards; covers delegation chains, agent identity, and trust establishment without defining new protocols.
  • IETF draft-niyikiza-oauth-attenuating-agent-tokens-00: Attenuating Authorization Tokens for Agentic Delegation Chains — Niyikiza (Tenuo), OAuth WG, March 2026. Defines Attenuating Authorization Tokens (AATs): JWT-based credentials encoding tool-level argument constraints with a cryptographically enforced monotonic attenuation invariant — any holder can derive a more restrictive token but never a more permissive one. Extends Rich Authorization Requests (RFC 9396) with delegation-chain semantics.
  • 📄 Certifying Ghosts: How Cybersecurity AI Agents Break the EU Cyber Resilience Act — Mayoral-Vilches, 2026. Argues autonomous vulnerability-discovery-and-exploitation agents invalidate the EU Cyber Resilience Act's core assumptions of slow, human-paced disclosure and fixed product security states, contending that because attackers and defenders now wield identical AI capabilities, meaningful compliance requires continuous agent-operated monitoring rather than static certification.

Surveys & Systematizations

  • 📄 Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challenges — Baek et al., 2026. Structured review of 66 studies (2022–2026) introducing a cross-dimensional representation T={S,B,P,A} linking affected surfaces, trust boundaries, violated security properties, and empirically examined architectures; analyzes 22 red-teaming studies and 11 benchmarks to characterize evaluation maturity and derive 13 open research questions.
  • 📄 Trustworthy Agentic AI: Failure Modes, Mitigation Strategies, and a Lifecycle Framework for Autonomous LLM Systems — Syed et al., 2026. Reviews agentic-AI trustworthiness across five dimensions and organizes failure modes (indirect prompt injection, backdoor triggers, goal misgeneralization, memory contamination, cross-session leakage) into a unified taxonomy, then proposes the six-phase Trustworthy Agent Development Lifecycle (TADL) with per-phase trust activities and risk-based decision gates.
  • 📄 A Survey on LLM-based Autonomous Agents: Common Attacks and Defenses — Wu et al., 2024. Comprehensive taxonomy of attacks on LLM agents across perception, cognition, and action stages.
  • 📄 Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents — Zhang et al., 2024. Formalization of 10 attack scenarios, 10 agents, 398 adversarial environments.
  • 📄 Security of AI Agents — He et al., 2024. Systematization of knowledge covering threat models for AI agents with tool access.
  • 📄 Not All Agents Are Created Equal: A Survey on Software-use Agent Security — Hua et al., 2025. Survey specifically on software-use agents and their unique security challenges.
  • 📄 A Survey on the Honesty of Large Language Models — Xie et al., 2024. Covers agent deception, sycophancy, and honesty in tool-use contexts.
  • 📄 A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models — Xu et al., 2024. Systematic study of jailbreak attacks relevant to agent guardrail bypass.
  • 📄 Prompt Injection Attacks and Defenses in LLM-Integrated Applications — Liu et al., 2024. Comprehensive taxonomy of injection attacks across direct and indirect vectors.
  • 📄 The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies — Gan et al., 2024. Survey with practical case studies of security failures.
  • 📄 Self-Evolving Agents: A Survey — Gao et al., 2025. How self-evolving agents create emergent security risks.
  • 📄 Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies — Lin et al., 2026. Uses a Module-Lifecycle Attack Surface matrix to show self-evolution transforms attack persistence from session-bounded to permanent — adversarial effects become encoded across generations, self-amplify, and propagate through agent populations without sustained attacker access, with 17 of 25 attack vectors rated critical.
  • 📄 From Thinker to Society: Security in Hierarchical Autonomy Evolution of AI Agents — Zhang et al., 2026. Hierarchical Autonomy Evolution (HAE) framework organizing agent security into cognitive, execution, and societal tiers.
  • 📄 Characterizing Faults in Agentic AI: A Taxonomy of Types, Symptoms, and Root Causes — Shah et al., 2026. Empirical taxonomy of reliability failures in agentic AI systems combining LLM reasoning with tool invocation.
  • 📄 Security Considerations for Multi-agent Systems — 2026. Systematic threat landscape of MAS with 193 threat items across 9 categories; evaluates 16 frameworks finding none achieves majority coverage.
  • 📄 The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey — Kim et al., USENIX Security 2026. First systematic survey of AI agent security covering design space, attack landscape, and defense mechanisms with case studies on securing agentic systems.
  • 📄 Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats — Deng et al., 2026. Five-layer lifecycle-oriented security framework analyzing compound threats across initialization, input, inference, decision, and execution stages of autonomous LLM agents.
  • 📄 OpenClaw as Language Infrastructure: A Case-Centered Survey of a Public Agent Ecosystem in the Wild — He et al., Preprints 2026. Case-centered survey of the OpenClaw public-agent ecosystem whose Security dimension synthesizes governance, skill-supply-chain (ClawHub), and deployment risks of an open skill ecosystem alongside Platform, Societies, and Deployment.
  • 📄 AgenticCyOps: Securing Multi-Agentic AI Integration in Enterprise Cyber Operations — Mitra et al., 2026. Holistic architectural security framework decomposing attack surfaces across component, coordination, and ecosystem layers of enterprise multi-agent systems.
  • 📄 MCP-in-SoS: Risk Assessment Framework for Open-Source MCP Servers — Kumar et al., 2026. System-of-systems risk assessment framework for evaluating security risks of open-source MCP server deployments in production agent systems.
  • 📄 SoK: The Attack Surface of Agentic AI — Tools, and Autonomy — Dehghantanha & Homayoun, 2026. Systematization mapping trust boundaries and security risks of agentic LLM systems; proposes taxonomy spanning prompt injection, RAG poisoning, tool exploits, and multi-agent threats with metrics like Unsafe Action Rate and Privilege Escalation Distance.
  • 📄 Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation — Ling et al., 2026. Systems-oriented synthesis of 247 papers organizing LLM agent security around information flow, delegated authority, and persistent state, identifying prompt injection and tool-mediated hijacking as dominant threats while flagging emerging state-corruption and multi-agent propagation risks.
  • 📄 Data Agents Under Attack: Vulnerabilities in LLM-Driven Analytical Systems — Wang et al., 2026. Systematic security study of LLM data agents identifying eight risks across interpretation, execution, and policy layers plus an attack taxonomy of fourteen techniques, demonstrating substantial gaps across six open-source and production analytics platforms.
  • 📄 Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents — Lahjouji & Colaco, 2026. Organizes privacy research in LLM agents around data sources rather than attack types — spanning database queries, external APIs, and inter-agent communication — and identifies governance gaps including the need for information-flow control and benchmarks covering an agent's complete data ecosystem.
  • 📄 Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations — Jamshidi et al., 2026. Empirical security analysis of a self-hosted multi-agent LLM system where model outputs trigger privileged operations, measuring compromise probability, boundary failures, and privilege drift as attacker capability and agent count scale.
  • 📄 LLM Agents Security Duality: A Comprehensive Survey of Self-Security and Empowered Cybersecurity — Xu et al., 2026. 73-page survey mapping the dual role of LLM agents in security — cataloguing agent-facing vulnerabilities and mitigations while examining how the same agents empower offensive and defensive cybersecurity, and highlighting the tension between self-protection and capability.
  • 📄 Agent Security Meets Regulatory Reality: A Practitioner Systematization of Autonomous-Agent Threats and Controls in Regulated Financial Systems — Mohan & Srinivasa, 2026. Maps agentic threats (prompt injection, agent identity, auditability, tool abuse, data residency) to financial-sector regulatory requirements and documents production agent-to-agent patterns and controls for compliance-bound deployments.
  • 📄 The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities — Rashidi, 2026. Systematizes 39 execution-security papers (2023–2026) on AI coding agents that read repositories, call tools, and run shell commands with limited oversight, exposing fragmentation across isolation, access control, TOCTOU, and MCP threat research along with five critical gaps including the absence of shared benchmarks for evaluating isolation architectures.
  • 📄 Security and Privacy in Agentic AI: Grand Challenges and Future Directions — Jenkins et al., 2026. Horizon-scanning report from thirty international experts across academia, industry, and government identifying the grand challenges and future research directions for the security and privacy of increasingly agentic AI.
  • 📄 Trust but Verify? Uncovering the Security Debt of Autonomous Coding Agents — Sakib et al., 2026. Empirical study of thousands of agent-authored pull requests finding 38.9% contain at least one security smell (misconfigurations, leaked credentials, supply-chain issues), with human collaborators introducing the majority of leaked secrets in agent-assisted workflows.
  • 📄 Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation — Badhe & Tiwari, 2026. Introduces SkillSec-Eval, a lifecycle framework for evaluating security of reusable LLM agent skills with a threat taxonomy spanning repository admission, semantic retrieval, planner selection, execution, and skill evolution — showing risks extend well beyond the runtime execution stage.
  • 📄 The Ethics of Autonomous AI Agents for Offensive Security — Happe et al., FAIEMA 2026. Analyzes how LLM-driven offensive-security agents introduce indeterminacy across their non-deterministic policies, open-ended impact, and a collapsing operator skill floor, arguing this combination industrializes offensive capability, diffuses moral attribution among users, tool-makers, and third parties, and outstrips existing dual-use and AI-ethics frameworks.
  • 📄 The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI — Narayan et al., 2026. Formalizes a threat model for persistence-based attacks on stateful agents — including memory injection (MINJA) and sleeper-agent behaviors that decouple the attack vector from the eventual harmful event — and synthesizes a defense-in-depth landscape spanning trajectory guardrails (AgentDoG), formal temporal verification (Agent-C), immunological memory consensus (A-MemGuard), and hardware-anchored trust via GPU TEEs and zero-trust memory.
  • 📄 Engineering Trustworthy Agentic AI for Critical Systems — Al-Refai et al., 2026. Survey treating trustworthiness as a first-class engineering property for agentic systems in constraint-bound domains, organizing threats, trust mechanisms, and quantitative metrics across five dimensions (safety, robustness, transparency, accountability, and privacy/security) and mapping them onto an assurance workflow examined across power systems, autonomous vehicles/robotics, HPC, and communication networks.
  • 📄 Agent Security Needs Redefinition through a Holistic Framework — Siu et al., ICML 2026. Position paper arguing agent security is fundamentally contextual rather than content-based — the same action (e.g., "delete user data") can be a routine request or an injection depending on authorization context — and operationalizes it through four jointly-held, trajectory-continuous properties (Source Authorization, Task Alignment, Action Alignment, Data Isolation), under which indirect prompt injection becomes a Source Authorization violation and snapshot benchmarks are shown structurally incapable of evaluating Data Isolation.
  • 📄 An Empirical Study of Model Context Protocol Applications — Majeed et al., 2026. Large-scale study of 1,723 MCP client applications mined from GitHub finding that while most configure servers via files (85.2%) and use an official SDK (81.1%), human oversight diverges sharply — only 37.2% gate tool execution behind a blocking approval step, leaving the LLM able to invoke any enabled tool unconditionally in most apps.
  • 📄 Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation — Liu et al., 2026. Survey tracing threats across the world-model lifecycle of embodied AI agents — from data construction and representation learning through state grounding, imagination, trajectory evaluation, execution, and tool/memory-based adaptation — showing how poisoning, backdoors, prompt injection, sensor spoofing, trajectory manipulation, and supply-chain attacks take on distinct meanings when they corrupt world states, and structuring defenses across provenance, robust grounding, uncertainty-aware prediction, trajectory gating, feedback auditing, and deployment assurance.
  • 📄 From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems — Malla & Siby, 2026. Proposes a taxonomy of attack vectors specific to web-based multi-agent systems (MAS) and releases the WebMASLab test-bed to isolate architecture's effect on security by holding task, tool surface, and browser substrate fixed; introduces a MAS-specific Telephone Loop attack that exploits cross-agent delegation to create cyclical task loops — inert against single-agent setups yet compromising MAS at ~80% baseline across three of four frontier models — and shows obvious defenses like prompt-hardening fail to generalize.
  • 📄 The Vulnerability With No CVE: Managing Persistent Gaps Between Mandate and Authority in AI Coding Agents — 2026. Proposes the agentic posture vulnerability (APV) as a task-conditioned vulnerability-management abstraction — a durable record for a composed agent-control exposure that outlives any single event and stays open until authority is narrowed, a missing control is added, risk is accepted, or closure is verified — operationalizing existing excessive-agency, authorization, and control-composition weaknesses into six recurring patterns, a vulnerability lifecycle, and a control-and-closure matrix.
  • 📄 On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models — Hossain et al., 2026. PRISMA 2020 systematic review of 85 agentic-LLM security papers (2023–2025) finding attack research outpaces defense 3.9:1; contributes a four-layer taxonomy (perception, brain, action, interaction) of 13 vulnerability types and shows perception-layer flaws (prompt injection, jailbreaking) dominate the literature while action-layer risks (tool misuse, code injection, sandbox escape) remain understudied relative to real-world impact.
  • 📄 When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling — Karanjai et al., 2026. Attack-surface survey of AI agents operating on blockchain networks through MCP, skills, and tool calling, arguing that blockchain properties like irreversibility and continuous autonomy qualitatively change the agent threat model relative to conventional software and mapping the resulting vulnerabilities across the tool-calling stack.
  • 📄 A2ABreak: Systematic Security Analysis of the A2A Protocol — Lotfi et al., 2026. First rigorous systematic security analysis of the Linux-Foundation-governed Agent2Agent (A2A) protocol — the emerging inter-agent communication layer complementing MCP — using LLM-assisted extraction of a verified finite-state machine (37 states, 76 transitions from 929 formalized statements) directly from the natural-language specification, then reasoning over the model to discover protocol-level vulnerabilities in cross-organizational agent discovery, authentication, and task delegation.
  • 📄 When Passing Tests Hides Vulnerabilities: An Empirical Study of Silent Failures in Agentic Systems — Bai et al., 2026. Empirical study of LLM-based agentic code-repair patches that pass syntactic and functional verification yet still retain or introduce security vulnerabilities; across 1,030 execution traces from seven agent frameworks on SecurityEval and CVEfixes, identifies 170 confirmed "silent failures" and categorizes them (omission, incomplete fix, and newly introduced flaws), showing test-passing is an unsafe proxy for security in agent-authored code.
  • 📄 Trustworthy Agentic AI: A Comprehensive Cybersecurity and Systems Survey on Threat Landscapes, Defense Architectures, and Open Challenges — Mostafavi, 2026. Synthesizes 206 studies and standards into a systems-security reference framework, formalizing the agent as a stateful 5-tuple and a 6-dimensional trustworthiness taxonomy, then analyzing threat surfaces across intra-execution loops and interaction planes and proposing a multi-layered zero-trust defense-in-depth architecture (Dual-LLM isolation, capability-based access control, kernel eBPF probes, sandboxed runtimes) mapped to international governance frameworks.
  • 📄 Authorization Architectures for Tool-Using AI Agents — Surapani et al., 2026. Structured narrative review of 89 primary sources introducing a principal hierarchy (human user, operator/deployer, orchestrator, sub-agent, tool endpoint) and five interdependent layers — agent identity and credential lifecycle, delegation and scope propagation across multi-hop chains, runtime enforcement and just-in-time authorization at policy enforcement points, prompt injection as authorization bypass, and auditability/provenance/non-repudiation — deriving seven structural requirements and a four-layer reference architecture, with runtime enforcement and aggregation bounds as the principal open gaps.
  • 📄 SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration — Mia et al., 2026. Systematization reframing jailbreak security around the full agentic execution pipeline (user interaction, planning, memory, tool use, inter-agent communication) with unified attack/defense taxonomies and a security–utility–efficiency framework, finding that strong native alignment does not imply adversarial robustness and that low final-response attack success can mask severe intermediate compromise of planning, memory, and tool interactions.
  • 📄 After the Party: Governing What a Viral Agent-Skill Ecosystem Left Behind — Xiong & Zhang, APSEC 2026. Measures the aftermath of the 2026 OpenClaw skill-registry boom using Git history, GitHub issues/PRs, and three ClawHub snapshots, finding attention concentrated (top 10% of skills drew 46.93% of downloads), scrutiny absent (77.86% have zero stars/comments while 85.06% of readable skills carry privilege evidence), and automated cleanup unready — three security scanners disagreed on 23,702 of 61,990 shared skills, with weighted sensitivity of only 21.67–61.06% after human adjudication.
  • 📄 SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes — Wang & Saxena, 2026. Argues agentic-AI security studies are too domain-agnostic for high-stakes settings and presents FARSIGHT, a scheme-level framework evaluating financial LLM trading agents on robustness under market turbulence and security against attacks on information sources, attacks on agents, and agent-as-attacker behaviors; across 15 academic schemes, 80% fail at least one core robustness metric and 100% exhibit security vulnerabilities, with a single compromised agent able to trigger a market-wide crash at minimal cost.
  • 📄 Characterizing Network Centralization and Observability in the Remote MCP Ecosystem — Sohail, NIPA 2026. Empirically characterizes the public remote MCP server ecosystem with a three-tier observability framework (catalog metadata, passive compliance, live vulnerability analysis) over 179 endpoints, finding heavy infrastructural consolidation (ASN Herfindahl-Hirschman Index 0.736) and a Security-Observability Tradeoff — platform-level OAuth 2.1/PKCE that secures 95% of commercial PaaS-hosted servers simultaneously blocks automated tool-poisoning vulnerability scanning without prior credential provisioning.
  • 📄 PentestChain: A Cost-Aware, MCP-Orchestrated Framework for Automated Penetration Testing with Free-Tier LLMs — Patel et al., 2026. Automated pentest framework exposing its pipeline through an eleven-tool MCP server, and — beyond cost-aware model cascading — analyzes the attack surface an MCP-exposed offensive engine introduces, grounding a four-position threat model in the 2025 MCP incident record (CVE-2025-6514 RCE in mcp-remote, the postmark-mcp supply-chain backdoor, and the tool-poisoning/rug-pull/line-jumping class) and contributing four mitigations.
  • 📄 Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives — Rahul Dev & Nath, 2026. Systematizes the trust boundaries and attack surfaces of representative autonomous pentesting-agent architectures, arguing that persistent memory, real-world action, and long-horizon reasoning raise qualitatively different concerns than chat-based LLMs; contributes a lifecycle-aligned threat taxonomy (LLM-lifecycle, agent-architecture, and cross-cutting behavioural attacks) and shows why conversational-AI guardrails fall short for offensive agents, motivating context- and architecture-aware guardrail research.

