Pith. sign in

REVIEW 3 major objections 5 minor 65 references

Self-hosted AI agents can be corrupted through the same file writes they use to remember, and no OS monitor can reliably tell the difference.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 16:25 UTC pith:WA2BQOVG

load-bearing objection The self-state attack framing is new and useful, but the 'structurally indistinguishable' residual is detector-relative, not OS-structural. the 3 major comments →

arxiv 2607.17986 v1 pith:WA2BQOVG submitted 2026-07-20 cs.CR cs.AIcs.CLcs.MA

Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?

Yimeng Chen , Nathana\"el Denis , Roberto Di Pietro , J\"urgen Schmidhuber This is my paper
classification cs.CR cs.AIcs.CLcs.MA
keywords AI agent securityself-state attacksprompt injectionoperating system defensesanomaly detectionworkload-conditioned detectionmemory poisoningfile integrity monitoring
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper establishes a class of attacks it calls self-state attacks: when an AI agent's own memory, instruction, and configuration files are corrupted, the malicious writes are a subset of the legitimate writes the agent must perform to function. The paper argues that the OS is the last deterministic enforcement point, but prevention, detection, and recovery each hit a structural limit: prevention cannot distinguish attack writes from legitimate ones, detection's feature tuple carries no intent, and recovery dissolves unless detection fires. It then shows that workload-conditioned anomaly detection, which learns per-file baselines from normal traces, partially bridges the gap: in a 23-cell attack matrix over four workload profiles, a layered stack of access-control prevention, workload-conditioned detection, and periodic backup closes all but four memory-row cells, which remain structurally indistinguishable at the OS level. The stakes: as agents move into private codebases and personal machines, the OS may be the only deterministic boundary, and this work maps exactly where that boundary fails.

Core claim

The central claim is that self-state attacks, formally defined as A(R) subset of L(R) on any self-state resource R, make OS defenses structurally limited. At the VFS boundary, every attack reduces to a feature tuple of target path, operation type, signed size delta, mode delta, and inter-arrival time; legitimate and attack writes can share identical tuples. Claim 1 states that per-event access-control prevention cannot distinguish attack writes from legitimate writes on writable self-state files. Claim 2 states that the feature tuple seen by OS monitoring cannot decide, per event, whether a modification is malicious. Recovery inherits detection as a precondition, suffers data loss proportion

What carries the argument

The engine of the argument is the VFS feature tuple and the workload-conditioned baseline. On any kernel event, a monitor sees only (target-path, op_type, delta_s, mode-delta, delta_t); the four-axis attack space (Target, Mechanism, Granularity, Temporal) is constructed so that each axis projects onto one component of this tuple. Detection works by scoring an event against per-file baselines fit from legitimate traces, using a z-score over signed size deltas and log inter-arrival times. The B2 detector instantiates workload conditioning: per-profile baselines instead of one pooled global baseline, which rescues cells that pooling hides and exposes vulnerabilities it conceals. The defense cas

Load-bearing premise

The quantitative residual of 4 of 23 cells rests on the assumption that the four workload profiles' legitimate memory-write distributions resemble real self-hosted agents' behavior, and the paper's own appendix concedes that reflection-centric traces would change some cell colors.

