{"id":"ced46c32-d6ea-4ff0-912b-650915354c80","arxiv_id":"2606.09549","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"SecureClaw is a dual-boundary defense placing data confinement at reads and authorization at writes, achieving near-zero attack success while retaining task utility on AgentDojo, AgentLeak, and ASB.","lead":"SecureClaw adds a trusted gateway that replaces sensitive data with opaque handles or summaries at the read boundary and requires a preview-commit step for any external write. A smart generalist might read it to see a concrete way to reduce both data leaks and unauthorized actions in tool-using AI agents.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Security guarantees rest on uncompromised trusted gateway and executor implementing handle replacement and PREVIEW→COMMIT","rationale":"The reader's weakest_assumption matches the load-bearing dependency exactly. The reported metrics are conditional on the trusted components functioning correctly; the paper's positioning of them as the enforcement points makes this the point where the argument is least secure. No other internal inconsistency is visible from the abstract.","tokens_in":1733,"tokens_out":317,"duration_ms":12986,"concrete_test":"Review the full implementation of the trusted gateway (handle replacement + summary declassification) and executor (PREVIEW→COMMIT logic) to confirm isolation from the untrusted LLM runtime and absence of injection paths; if any bypass exists that allows raw secret access or unauthorized state change, recompute the ASR and leak metrics under that threat model.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central empirical claim (0% ASR on ASB, 0.64% on AgentDojo, 3.23% leak on AgentLeak while retaining utility) is produced by a dual-boundary design in which raw values are replaced by opaque handles at the read boundary and writes require a trusted executor to perform the canonical commit. The abstract states that the runtime \"cannot directly dereference secrets or perform side effects,\" but this property holds only if the gateway correctly performs replacement and the executor correctly enforces policy and rejects unauthorized commits. No additional hardening of these components against compromise or misconfiguration is described; any bypass collapses both confidentiality and authorization.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"SecureClaw proposes a dual-boundary architecture for LLM agents that confines plaintext at the read boundary (via a trusted gateway replacing raw values with opaque handles and bounded summaries) and enforces authorization at the write boundary (via a PREVIEW→COMMIT protocol executed only by a trusted executor). The runtime plans over summaries and symbolic references but cannot dereference secrets or perform side effects directly. Across AgentDojo, AgentLeak, and ASB benchmarks in a common harness, it is claimed to be the only evaluated defense that retains usable task utility while achieving 0% ASR on ASB, 0.64% ASR on AgentDojo, and 3.23% overall leak on AgentLeak's attacked parity lane.","tokens_in":1866,"tokens_out":532,"duration_ms":12805,"significance":"If the empirical results hold under the stated deployment assumptions, the work is significant for simultaneously addressing both confidentiality and authorization surfaces that prior single-boundary defenses leave exposed. The common-harness comparison and explicit declassification interface via summaries are strengths that enable direct comparison of utility-security trade-offs.","major_comments":[{"comment":"Abstract and threat-model discussion: the confidentiality and authorization guarantees rest entirely on the assumption that the trusted gateway correctly performs handle replacement and the trusted executor correctly enforces the PREVIEW→COMMIT policy; the manuscript does not describe additional hardening or a threat model for compromise/misconfiguration of these components, yet any bypass would collapse both properties and undermine the reported ASR numbers.","section":"Abstract"},{"comment":"Evaluation sections (AgentDojo, AgentLeak, ASB results): the central claim that SecureClaw is the only defense retaining utility at the reported ASR/leak rates depends on the precise implementation of the gateway and executor in the harness; without an ablation or explicit statement that these components were themselves hardened against the evaluated attacks, the 0%/0.64%/3.23% figures cannot be interpreted as robust to realistic deployment.","section":"Evaluation"}],"minor_comments":[{"comment":"Abstract lacks any mention of the threat model, number of runs, or statistical significance of the ASR figures; adding one sentence on these would improve clarity without altering the technical