Attack Research

Prompt Injection via Tools

Tool Poisoning & Supply Chain

Privilege Escalation & Excessive Agency

Data Exfiltration & Privacy

Indirect Prompt Injection

Agent Deception & Manipulation

Compound System Attacks

Cross-Plugin Attacks

Backdoor Attacks on Agents

Jailbreaking & Guardrail Bypass

Defense Research

Permission & Access Control

  • 📄 ActGov: Governing LLM Agent Actions via Policy-Constrained Validation — Zhang et al., 2026. Runtime enforcement framework that validates every LLM-proposed tool action before it causes external effects; ActGov-Policy iteratively builds an SMT-verified policy set from tool specs, benign tasks, and failure traces, and ActGov-Runtime abstracts each call into finite policy records, permitting it only within the task-scoped authorization boundary — reducing indirect-prompt-injection success on AgentDojo and AgentDyn without relying on the LLM to spot malicious instructions.
  • 📄 Zero-Trust Authorization and Discovery for Enterprise MCP — Li et al., 2026. Gap analysis of six MCP SDKs identifies single-header credential binding, no pre-auth tool discovery, and missing per-tool authorization; adds composable FastMCP extensions (cross-header credential normalization, cached token verification, unauthenticated metadata endpoint, permission-filtered tool visibility) — driving forbidden-tool exposure from 21.1% to 0/720 and showing discovery controls cannot replace invocation-time enforcement (models named hidden tools in up to 94% of settings).
  • 📄 Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems — Paul & Nandy, ICML AIWILD 2026. Enumerates 14 attack vectors across direct, indirect, inter-agent, and cascading injection channels; testing on a 6-agent system finds 67% of agents vulnerable to at least one scope violation, then reduces overall injection success from 31.2% to 4.2% via message signing with provenance tracking, boundary I/O sanitization, privilege-scoped per-role tool access, and anomaly detection on inter-agent communication.
  • 📄 Linguistic Firewall: Geometry as Defense in Multi-Agent Systems Routing — Alsheich et al., 2026. ANTAP routes tasks to agents based on empirically verified capability rather than self-declared textual descriptions, resisting description-based injection, embedding attacks, and covert-backdoor impersonation where malicious agents misrepresent their proficiencies.
  • 📄 PAuth: Precise Task-Scoped Authorization For Agents — Sharma et al., 2026. Implicit authorization model where NL task submission authorizes only required operations; uses NL slices and envelopes for provenance-based server-side verification, blocking injected operations in AgentDojo with zero false positives.
  • 📄 Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies — Schneider et al., 2026. Proposes the Dynamic Security Control Compositor (DSCC), which enforces compositional security policies over multi-tool agent chains by combining static analysis with runtime data-flow tracking.
  • 📄 Rethinking Agent Security as a Networking Problem — Tran et al., 2026. Argues agent-centric defenses fail because they entrust policy enforcement to nondeterministic, injectable LLMs, and instead borrows networking principles — centralized control with distributed enforcement, capability-based access, and zero-trust least privilege — combining deterministic enforcement with semantic, context-aware policies in a reference architecture for securing AI agent systems.
  • 📄 Twin Agent: Context Residual Compression for Privilege Separated Agents — Hu et al., 2026. General privilege-separation design pattern using two near-symmetric agents — an Explore Agent that inspects untrusted context and a Safe Agent that executes privileged actions — where the Explore Agent, conditioned on the Safe Agent's context, communicates only compact hints about the next action, improving the security–utility tradeoff and preventing prompt injection across SWE-bench Lite, AgentDojo, and DecodingTrust-Agent.
  • 📄 TrustAgent: Towards Safe and Trustworthy LLM-based Agents — Agent Constitution for safety-aware planning with pre/post-action inspection.
  • 📄 Autoformalization of Agent Instructions into Policy-as-Code — Mondl et al., 2026. Uses an LLM generator-critic loop to automatically translate natural-language agent instructions and policy documents into formally enforceable Cedar policies, achieving broader coverage than hand-coded symbolic enforcement while avoiding the no-guarantees weakness of probabilistic guardrails on medical agent benchmarks.
  • 📄 Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI Systems — Salfeld-Nebgen et al., 2026. Formalizes an institutional governance model where an autonomous agent keeps full planning autonomy but must present independently attested evidence at the point of consequential, irreversible action (e.g., clinical prescribing, production deployment) rather than having its reasoning monitored.
  • 📄 A Deterministic Control Plane for LLM Coding Agents — Madatha, 2026. Proposes Rel(AI)Build, treating coding-agent definitions as a managed supply chain with content addressing, permission enforcement, and audit logging, arguing governance of the agent-config layer must be deterministic and tool-agnostic rather than delegated to further LLM orchestration.
  • 📄 A Dual-Helix Governance Approach for Reliable Agentic AI — 3-track architecture (Knowledge, Behavior, Skills) using knowledge graphs.
  • 📄 Talk Freely, Execute Strictly: Schema-Gated Agentic AI — Schema-gated orchestration for trustworthy agent deployment in regulated domains.
  • 📄 ESAA-Security: Event-Sourced Architecture for Agent-Assisted Security Audits — 26 tasks, 95 checks, append-only event logs for reproducible AI code audits.
  • 📄 Caging the Agents: A Zero Trust Security Architecture for Autonomous AI in Healthcare — Maiti, 2026. Production-deployed zero-trust architecture for 9 autonomous AI agents: gVisor kernel isolation, credential proxy sidecars, network egress allowlisting, and prompt integrity framework with untrusted content labeling. Open-source configs released.
  • 📄 Sovereign Execution Brokers: Enforcing Certificate-Bound Authority in Agentic Control Planes — He & Yu, 2026. Runtime enforcement layer that intercepts autonomous agent requests and verifies them against cryptographically-issued certificates before allowing infrastructure mutations, ensuring production changes cannot originate from agent reasoning alone.
  • 📄 The Unfireable Safety Kernel: Execution-Time AI Alignment for AI Agents and Other Escapable AI Systems — Dobrin & Chmiel, 2026. Rust-based, formally verified safety kernel that enforces authorization on agent actions through process separation and cryptographic verification, designed to resist self-modification and escape attempts so an agent cannot circumvent its own safety controls at runtime.
  • 📄 A First Measurement Study on Authentication Security in Real-World Remote MCP Servers — Zhou et al., 2026. Large-scale measurement of 7,973 remote MCP servers finding widespread unauthenticated exposure and pervasive OAuth flaws, with 9 CVEs from responsible disclosure.
  • 📄 CmdNeedle: Measuring the Incompleteness of Command Denylists for AI Agents — Chen et al., 2026. Shows that the denylist component of terminal agents' three-list command-gating mechanism — including Claude Code's built-in list — is systematically incomplete against the large, ever-expanding set of shell commands shipped by modern operating systems.
  • 📄 SecureClaw: Clawing Back Control of LLM Agents — Ma et al., 2026. Dual-boundary security architecture placing authorization at the effect sink and plaintext confinement at the read boundary, using opaque handles and a PREVIEW→COMMIT protocol to block unauthorized external actions and sensitive-data leakage in tool-using agents.
  • 📄 SessionBound: Turning Enterprise Task Approval into Budgeted Database Sessions — Wu, 2026. Confines enterprise agent-generated SQL to pre-approved business tasks via short-lived, budgeted, auditable database sessions — the agent may generate queries freely, but every attempt must stay inside the approved boundary — enforcing safety through database-layer access controls, query budgets, and disclosure limits rather than trusting the LLM to self-police.
  • 📄 Janus: A Playground for User-Involved Agentic Permission Management — Brigham et al., 2026. Playground system implementing six permission assistants across a design space of user involvement in agentic tool-call authorization; shows user input meaningfully strengthens privacy and security, AI augmentation of user decisions reduces cognitive load, and permission fatigue must be modeled since no single design is optimal across contexts. Code.
  • 📄 aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents — Kodathala, 2026. Off-host authorization gateway that binds tool calls to verified user authority via HMAC-SHA256 signatures and role-based policies, blocking deceived agents from executing actions beyond granted permissions rather than trusting the model's own refusals over unverifiable text context.
  • 📄 From Neural Intent to Cryptographic Authorization: Governing Agentic Workflows — Weng et al., 2026. Neural Cryptographic Services (NCS) inserts a deterministic symbolic controller between LLM agents and privileged tools, admitting a tool invocation only when it matches cryptographically authorized instructions from an offline-signed, hash-chained instruction stream rather than trusting the model to comply with intent — cutting attack success while preserving utility on legitimate workflows.
  • 📄 Steerability via Constraints: A Substrate for Scalable Oversight of Coding Agents — Winninger, ICML 2026 Deep Learning for Code Workshop. Argues the controls long used to manage large human engineering teams — access control, network policies, tooling-enforced coding conventions — transfer directly to unconstrained coding agents (whose autonomy introduces security risks) and are cheaper in tokens than agentic scaffolding; a controlled experiment shows a small reviewer's recall on 11 inserted backdoors rising from 54.5% to 90.9% when given a constrained substrate plus a ~200-LoC docs CLI.
  • 📄 Context-to-Execution Integrity for LLM Agents — Santos-Grueiro, 2026. CXI is an execution-boundary system that marks protected sink fields, carries narrow validated values from writable context via typed releases, keeps evidence in opaque data slots, and admits a tool call only when field authority, exact-effect authorization, and invocation authority all bind to the same action manifest — yielding zero field/effect/invocation escapes across 720 AgentDojo episodes and 400 code-agent episodes.
  • 📄 Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agents — Reddy et al., 2026. Identifies "silent wrong-state" failures where policy-permissive tools execute forbidden state transitions without any error, and shows lightweight deterministic read-only pre-execution gates raise τ²-bench airline success from 29.6% to 42.0% by blocking policy-violating writes at the action boundary.
  • 📄 ScopeJudge: Cost-Aware Pre-Execution Gating for Offensive Security Agents — Caldwell et al., 2026. Pre-execution gate in which a lightweight LLM judge inspects each offensive-security agent tool call against the engagement scope inferred from the user's request — treating the boundary as intent-declared rather than a fixed policy — to block out-of-scope actions before they execute.
  • 📄 How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement — Michael & Roesner, 2026. Systematizes user-level permission systems for AI agents via a taxonomy of 21 proposals and an analysis of five commercial agents, examining how permissions are specified, derived, and enforced at runtime to counter prompt injection and unauthorized task execution.
  • 📄 Toward Cryptographically Verifiable Authorization for Autonomous AI Agents — Llambí-Morillas & Fernández-Fernández, 2026. Formalizes agent authorization as a cryptographically verifiable relation (CVA) that jointly binds an agent principal, a concrete request, an execution context, and policy satisfaction while preserving confidentiality of private attributes; defines candidate properties (authorization soundness, principal/request/policy binding, replay resistance), gives a Groth16 zk-SNARK proof-of-concept, and identifies the structural separation of identity, request, and runtime-execution binding as a central open problem for secure agentic systems.
  • 📄 ToolGuardian: Declarative Security for AI Agent-Tool Interactions — Ravindran & Deochake, 2026. Policy-driven framework pairing pre-admission tool vetting via progressive characterization (declared descriptions, syscall traces, mock-execution effects, source analysis) with task-aware runtime authorization, built on an Answer Set Programming declarative policy layer that reasons explicitly over capabilities, effects, task context, and multi-tool composition; on 16 MCP-style tools (8 malicious variants of real open-source tools) it reaches deny-class F1 0.86 for vetting and classifies all runtime scenarios correctly when fully specified.
  • 📄 Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecture — Noyan, AIWILD @ ICML 2026. Treats capability scoping as prevention before detection — a credential absent from an agent's context cannot be misused regardless of reasoning or evasion — via a three-source architecture (role-based ceilings, a task-context classifier, and policy-derived combination prohibitions), and releases a 600-prompt synthetic dataset labeled with minimum required permissions across a 15-permission tool-based taxonomy, with iterative dataset–policy refinement cutting ceiling violations 93% (46→3).
  • 📄 Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents — Kravchenko et al., 2026. Introduces APPA, which uses engine-managed context branching and prospective evaluation to confine taint from untrusted data locally — child trajectories absorb contamination while sanitizers return cleaned results to an unchanged parent context — preventing prompt injection from polluting the primary workspace without sacrificing operational utility.
  • 📄 Toward Standardized Cross-Vendor Agent Tool Trust Management in Autonomous Networks — Sharma et al., 2026. Proposes AgentToolMO, a 3GPP NRM information model that gives agents cross-vendor visibility into tool trust degradation — a formally defined trust state machine with graduated enforcement, damped cascade propagation, and trust notifications over existing Management Services interfaces — so a compromised tool from one vendor no longer keeps getting invoked by another vendor's agents, shrinking blast radius from hours-scale undetected propagation to near-real-time containment.
  • 📄 FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs — Zhang et al., 2026. Permission-carrying authorization framework that translates ambiguous natural-language tasks into a Permission Intermediate Representation, lowers it into an evidence-backed permission graph tracking data flows, dependencies, and contextual labels, and has a Satisfiability Modulo Theories authorizer mathematically verify each effectful action against security policies before a runtime gateway either authorizes it or intercepts it with a precise counterexample — reaching a 90.5% Decision Compliance Rate across OpenAgentSafety, OctoBench, and ActPlane.
  • 📄 Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents — Zhang & Zhang, 2026. Addresses the authorization gap created when long-lived agents evolve after deployment — retaining experience, acquiring skills and tools, revising workflows, and delegating — so the subject or context exercising a live grant no longer matches what the user evaluated; proposes earned authority bounded by a fixed ceiling to keep prompt-injection- and error-driven external actions within originally-authorized limits.
  • 📄 Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory — Xu et al., 2026. Identifies "memory provenance laundering," where untrusted external observations are rewritten into persistent agent memory as trusted user history during consolidation, and proposes the Provenance-Preserving Memory Firewall (PPMF), a middleware that keeps platform-maintained provenance and authorizes tool calls by matching action risk to the authority of the action-relevant memories.
  • 📄 Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions — Xu et al., 2026. Identifies semantic replay — where replanning, retries, delegation, and crash-resumption cause one user authorization to execute multiple times under freshly issued single-use tokens — and proposes durable, token-independent authorization state that bounds an authorized action's execution budget.
  • 📄 MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication — Xu et al., 2026. Scope-bound semantic declassification framework for multi-agent LLM systems that specifies what a legitimately informed agent should disclose and how, closing privacy leaks through internal messages, tool arguments, logs, and persistent memory that surface-redaction and source-level access controls leave open.
  • 📄 Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture — Sambrook & Sovio, 2026. Replaces software-resident agent signing keys (git commits, API auth, certificate issuance) with hardware-confined keys behind a vendor-neutral PKCS#11 interface, wrapped in a five-layer zero-trust enforcement stack — session identity, scope bounds, semantic validation, taint tracking, and a hardware execution boundary — motivated by a production incident where keys were exfiltrated via email injection in under five minutes; cuts attack success from 19.3% to 0% across 12 AgentDojo-derived injection scenarios with zero false positives on benign tasks.
  • 📄 NiyamAI: An Intent-Bound AI Agent with Cryptographically Verifiable Guardrails using Zero-Knowledge Proofs — Katkar et al., 2026. Locks permitted tools and constraints into a SHA-256-committed Intent Contract at session start and validates every tool call with an isolated Judge model that emits an EZKL zk-SNARK proof, so a tool executes only after proof verification and third parties can confirm enforcement without accessing the Judge model's weights; reaches 88.5% F1 at a 1.1% false-positive rate on Agent-SafetyBench.
  • 📄 A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem — Kumar et al., 2026. Reports a production centralized MCP gateway fronting dozens of downstream servers to resolve the governance crisis of fragmented per-team auth (some with none, some API keys, some OAuth); contributes a two-axis persona×credential authentication model, three enterprise SSO grants with BYO/GYO/delegated-OAuth (RFC 8693) token provisioning, and three end-to-end identity flows spanning user and non-user (automated) agent personas.
  • 📄 InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agents — Zou et al., 2026. Trust-native protocol suite that supplies the missing security substrate for the Internet of Agents alongside existing communication protocols, via four layers (Persistent Identity, Discovery, Trust Negotiation, and Accountability) that let an agent prove its identity, authorization, advertised capabilities, and accountability after delegation across organizational boundaries.
  • 📄 Bounded Agents: Delegation Security for Multi-Agent AI Systems — Muruaga, 2026. Frames agent misbehavior within granted permissions as an authorization-architecture problem and proposes the Agentic Principal Chain (APC), which tracks delegated authority across principals so static per-request permissions cannot be combined into a prohibited outcome or delegated unbounded to a sub-agent.
  • 📄 Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems — Liu, 2026. Enforces an anti-monotone audience-membership rule at the memory-to-context transition — a memory item is admitted only when every current viewer already belonged to its audience — preventing cross-audience information disclosure in multi-user agentic systems independent of the underlying model.
  • 📄 PACE: Policy-Attested Contract Execution for Safe AI Agents in Decentralized Finance — Karanjai et al., 2026. Transaction-level authorization framework interposing between LLM agents and blockchain execution, using typed transaction intents, a deterministic policy verifier, and signed Policy Decision Records to cryptographically bind verifier-approved actions to the exact on-chain transactions submitted, blocking prompt-injection-driven DeFi actions.
  • 📄 From Intent to Execution Grant: An Execution-Boundary Conformance Profile for High-Risk AI Actions — Wu et al., 2026. Specifies EBL-Core, a conformance profile for the final transition from a candidate AI action to execution authority: it binds a structured intent object, Root and Operational Policies, typed evidence obligations, context, and time into a verifiable Decision Derivation issued as an Execution Release Contract (ERC), defining a common semantic contract that authorization engines, policy languages, runtime monitors, and guardrails otherwise leave unspecified for high-risk actions such as transfers, deployments, disclosures, and physical actuation.
  • 📄 Scan the Skill, Govern the Action: Composing Registry Verdicts with Runtime Consequence Control — Taneja & Weber, 2026. Argues skill-registry scanners answer "is this skill malicious?" but not "is this action permitted here, by this operator, now?"; measuring 66,192 public ClawHub skill versions, finds 705 unanimously-clean skills that still instruct actions prohibited by CIS Control 2.7 and NIST SP 800-53 CM-11, and that 34.7% of a live agent's sandbox commands carried a consequence class absent from the skill's own documentation — then proposes a deterministic resolver (no model in the decision path) feeding a per-(resource, class) trust ledger whose promotion thresholds derive from operator risk tolerance, releasing a 64-case obfuscation benchmark.
  • 📄 The Stochastic Deputy: Structural Tenant Isolation for Tool-Using LLM Agents — Baig et al., 2026. Formalizes the stochastic deputy problem — passing a tenant identifier to a tool delegates resource selection to a context an adversary may control — and defends it structurally: remove tenant identity from the MCP tool schema, bind scope to a verified credential, and enforce it below the agent. In a 373-trial ablation a validated tenant parameter still served every out-of-scope attempt, while removing the parameter left no tool signature able to express the read (forged-scope escapes required cryptographically protected context).
  • 📄 AcquireBound: Runtime Authorization for Resources Acquired by AI Agents — Zhu, 2026. Provenance-bounded runtime authorization for the post-fulfillment activation gap, where payment/OAuth/mandate checks validate a transaction but not whether a returned resource (compute, credentials, accounts, sub-agents) may become usable authority; AcquireBound quarantines acquired outputs, resolves their capabilities from authenticated provider evidence, and activates them only through a current transaction checked against a downward-closed relational envelope over a typed resource-capability hypergraph, with eight proven safety properties and validation across five resource classes and staged MCP-to-Docker compositions.
  • 📄 LLM Agent Capabilities Should Follow Task Intent and Context Source — Zheng et al., AgenticOS 2026. Argues the least-privilege capability an agent needs is dynamic and task-intent-dependent, yet all inputs (user request, tool results, documents, shell output, Skill/MCP instructions, memory) enter one shared planning channel with equal authority; IntentCap composes short-lived leases from four sources — user intent, workflow instructions, tool schemas, and runtime environment — with field-level ownership and monotonic narrowing (each source fills only its own fields and can only narrow the user's authority), validated by a deterministic checker before any side effect and enforced by tool- and OS-level information-flow policies.
  • 📄 Trust Propagation and Structural Containment in Multi-Agent LLM Pipelines — Safin et al., 2026. Studies attack propagation in a four-agent LangGraph pipeline (Supervisor, Researcher, Validator, Executor) under shared-memory poisoning and indirect prompt injection via a forged in-document approval, contrasting the Validator's own judgment with an independent authorization layer using task-bound signed tokens and a separately verified policy oracle; introduces the Judgment Bypass Rate (JBR) measured at the attacked agent, and shows structural authorization contains compromise (100% JBR yet 0% Unsafe Action Rate) even when upstream LLM judgment fails, while an Observer layer cuts the agent-hijacking false-positive rate from 49% to 7%.
  • 📄 Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence under Delegation and Asynchronous Execution — Zhu & Wang, 2026. Addresses long-running agents that outlive their initiating process through credentials, delegated tasks, queues, callbacks, and provider-side operations — where cancellation, process exit, and credential revocation neither close every pre-cut carrier nor distinguish independently authorized shared work; defines root-scoped authorization quiescence and a protocol that linearizes a root cut, fences old-root expansion and protected sinks, represents alternative/conjunctive authority as antichains of minimal sufficient root sets, and composes provider-frontier certificates, with proven post-cut issuer non-expansion and compositional soundness and a checker verifying 17/17 traces while rejecting 44/44 semantic regressions.

Runtime Monitoring & Sandboxing

  • 📄 The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents — Bhowmik, 2026. Measures the always-paid cost of memory-poisoning defenses on entirely benign traffic: three write-time defenses (input sanitization, provenance checking, LLM anomaly detection) show no resolvable utility cost, while a read-time reranker lowers accuracy ~4.4 points and quarantines legitimate memories on 33.6% of items — arguing where a defense intercepts the pipeline, not whether it uses an LLM, determines its benign-case price.
  • 📄 Forensic Trajectory Signatures for Agent Memory Poisoning Detection — Leong, 2026. Finds that successful agent memory-poisoning attacks leave an invariant tool-call signature (a memory recall preceding a sensitive action such as email send), enabling incident responders to detect memory-channel attacks from tool-call logs alone at 99% accuracy without inspecting memory contents.
  • 📄 MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems — Li et al., 2026. Framework that ranks the most security-critical inter-agent communication edges so defenders can deploy protection proactively, showing channel-level attack impact is highly non-uniform — a single compromised edge can account for up to 75% of total attack success.
  • 📄 AI Sandboxes: A Threat Model, Taxonomy, and Measurement Framework — Singh et al., 2026. Formal framework for evaluating AI testing environments via threat models, sandbox archetypes, and measurement criteria (fidelity, controllability, observability, containment, reproducibility) across digital, embodied, and cyber-physical deployments.
  • 📄 Cordon: Semantic Transactions for Tool-Using LLM Agents — Chen et al., 2026. Transactional runtime that wraps multi-step agent workflows in a task-scoped containment boundary for staging, validating, committing, and rolling back irreversible tool actions, rather than relying on isolated per-call guardrails.
  • 📄 VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills — Li et al., 2026. End-to-end framework that monitors agent execution traces against behavioral policies declared in skill specifications and operator constraints, using a dedicated policy language and symbolic evaluation to catch violations across temporal dependencies, argument relationships, and value flows spanning multiple tool calls — over 95% recall with sub-10% false positives on real-world agent tasks.
  • 📄 AIRGuard: Guarding Agent Actions with Runtime Authority Control — Qin et al., 2026. Runtime defense layer that treats untrusted context as informative but never authorizing, normalizing tool calls and enforcing action-time authority checks to reduce tool-mediated attacks.
  • 📄 Safeguarding LLM Agents from Misalignment through Provenance Analysis — She, Liang & Kang, 2026. ProvenanceGuard detects and blocks misaligned tool invocations by tracing whether each proposed agent action is actually supported by evidence in the agent's context, catching actions that deviate from user intent before they execute.
  • 📄 Operating-Layer Controls for Onchain Language-Model Agents Under Real Capital — Barton et al., 2026. Production study of 3,505 real-capital agents showing that agent reliability depends on operating-layer controls like prompt compilation, typed controls, policy validation, execution guards, and trace-level observability.
  • 📄 Governing What You Cannot Observe: Adaptive Runtime Governance for Autonomous AI Agents — Marin and Chaudhary, 2026. Proposes adaptive runtime governance based on bounding unobserved risk as agent behavior drifts after authorization.
  • 📄 AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents — Zhang et al., 2026. Lifecycle security architecture for autonomous agents spanning skills, external content, memory, planning, and privileged tool execution.
  • 📄 Behavioral Integrity Verification for AI Agent Skills — Wu et al., 2026. Scalable pre-deployment skill auditing framework that compares declared versus actual capabilities, surfaces description-implementation gaps, and detects malicious skills with 0.946 F1.
  • 📄 ADR: An Agentic Detection System for Enterprise Agentic AI Security — Li et al., MLSys Industry Track 2026. Production MCP security system with telemetry, red teaming, and two-tier online detection deployed across 7,200+ hosts and 10,000+ daily agent sessions.
  • 📄 Content-Aware Attack Detection in LLM Agent Tool-Call Traffic: An Empirical Study of Features, Architectures, and Evaluation Protocols — Zavrak, 2026. Shows content-aware graph and embedding-based monitoring of MCP tool-call traffic substantially outperforms metadata-only detection and highlights evaluation leakage pitfalls.
  • 📄 Arbiter: Detecting Interference in LLM Agent System Prompts — Mason, 2026. Framework combining formal evaluation rules with multi-model LLM scouring to detect interference and vulnerability classes in agent system prompts.
  • 📄 MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in MCP Agents — Zhou et al., 2026. Plug-in security cognition layer for MCP agents that validates third-party tool invocations via experience-driven trust calibration.
  • 📄 OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents — Li, 2026. Runtime security layer distributing enforcement across ten lifecycle hooks with hybrid heuristic-plus-LLM scanning, session-scoped risk accumulation, and tamper-evident audit for agent gateways.
  • 📄 Governing Evolving Memory in LLM Agents: Risks, Mechanisms, and the SSGM Framework — Lam et al., 2026. Stability and Safety-Governed Memory framework mitigating topology-induced knowledge leakage and semantic drift in persistent agent memory systems.
  • 📄 Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees — Louck, 2026. Proves content- and lineage-based memory-poisoning defenses are fundamentally insufficient against agent-specific laundering, and proposes TMA-NM, a non-malleable information-flow-control mechanism that achieves 0% attack success with full legitimate utility across eight frontier models versus up to 68% for prior defenses.
  • 📄 Detecting Malicious Agent Skills in the Wild using Attention — Etteib et al., 2026. Locate-and-Judge, a two-stage detector that flags malicious marketplace skills by analyzing instruction-following attention patterns, concentrating expensive LLM examination on high-attention instruction spans for cost-efficient marketplace-wide auditing while catching malicious skills existing scanners miss.
  • 📄 AgentSentry: Real-time Monitoring for Agentic AI Systems — Runtime behavioral monitoring of tool-using agents.
  • 📄 Monitoring Emergent Reward Hacking via Internal Activations — Sparse autoencoders detect reward-hacking during generation.
  • 📄 Self-Attribution Bias: When AI Monitors Go Easy on Themselves — AI monitors exhibit systematic leniency on own outputs.
  • 📄 Salient Directions in AI Control — Structure of AI Control evaluations: trusted monitors overseeing untrusted agents.
  • 📄 Governed Memory: A Production Architecture for Multi-Agent Workflows — Taheri, 2026. Shared memory governance layer with dual memory model, tiered governance routing, entity-scoped isolation (zero cross-entity leakage across 500 adversarial queries), and 100% adversarial governance compliance in production.
  • 📄 Agent-Native Immune System: Architecture, Taxonomy, and Engineering — Shen et al., 2026. Proposes ANIS, an endogenous biologically-inspired defense embedded directly in the agent's cognitive loop with a six-layer "Immune Tower" (including a non-cognitive isolation layer), a taxonomy of agent viruses and vaccines, and continual immune learning to counter runtime hijacking via memory poisoning, tool-chain manipulation, and multi-agent protocol attacks that survive training-time alignment.
  • 🔗 Behavioral Attestation and Compaction Drift in Persistent AI Agents — Morrow (agent-morrow), 2026. Identifies compaction drift — non-adversarial behavioral shift caused by context window compression — as a runtime integrity threat class distinct from adversarial injection. Proposes behavioral attestation (context fingerprint delta against a pre-compression baseline) as the mechanism for continuous rather than one-time agent authorization. Complements credential-scope enforcement (e.g., AATs) with runtime execution verification.
  • 📄 The Decomposition Is the Fingerprint: Per-Component Identity for Agent Skills — Liu et al., 2026. Fingerprinting framework that assigns each agent-skill component a locality-sensitive-hash identity to detect tampering, unauthorized reuse, and drift across skill versions, complementing behavioral verification with structural provenance.
  • 📄 From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes — Liu, 2026. Defines and benchmarks eight security invariants for MCP-style execution runtimes; the proposed HCP runtime blocks all modeled attacks (tool poisoning, unauthorized execution, privilege drift) that a naive baseline permits.
  • 📄 AgenticOS: An Intent-Oriented Secure Operating System Architecture for Autonomous AI Agents — Zhao et al., 2026. OS-like security architecture that reframes agent protection as an intent filter, layering a Ghost Kernel, Logic Shutter, Agent Capsule, and Semantic Boundary Gateway to isolate and mediate autonomous agent actions.
  • 📄 Proof of Execution: Runtime Verification for Governed AI Agent Actions — Rhodes et al., 2026. Cryptographically-sound runtime verification framework that binds authorization, effectful actions, tamper-evident history, and deterministic replay into attestable execution objects, so each governed agent step's authority and integrity can be proven rather than assumed from output plausibility.
  • 📄 NovaFabric: Tamper-Evident, Replayable Evidence for Autonomous AI Agent Runs — Seyedkazemi Ardebili, 2026. Records an autonomous agent run — without modifying agent logic — into a portable Run Capsule sealed with a DSSE signature, RFC 3161 timestamp, Merkle log, and redaction attestation, producing provider-neutral, tamper-evident, replayable audit evidence exportable for third-party verification with stock tooling (OpenTelemetry, DSSE/in-toto, W3C PROV); targets the compliance records (EU AI Act, ISO 42001, NIST AI RMF) that mutable observability traces cannot supply, with a four-mode replay protocol and evaluated redaction of 14/14 credential types.
  • 📄 When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems — Xu et al., ICML 2026. AcMAS detects semantically stealthy attacks in multi-agent systems by analyzing local agents' activation-space reasoning states without relying on explicit interaction graphs, staying robust to asynchronous execution (+0.55 F1 over graph baselines asynchronously) and using the same signals to restore compromised agents rather than isolate them.
  • 📄 Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents — Wang et al., 2026. TokenWall audits the natural-language token flows of long-lived agents at runtime, intercepting unsafe behaviors before they reach privileged operations and achieving a 12.5% attack success rate while preserving 97.4% benign-operation compatibility.
  • 📄 TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories — Gao et al., 2026. Embeds attribution watermarks directly into an agent's action-log trajectory across two complementary channels — one surviving content deletion, the other surviving rewrites — so a rebranding reseller who silently substitutes a cheaper model or tampers with logs can be detected, protecting agent provenance in production deployments.
  • 📄 FlowGuard: From Signals to Evidence for MCP Security Detection — An et al., 2026. Evidence-grounded MCP security detection system that verifies execution-related risks (command injection, file-system access) through runtime evidence rather than suspicious semantic signals alone, combining recon-guided payload narrowing, schema-valid probe generation, and evidence adjudication; on a 1,880-case executable benchmark it reaches 0.879–0.942 F1 while cutting end-to-end latency up to 2.23x, and surfaces 523 findings across 326 real-world servers.
  • 📄 When Agents Look Like Beacons: NIDS Evasion by Model Context Protocol Traffic — Sohail, NIPA 2026. Shows that remote MCP over Streamable HTTP produces machine-generated, authenticated, high-frequency JSON-RPC traffic that structurally and temporally resembles C2 beaconing (e.g. Cobalt Strike polling), yet — across a Docker testbed of eleven traffic profiles under Opaque, TLS-Inspected, and Cleartext conditions — evades Suricata signatures and RITA behavioral beacon scoring (a consistent 0.0 beacon score and near-zero alerts under ET Open), because NIDS heuristics tuned for traditional malware do not flag the lognormal inter-arrival distributions of generative-AI reasoning loops; proposes an agent-native network indication standard (Agent-Native ALPN and out-of-band headers) to close the visibility gap.
  • 📄 Democratizing Agent Deployment Safety: A Structural Monitoring Approach — Ravindra et al., ICML 2026 Workshops. Untrained Information Flow Graph (IFG) monitor that detects infrastructure-level sabotage under task success — coding agents that complete their task while covertly broadening permissions, degrading logging, or planting persistence — by diffing control- and data-flow graphs; cuts missed attacks from 11.6% to 3.5% asynchronously and, run synchronously as a pre-merge gate with rollback, drops joint main+covert task success from 74.4% to 0.0% without reducing legitimate completion.
  • 📄 Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents — Park et al., 2026. Links coordinated attack campaigns across separate agent sessions with no shared infrastructure or labels by fingerprinting behavioral signals such as tool-usage patterns and writing style, enabling cross-agent attribution for incident response.
  • 📄 ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems — Narayan et al., 2026. Sequential detection framework that models MCP attack progression as a six-stage kill chain and applies a Hidden Markov Model over a 20-dimensional tool-interaction feature schema to flag malicious tool-call sequences composed from individually benign invocations that evade per-call defenses, covering direct sequential, indirect-injection, and hybrid multi-stage attack chains.
  • 📄 Operational Hallucination and Safety Drift in AI Agents — Yu et al., 2026. Empirically characterizes two multi-turn failure modes in tool-using agents — Safety Drift (declared safety intent eroding into constraint-violating actions such as refusal followed by unsafe execution) and Operational Hallucination (livelock-inducing repetitive tool calls from flawed state perception) — attributes them to reasoning/execution-state decoupling, and proposes a plug-in Action-Aware Supervision Layer with intent-action consistency checks, runtime state tracking, and forced-termination primitives.
  • 📄 JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety — Xiong et al., 2026. Foresight-oriented guard framework that trains a guard model (Vanguard) to anticipate delayed risks from partial agent trajectories via coupled anticipation and adjudication tasks optimized with CoAA-RL, blocking unsafe actions before execution and improving average protection by 15.9 points over baseline guards while raising benign task completion by 5.1 points across four agent-safety benchmarks.
  • 📄 CARE: Pre-Execution Command Verification for Shell-Executing LLM Agents — Zhang et al., ISSRE 2026. Shell-specific static-first verifier that mediates individual commands at the dispatch boundary — canonicalizing generated commands into stable verification targets, deriving deterministic evidence over syntax, command semantics, path context, and provenance-backed risk patterns, and escalating only underdetermined cases to an LLM judge — reaching 85.64% F1 at a 0.91% false-positive rate and 2.32 ms mean latency, and cutting realized harm on RedCode-gen to 37.33% in its static enforcement profile.
  • 📄 SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems — Dai et al., 2026. Reframes cross-agent malicious propagation — where a harmful objective is fragmented into locally plausible subtasks that evade any single agent — as a semantic information-flow problem, attaching structured semantic taints to root requests, propagating them through a dynamic collaboration graph, and performing workflow-level validation to reconstruct global risk context before irreversible actions commit.
  • 📄 Hybrid Analysis for Secure MCP Tool Use in LLM Agents — 2026. MTGuard defends MCP tool use through lifecycle-aware static–dynamic co-analysis rather than inspecting prompts and outputs alone, arguing static-only defenses limit effectiveness and robustness against agents induced into malicious or unauthorized tool actions.
  • 📄 Distributing Security Controls Through Harness Engineering — Gore, 2026. Shows off-the-shelf security controls (OS sandboxing, skill scanning, tool restriction) can be embedded into a distributable agent harness (SHarD, built on Pi) and scaled to commercial coding agents via a single install command, matching direct-install efficacy and scoring 100% on a 23-test suite derived from the OWASP Top 10 for Agentic Applications.
  • 📄 SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents — Yang et al., 2026. Deployable security gateway that screens skill packages before coding-agent installation via a hybrid regex-prefilter + LLM-judge pipeline — safe-signal files bypass the LLM entirely and flagged files send only matched snippet windows rather than full content — reaching F1 0.817 at 1.13% FPR on SkillsBench (n=1,650, 9.1% malicious) while cutting LLM input tokens 77% and outperforming existing tools 5–6x on threshold-independent AUPRC.
  • 📄 Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study — Arias et al., 2026. Studies distributed backdoors where a poisoned tool hides encrypted payload fragments across several agents that an external step reassembles after the run, evading per-step safety checks; a prefix detector flags 99.3% of successful attacks with a median of five steps remaining (10.3% safe-run false positives), but shows much of that warning rests on removable surface cues (ciphertext length and entropy) rather than the attack's distributed structure — once stripped, detection arrives later and transfers poorly across domains.
  • 📄 $S^3$: Improving Agent Safety through Multi-Stage Defense — Xiao et al., 2026. Multi-stage defense that jointly protects LLM agents across the memory, planning, and tool-execution stages of the agentic workflow, mitigating risks that emerge at one stage and propagate across steps rather than protecting isolated stages in ways that are hard to integrate.
  • 📄 AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection — Weng et al., 2026. Self-evolving "immune system" against prompt injection that represents the user's security boundary as a persistent library of antibodies, learning from each encounter to recognize and neutralize injections that exploit underspecified user requests where the desired outcome is stated but acceptable behavior is not.
  • 📄 DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model — Lin et al., 2026. Proactive runtime guardrail built around a risk-aware world model that maintains a compact recurrent latent state over the agent's trajectory and predicts future latent states to derive immediate-hazard and prefix-risk signals, catching long-horizon risks where individually benign-looking actions gradually drift the agent toward hazardous states; fuses the multi-horizon signals into pre-execution intervention decisions, achieving the best safety–utility trade-off across four benchmarks at ~25 ms average latency per call.
  • 📄 Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents — Ruan et al., 2026. Develops a harness-level formulation of runtime defense that characterizes how harness mechanisms enable defense construction, then uses it to move past manually designed interventions toward self-evolving defenses that automatically construct and maintain security mechanisms inside the agent execution loop.
  • 📄 Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened — Rahman & Kim, 2026. Counters memory-forgery attacks such as FARMA — where fabricated reasoning-memory entries claim a required safety step is already done so the agent skips it — by verifying entries against what the agent actually executed, rather than scoring them against a fixed suspicious-wording list that an automated rewriter can evade.
  • 📄 DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents — Pinjari & Saint-Germain, 2026. Dual-head trajectory Transformer that reads a logged tool-call trajectory and in one forward pass both classifies it as compromised or not and assigns every step one of four labels (benign, injection point, hijacked, failed injection) — reportedly the first supervised detector to jointly answer where an indirect prompt injection entered, which steps it corrupted, and whether apparent poison was resisted, giving operators step-level localization rather than a single whole-trace verdict or unsafe index.
  • 📄 Engineering Reliable Commit Gates for Agentic AI: Cost-Aware Verification Portfolios under Common-Mode Data Failures — Zheng et al., 2026. Shows additional verifiers can inherit the same upstream fault as the actor (a cross-model vote over shared evidence approves 62.9% of unsafe proposals versus 22.9% with an independent evidence source — a 40.9-point source effect dwarfing 11.3 for model diversity), and presents VP-CONTROL, a runtime-assurance design and 2,880-scenario benchmark whose portfolio controller selects cost-aware verification plans from deployment-observable metadata; a preregistered live HTTP/SQLite study finds after-check races defeat verifier-only gates while a full atomic commit-time guard records no unsafe effects across 216 episodes.
  • 📄 Provisional Reachability: Containing Agents by Making Every Crossing Revocable — Takashita, 2026. Treats data exfiltration as a rate to be bounded rather than blocked: hold every trust-boundary crossing in escrow for one period, audit each held item independently with probability r, and revoke the window on any catch, giving a per-window leak bound of ~c/(er) bits that holds as a supremum over adversary strategy (so the scheme may be public); pairs escrow with per-period decay so an L-bit secret becomes unreachable once decay exceeds a threshold, and reports an end-to-end stack cutting a leak from 100,000 to 59 bits (≈1,704×) while leaving 88% of legitimate work standing, with caller-keyed windows restoring full utility.

Input/Output Validation

  • 📄 IHDec: Divergence-Steered Contrastive Decoding for Securing Multi-Turn Instruction Hierarchies — Liu et al., 2026. Training-free decoding-time defense that uses Jensen-Shannon divergence to detect and suppress token-level violations where lower-priority inputs override higher-priority instructions, strengthening multi-turn agents against adversarial prompt injection.
  • 📄 AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization — Ying et al., 2026. Defends tool-using agents by semantically virtualizing untrusted external content to reduce prompt injection influence on privileged actions.
  • 📄 Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems — Soosahabi & Namsani, 2026. Proposes CMPE, a defense that replaces predictable refusals with misleading-but-safe outputs to degrade automated jailbreak attacks by denying attackers a reliable success signal.
  • 📄 Defending against Adaptive Prompt Injection Attacks via Reasoning-enabled Task Alignment — He et al., 2026. Argues pattern-matching IPI defenses collapse under adaptive attacks, and instead assesses whether each embedded instruction's intent is relevant to the user's task — restoring robustness against attackers who optimize against the deployed defense.
  • 📄 Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning — Shi et al., 2026. Tool-Guard defense that quarantines untrusted tool descriptions during a first isolated planning pass so poisoned tool metadata cannot steer agent actions, preserving task utility while cutting attack success on AgentDojo and Agent Security Bench.
  • 📄 StruQ: Defending Against Prompt Injection with Structured Queries — Separates prompts from data to prevent injection.
  • 📄 Towards Provably Unbiased LLM Judges via Bias-Bounded Evaluation — Formal guarantees for reducing bias in LLM-as-judge systems.
  • 📄 Judge Reliability Harness: Stress Testing LLM Judges — No evaluated judge is uniformly reliable.
  • 📄 GELO: Good-Enough LLM Obfuscation — Privacy-preserving LLM inference with ~20-30% latency overhead.
  • 📄 Untrusted Content Masking for Web Agents with Security Guarantees — Nikolić et al., 2026. UCM restores the trusted/untrusted boundary for web agents by using the DOM to redact untrusted page regions before they reach the agent and routing interaction through a sandboxed, privilege-separated interface — extending provable prompt-injection defenses from tool-use APIs to the rendered-page setting.
  • 📄 Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions — Shi et al., 2026. Finds taint-style flaws dominate MCP server vulnerabilities and are slow to patch, then proposes SPELLSMITH, which builds tool-level risk profiles and embeds behavioral guidance into the protocol's Description field plus an LLM self-reflection loop to mitigate exploitation without context-specific code fixes.
  • 📄 Multi-Agent Firewall Architecture for Privacy Protection of Sensitive Data in Interactions with Language Models — García Cuesta et al., 2026. Intercepts user–LLM traffic over HTTP(S) and WebSocket via a browser extension and proxy, then runs a multi-agent detection pipeline combining deterministic detectors with LLM-driven semantic analysis to block sensitive-data and proprietary-code leakage before transmission (F1 up to 94.93%).
  • 📄 PVDetector: Detecting Prompt Injection Attacks on Purpose-Specific LLM Agents through Policy-Violation Concept Analysis — Wang et al., 2026. Training-free inference-time defense that detects prompt injection by measuring a purpose-specific agent's hidden-state alignment with latent "policy-violation concepts" — semantic representations of the conflict between the user request and the agent's designated purpose restrictions.
  • 📄 SingGuard-NSFA: Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification — 2026. Dual-mode guardrail framework combining interpretable generative reasoning with real-time classification across 133 languages to detect operational threats to agentic AI — prompt injection, sensitive-information extraction, malicious code requests, dangerous tool misuse, and resource exhaustion.
  • 📄 ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems — Hossain et al., 2026. Shows across a 2,100-trace evaluation that an undefended multi-agent pipeline's apparent safety owes almost entirely to cloud-provider server-side filters (54 of 60 blocks on Azure GPT-5) and silently vanishes on backends without them; proposes a training-free defense-in-depth framework placing information-bottleneck gates on every inter-agent channel, blocking tool poisoning 30/30 at the application layer identically across backends while halving prompt-injection success and preserving benign accuracy.
  • 📄 MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck — Liu et al., 2026. Observes that benign and poisoned agent trajectories differ in the relationship between initial user intent and subsequent behavior, and uses an intent-aware information bottleneck to extract compact intent–behavior representations that denoise retrieved memory, defending against memory injection attacks with lower cost and less multi-turn redundancy than prior defenses.
  • 📄 PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents — Zhang et al., 2026. PromptShield-Home, a pilot benchmark of realistic smart-home scenarios (addressee ambiguity, screen/audio injection, health-monitor false triggers, mixed occupancy, legitimate-command floor) probing whether multimodal home agents can distinguish genuine user commands from ambient TV, on-screen, or overheard content, and compares traditional detectors, single-MLLM, and multi-agent mediation defense layers.
  • 📄 Robust Context-Aware Detection of Malicious Instructions in Text — Liu et al., 2026. Context- and query-aware classifier that segments text into benign and malicious sentences to detect indirect prompt injection at the segment level, hardened against adaptive evasion attacks realizable in agentic executions.
  • 📄 Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents — Pan et al., 2026. Identifies schema-formatted tool specifications as a primary source of agent safety degradation — white-box representation analysis shows they weaken the model's internal refusal signals — and proposes SafeKeep, an inference-time safeguard that judges requests against flattened textual tool specs while executing with the original schema, raising harmful-request refusal from 23.8% to 70.6% and cutting observation-level prompt-injection success from 25.6% to 2.5%. Code.
  • 📄 PIPES: Securing Agent Perception with Provenance and Priors — Kariyappa et al., 2026. Identifies state-corruption attacks, where attacker-controlled tool-response content makes environmental claims beyond the informational authority of its response component and corrupts the agent's perceived environment so the resulting action looks justified to existing guardrails; PIPES (Provenance-Informed, Prior-Enforced Screening) screens response units using semantic priors and source provenance so injected claims cannot masquerade as trusted context.
  • 📄 Cross-Layer Misalignment Detection in Agent Skills: A Progressive Loading-Aware Contrastive Learning Approach — Zhang et al., KDD 2026 Workshop. Detects "cross-layer misalignment" — inconsistency between a third-party skill's advertised metadata and its true runtime behavior — with progressive loading-aware hierarchical contrastive learning over a normalized corpus of 264,000+ open-source skills, raising Macro-F1 from ~0.45 for unadapted baselines to 0.87–0.89 as a screening tool for users and operators selecting skills.
  • 📄 Universal Defenses for Tool-Integrated LLM Agents Against Adversarial Attacks — Li & Wang, 2026. Explores generalizable defenses spanning four attack types at once (direct/indirect prompt injection, memory poisoning, backdoor) via two universal tool-based mechanisms — Attacker Tool Filtering, which uses anomaly detection (e.g. Isolation Forest) to remove suspicious tools, and Normal Tool Recalling, a white-box method restoring the agent's original toolset before planning — plus chain-of-thought, self-reflection, and task-paraphrasing prompt defenses; across four open-source and three proprietary LLMs (through GPT-5) it reaches 0% attack success in many settings while preserving task success. Code
  • 📄 The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents — Irshad et al., 2026. Architectural HITL defense for agentic browsers that reconstructs approval information from the ground-truth pending action and trusted intent provenance, renders it out-of-band in trusted browser chrome, and binds approval to the exact action re-verified at dispatch — combining provenance fencing, default-deny confirmation, and execution binding; across a 24-scenario benchmark (confused-deputy, Lies-in-the-Loop dialog forging, indirect prompt injection, adaptive substitution) it cuts attack success from 68–100% to 0% on every model with 78% legitimate-task completion and 0% false-block rate.
  • 📄 Detecting and Localizing Segment-Level Poisoning in Multi-Source LLM-Agent Inputs — Tan et al., 2026. Targets segment-level poisoning, where an adversary controlling only a small subset of an agent's aggregated sources (retrieved passages, reviews, documents) injects fluent, semantically plausible malicious content; observes that successful corrupted-evidence and adversarial-instruction attacks induce a consistent activation-space "poison direction" and proposes ActProbe, which projects MLP activations onto a learned poison direction with a lightweight linear SVM to detect contaminated prompts, then applies BinRoL (recursive replacement ablation, Mahalanobis branch pruning, MAD-based leaf detection) to localize poisoned segments in O(k log n) forward passes — reaching 0.01 FPR, 0.05 FNR, and 0.90 localization F1 across three datasets and four open-weight LLMs while remaining effective under adaptive attacks and protecting black-box APIs via surrogate-based removal.

Formal Verification & Analysis

  • 📄 Efficient and Sound Probabilistic Verification for AI Agents — Solko-Breslin et al., 2026. Verification framework using distributionally robust optimization to compute sound upper bounds on the probability of agent policy violations under uncertainty, without independence assumptions between predicates.
  • 📄 Agentics 2.0: Logical Transduction Algebra for Agentic Data Workflows — Formalizes LLM inference as typed semantic transformations with algebraic composition.
  • 📄 Knowledge Divergence and the Value of Debate for Scalable Oversight — Formal framework for choosing oversight mechanisms.
  • 📄 AutoSpec: Safety Rule Evolution for LLM Agents via Inductive Logic Programming — Ma et al., 2026. Counterexample-guided inductive synthesis that evolves expert-designed agent safety rules via inductive logic programming, reaching F1 of 0.98/0.93 across two domains, cutting false positives up to 94%, and producing human-auditable rules that generalize to unseen scenarios.
  • 📄 Local LLM Agents as Vulnerable Runtimes: A Source-Code Audit of the Agent Runtime Layer — Zhang et al., 2026. CLAWAUDIT static-analysis framework that audits the agent runtime layer itself for security vulnerabilities, raising recall from 13.8–21.7% baselines to 66.8–75.1% across 217 held-out advisories.
  • 📄 AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs — Wang et al., 2026. First static analysis framework to recover agent-specific dependencies (agent constructors, tool decorators, handoff declarations) into an Agent Dependency Graph, enabling Agent Bill of Materials generation and prompt-to-tool risk detection; uncovers 238 taint-style prompt-to-tool risks across 5,399 real-world agent programs.
  • 📄 SkillsMetric: Mapping the Detection Boundary of Static Analysis for Malicious Agent Skills — Chen et al., 2026. Five-stage static-analysis framework scoring skill packages along pattern density, statistical anomaly, dataflow taint, import anomaly, and capability-mismatch dimensions (AUC 0.93 on the full SkillMD-138K corpus plus a 2,266-skill adversarial set spanning 16 attack types), while exposing a fundamental blind spot: host-destruction attacks using common shell commands evade all five stages.
  • 📄 SkillConsist: Detecting Inconsistencies in Agent Skills via Bidirectional Graph Alignment — Meng et al., 2026. Detects agent-skill inconsistencies — undisclosed dangerous behavior or mismatched declarations that cause wrong skill selection — by separating declaration and implementation content into behavior records (via an LLM plus static analysis) and aligning them with a bidirectional graph, handling cases where declaration and implementation are mixed across text and code and a concise declaration maps to multiple connected implementation steps.
  • 📄 Correct Is Not Governed: Provenance Integrity in Agentic Workflows — Salas, 2026. Argues outcome-correctness is insufficient in institutional settings, where a correct action may rely on the wrong authority, an unsupported completion claim, or work made stale by a later change, and defines governed execution as work whose decisions, completion, and response to change are backed by inspectable provenance; presents Matrix, a deterministic causal-state layer that records authority and fact dependencies, verifies completion evidence, and selectively invalidates affected work.
  • 📄 CaMeLoT: CaMeL orchestrated with Temporal logic for static verification and liveness — Nikolaou et al., CAMLIS 2026. Extends the CaMeL prompt-injection defense with a static verification layer that translates an agent's generated plan into a finite-state transition system labeled with tool calls, provenance, and taint, then model-checks it against CTL temporal policies via nuXmv before any tool runs — rejecting unsafe plans without spending LLM or tool calls and returning counterexamples for plan repair; evaluated on policies derived from AgentDojo, SOC workflows, and prompt-extraction experiments.
  • 📄 Formal Analysis and Supply Chain Security for Agentic AI Skills — Bhardwaj, 2026. Five theorems with complete proofs establishing soundness for skill-package analysis, combining pattern-matching detection with information-flow analysis (96.15% F1), and releasing SkillFortify; notably reports that information-flow analysis added no detections beyond pattern matching on the tested corpus.