contribution.","section":"Abstract"},{"comment":"Notation for handles and the PREVIEW→COMMIT transition could be formalized with a short diagram or pseudocode to make the boundary separation easier to follow.","section":"Architecture"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback. Below we provide point-by-point responses to the major comments and outline the revisions we plan to make.","responses":[{"response":"The guarantees do rely on the trusted components remaining uncompromised. Our threat model treats the gateway and executor as the TCB and assumes they are correctly implemented and not subject to compromise. We will revise the manuscript to make this assumption explicit in the abstract and threat model discussion, including a note that bypass of these components would invalidate the security claims. We do not provide hardening mechanisms for the TCB as that falls outside the scope of the current threat model.","revision_made":"yes","referee_comment":"[Abstract] Abstract and threat-model discussion: the confidentiality and authorization guarantees rest entirely on the assumption that the trusted gateway correctly performs handle replacement and the trusted executor correctly enforces the PREVIEW→COMMIT policy; the manuscript does not describe additional hardening or a threat model for compromise/misconfiguration of these components, yet any bypass would collapse both properties and undermine the reported ASR numbers."},{"response":"In the common harness, the gateway and executor are implemented according to the SecureClaw specification and are not the target of the evaluated attacks, which focus on the agent planner and runtime. The results reflect performance under correct TCB implementation. We will add an explicit clarification in the evaluation sections stating this assumption. While we do not provide an ablation on TCB compromise (as it would require a different evaluation setup), we will acknowledge this as a boundary condition of the reported figures.","revision_made":"partial","referee_comment":"[Evaluation] Evaluation sections (AgentDojo, AgentLeak, ASB results): the central claim that SecureClaw is the only defense retaining utility at the reported ASR/leak rates depends on the precise implementation of the gateway and executor in the harness; without an ablation or explicit statement that these components were themselves hardened against the evaluated attacks, the 0%/0.64%/3.23% figures cannot be interpreted as robust to realistic deployment."}],"tokens_in":1439,"tokens_out":448,"duration_ms":29174,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The main thing here is a dual-boundary architecture for LLM agents. Reads go through a trusted gateway that swaps raw values for opaque handles (plus bounded summaries for declassification), and writes use a preview-then-commit step where only a trusted executor can finalize actions. The abstract reports that this keeps task utility while hitting 0% ASR on ASB, 0.64% on AgentDojo, and 3.23% leak on the attacked parity lane of AgentLeak.\n\nThe combination of read confinement and write authorization in one evaluated system is what stands out as new. Most prior defenses target one surface or the other. Running the comparison in a shared harness against other defenses is useful for seeing relative performance on both security and usability.\n\nThe soft spot is exactly what the stress-test note flags. The claims only hold if the gateway correctly performs handle replacement and the executor correctly enforces the commit policy. The abstract gives no description of hardening, verification, or isolation for those two components. A bypass or misconfiguration there collapses both the confidentiality and authorization properties. The headline numbers also come without threat model details, ablation data, or evaluation methodology, so it is hard to judge how sensitive the results are to setup choices.\n\nThis paper is aimed at researchers and engineers working on practical agent deployments. Anyone looking at concrete ways to limit both data exposure and unauthorized actions would find the architecture worth reading. It deserves a serious referee because the problem is real, the proposed fix is specific, and the benchmarks are standard in the area.