Evaluation & Red Teaming

  • 📄 MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG — Singh et al., 2026. Cross-surface red-teaming framework for multimodal agentic RAG that uses memory-guided Monte Carlo tree search to generate novel attacks spanning text poisoning, image injection, direct-query attacks, and orchestrator-level tool manipulation, avoiding the 73–84% template duplication of prior surface-specific approaches.
  • 📄 CONTRA: Red-Teaming Configurations of Personalizable Agents — Nöther et al., 2026. LLM-assisted tree-search red-teaming algorithm for discovering unsafe configurations of personalizable agents, finding that most popular skills can be manipulated into executing malicious actions.
  • 📄 Safety Testing LLM Agents at Scale: From Risk Discovery to Evidence-Grounded Verification — Feng et al., 2026. Introduces Vera, an automated safety-testing framework that discovers agent vulnerabilities via structured risk taxonomies and evidence-grounded verification, achieving 93.9% attack success across four production agent frameworks.
  • 📄 The Best-Laid SCHEMEs: Coordinated Sabotage and Monitoring in Multi-Agent Systems — Bernabeu-Perez et al., 2026. Benchmark for covert multi-agent sabotage showing coordinated hidden objectives are already practical in coding systems, while trusted monitors can still detect most attacks.
  • 📄 ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D — Libon et al., 2026. AI-control framework spanning four long-horizon AI R&D tasks (safety and capabilities post-training, CUDA-kernel and inference-server optimization), each paired with an embedded side task that sabotages the produced artifact and an independent out-of-scope sandbox side task, evaluating frontier agents at both sabotage and monitoring across four monitor types — and finding training-data-hidden sabotage is flagged under half the time even when monitors may execute and probe the artifact rather than only read the trajectory.
  • 📄 Real-Time Trust Verification for Safe Agentic Actions using TrustBench — Sharma et al., AAAI 2026 Workshop on TrustAgent. Dual-mode framework benchmarking trust across multiple dimensions and providing a pre-execution action verification toolkit for agents.
  • 📄 Agent Security Bench (ASB) — 10 scenarios, 10 agents, 398 environments. Comprehensive agent security benchmark.
  • 📄 SkillVetBench: LLM-as-Judge for Multi-Dimensional Security Risk Evaluation in Open-Source LLM Agent Skills — Hossain et al., 2026. Live public leaderboard and semantic vetting system that evaluates instruction-layer and multi-agent risks in community-contributed agent skills — directives that hijack an agent, exfiltrate data via encoded side channels, or chain harm across pipelines — which code-layer scanners are structurally blind to.
  • 📄 Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents — Narisetty et al., 2026. Frames out-of-band defenses (CaMeL, FIDES, Progent) as classical integrity-protection mechanisms and stress-tests them with adaptive attacks, cautioning that — like earlier in-band defenses — their reported gains (e.g. Progent cutting attack success from 25.8% to 4.2%) have only been validated against static benchmarks.
  • 📄 AutoDojo: Adaptive Attacks Expose Superficial Defenses and User-Underspecification Limits in LLM Agents — Ma et al., 2026. Replaces static IPI benchmarks like AgentDojo with adaptive attack generation, revealing that prompt-based, detection-based, and system-level defenses are substantially weaker than static evaluations suggest.
  • 📄 SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfaces — Jin et al., 2026. Runnable benchmark with 155 adversarial skill-mediated cases across 47 tasks, 6 risk domains, and 30 safety categories.
  • 📄 No More, No Less: Task Alignment in Terminal Agents — Mavali et al., 2026. Introduces TAB, an 89-task benchmark for whether terminal agents selectively follow relevant environmental cues while resisting distractor instructions.
  • 📄 Proteus: A Self-Evolving Red Team for Agent Skill Ecosystems — Zhou et al., 2026. Grey-box adaptive red-teaming framework that iteratively rewrites skills using audit and runtime feedback to measure residual deployment risk.
  • 📄 SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skills — Mecca et al., 2026. Fully agentic red/blue framework that generates context-compatible injections across nine threat types, then analyses complete skill packages to detect, localise, and patch them with grounded evidence; its best backend is the only scanner to reach a 100% injection detection rate, and analysing popular skills.sh skills surfaces latent vulnerabilities in over 17% examined — some triggering real incidents when run.
  • 📄 SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills — Li et al., 2026. Dynamic safety-testing framework that places external agent skills in adaptive "honey worlds" to trigger execution-time malicious behavior that only surfaces under particular environmental states, resources, or interaction histories — catching threats that static analysis, predefined rules, and one-shot semantic judgments miss.
  • 📄 AgentDyn: A Dynamic Open-Ended Benchmark for Prompt Injection Attacks — Li et al., 2026. Dynamic, open-ended benchmark for evaluating indirect prompt injection defenses in real-world agent security systems.
  • 📄 NAAMSE: Framework for Evolutionary Security Evaluation of Agents — Pai et al., ICLR 2026 Workshop. Evolutionary framework reframing agent security evaluation as feedback-driven optimization with autonomous red-teaming.
  • 📄 R-Judge: Benchmarking Safety Risk Awareness — 162 records, 27 risk scenarios for agent safety.
  • 📄 InjecAgent: Benchmarking Indirect Prompt Injections — 1,054 test cases for tool-integrated agents.
  • 📄 SIABENCH: Evaluating LLMs for Security Incident Analysis — 11 LLMs × 160 security incident scenarios.
  • 📄 EVMbench: Evaluating AI Agents on Smart Contract Security — 117 vulnerabilities, frontier agents exploit end-to-end.
  • 📄 τ-Knowledge: Evaluating Conversational Agents over Unstructured Knowledge — Even frontier models achieve only ~25.5% on complex agent tasks.
  • 📄 Interactive Benchmarks — Evaluating via interactive proofs and games instead of static benchmarks.
  • 📄 VeriGrey: Greybox Agent Validation — Zhang et al., 2026. Greybox security testing using tool-invocation sequences as feedback and mutational prompt fuzzing; 33% more effective than black-box on AgentDojo, discovers prompt injection scenarios missed by black-box in Gemini CLI and OpenClaw.
  • 📄 LAAF: Logic-layer Automated Attack Framework for Agentic LLM Systems — Atta et al., 2026. First automated red-teaming framework combining 49-technique LPCI taxonomy with stage-sequential seed escalation; 84% mean aggregate breakthrough rate across five production LLM platforms.
  • 📄 VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Servers — Sun et al., 2026. End-to-end auditing framework that statically localizes vulnerable MCP tool handlers and dynamically evolves proof-of-concept prompts, uncovering 106 confirmed 0-days and 67 CVEs across open-source MCP servers.
  • 📄 SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents — Tian et al., 2026. Staged benchmark of 600 adversarial tasks distinguishing three agent failure modes — semantic acceptance, auditable harm evidence, and executable state changes — showing these endpoints capture different vulnerabilities across models and prompt policies.
  • 📄 Red-Teaming the Agentic Red-Team — Pasquini et al., 2026. First security assessment of widely-deployed offensive-security agents, documenting a complete attack chain in which an active adversary exfiltrates API keys, establishes persistent footholds, and compromises operator machines, and proposing architectural safeguards.
  • 📄 Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming — Yang et al., 2026. AI-Infra-Guard organizes agent red-teaming across infrastructure, protocol/tool, behavior, and model layers with 75+ components and 1,400+ rules, matching detection paradigms to each attack surface.
  • 📄 Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens — Niu et al., 2026. SafeClawArena benchmark evaluates always-on agents across supply-chain integrity, state exploitation, data-flow, and indirect-injection attack surfaces, reaching 70% peak attack success and surfacing systemic weaknesses in persistent agents.
  • 📄 Security–Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense — Hermon et al., 2026. Introduces the SecFid benchmark showing no model jointly achieves strong security and task fidelity — the most secure configuration reaches 99.3% defense at only 71.0–73.9% fidelity — quantifying the utility cost of injection defenses.
  • 📄 When AUC 0.998 Is Not Enough: A Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agents — Li et al., 2026. Cautions that high probing AUC on multimodal computer-use agents does not by itself establish reliable malicious-injection detection, and proposes diagnostic controls for evaluating hidden-state IPI probes.
  • 📄 Distributed Attacks in Persistent-State AI Control — Hills et al., 2026. Introduces Iterative VibeCoding, an AI-control benchmark where a prompt-injected coding agent distributes a covert side task across successive pull requests in a persistent codebase; shows no single monitor resists both gradual and concentrated attacks (>=65% evasion generalizes across model backends), and proposes a stateful link-tracker monitor that cuts gradual-attack evasion from 93% to 47% in a four-monitor ensemble.
  • 📄 Beyond Attack-Success Rate: Action-Graded Severity Scale for Tool-Using AI Agents — Owiredu-Ashley, 2026. Replaces the binary attack-success metric with a seven-level (L0–L6) action-graded harm rubric scoring an agent's tool-call trajectory by reversibility, cross-scope reach, and privilege expansion, computed via a deterministic oracle and a three-judge panel (Krippendorff's α=0.91) that together expose cross-scope leaks a zero-attack-success-rate defense hides.
  • 📄 Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability — Chen et al., 2026. Introduces MCPZoo, a dataset of 64,611 unique runtime MCP servers enabling dynamic analysis, and shows existing MCP security scanners are unreliable — flagging 96.89% of servers as risky while fewer than 50% of sampled alerts are true positives.
  • 📄 Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale — Padilla et al., 2026. First dynamic behavioral security assessment of internet-facing MCP servers, combining passive discovery across eleven data sources with active testing via Corvus (34 test modules covering 10 MCP-specific vulnerability classes); across four July 2026 runs it audits 414 confirmed servers and uncovers 68 reportable vulnerabilities (SQL injection, SSRF against cloud metadata, prompt-template injection, path traversal), finding 91.8% lack OAuth authentication and 687 tool instances expose unguarded shell execution, and releases Corvus as an open-source MCP security evaluation framework.
  • 📄 Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation — Allahbakhsh et al., 2026. Reframes penetration testing for AI-enabled systems around behavioral objective violations rather than infrastructure compromise, mapping adversarial pathways including prompt injection, indirect prompt injection, data/retrieval poisoning, tool misuse, and agentic misalignment.
  • 📄 Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security — Jain et al., 2026. Multi-turn, multi-LLM benchmark showing defenders that resist single-turn attacks degrade sharply against adaptive adversaries who revise tactics across rounds, with attack success climbing from 0–1% to 5.4–14.0% over 15 iterative attempts.
  • 📄 RECEIPT: Deterministic, Reward-Hacking-Resistant Verification for White-Box Agentic XSS Discovery — Lyu et al., 2026. Deterministic verification framework that stops LLM coding agents from reward-hacking XSS-discovery tasks with false success claims, enforcing strict environment isolation and role-based payload execution before a finding is counted as valid.
  • 📄 Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming — Wang et al., 2026. PIMiner, an agentic prompt-injection red-teaming system that builds a transferable strategy library from scratch during training and applies it to previously unseen target LLMs without retraining using only ~10 queries per sample, reaching up to 86.7% ASR on AgentDojo and 76.2% on IPIArena against frontier models. Code.
  • 📄 Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents — Eliav et al., 2026. Formalizes agent reconnaissance as the extraction of knowledge assets that give adversaries leverage in indirect prompt injection, and instantiates it as KYA, a framework that automates black-box, recon-driven pentesting by probing agents, building target profiles, and using those profiles to craft stronger attacks; evaluated on agent-security benchmarks and a real-world coding agent, released with benchmarks and baselines.
  • 📄 Guardrails as Scapegoats: Auditing Unfaithful Safety Refusals in Tool-Augmented LLM Agents — Singh, KDD 2026 Workshop. Black-box auditing framework that injects silent tool-failure profiles (empty, null, or malformed HTTP-200 payloads) and classifies agent responses as Honest Surrender, Fabrication, or Unfaithful Safety Refusal — finding fabrication dominates (56.6%) while adding standard safety language to the system prompt amplifies invented policy/privacy rationales for tool failures 15.6x, concentrated on sensitive tools such as medical-record and contract retrieval.
  • 📄 IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests — Singh et al., 2026. Benchmark of malicious issue-request attacks against production coding agents (Cursor, Claude Code, Codex Desktop) spanning four attack categories and six delivery vectors (PDF, issue comment, etc.); 66.5% of malicious issues penetrate all agent- and LLM-level guardrails, with refusals coming almost entirely from the model rather than the agent framework and current agent-level defenses adding little protection.
  • 📄 OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills — Liu et al., 2026. Safety benchmark of 263 risky skills collected from public marketplaces across seven threat categories, each paired with a standardized task and sandbox; across three CLI agent frameworks and thirteen LLMs even the safest configuration still executes unsafe actions ~17% of the time, and behavioral analysis surfaces three recurring failure patterns — failing to recognize the risk, recognizing it but not intervening before acting, and following skill instructions beyond the user's intended scope.
  • 📄 Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation — Ahmed & Abbas, 2026. Audits a preserved MCP agent-security campaign and shows the historical grader suffered direct treatment leakage — treatment metadata gated the ATTACK_SUCCESS class, so fixed behavior could change class under relabeling; tracing 10,200 execution rows back to their true stimuli, a treatment-blind reconstruction corrects 58 mislabeled ATTACK_SUCCESS/HIJACK_ATTEMPT records, warning that stored labels must not be equated with behavioral facts.
  • 📄 Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming — Mao et al., 2026. AHA, a falsifiable discovery loop that proposes a vulnerability hypothesis, builds a falsifier, instantiates and executes an attack in a sandboxed harness, then promotes confirmed findings into a reusable Vulnerability Concept Graph (VCG); across Claude Code and Codex on direct and indirect attacks, the frozen VCG requires no further search yet beats the strongest discovery baseline by 14.2 points under a single-shot protocol and transfers across scenarios and attack channels. Code.
  • 📄 Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection — Ying et al., 2026. Uses AI-Infra-Guard to run 14,560 controlled executions across 16 indirect-content channels, 35 payload objectives, and 12 attack methods against the DeepSeek Harness agent loop, judging outcomes with paired rule-based and semantic LLM judges over local source-tool and sensitive-sink fixtures so attempted actions are recorded without external side effects.
  • 📄 BenchShield: Formal Model-Backed Instrumentation for Reward Integrity in LLM-Agent Evaluation Infrastructure — Zheng et al., 2026. Treats interactive LLM-agent benchmarks as attack surfaces for reward hacking — where an agent improves its measured score by exploiting the reward-relevant trajectory instead of solving the task — and grounds detection in a finite lifecycle model of an evaluation's reward-relevant events, providing reusable per-run evidence that a concrete execution stayed within its intended evaluation boundary rather than relying on task-specific patches, prompt instructions, or post-hoc detectors.
  • 📄 Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems — Akkil et al., 2026. Continuously-running multi-agent environment for adversarially stress-testing persistent autonomous systems: eight parallel worlds of ten agents (seven single-model, one mixed) ran 16 days, 850,000+ LLM calls and ~50B tokens while pursuing goals, using/creating tools, and maintaining memory, then received three controlled stress events (indirect prompt injection, misinformation, private-memory exposure) through ordinary interaction surfaces; no world was fully resilient, detection did not ensure containment (systems recognized threats yet wrote adversarial content into memory and acted on it up to 46 hours later), and model-level alignment proved non-compositional.
  • 📄 Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery — Kumar et al., 2026. Systematic black-box risk-aware agent evaluation requiring only basic system descriptions, pairing a seven-domain taxonomy that maps observable behaviors to risk categories with fully automated SAGE-RT red teaming (120 adversarial scenarios per domain) and human-validated LLM-judge scoring; across CrewAI and AutoGen with four base models it surfaces 56.25% average governance risk, 65% privacy risk in multi-agent configs, and agent-behavior vulnerabilities reaching 85% without privileged access.
  • 📄 Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents — Remedios et al., 2026. Red-teams production blocking monitors that review each proposed coding-agent action before it runs (Auto Mode in Claude Code, Guardian in OpenAI's Codex) under a persistently-misaligned agent rather than only untrusted-source injections; adversarial agents given high-level strategies evade monitors via agent-generated prompt injection, multi-agent attacks, and malicious compaction — running arbitrary bash in 79% of trials — and the paper shows design changes (broader tool coverage, transcript formatting, an agentic monitor stage) that harden Auto Mode while leaving multi-context attacks an open problem. Code.
  • 📄 AgentLSD: Evaluating AI Security Agents Under Adversarial Task Contamination — Golinelli et al., AISec 2026. Introduces adversarial task contamination — deceptive non-instructional evidence (fake results, decoy endpoints) beyond attacker-supplied instructions — and a controlled CTF-based framework that injects trap artifacts while preserving the intended solution, with deterministic trap generation, runtime injection, and telemetry; across six models on 11 web CTF challenges, traps raise turns (+20) and reasoning tokens (+2k) even when the flag is still recovered, showing clean CTF performance understates vulnerability to deceptive task evidence.
  • 📄 Collective Loss of Control in LLM Agent Systems: An Epidemic Account of Mutation, Contagion, and Recovery — Wu et al., 2026. Models how a local deviation in a multi-agent system escalates into collective loss of control via accidental mutation, contagion, and recovery — where communication lets agents adopt and retransmit an unsafe strategy faster than correction contains it; a deployment audit finds implicit communication paths between nominally independent evaluation runs transported through a default Docker backend, and the RogueHandoff-20 benchmark (20 executable scenarios injecting unsafe trajectories) shows executed harm rises from 0–5% on normal tasks to 40–95% after injection, motivating defenses that strengthen recipient resistance and recovery and restrict unintended inter-agent channels.
  • 📄 Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AI — Ghanem, 2026. Argues auditor independence for agentic systems (which are now both audited subject and auditor) must be graded along three orthogonal axes — principal (who controls the auditor), substrate (an auditor sharing the auditee's model family, toolchain, or guardrails fails with it), and evidence (attestable vs. self-reported) — aggregated by weakest link via a transplanted beta-factor common-cause-failure model; a seven-step verifiable protocol plus a Monte Carlo study show a conventional internal agent audit surfaces only 5.9% of detectable faults and none in half the fault classes, mapped to the EU AI Act and ISO/IEC 42006.
  • 📄 A Unified Evaluation Framework for Trustworthy Large Language Models, Agentic AI, and Multimodal Systems — Raza et al., 2026. Connects output-level, trajectory-level, and cross-modal assessment across eight trustworthiness dimensions (capability, robustness, safety, fairness, transparency, governance, oversight, efficiency), preserving system-specific metrics while mapping them to common performance bands with uncertainty estimates and traceable evidence; adds a meta-evaluation layer for the validity/reliability/reproducibility of the evaluation itself and safety-critical overrides that prevent aggregate scores from masking critical agentic failures, with mappings to governance frameworks and EU regulation.

Benchmarks & Datasets

BenchmarkFocusSizePaper
ASBComprehensive agent security10 agents, 398 envsZhang et al.
InjecAgentIndirect prompt injection1,054 test casesZhan et al.
R-JudgeSafety risk awareness162 records, 27 scenariosYuan et al.
ToolSwordTool learning safety6 scenarios, 3 stagesYe et al.
AgentDynDynamic prompt injectionOpen-ended, extensibleLi et al.
SkillSafetyBenchSkill-mediated agent safety155 cases, 47 tasksJin et al.
SkillVetBenchSecurity risk eval of open-source agent skillsLive leaderboardHossain et al.
SCR-BenchSkill composition riskMulti-skill chainsXie et al.
SafeClawBenchStaged harm in tool-using agents600 adversarial tasksTian et al.
ToolPrivacyBenchPurpose-bound privacy in tool-using agents2,150 casesHu et al.
TABSelective cue following in terminal agents89 terminal tasksMavali et al.
Skill-InjectSkill file attacksMulti-scenarioSchmotz et al.
NAAMSEEvolutionary agent security evalAdaptive red-teamingPai et al.
AgentHarmAgent misuse110 behaviors, 440 variantsAndriushchenko et al.
SkillGuard DatasetMalicious skill detection157 malicious skillsLiu et al.
WIPIWeb-based indirect injectionMulti-scenarioLiu et al.
DUMA-BenchDual-control agent security (8 vuln classes)8 domains, 14 modelsAleksandrov et al.
SkillAtlasAttack trace library for agent skills3,014 cases, 6,589 tracesTian et al.
IssueTrojanBenchMalicious issue requests vs. coding agents4 attack categories, 6 vectorsSingh et al.
OpenSkillRiskAgent safety with risky third-party skills263 skills, 7 categoriesLiu et al.
AudioAgentSecurityAudio prompt injection vs. multimodal agents8 scenarios, 10 patternsLiu et al.
AIP-BenchAgentic commerce protocol-level security3 platforms, 33 vulnsLouck
ContainmentBenchPost-injection containment in tool-using agentsTrace-based, multi-metricLan et al.
MemSecBenchLifecycle security of agent memory poisoning310 cases, 24-config matrixChen et al.
IH-BenchmarkInstruction-hierarchy robustness incl. tool-mediated conflicts44 constraint families, 37 modelsMcCauley et al.
AgentS4DLifecycle runtime risks of workspace agentsSandboxed, trajectory-awareZhou et al.
StepJackMulti-step indirect prompt injection vs. computer-use agents480 test casesZhan et al.
HarnessSafeSafety across persistent carriers in agent harnesses328 cases, 7 carrier familiesZhang et al.
ToolHazardScalable synthesis of adversarial tool environments for indirect prompt injectionExpandable via seed domains + computeMou et al.
ATOBenchPentest-agent vulnerability verification under deceptive target evidenceRuntime response transformationsChen et al.
HarnessRiskLifecycle safety of agent harnesses across operational phases6 operational phasesBai et al.
ChemMat-AgentSafetyBenchLong-horizon attacks/defenses in chemistry & materials agents (tool-mediated hazardous-protocol release)432 cases, 8 hazard classes, 5 online attacksYao et al.
PIDS-BenchPrompt-injection detectors under over-defense, obfuscation, and distribution shift7 detectors, multi-axis (incl. hard-benign FPR)Shire & Kim
HTB (Hallucinated-Tools Benchmark)Tool hallucination (fabricated tools/args) incl. cross-server MCP namespace collisions322 single-registry + 154 MCP hallucinations, H1–H5 / M1–M5 taxonomyIyer
ClashBenchDestructive resource preemption by privileged agents (terminating/overwriting incumbent tasks to resolve conflicts)268 conflict cases, 55 resource types, 17 modelsXie et al.
MemoryStackBenchAgent memory safety and auditability5 scenarios, 33 checksRepository
mcp-defense-benchMCP defensive-proxy attack-surface coverage24 vectors, 35 casesArumugam
VLoc BenchRepository-scale vulnerability localization by security agents (incl. refrain-on-patched)500 vulns, 290 repos, 147 CWEsPriyanshu et al.
APort VaultPayment authorization in tool-using agents (deterministic pre-action check vs. model-alone)4,371 human CTF attacks, 14 models, 225,964 evalsUchibeke

Tools & Frameworks

ToolDescriptionLink
Agent Memory GuardOWASP reference implementation for ASI06 (Memory Poisoning): runtime defense that screens every agent memory read/write through detectors + a declarative policy, with source-class provenance, forensic SecurityEvents, and snapshot rollback. LangChain/OpenAI-Agents/AutoGen/CrewAI/mem0 integrationsGitHub
Bounty SieveOffline-by-default bounty intake guardrail for coding agents: read-only GitHub issue/URL-list import, deterministic triage, local decision briefs, and human approval gatesGitHub
SkillGuardLLM-native agent skill security auditor (OWASP Agentic + MITRE ATLAS)GitHub
SkillCIRegression testing + OWASP Agentic Skills Top 10-mapped static security lint for Claude Skills. Adds a self-growing eval loop (an uncovered regression or successful redteam attack writes its own permanent test case) and git-native bisect to find the exact commit that broke a skillGitHub
PipelockOpen-source AI agent firewall and MCP-aware egress proxy with DLP, prompt injection scanning, process sandboxing, and mediator-signed action receiptsGitHub
NemoClawNVIDIA reference stack for running always-on AI agents more safely in sandboxes, with network policy, hardening, routed inference, and lifecycle controlsGitHub
CubeSandboxHardware-isolated (per-kernel) sub-60ms sandbox for secure AI agent code execution, with an out-of-sandbox credential vault, eBPF network isolation, and domain-allowlisted egress controls with audit loggingGitHub
Invariant GuardrailsPolicy-based agent security guardrailsGitHub
Armorer GuardLocal Rust scanner for AI-agent prompt injection, credential redaction, sensitive-data requests, exfiltration-style text, and dangerous tool-call contextGitHub
SunglassesRuntime trust scanner for agent skills and tool use: 1,089 patterns across 65 attack categories (prompt injection, tool poisoning, MCP attacks, skill compromise) plus a mechanism layer, shipped as a pip package, GitHub Action, and free web scanner with a published precision/recall benchmarkGitHub
LLM GuardInput/output scanning for LLM applicationsGitHub
RebuffSelf-hardening prompt injection detectorGitHub
NeMo GuardrailsNVIDIA's toolkit for adding guardrails to LLM-based applicationsGitHub
Lakera GuardEnterprise prompt injection defense APIWebsite
PromptfooLLM red teaming and evaluation frameworkGitHub
GarakLLM vulnerability scannerGitHub
IPI-ProxyIntercepting proxy for red-teaming web-browsing agents against indirect prompt injection on live whitelisted domainsGitHub
Tuning Engines CLIMCP server and CLI for governed agent/skill/tool access with policy checks, approvals, traces, and role-scoped registriesGitHub
AgentSkillsScannerStatic analysis scanner for agent skill definitionsGitHub
repo-agent-scanLocal deterministic scanner for agent skills and repository instruction files (SKILL.md, AGENTS.md, CLAUDE.md, and IDE rules), with evidence-anchored findings, SARIF, pre-commit, and GitHub Action supportGitHub
SkillTotalStatic, offline scanner for AI components (MCP servers, agent skills, npm/PyPI packages, repos): supply-chain risk, dangerous capabilities, prompt-injection, exfiltration; deterministic, evidence-anchored, SARIF + pre-commit/GitHub ActionGitHub
SkilLockBehavior-pinning lockfile + capability-delta PR review for Claude Code & Codex skills; SARIF output for Code ScanningGitHub
agent-diff-guardPre-push guardrail that flags high-risk coding-agent diffs such as CI/CD changes, dependency edits, test deletions, hardcoded secrets, and task-scope drift before mergeGitHub
SkillidPolicy-driven Claude Code plugin that combines skill guidance with per-tool hooks to enforce org guardrails, confirmation rules, redaction, and connector-specific access controlGitHub
Agent AuditSecurity analysis system for LLM agent apps: dataflow analysis, credential detection, MCP config parsing, privilege-risk checksZhang et al.
mcp-sec-auditMCP server security toolkit: static pattern matching + dynamic sandboxed fuzzing via Docker/eBPF for detecting over-privileged tool capabilitiesHuang et al.
SkillGateDeterministic local CLI that statically inspects an agent Skill package before harness admission — reports instruction surface and execution surface without executing, installing, or trusting the SkillGitHub
Assay HarnessCI gate that checks an agent's claimed tool side-effects (filesystem, network, process) against independently observed runtime evidence, classifying each claim as supported, degraded, blocked, or not-evaluable (observed support is the ceiling)GitHub
Agent ScanSnyk's scanner for local agent supply chains, covering MCP servers and skills with checks for prompt injection, tool poisoning, toxic flows, and malware-laced skill filesGitHub
DScanOpen-source agent security suite for runtime tool-call tracing, prompt-injection shielding, MCP audits, adversarial testing, and sequence-level attack detectionGitHub
Sayfos SDKRuntime guardrail SDK for AI agents with provenance checks, budget governance, plan preflight, and adjudication tokens before high-risk tool actionsGitHub
PIC StandardLocal-first standard and reference verifier that checks agent intent, provenance, and evidence at the action boundary and fails closed before high-impact tool calls; Python CLI, MCP/LangGraph/OpenClaw integrations, HTTP bridge, and a language-agnostic conformance suiteGitHub
**[Trace

Truncated — view the full README on GitHub.

agent-security
ai-safety
awesome-list
llm-security
mcp
owasp
prompt-injection
tool-use

Contributors

sumleo

77 commits

agent-morrow

1 commits

arian-gogani

1 commits

armorer-labs

1 commits

Similar repos

MurrayTom/Awesome-Agent-Security-Papers

Beyond Environment and User Inputs: A Comprehensive Survey of Skill-Oriented Security in Agentic AI

10

8kSec/awesome-ai-security

A practitioner-focused reference for AI/ML security — attacks, tools, research, and defenses.…

4

h5i-dev/awesome-ai-agent-incidents

A curated corpus of incidents, attack vectors, failure modes, and defensive tools for autonomous AI…

52

Joe-B-Security/awesome-prompt-injection

Learn about a type of vulnerability that specifically targets machine learning models

639

scadastrangelove/awesome-ai-security-tools

A curated list of public-source, research, and commercial tools for AI security and AI-assisted…

1,520

raphabot/awesome-cybersecurity-agentic-ai

590

The-Art-of-Hacking/h4cker

This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources…

29,501

anmolksachan/AI-ML-Free-Resources-for-Security-and-Prompt-Injection

AI/ML Pentesting Roadmap for Beginners

792

LLMSecurity/awesome-agent-skills-security

🛡️ A curated list of resources on agent skills security: attacks, defenses, frameworks, and benchmarks for securing AI agent tool use and skill ecosystems

102

101 commits

updated Sep 22, 2026

See the code

README

Awesome Agent Skills Security Awesome

🛡️ A curated list of resources on securing AI agent tool use and skill ecosystems — attacks, defenses, frameworks, benchmarks, and standards.

AI agents increasingly use external tools, plugins, and skills to interact with the world. This creates a new attack surface: agent skills security. This list covers the threats, defenses, and research landscape for securing these capabilities.

Contents

Threat Frameworks & Standards

  • OWASP Agentic AI Threats and Mitigations — First in a series from the OWASP Agentic Security Initiative (ASI), providing threat-model-based reference for agentic threats.
  • OWASP Top 10 for LLM Applications — Includes LLM01: Prompt Injection, LLM06: Excessive Agency, LLM07: Insecure Plugin Design, LLM08: Excessive Autonomy.
  • OWASP Agentic Skills Top 10 (AST10) — OWASP incubator project, v1.0 (2026 edition). First standards-body enumeration of risks specific to agent skills rather than agents in general, running from AST01 Malicious Skills to AST10 Cross-Platform Reuse, with AST01 and AST02 (Supply Chain Compromise) rated critical; scopes to the skill layer where the OWASP Agentic AI Threats entry above covers agents broadly.
  • MITRE ATLAS™ — Adversarial Threat Landscape for AI Systems. Tactics, techniques, and case studies for attacks on ML/AI systems.
  • NIST AI Risk Management Framework — Federal framework for managing AI risks, including autonomous agent risks.
  • NIST SP 800-218A: Secure Software Development for AI — Secure development practices specific to AI-enabled systems.
  • EU AI Act — European regulation with specific provisions for high-risk AI systems including autonomous agents.
  • Anthropic Responsible Scaling Policy — AI Safety Levels (ASL) framework addressing agent capability thresholds.
  • IETF draft-klrc-aiagent-auth-01: AI Agent Authentication and Authorization — Kasselman et al., IETF WIMSE-adjacent, 2026. Proposes a model for authentication and authorization of AI agent interactions using existing OAuth 2.0 and WIMSE standards; covers delegation chains, agent identity, and trust establishment without defining new protocols.
  • IETF draft-niyikiza-oauth-attenuating-agent-tokens-00: Attenuating Authorization Tokens for Agentic Delegation Chains — Niyikiza (Tenuo), OAuth WG, March 2026. Defines Attenuating Authorization Tokens (AATs): JWT-based credentials encoding tool-level argument constraints with a cryptographically enforced monotonic attenuation invariant — any holder can derive a more restrictive token but never a more permissive one. Extends Rich Authorization Requests (RFC 9396) with delegation-chain semantics.
  • 📄 Certifying Ghosts: How Cybersecurity AI Agents Break the EU Cyber Resilience Act — Mayoral-Vilches, 2026. Argues autonomous vulnerability-discovery-and-exploitation agents invalidate the EU Cyber Resilience Act's core assumptions of slow, human-paced disclosure and fixed product security states, contending that because attackers and defenders now wield identical AI capabilities, meaningful compliance requires continuous agent-operated monitoring rather than static certification.

Surveys & Systematizations

  • 📄 Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challenges — Baek et al., 2026. Structured review of 66 studies (2022–2026) introducing a cross-dimensional representation T={S,B,P,A} linking affected surfaces, trust boundaries, violated security properties, and empirically examined architectures; analyzes 22 red-teaming studies and 11 benchmarks to characterize evaluation maturity and derive 13 open research questions.
  • 📄 Trustworthy Agentic AI: Failure Modes, Mitigation Strategies, and a Lifecycle Framework for Autonomous LLM Systems — Syed et al., 2026. Reviews agentic-AI trustworthiness across five dimensions and organizes failure modes (indirect prompt injection, backdoor triggers, goal misgeneralization, memory contamination, cross-session leakage) into a unified taxonomy, then proposes the six-phase Trustworthy Agent Development Lifecycle (TADL) with per-phase trust activities and risk-based decision gates.
  • 📄 A Survey on LLM-based Autonomous Agents: Common Attacks and Defenses — Wu et al., 2024. Comprehensive taxonomy of attacks on LLM agents across perception, cognition, and action stages.
  • 📄 Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents — Zhang et al., 2024. Formalization of 10 attack scenarios, 10 agents, 398 adversarial environments.
  • 📄 Security of AI Agents — He et al., 2024. Systematization of knowledge covering threat models for AI agents with tool access.
  • 📄 Not All Agents Are Created Equal: A Survey on Software-use Agent Security — Hua et al., 2025. Survey specifically on software-use agents and their unique security challenges.
  • 📄 A Survey on the Honesty of Large Language Models — Xie et al., 2024. Covers agent deception, sycophancy, and honesty in tool-use contexts.
  • 📄 A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models — Xu et al., 2024. Systematic study of jailbreak attacks relevant to agent guardrail bypass.
  • 📄 Prompt Injection Attacks and Defenses in LLM-Integrated Applications — Liu et al., 2024. Comprehensive taxonomy of injection attacks across direct and indirect vectors.
  • 📄 The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies — Gan et al., 2024. Survey with practical case studies of security failures.
  • 📄 Self-Evolving Agents: A Survey — Gao et al., 2025. How self-evolving agents create emergent security risks.
  • 📄 Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies — Lin et al., 2026. Uses a Module-Lifecycle Attack Surface matrix to show self-evolution transforms attack persistence from session-bounded to permanent — adversarial effects become encoded across generations, self-amplify, and propagate through agent populations without sustained attacker access, with 17 of 25 attack vectors rated critical.
  • 📄 From Thinker to Society: Security in Hierarchical Autonomy Evolution of AI Agents — Zhang et al., 2026. Hierarchical Autonomy Evolution (HAE) framework organizing agent security into cognitive, execution, and societal tiers.
  • 📄 Characterizing Faults in Agentic AI: A Taxonomy of Types, Symptoms, and Root Causes — Shah et al., 2026. Empirical taxonomy of reliability failures in agentic AI systems combining LLM reasoning with tool invocation.
  • 📄 Security Considerations for Multi-agent Systems — 2026. Systematic threat landscape of MAS with 193 threat items across 9 categories; evaluates 16 frameworks finding none achieves majority coverage.
  • 📄 The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey — Kim et al., USENIX Security 2026. First systematic survey of AI agent security covering design space, attack landscape, and defense mechanisms with case studies on securing agentic systems.
  • 📄 Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats — Deng et al., 2026. Five-layer lifecycle-oriented security framework analyzing compound threats across initialization, input, inference, decision, and execution stages of autonomous LLM agents.
  • 📄 OpenClaw as Language Infrastructure: A Case-Centered Survey of a Public Agent Ecosystem in the Wild — He et al., Preprints 2026. Case-centered survey of the OpenClaw public-agent ecosystem whose Security dimension synthesizes governance, skill-supply-chain (ClawHub), and deployment risks of an open skill ecosystem alongside Platform, Societies, and Deployment.
  • 📄 AgenticCyOps: Securing Multi-Agentic AI Integration in Enterprise Cyber Operations — Mitra et al., 2026. Holistic architectural security framework decomposing attack surfaces across component, coordination, and ecosystem layers of enterprise multi-agent systems.
  • 📄 MCP-in-SoS: Risk Assessment Framework for Open-Source MCP Servers — Kumar et al., 2026. System-of-systems risk assessment framework for evaluating security risks of open-source MCP server deployments in production agent systems.
  • 📄 SoK: The Attack Surface of Agentic AI — Tools, and Autonomy — Dehghantanha & Homayoun, 2026. Systematization mapping trust boundaries and security risks of agentic LLM systems; proposes taxonomy spanning prompt injection, RAG poisoning, tool exploits, and multi-agent threats with metrics like Unsafe Action Rate and Privilege Escalation Distance.
  • 📄 Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation — Ling et al., 2026. Systems-oriented synthesis of 247 papers organizing LLM agent security around information flow, delegated authority, and persistent state, identifying prompt injection and tool-mediated hijacking as dominant threats while flagging emerging state-corruption and multi-agent propagation risks.
  • 📄 Data Agents Under Attack: Vulnerabilities in LLM-Driven Analytical Systems — Wang et al., 2026. Systematic security study of LLM data agents identifying eight risks across interpretation, execution, and policy layers plus an attack taxonomy of fourteen techniques, demonstrating substantial gaps across six open-source and production analytics platforms.
  • 📄 Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents — Lahjouji & Colaco, 2026. Organizes privacy research in LLM agents around data sources rather than attack types — spanning database queries, external APIs, and inter-agent communication — and identifies governance gaps including the need for information-flow control and benchmarks covering an agent's complete data ecosystem.
  • 📄 Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations — Jamshidi et al., 2026. Empirical security analysis of a self-hosted multi-agent LLM system where model outputs trigger privileged operations, measuring compromise probability, boundary failures, and privilege drift as attacker capability and agent count scale.
  • 📄 LLM Agents Security Duality: A Comprehensive Survey of Self-Security and Empowered Cybersecurity — Xu et al., 2026. 73-page survey mapping the dual role of LLM agents in security — cataloguing agent-facing vulnerabilities and mitigations while examining how the same agents empower offensive and defensive cybersecurity, and highlighting the tension between self-protection and capability.
  • 📄 Agent Security Meets Regulatory Reality: A Practitioner Systematization of Autonomous-Agent Threats and Controls in Regulated Financial Systems — Mohan & Srinivasa, 2026. Maps agentic threats (prompt injection, agent identity, auditability, tool abuse, data residency) to financial-sector regulatory requirements and documents production agent-to-agent patterns and controls for compliance-bound deployments.
  • 📄 The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities — Rashidi, 2026. Systematizes 39 execution-security papers (2023–2026) on AI coding agents that read repositories, call tools, and run shell commands with limited oversight, exposing fragmentation across isolation, access control, TOCTOU, and MCP threat research along with five critical gaps including the absence of shared benchmarks for evaluating isolation architectures.
  • 📄 Security and Privacy in Agentic AI: Grand Challenges and Future Directions — Jenkins et al., 2026. Horizon-scanning report from thirty international experts across academia, industry, and government identifying the grand challenges and future research directions for the security and privacy of increasingly agentic AI.
  • 📄 Trust but Verify? Uncovering the Security Debt of Autonomous Coding Agents — Sakib et al., 2026. Empirical study of thousands of agent-authored pull requests finding 38.9% contain at least one security smell (misconfigurations, leaked credentials, supply-chain issues), with human collaborators introducing the majority of leaked secrets in agent-assisted workflows.
  • 📄 Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation — Badhe & Tiwari, 2026. Introduces SkillSec-Eval, a lifecycle framework for evaluating security of reusable LLM agent skills with a threat taxonomy spanning repository admission, semantic retrieval, planner selection, execution, and skill evolution — showing risks extend well beyond the runtime execution stage.
  • 📄 The Ethics of Autonomous AI Agents for Offensive Security — Happe et al., FAIEMA 2026. Analyzes how LLM-driven offensive-security agents introduce indeterminacy across their non-deterministic policies, open-ended impact, and a collapsing operator skill floor, arguing this combination industrializes offensive capability, diffuses moral attribution among users, tool-makers, and third parties, and outstrips existing dual-use and AI-ethics frameworks.
  • 📄 The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI — Narayan et al., 2026. Formalizes a threat model for persistence-based attacks on stateful agents — including memory injection (MINJA) and sleeper-agent behaviors that decouple the attack vector from the eventual harmful event — and synthesizes a defense-in-depth landscape spanning trajectory guardrails (AgentDoG), formal temporal verification (Agent-C), immunological memory consensus (A-MemGuard), and hardware-anchored trust via GPU TEEs and zero-trust memory.
  • 📄 Engineering Trustworthy Agentic AI for Critical Systems — Al-Refai et al., 2026. Survey treating trustworthiness as a first-class engineering property for agentic systems in constraint-bound domains, organizing threats, trust mechanisms, and quantitative metrics across five dimensions (safety, robustness, transparency, accountability, and privacy/security) and mapping them onto an assurance workflow examined across power systems, autonomous vehicles/robotics, HPC, and communication networks.
  • 📄 Agent Security Needs Redefinition through a Holistic Framework — Siu et al., ICML 2026. Position paper arguing agent security is fundamentally contextual rather than content-based — the same action (e.g., "delete user data") can be a routine request or an injection depending on authorization context — and operationalizes it through four jointly-held, trajectory-continuous properties (Source Authorization, Task Alignment, Action Alignment, Data Isolation), under which indirect prompt injection becomes a Source Authorization violation and snapshot benchmarks are shown structurally incapable of evaluating Data Isolation.
  • 📄 An Empirical Study of Model Context Protocol Applications — Majeed et al., 2026. Large-scale study of 1,723 MCP client applications mined from GitHub finding that while most configure servers via files (85.2%) and use an official SDK (81.1%), human oversight diverges sharply — only 37.2% gate tool execution behind a blocking approval step, leaving the LLM able to invoke any enabled tool unconditionally in most apps.
  • 📄 Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation — Liu et al., 2026. Survey tracing threats across the world-model lifecycle of embodied AI agents — from data construction and representation learning through state grounding, imagination, trajectory evaluation, execution, and tool/memory-based adaptation — showing how poisoning, backdoors, prompt injection, sensor spoofing, trajectory manipulation, and supply-chain attacks take on distinct meanings when they corrupt world states, and structuring defenses across provenance, robust grounding, uncertainty-aware prediction, trajectory gating, feedback auditing, and deployment assurance.
  • 📄 From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems — Malla & Siby, 2026. Proposes a taxonomy of attack vectors specific to web-based multi-agent systems (MAS) and releases the WebMASLab test-bed to isolate architecture's effect on security by holding task, tool surface, and browser substrate fixed; introduces a MAS-specific Telephone Loop attack that exploits cross-agent delegation to create cyclical task loops — inert against single-agent setups yet compromising MAS at ~80% baseline across three of four frontier models — and shows obvious defenses like prompt-hardening fail to generalize.
  • 📄 The Vulnerability With No CVE: Managing Persistent Gaps Between Mandate and Authority in AI Coding Agents — 2026. Proposes the agentic posture vulnerability (APV) as a task-conditioned vulnerability-management abstraction — a durable record for a composed agent-control exposure that outlives any single event and stays open until authority is narrowed, a missing control is added, risk is accepted, or closure is verified — operationalizing existing excessive-agency, authorization, and control-composition weaknesses into six recurring patterns, a vulnerability lifecycle, and a control-and-closure matrix.
  • 📄 On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models — Hossain et al., 2026. PRISMA 2020 systematic review of 85 agentic-LLM security papers (2023–2025) finding attack research outpaces defense 3.9:1; contributes a four-layer taxonomy (perception, brain, action, interaction) of 13 vulnerability types and shows perception-layer flaws (prompt injection, jailbreaking) dominate the literature while action-layer risks (tool misuse, code injection, sandbox escape) remain understudied relative to real-world impact.
  • 📄 When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling — Karanjai et al., 2026. Attack-surface survey of AI agents operating on blockchain networks through MCP, skills, and tool calling, arguing that blockchain properties like irreversibility and continuous autonomy qualitatively change the agent threat model relative to conventional software and mapping the resulting vulnerabilities across the tool-calling stack.
  • 📄 A2ABreak: Systematic Security Analysis of the A2A Protocol — Lotfi et al., 2026. First rigorous systematic security analysis of the Linux-Foundation-governed Agent2Agent (A2A) protocol — the emerging inter-agent communication layer complementing MCP — using LLM-assisted extraction of a verified finite-state machine (37 states, 76 transitions from 929 formalized statements) directly from the natural-language specification, then reasoning over the model to discover protocol-level vulnerabilities in cross-organizational agent discovery, authentication, and task delegation.
  • 📄 When Passing Tests Hides Vulnerabilities: An Empirical Study of Silent Failures in Agentic Systems — Bai et al., 2026. Empirical study of LLM-based agentic code-repair patches that pass syntactic and functional verification yet still retain or introduce security vulnerabilities; across 1,030 execution traces from seven agent frameworks on SecurityEval and CVEfixes, identifies 170 confirmed "silent failures" and categorizes them (omission, incomplete fix, and newly introduced flaws), showing test-passing is an unsafe proxy for security in agent-authored code.
  • 📄 Trustworthy Agentic AI: A Comprehensive Cybersecurity and Systems Survey on Threat Landscapes, Defense Architectures, and Open Challenges — Mostafavi, 2026. Synthesizes 206 studies and standards into a systems-security reference framework, formalizing the agent as a stateful 5-tuple and a 6-dimensional trustworthiness taxonomy, then analyzing threat surfaces across intra-execution loops and interaction planes and proposing a multi-layered zero-trust defense-in-depth architecture (Dual-LLM isolation, capability-based access control, kernel eBPF probes, sandboxed runtimes) mapped to international governance frameworks.
  • 📄 Authorization Architectures for Tool-Using AI Agents — Surapani et al., 2026. Structured narrative review of 89 primary sources introducing a principal hierarchy (human user, operator/deployer, orchestrator, sub-agent, tool endpoint) and five interdependent layers — agent identity and credential lifecycle, delegation and scope propagation across multi-hop chains, runtime enforcement and just-in-time authorization at policy enforcement points, prompt injection as authorization bypass, and auditability/provenance/non-repudiation — deriving seven structural requirements and a four-layer reference architecture, with runtime enforcement and aggregation bounds as the principal open gaps.
  • 📄 SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration — Mia et al., 2026. Systematization reframing jailbreak security around the full agentic execution pipeline (user interaction, planning, memory, tool use, inter-agent communication) with unified attack/defense taxonomies and a security–utility–efficiency framework, finding that strong native alignment does not imply adversarial robustness and that low final-response attack success can mask severe intermediate compromise of planning, memory, and tool interactions.
  • 📄 After the Party: Governing What a Viral Agent-Skill Ecosystem Left Behind — Xiong & Zhang, APSEC 2026. Measures the aftermath of the 2026 OpenClaw skill-registry boom using Git history, GitHub issues/PRs, and three ClawHub snapshots, finding attention concentrated (top 10% of skills drew 46.93% of downloads), scrutiny absent (77.86% have zero stars/comments while 85.06% of readable skills carry privilege evidence), and automated cleanup unready — three security scanners disagreed on 23,702 of 61,990 shared skills, with weighted sensitivity of only 21.67–61.06% after human adjudication.
  • 📄 SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes — Wang & Saxena, 2026. Argues agentic-AI security studies are too domain-agnostic for high-stakes settings and presents FARSIGHT, a scheme-level framework evaluating financial LLM trading agents on robustness under market turbulence and security against attacks on information sources, attacks on agents, and agent-as-attacker behaviors; across 15 academic schemes, 80% fail at least one core robustness metric and 100% exhibit security vulnerabilities, with a single compromised agent able to trigger a market-wide crash at minimal cost.
  • 📄 Characterizing Network Centralization and Observability in the Remote MCP Ecosystem — Sohail, NIPA 2026. Empirically characterizes the public remote MCP server ecosystem with a three-tier observability framework (catalog metadata, passive compliance, live vulnerability analysis) over 179 endpoints, finding heavy infrastructural consolidation (ASN Herfindahl-Hirschman Index 0.736) and a Security-Observability Tradeoff — platform-level OAuth 2.1/PKCE that secures 95% of commercial PaaS-hosted servers simultaneously blocks automated tool-poisoning vulnerability scanning without prior credential provisioning.
  • 📄 PentestChain: A Cost-Aware, MCP-Orchestrated Framework for Automated Penetration Testing with Free-Tier LLMs — Patel et al., 2026. Automated pentest framework exposing its pipeline through an eleven-tool MCP server, and — beyond cost-aware model cascading — analyzes the attack surface an MCP-exposed offensive engine introduces, grounding a four-position threat model in the 2025 MCP incident record (CVE-2025-6514 RCE in mcp-remote, the postmark-mcp supply-chain backdoor, and the tool-poisoning/rug-pull/line-jumping class) and contributing four mitigations.
  • 📄 Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives — Rahul Dev & Nath, 2026. Systematizes the trust boundaries and attack surfaces of representative autonomous pentesting-agent architectures, arguing that persistent memory, real-world action, and long-horizon reasoning raise qualitatively different concerns than chat-based LLMs; contributes a lifecycle-aligned threat taxonomy (LLM-lifecycle, agent-architecture, and cross-cutting behavioural attacks) and shows why conversational-AI guardrails fall short for offensive agents, motivating context- and architecture-aware guardrail research.