\n\nI would send it to peer review to get the full evaluation details and a closer look at the trusted-component assumptions.","headline":"SecureClaw's dual-boundary design with handles and preview-commit is the main idea, but security rests on unhardened trusted components.","tokens_in":2323,"tokens_out":407,"would_cite":false,"duration_ms":19132,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"SecureClaw confines sensitive data at the read boundary and authorizes writes via preview-commit in LLM agents.","keywords":["LLM agents","tool use","security","data confinement","authorization","handles","preview commit","benchmarks"],"falsifier":"Demonstrating a successful attack that extracts raw sensitive values through the runtime or forces an unauthorized commit despite the protocol would falsify the security guarantees.","tokens_in":2630,"feed_emoji":"🔐","tokens_out":623,"duration_ms":24593,"temperature":0.7,"pith_summary":"Tool-using LLM agents risk unauthorized external actions and leaking sensitive plaintext because the runtime can access raw values and trigger effects without oversight. Defenses that protect only the planner or only the action sink leave one vulnerability open. SecureClaw adds a trusted gateway that swaps sensitive reads for opaque handles and summaries, plus a PREVIEW to COMMIT protocol where a trusted executor alone can finalize changes. The agent can still plan using these safe references. In tests on three benchmarks, this setup keeps task utility while driving attack success rates to zero or very low, something no other tested defense achieves at once.","feed_headline":"SecureClaw secures LLM agents at read and write boundaries","feed_subtitle":"Gateway replaces secrets with handles; writes need preview then trusted commit to block leaks and unauthorized actions.","key_machinery":"Trusted gateway for replacing raw values with opaque handles and bounded summaries, together with the PREVIEW→COMMIT protocol enforced by the trusted executor.","core_discovery":"SecureClaw is a dual-boundary architecture that places authorization at the effect sink and plaintext confinement at the read boundary. Sensitive reads pass through a trusted gateway that replaces raw values with opaque handles and, in the evaluated deployment, bounded summaries as an explicit declassification interface. Writes that change external state follow a PREVIEW→COMMIT protocol in which only a trusted executor may commit the exact canonical request authorized by policy. The runtime can still plan over summaries and symbolic references, but cannot directly dereference secrets or perform side effects.","pith_inferences":["Inserting such gateways into existing agent runtimes could secure them without retraining the underlying models.","Defining appropriate summary bounds for different data types would determine how much planning capability is preserved.","Similar handle mechanisms might apply to prevent leakage in multi-turn or multi-agent conversations.","Policy definition for what constitutes an authorized commit becomes a central design choice for deployment."],"forward_implications":["LLM agents retain the ability to plan and use tools over symbolic references without seeing plaintext secrets.","External state changes occur only after preview and explicit commit by the trusted component following policy.","Attack success rates drop to 0% on ASB, 0.64% on AgentDojo, and 3.23% leak on AgentLeak while task utility stays usable.","The approach secures both the confidentiality and authorization surfaces that single-boundary defenses miss."],"fun_headline_variants":["SecureClaw read boundary uses gateway for opaque handles","SecureClaw write boundary requires preview then trusted commit","LLM agents plan over summaries with SecureClaw confinement","Dual boundaries in SecureClaw separate read handles from write commits","SecureClaw places authorization at effect sink and confinement at reads"],"cache_read_input_tokens":64,"weakest_assumption_plain":"The trusted gateway and executor components remain uncompromised and correctly implement the handle replacement and preview-commit logic.","fun_headline_variants_meta":{"raw":{"variants":["SecureClaw read boundary uses gateway for opaque handles","SecureClaw write boundary requires preview then trusted commit","LLM agents plan over summaries with SecureClaw confinement","Dual boundaries in SecureClaw separate read handles from write commits","SecureClaw places authorization at effect sink and confinement at reads"]},"model":"grok-4.3","cost_usd":0.010391,"raw_usage":{"total_tokens":4615,"prompt_tokens":702,"num_sources_used":0,"completion_tokens":79,"cost_in_usd_ticks":103912000,"prompt_tokens_details":{"text_tokens":702,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":3834,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":702,"tokens_out":79,"duration_ms":25984,"temperature":1.0,"reasoning_tokens":3834,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-27T16:23:48.888139+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Demonstrating a successful attack that extracts raw sensitive values through the runtime or forces an unauthorized commit despite the protocol would falsify the security guarantees.","supporting_citations":[],"review_version":1}