Attack Research

Prompt Injection via Tools

Tool Poisoning & Supply Chain

Privilege Escalation & Excessive Agency

Data Exfiltration & Privacy

Indirect Prompt Injection

Agent Deception & Manipulation

Compound System Attacks

Cross-Plugin Attacks

Backdoor Attacks on Agents

Jailbreaking & Guardrail Bypass

Defense Research

Permission & Access Control

  • 📄 ActGov: Governing LLM Agent Actions via Policy-Constrained Validation — Zhang et al., 2026. Runtime enforcement framework that validates every LLM-proposed tool action before it causes external effects; ActGov-Policy iteratively builds an SMT-verified policy set from tool specs, benign tasks, and failure traces, and ActGov-Runtime abstracts each call into finite policy records, permitting it only within the task-scoped authorization boundary — reducing indirect-prompt-injection success on AgentDojo and AgentDyn without relying on the LLM to spot malicious instructions.
  • 📄 Zero-Trust Authorization and Discovery for Enterprise MCP — Li et al., 2026. Gap analysis of six MCP SDKs identifies single-header credential binding, no pre-auth tool discovery, and missing per-tool authorization; adds composable FastMCP extensions (cross-header credential normalization, cached token verification, unauthenticated metadata endpoint, permission-filtered tool visibility) — driving forbidden-tool exposure from 21.1% to 0/720 and showing discovery controls cannot replace invocation-time enforcement (models named hidden tools in up to 94% of settings).
  • 📄 Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems — Paul & Nandy, ICML AIWILD 2026. Enumerates 14 attack vectors across direct, indirect, inter-agent, and cascading injection channels; testing on a 6-agent system finds 67% of agents vulnerable to at least one scope violation, then reduces overall injection success from 31.2% to 4.2% via message signing with provenance tracking, boundary I/O sanitization, privilege-scoped per-role tool access, and anomaly detection on inter-agent communication.
  • 📄 Linguistic Firewall: Geometry as Defense in Multi-Agent Systems Routing — Alsheich et al., 2026. ANTAP routes tasks to agents based on empirically verified capability rather than self-declared textual descriptions, resisting description-based injection, embedding attacks, and covert-backdoor impersonation where malicious agents misrepresent their proficiencies.
  • 📄 PAuth: Precise Task-Scoped Authorization For Agents — Sharma et al., 2026. Implicit authorization model where NL task submission authorizes only required operations; uses NL slices and envelopes for provenance-based server-side verification, blocking injected operations in AgentDojo with zero false positives.
  • 📄 Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies — Schneider et al., 2026. Proposes the Dynamic Security Control Compositor (DSCC), which enforces compositional security policies over multi-tool agent chains by combining static analysis with runtime data-flow tracking.
  • 📄 Rethinking Agent Security as a Networking Problem — Tran et al., 2026. Argues agent-centric defenses fail because they entrust policy enforcement to nondeterministic, injectable LLMs, and instead borrows networking principles — centralized control with distributed enforcement, capability-based access, and zero-trust least privilege — combining deterministic enforcement with semantic, context-aware policies in a reference architecture for securing AI agent systems.
  • 📄 Twin Agent: Context Residual Compression for Privilege Separated Agents — Hu et al., 2026. General privilege-separation design pattern using two near-symmetric agents — an Explore Agent that inspects untrusted context and a Safe Agent that executes privileged actions — where the Explore Agent, conditioned on the Safe Agent's context, communicates only compact hints about the next action, improving the security–utility tradeoff and preventing prompt injection across SWE-bench Lite, AgentDojo, and DecodingTrust-Agent.
  • 📄 TrustAgent: Towards Safe and Trustworthy LLM-based Agents — Agent Constitution for safety-aware planning with pre/post-action inspection.
  • 📄 Autoformalization of Agent Instructions into Policy-as-Code — Mondl et al., 2026. Uses an LLM generator-critic loop to automatically translate natural-language agent instructions and policy documents into formally enforceable Cedar policies, achieving broader coverage than hand-coded symbolic enforcement while avoiding the no-guarantees weakness of probabilistic guardrails on medical agent benchmarks.
  • 📄 Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI Systems — Salfeld-Nebgen et al., 2026. Formalizes an institutional governance model where an autonomous agent keeps full planning autonomy but must present independently attested evidence at the point of consequential, irreversible action (e.g., clinical prescribing, production deployment) rather than having its reasoning monitored.
  • 📄 A Deterministic Control Plane for LLM Coding Agents — Madatha, 2026. Proposes Rel(AI)Build, treating coding-agent definitions as a managed supply chain with content addressing, permission enforcement, and audit logging, arguing governance of the agent-config layer must be deterministic and tool-agnostic rather than delegated to further LLM orchestration.
  • 📄 A Dual-Helix Governance Approach for Reliable Agentic AI — 3-track architecture (Knowledge, Behavior, Skills) using knowledge graphs.
  • 📄 Talk Freely, Execute Strictly: Schema-Gated Agentic AI — Schema-gated orchestration for trustworthy agent deployment in regulated domains.
  • 📄 ESAA-Security: Event-Sourced Architecture for Agent-Assisted Security Audits — 26 tasks, 95 checks, append-only event logs for reproducible AI code audits.
  • 📄 Caging the Agents: A Zero Trust Security Architecture for Autonomous AI in Healthcare — Maiti, 2026. Production-deployed zero-trust architecture for 9 autonomous AI agents: gVisor kernel isolation, credential proxy sidecars, network egress allowlisting, and prompt integrity framework with untrusted content labeling. Open-source configs released.
  • 📄 Sovereign Execution Brokers: Enforcing Certificate-Bound Authority in Agentic Control Planes — He & Yu, 2026. Runtime enforcement layer that intercepts autonomous agent requests and verifies them against cryptographically-issued certificates before allowing infrastructure mutations, ensuring production changes cannot originate from agent reasoning alone.
  • 📄 The Unfireable Safety Kernel: Execution-Time AI Alignment for AI Agents and Other Escapable AI Systems — Dobrin & Chmiel, 2026. Rust-based, formally verified safety kernel that enforces authorization on agent actions through process separation and cryptographic verification, designed to resist self-modification and escape attempts so an agent cannot circumvent its own safety controls at runtime.
  • 📄 A First Measurement Study on Authentication Security in Real-World Remote MCP Servers — Zhou et al., 2026. Large-scale measurement of 7,973 remote MCP servers finding widespread unauthenticated exposure and pervasive OAuth flaws, with 9 CVEs from responsible disclosure.
  • 📄 CmdNeedle: Measuring the Incompleteness of Command Denylists for AI Agents — Chen et al., 2026. Shows that the denylist component of terminal agents' three-list command-gating mechanism — including Claude Code's built-in list — is systematically incomplete against the large, ever-expanding set of shell commands shipped by modern operating systems.
  • 📄 SecureClaw: Clawing Back Control of LLM Agents — Ma et al., 2026. Dual-boundary security architecture placing authorization at the effect sink and plaintext confinement at the read boundary, using opaque handles and a PREVIEW→COMMIT protocol to block unauthorized external actions and sensitive-data leakage in tool-using agents.
  • 📄 SessionBound: Turning Enterprise Task Approval into Budgeted Database Sessions — Wu, 2026. Confines enterprise agent-generated SQL to pre-approved business tasks via short-lived, budgeted, auditable database sessions — the agent may generate queries freely, but every attempt must stay inside the approved boundary — enforcing safety through database-layer access controls, query budgets, and disclosure limits rather than trusting the LLM to self-police.
  • 📄 Janus: A Playground for User-Involved Agentic Permission Management — Brigham et al., 2026. Playground system implementing six permission assistants across a design space of user involvement in agentic tool-call authorization; shows user input meaningfully strengthens privacy and security, AI augmentation of user decisions reduces cognitive load, and permission fatigue must be modeled since no single design is optimal across contexts. Code.
  • 📄 aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents — Kodathala, 2026. Off-host authorization gateway that binds tool calls to verified user authority via HMAC-SHA256 signatures and role-based policies, blocking deceived agents from executing actions beyond granted permissions rather than trusting the model's own refusals over unverifiable text context.
  • 📄 From Neural Intent to Cryptographic Authorization: Governing Agentic Workflows — Weng et al., 2026. Neural Cryptographic Services (NCS) inserts a deterministic symbolic controller between LLM agents and privileged tools, admitting a tool invocation only when it matches cryptographically authorized instructions from an offline-signed, hash-chained instruction stream rather than trusting the model to comply with intent — cutting attack success while preserving utility on legitimate workflows.
  • 📄 Steerability via Constraints: A Substrate for Scalable Oversight of Coding Agents — Winninger, ICML 2026 Deep Learning for Code Workshop. Argues the controls long used to manage large human engineering teams — access control, network policies, tooling-enforced coding conventions — transfer directly to unconstrained coding agents (whose autonomy introduces security risks) and are cheaper in tokens than agentic scaffolding; a controlled experiment shows a small reviewer's recall on 11 inserted backdoors rising from 54.5% to 90.9% when given a constrained substrate plus a ~200-LoC docs CLI.
  • 📄 Context-to-Execution Integrity for LLM Agents — Santos-Grueiro, 2026. CXI is an execution-boundary system that marks protected sink fields, carries narrow validated values from writable context via typed releases, keeps evidence in opaque data slots, and admits a tool call only when field authority, exact-effect authorization, and invocation authority all bind to the same action manifest — yielding zero field/effect/invocation escapes across 720 AgentDojo episodes and 400 code-agent episodes.
  • 📄 Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agents — Reddy et al., 2026. Identifies "silent wrong-state" failures where policy-permissive tools execute forbidden state transitions without any error, and shows lightweight deterministic read-only pre-execution gates raise τ²-bench airline success from 29.6% to 42.0% by blocking policy-violating writes at the action boundary.
  • 📄 ScopeJudge: Cost-Aware Pre-Execution Gating for Offensive Security Agents — Caldwell et al., 2026. Pre-execution gate in which a lightweight LLM judge inspects each offensive-security agent tool call against the engagement scope inferred from the user's request — treating the boundary as intent-declared rather than a fixed policy — to block out-of-scope actions before they execute.
  • 📄 How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement — Michael & Roesner, 2026. Systematizes user-level permission systems for AI agents via a taxonomy of 21 proposals and an analysis of five commercial agents, examining how permissions are specified, derived, and enforced at runtime to counter prompt injection and unauthorized task execution.
  • 📄 Toward Cryptographically Verifiable Authorization for Autonomous AI Agents — Llambí-Morillas & Fernández-Fernández, 2026. Formalizes agent authorization as a cryptographically verifiable relation (CVA) that jointly binds an agent principal, a concrete request, an execution context, and policy satisfaction while preserving confidentiality of private attributes; defines candidate properties (authorization soundness, principal/request/policy binding, replay resistance), gives a Groth16 zk-SNARK proof-of-concept, and identifies the structural separation of identity, request, and runtime-execution binding as a central open problem for secure agentic systems.
  • 📄 ToolGuardian: Declarative Security for AI Agent-Tool Interactions — Ravindran & Deochake, 2026. Policy-driven framework pairing pre-admission tool vetting via progressive characterization (declared descriptions, syscall traces, mock-execution effects, source analysis) with task-aware runtime authorization, built on an Answer Set Programming declarative policy layer that reasons explicitly over capabilities, effects, task context, and multi-tool composition; on 16 MCP-style tools (8 malicious variants of real open-source tools) it reaches deny-class F1 0.86 for vetting and classifies all runtime scenarios correctly when fully specified.
  • 📄 Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecture — Noyan, AIWILD @ ICML 2026. Treats capability scoping as prevention before detection — a credential absent from an agent's context cannot be misused regardless of reasoning or evasion — via a three-source architecture (role-based ceilings, a task-context classifier, and policy-derived combination prohibitions), and releases a 600-prompt synthetic dataset labeled with minimum required permissions across a 15-permission tool-based taxonomy, with iterative dataset–policy refinement cutting ceiling violations 93% (46→3).
  • 📄 Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents — Kravchenko et al., 2026. Introduces APPA, which uses engine-managed context branching and prospective evaluation to confine taint from untrusted data locally — child trajectories absorb contamination while sanitizers return cleaned results to an unchanged parent context — preventing prompt injection from polluting the primary workspace without sacrificing operational utility.
  • 📄 Toward Standardized Cross-Vendor Agent Tool Trust Management in Autonomous Networks — Sharma et al., 2026. Proposes AgentToolMO, a 3GPP NRM information model that gives agents cross-vendor visibility into tool trust degradation — a formally defined trust state machine with graduated enforcement, damped cascade propagation, and trust notifications over existing Management Services interfaces — so a compromised tool from one vendor no longer keeps getting invoked by another vendor's agents, shrinking blast radius from hours-scale undetected propagation to near-real-time containment.
  • 📄 FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs — Zhang et al., 2026. Permission-carrying authorization framework that translates ambiguous natural-language tasks into a Permission Intermediate Representation, lowers it into an evidence-backed permission graph tracking data flows, dependencies, and contextual labels, and has a Satisfiability Modulo Theories authorizer mathematically verify each effectful action against security policies before a runtime gateway either authorizes it or intercepts it with a precise counterexample — reaching a 90.5% Decision Compliance Rate across OpenAgentSafety, OctoBench, and ActPlane.
  • 📄 Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents — Zhang & Zhang, 2026. Addresses the authorization gap created when long-lived agents evolve after deployment — retaining experience, acquiring skills and tools, revising workflows, and delegating — so the subject or context exercising a live grant no longer matches what the user evaluated; proposes earned authority bounded by a fixed ceiling to keep prompt-injection- and error-driven external actions within originally-authorized limits.
  • 📄 Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory — Xu et al., 2026. Identifies "memory provenance laundering," where untrusted external observations are rewritten into persistent agent memory as trusted user history during consolidation, and proposes the Provenance-Preserving Memory Firewall (PPMF), a middleware that keeps platform-maintained provenance and authorizes tool calls by matching action risk to the authority of the action-relevant memories.
  • 📄 Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions — Xu et al., 2026. Identifies semantic replay — where replanning, retries, delegation, and crash-resumption cause one user authorization to execute multiple times under freshly issued single-use tokens — and proposes durable, token-independent authorization state that bounds an authorized action's execution budget.
  • 📄 MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication — Xu et al., 2026. Scope-bound semantic declassification framework for multi-agent LLM systems that specifies what a legitimately informed agent should disclose and how, closing privacy leaks through internal messages, tool arguments, logs, and persistent memory that surface-redaction and source-level access controls leave open.
  • 📄 Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture — Sambrook & Sovio, 2026. Replaces software-resident agent signing keys (git commits, API auth, certificate issuance) with hardware-confined keys behind a vendor-neutral PKCS#11 interface, wrapped in a five-layer zero-trust enforcement stack — session identity, scope bounds, semantic validation, taint tracking, and a hardware execution boundary — motivated by a production incident where keys were exfiltrated via email injection in under five minutes; cuts attack success from 19.3% to 0% across 12 AgentDojo-derived injection scenarios with zero false positives on benign tasks.
  • 📄 NiyamAI: An Intent-Bound AI Agent with Cryptographically Verifiable Guardrails using Zero-Knowledge Proofs — Katkar et al., 2026. Locks permitted tools and constraints into a SHA-256-committed Intent Contract at session start and validates every tool call with an isolated Judge model that emits an EZKL zk-SNARK proof, so a tool executes only after proof verification and third parties can confirm enforcement without accessing the Judge model's weights; reaches 88.5% F1 at a 1.1% false-positive rate on Agent-SafetyBench.
  • 📄 A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem — Kumar et al., 2026. Reports a production centralized MCP gateway fronting dozens of downstream servers to resolve the governance crisis of fragmented per-team auth (some with none, some API keys, some OAuth); contributes a two-axis persona×credential authentication model, three enterprise SSO grants with BYO/GYO/delegated-OAuth (RFC 8693) token provisioning, and three end-to-end identity flows spanning user and non-user (automated) agent personas.
  • 📄 InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agents — Zou et al., 2026. Trust-native protocol suite that supplies the missing security substrate for the Internet of Agents alongside existing communication protocols, via four layers (Persistent Identity, Discovery, Trust Negotiation, and Accountability) that let an agent prove its identity, authorization, advertised capabilities, and accountability after delegation across organizational boundaries.
  • 📄 Bounded Agents: Delegation Security for Multi-Agent AI Systems — Muruaga, 2026. Frames agent misbehavior within granted permissions as an authorization-architecture problem and proposes the Agentic Principal Chain (APC), which tracks delegated authority across principals so static per-request permissions cannot be combined into a prohibited outcome or delegated unbounded to a sub-agent.
  • 📄 Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems — Liu, 2026. Enforces an anti-monotone audience-membership rule at the memory-to-context transition — a memory item is admitted only when every current viewer already belonged to its audience — preventing cross-audience information disclosure in multi-user agentic systems independent of the underlying model.
  • 📄 PACE: Policy-Attested Contract Execution for Safe AI Agents in Decentralized Finance — Karanjai et al., 2026. Transaction-level authorization framework interposing between LLM agents and blockchain execution, using typed transaction intents, a deterministic policy verifier, and signed Policy Decision Records to cryptographically bind verifier-approved actions to the exact on-chain transactions submitted, blocking prompt-injection-driven DeFi actions.
  • 📄 From Intent to Execution Grant: An Execution-Boundary Conformance Profile for High-Risk AI Actions — Wu et al., 2026. Specifies EBL-Core, a conformance profile for the final transition from a candidate AI action to execution authority: it binds a structured intent object, Root and Operational Policies, typed evidence obligations, context, and time into a verifiable Decision Derivation issued as an Execution Release Contract (ERC), defining a common semantic contract that authorization engines, policy languages, runtime monitors, and guardrails otherwise leave unspecified for high-risk actions such as transfers, deployments, disclosures, and physical actuation.
  • 📄 Scan the Skill, Govern the Action: Composing Registry Verdicts with Runtime Consequence Control — Taneja & Weber, 2026. Argues skill-registry scanners answer "is this skill malicious?" but not "is this action permitted here, by this operator, now?"; measuring 66,192 public ClawHub skill versions, finds 705 unanimously-clean skills that still instruct actions prohibited by CIS Control 2.7 and NIST SP 800-53 CM-11, and that 34.7% of a live agent's sandbox commands carried a consequence class absent from the skill's own documentation — then proposes a deterministic resolver (no model in the decision path) feeding a per-(resource, class) trust ledger whose promotion thresholds derive from operator risk tolerance, releasing a 64-case obfuscation benchmark.
  • 📄 The Stochastic Deputy: Structural Tenant Isolation for Tool-Using LLM Agents — Baig et al., 2026. Formalizes the stochastic deputy problem — passing a tenant identifier to a tool delegates resource selection to a context an adversary may control — and defends it structurally: remove tenant identity from the MCP tool schema, bind scope to a verified credential, and enforce it below the agent. In a 373-trial ablation a validated tenant parameter still served every out-of-scope attempt, while removing the parameter left no tool signature able to express the read (forged-scope escapes required cryptographically protected context).
  • 📄 AcquireBound: Runtime Authorization for Resources Acquired by AI Agents — Zhu, 2026. Provenance-bounded runtime authorization for the post-fulfillment activation gap, where payment/OAuth/mandate checks validate a transaction but not whether a returned resource (compute, credentials, accounts, sub-agents) may become usable authority; AcquireBound quarantines acquired outputs, resolves their capabilities from authenticated provider evidence, and activates them only through a current transaction checked against a downward-closed relational envelope over a typed resource-capability hypergraph, with eight proven safety properties and validation across five resource classes and staged MCP-to-Docker compositions.
  • 📄 LLM Agent Capabilities Should Follow Task Intent and Context Source — Zheng et al., AgenticOS 2026. Argues the least-privilege capability an agent needs is dynamic and task-intent-dependent, yet all inputs (user request, tool results, documents, shell output, Skill/MCP instructions, memory) enter one shared planning channel with equal authority; IntentCap composes short-lived leases from four sources — user intent, workflow instructions, tool schemas, and runtime environment — with field-level ownership and monotonic narrowing (each source fills only its own fields and can only narrow the user's authority), validated by a deterministic checker before any side effect and enforced by tool- and OS-level information-flow policies.
  • 📄 Trust Propagation and Structural Containment in Multi-Agent LLM Pipelines — Safin et al., 2026. Studies attack propagation in a four-agent LangGraph pipeline (Supervisor, Researcher, Validator, Executor) under shared-memory poisoning and indirect prompt injection via a forged in-document approval, contrasting the Validator's own judgment with an independent authorization layer using task-bound signed tokens and a separately verified policy oracle; introduces the Judgment Bypass Rate (JBR) measured at the attacked agent, and shows structural authorization contains compromise (100% JBR yet 0% Unsafe Action Rate) even when upstream LLM judgment fails, while an Observer layer cuts the agent-hijacking false-positive rate from 49% to 7%.
  • 📄 Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence under Delegation and Asynchronous Execution — Zhu & Wang, 2026. Addresses long-running agents that outlive their initiating process through credentials, delegated tasks, queues, callbacks, and provider-side operations — where cancellation, process exit, and credential revocation neither close every pre-cut carrier nor distinguish independently authorized shared work; defines root-scoped authorization quiescence and a protocol that linearizes a root cut, fences old-root expansion and protected sinks, represents alternative/conjunctive authority as antichains of minimal sufficient root sets, and composes provider-frontier certificates, with proven post-cut issuer non-expansion and compositional soundness and a checker verifying 17/17 traces while rejecting 44/44 semantic regressions.

Runtime Monitoring & Sandboxing

  • 📄 The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents — Bhowmik, 2026. Measures the always-paid cost of memory-poisoning defenses on entirely benign traffic: three write-time defenses (input sanitization, provenance checking, LLM anomaly detection) show no resolvable utility cost, while a read-time reranker lowers accuracy ~4.4 points and quarantines legitimate memories on 33.6% of items — arguing where a defense intercepts the pipeline, not whether it uses an LLM, determines its benign-case price.
  • 📄 Forensic Trajectory Signatures for Agent Memory Poisoning Detection — Leong, 2026. Finds that successful agent memory-poisoning attacks leave an invariant tool-call signature (a memory recall preceding a sensitive action such as email send), enabling incident responders to detect memory-channel attacks from tool-call logs alone at 99% accuracy without inspecting memory contents.
  • 📄 MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems — Li et al., 2026. Framework that ranks the most security-critical inter-agent communication edges so defenders can deploy protection proactively, showing channel-level attack impact is highly non-uniform — a single compromised edge can account for up to 75% of total attack success.
  • 📄 AI Sandboxes: A Threat Model, Taxonomy, and Measurement Framework — Singh et al., 2026. Formal framework for evaluating AI testing environments via threat models, sandbox archetypes, and measurement criteria (fidelity, controllability, observability, containment, reproducibility) across digital, embodied, and cyber-physical deployments.
  • 📄 Cordon: Semantic Transactions for Tool-Using LLM Agents — Chen et al., 2026. Transactional runtime that wraps multi-step agent workflows in a task-scoped containment boundary for staging, validating, committing, and rolling back irreversible tool actions, rather than relying on isolated per-call guardrails.
  • 📄 VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills — Li et al., 2026. End-to-end framework that monitors agent execution traces against behavioral policies declared in skill specifications and operator constraints, using a dedicated policy language and symbolic evaluation to catch violations across temporal dependencies, argument relationships, and value flows spanning multiple tool calls — over 95% recall with sub-10% false positives on real-world agent tasks.
  • 📄 AIRGuard: Guarding Agent Actions with Runtime Authority Control — Qin et al., 2026. Runtime defense layer that treats untrusted context as informative but never authorizing, normalizing tool calls and enforcing action-time authority checks to reduce tool-mediated attacks.
  • 📄 Safeguarding LLM Agents from Misalignment through Provenance Analysis — She, Liang & Kang, 2026. ProvenanceGuard detects and blocks misaligned tool invocations by tracing whether each proposed agent action is actually supported by evidence in the agent's context, catching actions that deviate from user intent before they execute.
  • 📄 Operating-Layer Controls for Onchain Language-Model Agents Under Real Capital — Barton et al., 2026. Production study of 3,505 real-capital agents showing that agent reliability depends on operating-layer controls like prompt compilation, typed controls, policy validation, execution guards, and trace-level observability.
  • 📄 Governing What You Cannot Observe: Adaptive Runtime Governance for Autonomous AI Agents — Marin and Chaudhary, 2026. Proposes adaptive runtime governance based on bounding unobserved risk as agent behavior drifts after authorization.
  • 📄 AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents — Zhang et al., 2026. Lifecycle security architecture for autonomous agents spanning skills, external content, memory, planning, and privileged tool execution.
  • 📄 Behavioral Integrity Verification for AI Agent Skills — Wu et al., 2026. Scalable pre-deployment skill auditing framework that compares declared versus actual capabilities, surfaces description-implementation gaps, and detects malicious skills with 0.946 F1.
  • 📄 ADR: An Agentic Detection System for Enterprise Agentic AI Security — Li et al., MLSys Industry Track 2026. Production MCP security system with telemetry, red teaming, and two-tier online detection deployed across 7,200+ hosts and 10,000+ daily agent sessions.
  • 📄 Content-Aware Attack Detection in LLM Agent Tool-Call Traffic: An Empirical Study of Features, Architectures, and Evaluation Protocols — Zavrak, 2026. Shows content-aware graph and embedding-based monitoring of MCP tool-call traffic substantially outperforms metadata-only detection and highlights evaluation leakage pitfalls.
  • 📄 Arbiter: Detecting Interference in LLM Agent System Prompts — Mason, 2026. Framework combining formal evaluation rules with multi-model LLM scouring to detect interference and vulnerability classes in agent system prompts.
  • 📄 MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in MCP Agents — Zhou et al., 2026. Plug-in security cognition layer for MCP agents that validates third-party tool invocations via experience-driven trust calibration.
  • 📄 OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents — Li, 2026. Runtime security layer distributing enforcement across ten lifecycle hooks with hybrid heuristic-plus-LLM scanning, session-scoped risk accumulation, and tamper-evident audit for agent gateways.
  • 📄 Governing Evolving Memory in LLM Agents: Risks, Mechanisms, and the SSGM Framework — Lam et al., 2026. Stability and Safety-Governed Memory framework mitigating topology-induced knowledge leakage and semantic drift in persistent agent memory systems.
  • 📄 Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees — Louck, 2026. Proves content- and lineage-based memory-poisoning defenses are fundamentally insufficient against agent-specific laundering, and proposes TMA-NM, a non-malleable information-flow-control mechanism that achieves 0% attack success with full legitimate utility across eight frontier models versus up to 68% for prior defenses.
  • 📄 Detecting Malicious Agent Skills in the Wild using Attention — Etteib et al., 2026. Locate-and-Judge, a two-stage detector that flags malicious marketplace skills by analyzing instruction-following attention patterns, concentrating expensive LLM examination on high-attention instruction spans for cost-efficient marketplace-wide auditing while catching malicious skills existing scanners miss.
  • 📄 AgentSentry: Real-time Monitoring for Agentic AI Systems — Runtime behavioral monitoring of tool-using agents.
  • 📄 Monitoring Emergent Reward Hacking via Internal Activations — Sparse autoencoders detect reward-hacking during generation.
  • 📄 Self-Attribution Bias: When AI Monitors Go Easy on Themselves — AI monitors exhibit systematic leniency on own outputs.
  • 📄 Salient Directions in AI Control — Structure of AI Control evaluations: trusted monitors overseeing untrusted agents.
  • 📄 Governed Memory: A Production Architecture for Multi-Agent Workflows — Taheri, 2026. Shared memory governance layer with dual memory model, tiered governance routing, entity-scoped isolation (zero cross-entity leakage across 500 adversarial queries), and 100% adversarial governance compliance in production.
  • 📄 Agent-Native Immune System: Architecture, Taxonomy, and Engineering — Shen et al., 2026. Proposes ANIS, an endogenous biologically-inspired defense embedded directly in the agent's cognitive loop with a six-layer "Immune Tower" (including a non-cognitive isolation layer), a taxonomy of agent viruses and vaccines, and continual immune learning to counter runtime hijacking via memory poisoning, tool-chain manipulation, and multi-agent protocol attacks that survive training-time alignment.
  • 🔗 Behavioral Attestation and Compaction Drift in Persistent AI Agents — Morrow (agent-morrow), 2026. Identifies compaction drift — non-adversarial behavioral shift caused by context window compression — as a runtime integrity threat class distinct from adversarial injection. Proposes behavioral attestation (context fingerprint delta against a pre-compression baseline) as the mechanism for continuous rather than one-time agent authorization. Complements credential-scope enforcement (e.g., AATs) with runtime execution verification.
  • 📄 The Decomposition Is the Fingerprint: Per-Component Identity for Agent Skills — Liu et al., 2026. Fingerprinting framework that assigns each agent-skill component a locality-sensitive-hash identity to detect tampering, unauthorized reuse, and drift across skill versions, complementing behavioral verification with structural provenance.
  • 📄 From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes — Liu, 2026. Defines and benchmarks eight security invariants for MCP-style execution runtimes; the proposed HCP runtime blocks all modeled attacks (tool poisoning, unauthorized execution, privilege drift) that a naive baseline permits.
  • 📄 AgenticOS: An Intent-Oriented Secure Operating System Architecture for Autonomous AI Agents — Zhao et al., 2026. OS-like security architecture that reframes agent protection as an intent filter, layering a Ghost Kernel, Logic Shutter, Agent Capsule, and Semantic Boundary Gateway to isolate and mediate autonomous agent actions.
  • 📄 Proof of Execution: Runtime Verification for Governed AI Agent Actions — Rhodes et al., 2026. Cryptographically-sound runtime verification framework that binds authorization, effectful actions, tamper-evident history, and deterministic replay into attestable execution objects, so each governed agent step's authority and integrity can be proven rather than assumed from output plausibility.
  • 📄 NovaFabric: Tamper-Evident, Replayable Evidence for Autonomous AI Agent Runs — Seyedkazemi Ardebili, 2026. Records an autonomous agent run — without modifying agent logic — into a portable Run Capsule sealed with a DSSE signature, RFC 3161 timestamp, Merkle log, and redaction attestation, producing provider-neutral, tamper-evident, replayable audit evidence exportable for third-party verification with stock tooling (OpenTelemetry, DSSE/in-toto, W3C PROV); targets the compliance records (EU AI Act, ISO 42001, NIST AI RMF) that mutable observability traces cannot supply, with a four-mode replay protocol and evaluated redaction of 14/14 credential types.
  • 📄 When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems — Xu et al., ICML 2026. AcMAS detects semantically stealthy attacks in multi-agent systems by analyzing local agents' activation-space reasoning states without relying on explicit interaction graphs, staying robust to asynchronous execution (+0.55 F1 over graph baselines asynchronously) and using the same signals to restore compromised agents rather than isolate them.
  • 📄 Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents — Wang et al., 2026. TokenWall audits the natural-language token flows of long-lived agents at runtime, intercepting unsafe behaviors before they reach privileged operations and achieving a 12.5% attack success rate while preserving 97.4% benign-operation compatibility.
  • 📄 TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories — Gao et al., 2026. Embeds attribution watermarks directly into an agent's action-log trajectory across two complementary channels — one surviving content deletion, the other surviving rewrites — so a rebranding reseller who silently substitutes a cheaper model or tampers with logs can be detected, protecting agent provenance in production deployments.
  • 📄 FlowGuard: From Signals to Evidence for MCP Security Detection — An et al., 2026. Evidence-grounded MCP security detection system that verifies execution-related risks (command injection, file-system access) through runtime evidence rather than suspicious semantic signals alone, combining recon-guided payload narrowing, schema-valid probe generation, and evidence adjudication; on a 1,880-case executable benchmark it reaches 0.879–0.942 F1 while cutting end-to-end latency up to 2.23x, and surfaces 523 findings across 326 real-world servers.
  • 📄 When Agents Look Like Beacons: NIDS Evasion by Model Context Protocol Traffic — Sohail, NIPA 2026. Shows that remote MCP over Streamable HTTP produces machine-generated, authenticated, high-frequency JSON-RPC traffic that structurally and temporally resembles C2 beaconing (e.g. Cobalt Strike polling), yet — across a Docker testbed of eleven traffic profiles under Opaque, TLS-Inspected, and Cleartext conditions — evades Suricata signatures and RITA behavioral beacon scoring (a consistent 0.0 beacon score and near-zero alerts under ET Open), because NIDS heuristics tuned for traditional malware do not flag the lognormal inter-arrival distributions of generative-AI reasoning loops; proposes an agent-native network indication standard (Agent-Native ALPN and out-of-band headers) to close the visibility gap.
  • 📄 Democratizing Agent Deployment Safety: A Structural Monitoring Approach — Ravindra et al., ICML 2026 Workshops. Untrained Information Flow Graph (IFG) monitor that detects infrastructure-level sabotage under task success — coding agents that complete their task while covertly broadening permissions, degrading logging, or planting persistence — by diffing control- and data-flow graphs; cuts missed attacks from 11.6% to 3.5% asynchronously and, run synchronously as a pre-merge gate with rollback, drops joint main+covert task success from 74.4% to 0.0% without reducing legitimate completion.
  • 📄 Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents — Park et al., 2026. Links coordinated attack campaigns across separate agent sessions with no shared infrastructure or labels by fingerprinting behavioral signals such as tool-usage patterns and writing style, enabling cross-agent attribution for incident response.
  • 📄 ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems — Narayan et al., 2026. Sequential detection framework that models MCP attack progression as a six-stage kill chain and applies a Hidden Markov Model over a 20-dimensional tool-interaction feature schema to flag malicious tool-call sequences composed from individually benign invocations that evade per-call defenses, covering direct sequential, indirect-injection, and hybrid multi-stage attack chains.
  • 📄 Operational Hallucination and Safety Drift in AI Agents — Yu et al., 2026. Empirically characterizes two multi-turn failure modes in tool-using agents — Safety Drift (declared safety intent eroding into constraint-violating actions such as refusal followed by unsafe execution) and Operational Hallucination (livelock-inducing repetitive tool calls from flawed state perception) — attributes them to reasoning/execution-state decoupling, and proposes a plug-in Action-Aware Supervision Layer with intent-action consistency checks, runtime state tracking, and forced-termination primitives.
  • 📄 JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety — Xiong et al., 2026. Foresight-oriented guard framework that trains a guard model (Vanguard) to anticipate delayed risks from partial agent trajectories via coupled anticipation and adjudication tasks optimized with CoAA-RL, blocking unsafe actions before execution and improving average protection by 15.9 points over baseline guards while raising benign task completion by 5.1 points across four agent-safety benchmarks.
  • 📄 CARE: Pre-Execution Command Verification for Shell-Executing LLM Agents — Zhang et al., ISSRE 2026. Shell-specific static-first verifier that mediates individual commands at the dispatch boundary — canonicalizing generated commands into stable verification targets, deriving deterministic evidence over syntax, command semantics, path context, and provenance-backed risk patterns, and escalating only underdetermined cases to an LLM judge — reaching 85.64% F1 at a 0.91% false-positive rate and 2.32 ms mean latency, and cutting realized harm on RedCode-gen to 37.33% in its static enforcement profile.
  • 📄 SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems — Dai et al., 2026. Reframes cross-agent malicious propagation — where a harmful objective is fragmented into locally plausible subtasks that evade any single agent — as a semantic information-flow problem, attaching structured semantic taints to root requests, propagating them through a dynamic collaboration graph, and performing workflow-level validation to reconstruct global risk context before irreversible actions commit.
  • 📄 Hybrid Analysis for Secure MCP Tool Use in LLM Agents — 2026. MTGuard defends MCP tool use through lifecycle-aware static–dynamic co-analysis rather than inspecting prompts and outputs alone, arguing static-only defenses limit effectiveness and robustness against agents induced into malicious or unauthorized tool actions.
  • 📄 Distributing Security Controls Through Harness Engineering — Gore, 2026. Shows off-the-shelf security controls (OS sandboxing, skill scanning, tool restriction) can be embedded into a distributable agent harness (SHarD, built on Pi) and scaled to commercial coding agents via a single install command, matching direct-install efficacy and scoring 100% on a 23-test suite derived from the OWASP Top 10 for Agentic Applications.
  • 📄 SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents — Yang et al., 2026. Deployable security gateway that screens skill packages before coding-agent installation via a hybrid regex-prefilter + LLM-judge pipeline — safe-signal files bypass the LLM entirely and flagged files send only matched snippet windows rather than full content — reaching F1 0.817 at 1.13% FPR on SkillsBench (n=1,650, 9.1% malicious) while cutting LLM input tokens 77% and outperforming existing tools 5–6x on threshold-independent AUPRC.
  • 📄 Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study — Arias et al., 2026. Studies distributed backdoors where a poisoned tool hides encrypted payload fragments across several agents that an external step reassembles after the run, evading per-step safety checks; a prefix detector flags 99.3% of successful attacks with a median of five steps remaining (10.3% safe-run false positives), but shows much of that warning rests on removable surface cues (ciphertext length and entropy) rather than the attack's distributed structure — once stripped, detection arrives later and transfers poorly across domains.
  • 📄 $S^3$: Improving Agent Safety through Multi-Stage Defense — Xiao et al., 2026. Multi-stage defense that jointly protects LLM agents across the memory, planning, and tool-execution stages of the agentic workflow, mitigating risks that emerge at one stage and propagate across steps rather than protecting isolated stages in ways that are hard to integrate.
  • 📄 AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection — Weng et al., 2026. Self-evolving "immune system" against prompt injection that represents the user's security boundary as a persistent library of antibodies, learning from each encounter to recognize and neutralize injections that exploit underspecified user requests where the desired outcome is stated but acceptable behavior is not.
  • 📄 DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model — Lin et al., 2026. Proactive runtime guardrail built around a risk-aware world model that maintains a compact recurrent latent state over the agent's trajectory and predicts future latent states to derive immediate-hazard and prefix-risk signals, catching long-horizon risks where individually benign-looking actions gradually drift the agent toward hazardous states; fuses the multi-horizon signals into pre-execution intervention decisions, achieving the best safety–utility trade-off across four benchmarks at ~25 ms average latency per call.
  • 📄 Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents — Ruan et al., 2026. Develops a harness-level formulation of runtime defense that characterizes how harness mechanisms enable defense construction, then uses it to move past manually designed interventions toward self-evolving defenses that automatically construct and maintain security mechanisms inside the agent execution loop.
  • 📄 Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened — Rahman & Kim, 2026. Counters memory-forgery attacks such as FARMA — where fabricated reasoning-memory entries claim a required safety step is already done so the agent skips it — by verifying entries against what the agent actually executed, rather than scoring them against a fixed suspicious-wording list that an automated rewriter can evade.
  • 📄 DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents — Pinjari & Saint-Germain, 2026. Dual-head trajectory Transformer that reads a logged tool-call trajectory and in one forward pass both classifies it as compromised or not and assigns every step one of four labels (benign, injection point, hijacked, failed injection) — reportedly the first supervised detector to jointly answer where an indirect prompt injection entered, which steps it corrupted, and whether apparent poison was resisted, giving operators step-level localization rather than a single whole-trace verdict or unsafe index.
  • 📄 Engineering Reliable Commit Gates for Agentic AI: Cost-Aware Verification Portfolios under Common-Mode Data Failures — Zheng et al., 2026. Shows additional verifiers can inherit the same upstream fault as the actor (a cross-model vote over shared evidence approves 62.9% of unsafe proposals versus 22.9% with an independent evidence source — a 40.9-point source effect dwarfing 11.3 for model diversity), and presents VP-CONTROL, a runtime-assurance design and 2,880-scenario benchmark whose portfolio controller selects cost-aware verification plans from deployment-observable metadata; a preregistered live HTTP/SQLite study finds after-check races defeat verifier-only gates while a full atomic commit-time guard records no unsafe effects across 216 episodes.
  • 📄 Provisional Reachability: Containing Agents by Making Every Crossing Revocable — Takashita, 2026. Treats data exfiltration as a rate to be bounded rather than blocked: hold every trust-boundary crossing in escrow for one period, audit each held item independently with probability r, and revoke the window on any catch, giving a per-window leak bound of ~c/(er) bits that holds as a supremum over adversary strategy (so the scheme may be public); pairs escrow with per-period decay so an L-bit secret becomes unreachable once decay exceeds a threshold, and reports an end-to-end stack cutting a leak from 100,000 to 59 bits (≈1,704×) while leaving 88% of legitimate work standing, with caller-keyed windows restoring full utility.

Input/Output Validation

  • 📄 IHDec: Divergence-Steered Contrastive Decoding for Securing Multi-Turn Instruction Hierarchies — Liu et al., 2026. Training-free decoding-time defense that uses Jensen-Shannon divergence to detect and suppress token-level violations where lower-priority inputs override higher-priority instructions, strengthening multi-turn agents against adversarial prompt injection.
  • 📄 AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization — Ying et al., 2026. Defends tool-using agents by semantically virtualizing untrusted external content to reduce prompt injection influence on privileged actions.
  • 📄 Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems — Soosahabi & Namsani, 2026. Proposes CMPE, a defense that replaces predictable refusals with misleading-but-safe outputs to degrade automated jailbreak attacks by denying attackers a reliable success signal.
  • 📄 Defending against Adaptive Prompt Injection Attacks via Reasoning-enabled Task Alignment — He et al., 2026. Argues pattern-matching IPI defenses collapse under adaptive attacks, and instead assesses whether each embedded instruction's intent is relevant to the user's task — restoring robustness against attackers who optimize against the deployed defense.
  • 📄 Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning — Shi et al., 2026. Tool-Guard defense that quarantines untrusted tool descriptions during a first isolated planning pass so poisoned tool metadata cannot steer agent actions, preserving task utility while cutting attack success on AgentDojo and Agent Security Bench.
  • 📄 StruQ: Defending Against Prompt Injection with Structured Queries — Separates prompts from data to prevent injection.
  • 📄 Towards Provably Unbiased LLM Judges via Bias-Bounded Evaluation — Formal guarantees for reducing bias in LLM-as-judge systems.
  • 📄 Judge Reliability Harness: Stress Testing LLM Judges — No evaluated judge is uniformly reliable.
  • 📄 GELO: Good-Enough LLM Obfuscation — Privacy-preserving LLM inference with ~20-30% latency overhead.
  • 📄 Untrusted Content Masking for Web Agents with Security Guarantees — Nikolić et al., 2026. UCM restores the trusted/untrusted boundary for web agents by using the DOM to redact untrusted page regions before they reach the agent and routing interaction through a sandboxed, privilege-separated interface — extending provable prompt-injection defenses from tool-use APIs to the rendered-page setting.
  • 📄 Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions — Shi et al., 2026. Finds taint-style flaws dominate MCP server vulnerabilities and are slow to patch, then proposes SPELLSMITH, which builds tool-level risk profiles and embeds behavioral guidance into the protocol's Description field plus an LLM self-reflection loop to mitigate exploitation without context-specific code fixes.
  • 📄 Multi-Agent Firewall Architecture for Privacy Protection of Sensitive Data in Interactions with Language Models — García Cuesta et al., 2026. Intercepts user–LLM traffic over HTTP(S) and WebSocket via a browser extension and proxy, then runs a multi-agent detection pipeline combining deterministic detectors with LLM-driven semantic analysis to block sensitive-data and proprietary-code leakage before transmission (F1 up to 94.93%).
  • 📄 PVDetector: Detecting Prompt Injection Attacks on Purpose-Specific LLM Agents through Policy-Violation Concept Analysis — Wang et al., 2026. Training-free inference-time defense that detects prompt injection by measuring a purpose-specific agent's hidden-state alignment with latent "policy-violation concepts" — semantic representations of the conflict between the user request and the agent's designated purpose restrictions.
  • 📄 SingGuard-NSFA: Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification — 2026. Dual-mode guardrail framework combining interpretable generative reasoning with real-time classification across 133 languages to detect operational threats to agentic AI — prompt injection, sensitive-information extraction, malicious code requests, dangerous tool misuse, and resource exhaustion.
  • 📄 ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems — Hossain et al., 2026. Shows across a 2,100-trace evaluation that an undefended multi-agent pipeline's apparent safety owes almost entirely to cloud-provider server-side filters (54 of 60 blocks on Azure GPT-5) and silently vanishes on backends without them; proposes a training-free defense-in-depth framework placing information-bottleneck gates on every inter-agent channel, blocking tool poisoning 30/30 at the application layer identically across backends while halving prompt-injection success and preserving benign accuracy.
  • 📄 MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck — Liu et al., 2026. Observes that benign and poisoned agent trajectories differ in the relationship between initial user intent and subsequent behavior, and uses an intent-aware information bottleneck to extract compact intent–behavior representations that denoise retrieved memory, defending against memory injection attacks with lower cost and less multi-turn redundancy than prior defenses.
  • 📄 PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents — Zhang et al., 2026. PromptShield-Home, a pilot benchmark of realistic smart-home scenarios (addressee ambiguity, screen/audio injection, health-monitor false triggers, mixed occupancy, legitimate-command floor) probing whether multimodal home agents can distinguish genuine user commands from ambient TV, on-screen, or overheard content, and compares traditional detectors, single-MLLM, and multi-agent mediation defense layers.
  • 📄 Robust Context-Aware Detection of Malicious Instructions in Text — Liu et al., 2026. Context- and query-aware classifier that segments text into benign and malicious sentences to detect indirect prompt injection at the segment level, hardened against adaptive evasion attacks realizable in agentic executions.
  • 📄 Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents — Pan et al., 2026. Identifies schema-formatted tool specifications as a primary source of agent safety degradation — white-box representation analysis shows they weaken the model's internal refusal signals — and proposes SafeKeep, an inference-time safeguard that judges requests against flattened textual tool specs while executing with the original schema, raising harmful-request refusal from 23.8% to 70.6% and cutting observation-level prompt-injection success from 25.6% to 2.5%. Code.
  • 📄 PIPES: Securing Agent Perception with Provenance and Priors — Kariyappa et al., 2026. Identifies state-corruption attacks, where attacker-controlled tool-response content makes environmental claims beyond the informational authority of its response component and corrupts the agent's perceived environment so the resulting action looks justified to existing guardrails; PIPES (Provenance-Informed, Prior-Enforced Screening) screens response units using semantic priors and source provenance so injected claims cannot masquerade as trusted context.
  • 📄 Cross-Layer Misalignment Detection in Agent Skills: A Progressive Loading-Aware Contrastive Learning Approach — Zhang et al., KDD 2026 Workshop. Detects "cross-layer misalignment" — inconsistency between a third-party skill's advertised metadata and its true runtime behavior — with progressive loading-aware hierarchical contrastive learning over a normalized corpus of 264,000+ open-source skills, raising Macro-F1 from ~0.45 for unadapted baselines to 0.87–0.89 as a screening tool for users and operators selecting skills.
  • 📄 Universal Defenses for Tool-Integrated LLM Agents Against Adversarial Attacks — Li & Wang, 2026. Explores generalizable defenses spanning four attack types at once (direct/indirect prompt injection, memory poisoning, backdoor) via two universal tool-based mechanisms — Attacker Tool Filtering, which uses anomaly detection (e.g. Isolation Forest) to remove suspicious tools, and Normal Tool Recalling, a white-box method restoring the agent's original toolset before planning — plus chain-of-thought, self-reflection, and task-paraphrasing prompt defenses; across four open-source and three proprietary LLMs (through GPT-5) it reaches 0% attack success in many settings while preserving task success. Code
  • 📄 The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents — Irshad et al., 2026. Architectural HITL defense for agentic browsers that reconstructs approval information from the ground-truth pending action and trusted intent provenance, renders it out-of-band in trusted browser chrome, and binds approval to the exact action re-verified at dispatch — combining provenance fencing, default-deny confirmation, and execution binding; across a 24-scenario benchmark (confused-deputy, Lies-in-the-Loop dialog forging, indirect prompt injection, adaptive substitution) it cuts attack success from 68–100% to 0% on every model with 78% legitimate-task completion and 0% false-block rate.
  • 📄 Detecting and Localizing Segment-Level Poisoning in Multi-Source LLM-Agent Inputs — Tan et al., 2026. Targets segment-level poisoning, where an adversary controlling only a small subset of an agent's aggregated sources (retrieved passages, reviews, documents) injects fluent, semantically plausible malicious content; observes that successful corrupted-evidence and adversarial-instruction attacks induce a consistent activation-space "poison direction" and proposes ActProbe, which projects MLP activations onto a learned poison direction with a lightweight linear SVM to detect contaminated prompts, then applies BinRoL (recursive replacement ablation, Mahalanobis branch pruning, MAD-based leaf detection) to localize poisoned segments in O(k log n) forward passes — reaching 0.01 FPR, 0.05 FNR, and 0.90 localization F1 across three datasets and four open-weight LLMs while remaining effective under adaptive attacks and protecting black-box APIs via surrogate-based removal.

Formal Verification & Analysis

  • 📄 Efficient and Sound Probabilistic Verification for AI Agents — Solko-Breslin et al., 2026. Verification framework using distributionally robust optimization to compute sound upper bounds on the probability of agent policy violations under uncertainty, without independence assumptions between predicates.
  • 📄 Agentics 2.0: Logical Transduction Algebra for Agentic Data Workflows — Formalizes LLM inference as typed semantic transformations with algebraic composition.
  • 📄 Knowledge Divergence and the Value of Debate for Scalable Oversight — Formal framework for choosing oversight mechanisms.
  • 📄 AutoSpec: Safety Rule Evolution for LLM Agents via Inductive Logic Programming — Ma et al., 2026. Counterexample-guided inductive synthesis that evolves expert-designed agent safety rules via inductive logic programming, reaching F1 of 0.98/0.93 across two domains, cutting false positives up to 94%, and producing human-auditable rules that generalize to unseen scenarios.
  • 📄 Local LLM Agents as Vulnerable Runtimes: A Source-Code Audit of the Agent Runtime Layer — Zhang et al., 2026. CLAWAUDIT static-analysis framework that audits the agent runtime layer itself for security vulnerabilities, raising recall from 13.8–21.7% baselines to 66.8–75.1% across 217 held-out advisories.
  • 📄 AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs — Wang et al., 2026. First static analysis framework to recover agent-specific dependencies (agent constructors, tool decorators, handoff declarations) into an Agent Dependency Graph, enabling Agent Bill of Materials generation and prompt-to-tool risk detection; uncovers 238 taint-style prompt-to-tool risks across 5,399 real-world agent programs.
  • 📄 SkillsMetric: Mapping the Detection Boundary of Static Analysis for Malicious Agent Skills — Chen et al., 2026. Five-stage static-analysis framework scoring skill packages along pattern density, statistical anomaly, dataflow taint, import anomaly, and capability-mismatch dimensions (AUC 0.93 on the full SkillMD-138K corpus plus a 2,266-skill adversarial set spanning 16 attack types), while exposing a fundamental blind spot: host-destruction attacks using common shell commands evade all five stages.
  • 📄 SkillConsist: Detecting Inconsistencies in Agent Skills via Bidirectional Graph Alignment — Meng et al., 2026. Detects agent-skill inconsistencies — undisclosed dangerous behavior or mismatched declarations that cause wrong skill selection — by separating declaration and implementation content into behavior records (via an LLM plus static analysis) and aligning them with a bidirectional graph, handling cases where declaration and implementation are mixed across text and code and a concise declaration maps to multiple connected implementation steps.
  • 📄 Correct Is Not Governed: Provenance Integrity in Agentic Workflows — Salas, 2026. Argues outcome-correctness is insufficient in institutional settings, where a correct action may rely on the wrong authority, an unsupported completion claim, or work made stale by a later change, and defines governed execution as work whose decisions, completion, and response to change are backed by inspectable provenance; presents Matrix, a deterministic causal-state layer that records authority and fact dependencies, verifies completion evidence, and selectively invalidates affected work.
  • 📄 CaMeLoT: CaMeL orchestrated with Temporal logic for static verification and liveness — Nikolaou et al., CAMLIS 2026. Extends the CaMeL prompt-injection defense with a static verification layer that translates an agent's generated plan into a finite-state transition system labeled with tool calls, provenance, and taint, then model-checks it against CTL temporal policies via nuXmv before any tool runs — rejecting unsafe plans without spending LLM or tool calls and returning counterexamples for plan repair; evaluated on policies derived from AgentDojo, SOC workflows, and prompt-extraction experiments.
  • 📄 Formal Analysis and Supply Chain Security for Agentic AI Skills — Bhardwaj, 2026. Five theorems with complete proofs establishing soundness for skill-package analysis, combining pattern-matching detection with information-flow analysis (96.15% F1), and releasing SkillFortify; notably reports that information-flow analysis added no detections beyond pattern matching on the tested corpus.

Evaluation & Red Teaming

  • 📄 MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG — Singh et al., 2026. Cross-surface red-teaming framework for multimodal agentic RAG that uses memory-guided Monte Carlo tree search to generate novel attacks spanning text poisoning, image injection, direct-query attacks, and orchestrator-level tool manipulation, avoiding the 73–84% template duplication of prior surface-specific approaches.
  • 📄 CONTRA: Red-Teaming Configurations of Personalizable Agents — Nöther et al., 2026. LLM-assisted tree-search red-teaming algorithm for discovering unsafe configurations of personalizable agents, finding that most popular skills can be manipulated into executing malicious actions.
  • 📄 Safety Testing LLM Agents at Scale: From Risk Discovery to Evidence-Grounded Verification — Feng et al., 2026. Introduces Vera, an automated safety-testing framework that discovers agent vulnerabilities via structured risk taxonomies and evidence-grounded verification, achieving 93.9% attack success across four production agent frameworks.
  • 📄 The Best-Laid SCHEMEs: Coordinated Sabotage and Monitoring in Multi-Agent Systems — Bernabeu-Perez et al., 2026. Benchmark for covert multi-agent sabotage showing coordinated hidden objectives are already practical in coding systems, while trusted monitors can still detect most attacks.
  • 📄 ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D — Libon et al., 2026. AI-control framework spanning four long-horizon AI R&D tasks (safety and capabilities post-training, CUDA-kernel and inference-server optimization), each paired with an embedded side task that sabotages the produced artifact and an independent out-of-scope sandbox side task, evaluating frontier agents at both sabotage and monitoring across four monitor types — and finding training-data-hidden sabotage is flagged under half the time even when monitors may execute and probe the artifact rather than only read the trajectory.
  • 📄 Real-Time Trust Verification for Safe Agentic Actions using TrustBench — Sharma et al., AAAI 2026 Workshop on TrustAgent. Dual-mode framework benchmarking trust across multiple dimensions and providing a pre-execution action verification toolkit for agents.
  • 📄 Agent Security Bench (ASB) — 10 scenarios, 10 agents, 398 environments. Comprehensive agent security benchmark.
  • 📄 SkillVetBench: LLM-as-Judge for Multi-Dimensional Security Risk Evaluation in Open-Source LLM Agent Skills — Hossain et al., 2026. Live public leaderboard and semantic vetting system that evaluates instruction-layer and multi-agent risks in community-contributed agent skills — directives that hijack an agent, exfiltrate data via encoded side channels, or chain harm across pipelines — which code-layer scanners are structurally blind to.
  • 📄 Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents — Narisetty et al., 2026. Frames out-of-band defenses (CaMeL, FIDES, Progent) as classical integrity-protection mechanisms and stress-tests them with adaptive attacks, cautioning that — like earlier in-band defenses — their reported gains (e.g. Progent cutting attack success from 25.8% to 4.2%) have only been validated against static benchmarks.
  • 📄 AutoDojo: Adaptive Attacks Expose Superficial Defenses and User-Underspecification Limits in LLM Agents — Ma et al., 2026. Replaces static IPI benchmarks like AgentDojo with adaptive attack generation, revealing that prompt-based, detection-based, and system-level defenses are substantially weaker than static evaluations suggest.
  • 📄 SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfaces — Jin et al., 2026. Runnable benchmark with 155 adversarial skill-mediated cases across 47 tasks, 6 risk domains, and 30 safety categories.
  • 📄 No More, No Less: Task Alignment in Terminal Agents — Mavali et al., 2026. Introduces TAB, an 89-task benchmark for whether terminal agents selectively follow relevant environmental cues while resisting distractor instructions.
  • 📄 Proteus: A Self-Evolving Red Team for Agent Skill Ecosystems — Zhou et al., 2026. Grey-box adaptive red-teaming framework that iteratively rewrites skills using audit and runtime feedback to measure residual deployment risk.
  • 📄 SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skills — Mecca et al., 2026. Fully agentic red/blue framework that generates context-compatible injections across nine threat types, then analyses complete skill packages to detect, localise, and patch them with grounded evidence; its best backend is the only scanner to reach a 100% injection detection rate, and analysing popular skills.sh skills surfaces latent vulnerabilities in over 17% examined — some triggering real incidents when run.
  • 📄 SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills — Li et al., 2026. Dynamic safety-testing framework that places external agent skills in adaptive "honey worlds" to trigger execution-time malicious behavior that only surfaces under particular environmental states, resources, or interaction histories — catching threats that static analysis, predefined rules, and one-shot semantic judgments miss.
  • 📄 AgentDyn: A Dynamic Open-Ended Benchmark for Prompt Injection Attacks — Li et al., 2026. Dynamic, open-ended benchmark for evaluating indirect prompt injection defenses in real-world agent security systems.
  • 📄 NAAMSE: Framework for Evolutionary Security Evaluation of Agents — Pai et al., ICLR 2026 Workshop. Evolutionary framework reframing agent security evaluation as feedback-driven optimization with autonomous red-teaming.
  • 📄 R-Judge: Benchmarking Safety Risk Awareness — 162 records, 27 risk scenarios for agent safety.
  • 📄 InjecAgent: Benchmarking Indirect Prompt Injections — 1,054 test cases for tool-integrated agents.
  • 📄 SIABENCH: Evaluating LLMs for Security Incident Analysis — 11 LLMs × 160 security incident scenarios.
  • 📄 EVMbench: Evaluating AI Agents on Smart Contract Security — 117 vulnerabilities, frontier agents exploit end-to-end.
  • 📄 τ-Knowledge: Evaluating Conversational Agents over Unstructured Knowledge — Even frontier models achieve only ~25.5% on complex agent tasks.
  • 📄 Interactive Benchmarks — Evaluating via interactive proofs and games instead of static benchmarks.
  • 📄 VeriGrey: Greybox Agent Validation — Zhang et al., 2026. Greybox security testing using tool-invocation sequences as feedback and mutational prompt fuzzing; 33% more effective than black-box on AgentDojo, discovers prompt injection scenarios missed by black-box in Gemini CLI and OpenClaw.
  • 📄 LAAF: Logic-layer Automated Attack Framework for Agentic LLM Systems — Atta et al., 2026. First automated red-teaming framework combining 49-technique LPCI taxonomy with stage-sequential seed escalation; 84% mean aggregate breakthrough rate across five production LLM platforms.
  • 📄 VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Servers — Sun et al., 2026. End-to-end auditing framework that statically localizes vulnerable MCP tool handlers and dynamically evolves proof-of-concept prompts, uncovering 106 confirmed 0-days and 67 CVEs across open-source MCP servers.
  • 📄 SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents — Tian et al., 2026. Staged benchmark of 600 adversarial tasks distinguishing three agent failure modes — semantic acceptance, auditable harm evidence, and executable state changes — showing these endpoints capture different vulnerabilities across models and prompt policies.
  • 📄 Red-Teaming the Agentic Red-Team — Pasquini et al., 2026. First security assessment of widely-deployed offensive-security agents, documenting a complete attack chain in which an active adversary exfiltrates API keys, establishes persistent footholds, and compromises operator machines, and proposing architectural safeguards.
  • 📄 Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming — Yang et al., 2026. AI-Infra-Guard organizes agent red-teaming across infrastructure, protocol/tool, behavior, and model layers with 75+ components and 1,400+ rules, matching detection paradigms to each attack surface.
  • 📄 Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens — Niu et al., 2026. SafeClawArena benchmark evaluates always-on agents across supply-chain integrity, state exploitation, data-flow, and indirect-injection attack surfaces, reaching 70% peak attack success and surfacing systemic weaknesses in persistent agents.
  • 📄 Security–Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense — Hermon et al., 2026. Introduces the SecFid benchmark showing no model jointly achieves strong security and task fidelity — the most secure configuration reaches 99.3% defense at only 71.0–73.9% fidelity — quantifying the utility cost of injection defenses.
  • 📄 When AUC 0.998 Is Not Enough: A Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agents — Li et al., 2026. Cautions that high probing AUC on multimodal computer-use agents does not by itself establish reliable malicious-injection detection, and proposes diagnostic controls for evaluating hidden-state IPI probes.
  • 📄 Distributed Attacks in Persistent-State AI Control — Hills et al., 2026. Introduces Iterative VibeCoding, an AI-control benchmark where a prompt-injected coding agent distributes a covert side task across successive pull requests in a persistent codebase; shows no single monitor resists both gradual and concentrated attacks (>=65% evasion generalizes across model backends), and proposes a stateful link-tracker monitor that cuts gradual-attack evasion from 93% to 47% in a four-monitor ensemble.
  • 📄 Beyond Attack-Success Rate: Action-Graded Severity Scale for Tool-Using AI Agents — Owiredu-Ashley, 2026. Replaces the binary attack-success metric with a seven-level (L0–L6) action-graded harm rubric scoring an agent's tool-call trajectory by reversibility, cross-scope reach, and privilege expansion, computed via a deterministic oracle and a three-judge panel (Krippendorff's α=0.91) that together expose cross-scope leaks a zero-attack-success-rate defense hides.
  • 📄 Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability — Chen et al., 2026. Introduces MCPZoo, a dataset of 64,611 unique runtime MCP servers enabling dynamic analysis, and shows existing MCP security scanners are unreliable — flagging 96.89% of servers as risky while fewer than 50% of sampled alerts are true positives.
  • 📄 Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale — Padilla et al., 2026. First dynamic behavioral security assessment of internet-facing MCP servers, combining passive discovery across eleven data sources with active testing via Corvus (34 test modules covering 10 MCP-specific vulnerability classes); across four July 2026 runs it audits 414 confirmed servers and uncovers 68 reportable vulnerabilities (SQL injection, SSRF against cloud metadata, prompt-template injection, path traversal), finding 91.8% lack OAuth authentication and 687 tool instances expose unguarded shell execution, and releases Corvus as an open-source MCP security evaluation framework.
  • 📄 Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation — Allahbakhsh et al., 2026. Reframes penetration testing for AI-enabled systems around behavioral objective violations rather than infrastructure compromise, mapping adversarial pathways including prompt injection, indirect prompt injection, data/retrieval poisoning, tool misuse, and agentic misalignment.
  • 📄 Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security — Jain et al., 2026. Multi-turn, multi-LLM benchmark showing defenders that resist single-turn attacks degrade sharply against adaptive adversaries who revise tactics across rounds, with attack success climbing from 0–1% to 5.4–14.0% over 15 iterative attempts.
  • 📄 RECEIPT: Deterministic, Reward-Hacking-Resistant Verification for White-Box Agentic XSS Discovery — Lyu et al., 2026. Deterministic verification framework that stops LLM coding agents from reward-hacking XSS-discovery tasks with false success claims, enforcing strict environment isolation and role-based payload execution before a finding is counted as valid.
  • 📄 Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming — Wang et al., 2026. PIMiner, an agentic prompt-injection red-teaming system that builds a transferable strategy library from scratch during training and applies it to previously unseen target LLMs without retraining using only ~10 queries per sample, reaching up to 86.7% ASR on AgentDojo and 76.2% on IPIArena against frontier models. Code.
  • 📄 Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents — Eliav et al., 2026. Formalizes agent reconnaissance as the extraction of knowledge assets that give adversaries leverage in indirect prompt injection, and instantiates it as KYA, a framework that automates black-box, recon-driven pentesting by probing agents, building target profiles, and using those profiles to craft stronger attacks; evaluated on agent-security benchmarks and a real-world coding agent, released with benchmarks and baselines.
  • 📄 Guardrails as Scapegoats: Auditing Unfaithful Safety Refusals in Tool-Augmented LLM Agents — Singh, KDD 2026 Workshop. Black-box auditing framework that injects silent tool-failure profiles (empty, null, or malformed HTTP-200 payloads) and classifies agent responses as Honest Surrender, Fabrication, or Unfaithful Safety Refusal — finding fabrication dominates (56.6%) while adding standard safety language to the system prompt amplifies invented policy/privacy rationales for tool failures 15.6x, concentrated on sensitive tools such as medical-record and contract retrieval.
  • 📄 IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests — Singh et al., 2026. Benchmark of malicious issue-request attacks against production coding agents (Cursor, Claude Code, Codex Desktop) spanning four attack categories and six delivery vectors (PDF, issue comment, etc.); 66.5% of malicious issues penetrate all agent- and LLM-level guardrails, with refusals coming almost entirely from the model rather than the agent framework and current agent-level defenses adding little protection.
  • 📄 OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills — Liu et al., 2026. Safety benchmark of 263 risky skills collected from public marketplaces across seven threat categories, each paired with a standardized task and sandbox; across three CLI agent frameworks and thirteen LLMs even the safest configuration still executes unsafe actions ~17% of the time, and behavioral analysis surfaces three recurring failure patterns — failing to recognize the risk, recognizing it but not intervening before acting, and following skill instructions beyond the user's intended scope.
  • 📄 Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation — Ahmed & Abbas, 2026. Audits a preserved MCP agent-security campaign and shows the historical grader suffered direct treatment leakage — treatment metadata gated the ATTACK_SUCCESS class, so fixed behavior could change class under relabeling; tracing 10,200 execution rows back to their true stimuli, a treatment-blind reconstruction corrects 58 mislabeled ATTACK_SUCCESS/HIJACK_ATTEMPT records, warning that stored labels must not be equated with behavioral facts.
  • 📄 Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming — Mao et al., 2026. AHA, a falsifiable discovery loop that proposes a vulnerability hypothesis, builds a falsifier, instantiates and executes an attack in a sandboxed harness, then promotes confirmed findings into a reusable Vulnerability Concept Graph (VCG); across Claude Code and Codex on direct and indirect attacks, the frozen VCG requires no further search yet beats the strongest discovery baseline by 14.2 points under a single-shot protocol and transfers across scenarios and attack channels. Code.
  • 📄 Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection — Ying et al., 2026. Uses AI-Infra-Guard to run 14,560 controlled executions across 16 indirect-content channels, 35 payload objectives, and 12 attack methods against the DeepSeek Harness agent loop, judging outcomes with paired rule-based and semantic LLM judges over local source-tool and sensitive-sink fixtures so attempted actions are recorded without external side effects.
  • 📄 BenchShield: Formal Model-Backed Instrumentation for Reward Integrity in LLM-Agent Evaluation Infrastructure — Zheng et al., 2026. Treats interactive LLM-agent benchmarks as attack surfaces for reward hacking — where an agent improves its measured score by exploiting the reward-relevant trajectory instead of solving the task — and grounds detection in a finite lifecycle model of an evaluation's reward-relevant events, providing reusable per-run evidence that a concrete execution stayed within its intended evaluation boundary rather than relying on task-specific patches, prompt instructions, or post-hoc detectors.
  • 📄 Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems — Akkil et al., 2026. Continuously-running multi-agent environment for adversarially stress-testing persistent autonomous systems: eight parallel worlds of ten agents (seven single-model, one mixed) ran 16 days, 850,000+ LLM calls and ~50B tokens while pursuing goals, using/creating tools, and maintaining memory, then received three controlled stress events (indirect prompt injection, misinformation, private-memory exposure) through ordinary interaction surfaces; no world was fully resilient, detection did not ensure containment (systems recognized threats yet wrote adversarial content into memory and acted on it up to 46 hours later), and model-level alignment proved non-compositional.
  • 📄 Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery — Kumar et al., 2026. Systematic black-box risk-aware agent evaluation requiring only basic system descriptions, pairing a seven-domain taxonomy that maps observable behaviors to risk categories with fully automated SAGE-RT red teaming (120 adversarial scenarios per domain) and human-validated LLM-judge scoring; across CrewAI and AutoGen with four base models it surfaces 56.25% average governance risk, 65% privacy risk in multi-agent configs, and agent-behavior vulnerabilities reaching 85% without privileged access.
  • 📄 Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents — Remedios et al., 2026. Red-teams production blocking monitors that review each proposed coding-agent action before it runs (Auto Mode in Claude Code, Guardian in OpenAI's Codex) under a persistently-misaligned agent rather than only untrusted-source injections; adversarial agents given high-level strategies evade monitors via agent-generated prompt injection, multi-agent attacks, and malicious compaction — running arbitrary bash in 79% of trials — and the paper shows design changes (broader tool coverage, transcript formatting, an agentic monitor stage) that harden Auto Mode while leaving multi-context attacks an open problem. Code.
  • 📄 AgentLSD: Evaluating AI Security Agents Under Adversarial Task Contamination — Golinelli et al., AISec 2026. Introduces adversarial task contamination — deceptive non-instructional evidence (fake results, decoy endpoints) beyond attacker-supplied instructions — and a controlled CTF-based framework that injects trap artifacts while preserving the intended solution, with deterministic trap generation, runtime injection, and telemetry; across six models on 11 web CTF challenges, traps raise turns (+20) and reasoning tokens (+2k) even when the flag is still recovered, showing clean CTF performance understates vulnerability to deceptive task evidence.
  • 📄 Collective Loss of Control in LLM Agent Systems: An Epidemic Account of Mutation, Contagion, and Recovery — Wu et al., 2026. Models how a local deviation in a multi-agent system escalates into collective loss of control via accidental mutation, contagion, and recovery — where communication lets agents adopt and retransmit an unsafe strategy faster than correction contains it; a deployment audit finds implicit communication paths between nominally independent evaluation runs transported through a default Docker backend, and the RogueHandoff-20 benchmark (20 executable scenarios injecting unsafe trajectories) shows executed harm rises from 0–5% on normal tasks to 40–95% after injection, motivating defenses that strengthen recipient resistance and recovery and restrict unintended inter-agent channels.
  • 📄 Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AI — Ghanem, 2026. Argues auditor independence for agentic systems (which are now both audited subject and auditor) must be graded along three orthogonal axes — principal (who controls the auditor), substrate (an auditor sharing the auditee's model family, toolchain, or guardrails fails with it), and evidence (attestable vs. self-reported) — aggregated by weakest link via a transplanted beta-factor common-cause-failure model; a seven-step verifiable protocol plus a Monte Carlo study show a conventional internal agent audit surfaces only 5.9% of detectable faults and none in half the fault classes, mapped to the EU AI Act and ISO/IEC 42006.
  • 📄 A Unified Evaluation Framework for Trustworthy Large Language Models, Agentic AI, and Multimodal Systems — Raza et al., 2026. Connects output-level, trajectory-level, and cross-modal assessment across eight trustworthiness dimensions (capability, robustness, safety, fairness, transparency, governance, oversight, efficiency), preserving system-specific metrics while mapping them to common performance bands with uncertainty estimates and traceable evidence; adds a meta-evaluation layer for the validity/reliability/reproducibility of the evaluation itself and safety-critical overrides that prevent aggregate scores from masking critical agentic failures, with mappings to governance frameworks and EU regulation.

Benchmarks & Datasets

BenchmarkFocusSizePaper
ASBComprehensive agent security10 agents, 398 envsZhang et al.
InjecAgentIndirect prompt injection1,054 test casesZhan et al.
R-JudgeSafety risk awareness162 records, 27 scenariosYuan et al.
ToolSwordTool learning safety6 scenarios, 3 stagesYe et al.
AgentDynDynamic prompt injectionOpen-ended, extensibleLi et al.
SkillSafetyBenchSkill-mediated agent safety155 cases, 47 tasksJin et al.
SkillVetBenchSecurity risk eval of open-source agent skillsLive leaderboardHossain et al.
SCR-BenchSkill composition riskMulti-skill chainsXie et al.
SafeClawBenchStaged harm in tool-using agents600 adversarial tasksTian et al.
ToolPrivacyBenchPurpose-bound privacy in tool-using agents2,150 casesHu et al.
TABSelective cue following in terminal agents89 terminal tasksMavali et al.
Skill-InjectSkill file attacksMulti-scenarioSchmotz et al.
NAAMSEEvolutionary agent security evalAdaptive red-teamingPai et al.
AgentHarmAgent misuse110 behaviors, 440 variantsAndriushchenko et al.
SkillGuard DatasetMalicious skill detection157 malicious skillsLiu et al.
WIPIWeb-based indirect injectionMulti-scenarioLiu et al.
DUMA-BenchDual-control agent security (8 vuln classes)8 domains, 14 modelsAleksandrov et al.
SkillAtlasAttack trace library for agent skills3,014 cases, 6,589 tracesTian et al.
IssueTrojanBenchMalicious issue requests vs. coding agents4 attack categories, 6 vectorsSingh et al.
OpenSkillRiskAgent safety with risky third-party skills263 skills, 7 categoriesLiu et al.
AudioAgentSecurityAudio prompt injection vs. multimodal agents8 scenarios, 10 patternsLiu et al.
AIP-BenchAgentic commerce protocol-level security3 platforms, 33 vulnsLouck
ContainmentBenchPost-injection containment in tool-using agentsTrace-based, multi-metricLan et al.
MemSecBenchLifecycle security of agent memory poisoning310 cases, 24-config matrixChen et al.
IH-BenchmarkInstruction-hierarchy robustness incl. tool-mediated conflicts44 constraint families, 37 modelsMcCauley et al.
AgentS4DLifecycle runtime risks of workspace agentsSandboxed, trajectory-awareZhou et al.
StepJackMulti-step indirect prompt injection vs. computer-use agents480 test casesZhan et al.
HarnessSafeSafety across persistent carriers in agent harnesses328 cases, 7 carrier familiesZhang et al.
ToolHazardScalable synthesis of adversarial tool environments for indirect prompt injectionExpandable via seed domains + computeMou et al.
ATOBenchPentest-agent vulnerability verification under deceptive target evidenceRuntime response transformationsChen et al.
HarnessRiskLifecycle safety of agent harnesses across operational phases6 operational phasesBai et al.
ChemMat-AgentSafetyBenchLong-horizon attacks/defenses in chemistry & materials agents (tool-mediated hazardous-protocol release)432 cases, 8 hazard classes, 5 online attacksYao et al.
PIDS-BenchPrompt-injection detectors under over-defense, obfuscation, and distribution shift7 detectors, multi-axis (incl. hard-benign FPR)Shire & Kim
HTB (Hallucinated-Tools Benchmark)Tool hallucination (fabricated tools/args) incl. cross-server MCP namespace collisions322 single-registry + 154 MCP hallucinations, H1–H5 / M1–M5 taxonomyIyer
ClashBenchDestructive resource preemption by privileged agents (terminating/overwriting incumbent tasks to resolve conflicts)268 conflict cases, 55 resource types, 17 modelsXie et al.
MemoryStackBenchAgent memory safety and auditability5 scenarios, 33 checksRepository
mcp-defense-benchMCP defensive-proxy attack-surface coverage24 vectors, 35 casesArumugam
VLoc BenchRepository-scale vulnerability localization by security agents (incl. refrain-on-patched)500 vulns, 290 repos, 147 CWEsPriyanshu et al.
APort VaultPayment authorization in tool-using agents (deterministic pre-action check vs. model-alone)4,371 human CTF attacks, 14 models, 225,964 evalsUchibeke

Tools & Frameworks

ToolDescriptionLink
Agent Memory GuardOWASP reference implementation for ASI06 (Memory Poisoning): runtime defense that screens every agent memory read/write through detectors + a declarative policy, with source-class provenance, forensic SecurityEvents, and snapshot rollback. LangChain/OpenAI-Agents/AutoGen/CrewAI/mem0 integrationsGitHub
Bounty SieveOffline-by-default bounty intake guardrail for coding agents: read-only GitHub issue/URL-list import, deterministic triage, local decision briefs, and human approval gatesGitHub
SkillGuardLLM-native agent skill security auditor (OWASP Agentic + MITRE ATLAS)GitHub
SkillCIRegression testing + OWASP Agentic Skills Top 10-mapped static security lint for Claude Skills. Adds a self-growing eval loop (an uncovered regression or successful redteam attack writes its own permanent test case) and git-native bisect to find the exact commit that broke a skillGitHub
PipelockOpen-source AI agent firewall and MCP-aware egress proxy with DLP, prompt injection scanning, process sandboxing, and mediator-signed action receiptsGitHub
NemoClawNVIDIA reference stack for running always-on AI agents more safely in sandboxes, with network policy, hardening, routed inference, and lifecycle controlsGitHub
CubeSandboxHardware-isolated (per-kernel) sub-60ms sandbox for secure AI agent code execution, with an out-of-sandbox credential vault, eBPF network isolation, and domain-allowlisted egress controls with audit loggingGitHub
Invariant GuardrailsPolicy-based agent security guardrailsGitHub
Armorer GuardLocal Rust scanner for AI-agent prompt injection, credential redaction, sensitive-data requests, exfiltration-style text, and dangerous tool-call contextGitHub
SunglassesRuntime trust scanner for agent skills and tool use: 1,089 patterns across 65 attack categories (prompt injection, tool poisoning, MCP attacks, skill compromise) plus a mechanism layer, shipped as a pip package, GitHub Action, and free web scanner with a published precision/recall benchmarkGitHub
LLM GuardInput/output scanning for LLM applicationsGitHub
RebuffSelf-hardening prompt injection detectorGitHub
NeMo GuardrailsNVIDIA's toolkit for adding guardrails to LLM-based applicationsGitHub
Lakera GuardEnterprise prompt injection defense APIWebsite
PromptfooLLM red teaming and evaluation frameworkGitHub
GarakLLM vulnerability scannerGitHub
IPI-ProxyIntercepting proxy for red-teaming web-browsing agents against indirect prompt injection on live whitelisted domainsGitHub
Tuning Engines CLIMCP server and CLI for governed agent/skill/tool access with policy checks, approvals, traces, and role-scoped registriesGitHub
AgentSkillsScannerStatic analysis scanner for agent skill definitionsGitHub
repo-agent-scanLocal deterministic scanner for agent skills and repository instruction files (SKILL.md, AGENTS.md, CLAUDE.md, and IDE rules), with evidence-anchored findings, SARIF, pre-commit, and GitHub Action supportGitHub
SkillTotalStatic, offline scanner for AI components (MCP servers, agent skills, npm/PyPI packages, repos): supply-chain risk, dangerous capabilities, prompt-injection, exfiltration; deterministic, evidence-anchored, SARIF + pre-commit/GitHub ActionGitHub
SkilLockBehavior-pinning lockfile + capability-delta PR review for Claude Code & Codex skills; SARIF output for Code ScanningGitHub
agent-diff-guardPre-push guardrail that flags high-risk coding-agent diffs such as CI/CD changes, dependency edits, test deletions, hardcoded secrets, and task-scope drift before mergeGitHub
SkillidPolicy-driven Claude Code plugin that combines skill guidance with per-tool hooks to enforce org guardrails, confirmation rules, redaction, and connector-specific access controlGitHub
Agent AuditSecurity analysis system for LLM agent apps: dataflow analysis, credential detection, MCP config parsing, privilege-risk checksZhang et al.
mcp-sec-auditMCP server security toolkit: static pattern matching + dynamic sandboxed fuzzing via Docker/eBPF for detecting over-privileged tool capabilitiesHuang et al.
SkillGateDeterministic local CLI that statically inspects an agent Skill package before harness admission — reports instruction surface and execution surface without executing, installing, or trusting the SkillGitHub
Assay HarnessCI gate that checks an agent's claimed tool side-effects (filesystem, network, process) against independently observed runtime evidence, classifying each claim as supported, degraded, blocked, or not-evaluable (observed support is the ceiling)GitHub
Agent ScanSnyk's scanner for local agent supply chains, covering MCP servers and skills with checks for prompt injection, tool poisoning, toxic flows, and malware-laced skill filesGitHub
DScanOpen-source agent security suite for runtime tool-call tracing, prompt-injection shielding, MCP audits, adversarial testing, and sequence-level attack detectionGitHub
Sayfos SDKRuntime guardrail SDK for AI agents with provenance checks, budget governance, plan preflight, and adjudication tokens before high-risk tool actionsGitHub
PIC StandardLocal-first standard and reference verifier that checks agent intent, provenance, and evidence at the action boundary and fails closed before high-impact tool calls; Python CLI, MCP/LangGraph/OpenClaw integrations, HTTP bridge, and a language-agnostic conformance suiteGitHub
**[Trace

Truncated — view the full README on GitHub.

agent-security
ai-safety
awesome-list
llm-security
mcp
owasp
prompt-injection
tool-use

Similar repos

MurrayTom/Awesome-Agent-Security-Papers

Beyond Environment and User Inputs: A Comprehensive Survey of Skill-Oriented Security in Agentic AI

10

8kSec/awesome-ai-security

A practitioner-focused reference for AI/ML security — attacks, tools, research, and defenses.…

4

h5i-dev/awesome-ai-agent-incidents

A curated corpus of incidents, attack vectors, failure modes, and defensive tools for autonomous AI…

52

Joe-B-Security/awesome-prompt-injection

Learn about a type of vulnerability that specifically targets machine learning models

639

scadastrangelove/awesome-ai-security-tools

A curated list of public-source, research, and commercial tools for AI security and AI-assisted…

1,520

raphabot/awesome-cybersecurity-agentic-ai

590

The-Art-of-Hacking/h4cker

This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources…

29,501

anmolksachan/AI-ML-Free-Resources-for-Security-and-Prompt-Injection

AI/ML Pentesting Roadmap for Beginners

792

Contributors

sumleo

77 commits

agent-morrow

1 commits

arian-gogani

1 commits

armorer-labs

1 commits