What would settle it

Collect legitimate traces from a production self-hosted agent that periodically rewrites MEMORY.md in line-scale edits during normal operation, rerun the 43-instantiation attack suite, and check whether more memory-row cells fall below the TPR threshold; if the residual grows beyond four cells (or shrinks when memory writes are sparse), the empirical boundary is workload-dependent. The structural Claims 1 and 2 would still hold, since they follow from the definition of self-state attacks.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Under the recommended stack, Instruction and Configuration files can be locked read-only at nearly zero functionality cost, and the residual OS-defense gap concentrates entirely on the Memory row.
  • Workload-conditioned detection rescues cells that global baselines hide (small config edits) while exposing per-profile vulnerabilities that pooled baselines conceal (large Memory inserts on dense workloads); the mean TPR gain is largest on the previously indistinguishable cells (+0.46).
  • Recovery fully remediates every detected attack, including the indistinguishable class, but the rollback corpus is itself a target: a backup-wipe sentinel reaches 0% remediation, so backups must live outside the agent's write set.
  • Burst-aligned timing can push one boundary cell from Conditioned to Indistinguishable, and quiet-gap timing can push it back; only 2 of 23 cells change class across timing modes, so temporal evasion is a narrow attacker tool.
  • Hash-based file-integrity monitoring catches every attack at 1.00 TPR but raises alerts on 76-99% of legitimate writes, which is why workload-conditioned detection is the meaningful detector family for this threat class.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the structural claims hold for any agent that must write its own state, the same A(R) subset of L(R) shadow will appear wherever a trusted component mutates its own control data—package managers, auto-updaters, configuration daemons—so the four-axis decomposition may transfer to those systems as an analysis template.
  • The four 'structurally indistinguishable' cells are indistinguishable only relative to the measured workloads; a deployment with sparser memory writes would push them into Conditioned, while denser reflective memory curation could widen the residual, so adopters should regenerate V/C/I labels from their own traces before trusting any closed cell.
  • A two-stage defense—OS-level detection for Visible and Conditioned cells plus consume-time re-scoring of memory content at read time, which the paper mentions as future work but does not test—is the natural way to approach the residual surface without violating the per-event limit.
  • The empirical headline '4/23 cells' depends on a single tested agent model and hand-authored instruction packs; the structural indistinguishability claims do not, so the durable contribution is the formal limit rather than the exact count.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper defines self-state attacks as a class in which a compromised agent corrupts its own persistent state (memory, instruction, configuration) through file-system operations that are a subset of the agent's legitimate operations (A(R) ⊆ L(R)). It proposes a four-axis attack space (Target, Mechanism, Granularity, Temporal), instantiates it as a 23-cell matrix with 43 concrete attack realizations, and derives structural limits for OS prevention (Claim 1), detection (Claim 2), and recovery. Empirically, using traces from a minimal OpenClaw-style harness across four workload profiles, the paper evaluates prevention levels (L0–L5), three detectors (B0 FIM, B1 workload-blind statistical, B2 workload-conditioned statistical), and periodic backup recovery. The headline result is that under L3 prevention + B2 detection at τ=2.0 + a 15-event backup interval, all but four Memory-row cells are closed, and those four residual cells are described as 'structurally indistinguishable at the OS level.'

Significance. If the structural claims hold, the paper makes a useful contribution by formalizing an understudied attack class and providing a reproducible evaluation platform. The set-theoretic Claims 1–2 are simple and largely follow from the A(R) ⊆ L(R) definition; the four-axis decomposition and the workload-conditioned V/C/I framing are genuinely useful organizing devices. The artifact appears comprehensive (43 instantiations, 600 task slots, B0/B1/B2, three experiments, one-command reproduction), and the workload-conditioning ablation and the FIM baseline are informative. However, the central empirical claim is stronger than the evidence supports: the residual I-cells are shown to be undetectable by one per-event, memoryless detector at one threshold, not structurally indistinguishable for OS defenses in general. The paper's own Appendix G.2 and G.5 concessions materially bound the quantitative result.

major comments (3)
  1. [Abstract; §5.2, Table 6; App. G.2] The headline claim that the four I-cells (Mem-M1-G3, Mem-M1-G4, Mem-M2-G3, Mem-M2-G4) are 'structurally indistinguishable at the OS level' overreaches the evidence. Exp 2 evaluates only B2, a per-event memoryless statistical detector (Eq. 1), at τ=2.0, over the tuple (op_type, δs, Δt). Appendix G.2 explicitly concedes that sliding-window trajectory scoring over OS events—still an OS-layer defense—'is the natural way to reclaim some I-cells without moving to a semantic layer.' Moreover, Table 8 shows B0 (hash-based FIM) detects all 43 attacks at TPR=1.00, at the cost of high FPR. Thus the residual is detector-relative, not structural for OS defenses generally. This is load-bearing because the recommended L3+B2+backup stack and the conclusion that 'OS-level defense needs to be reconsidered' are justified by the structural reading. Please either re-scope the claim to the per-event memoryles
  2. [§4.4.2; §5.2] The V/C/I classification is defined directly from B2's TPR against per-profile fitted baselines, so a cell is I exactly when the injected attack tuples score below τ against the fitted legitimate distribution. This makes the empirical characterization of the four I-cells as 'inside the legitimate distribution' partially tautological with respect to the detector: the detector is the classifier used to define the classes. To support the structural reading, the paper should separate the analytic claim (feature-tuple overlap with legitimate writes, Claim 2) from the detector-realization claim, and present independent distributional evidence—e.g., histograms of legitimate per-file δs and Δt values with attack values overlaid—rather than only the detector's decision rule.
  3. [Abstract; App. G.5; Table 6] The quantitative headline '4/23 cells' is workload-specific, as Appendix G.5 concedes that collecting reflection-centric traces 'would change some cell colors.' The abstract and conclusion, however, present the residual as a general OS-level fact without the workload qualifier. Since the paper's own contribution is workload-conditioned detectability, the summary claims should carry the qualifier, e.g., 'under the four evaluated workload profiles and this detector family.' Otherwise the empirical result is easy to over-read as a universal structural bound.
minor comments (5)
  1. [Abstract; §4.3] The abstract says '43 concrete operations on real self-state files'; the body more precisely says '43 attack-script instantiations.' Please align the wording for consistency.
  2. [§5.1, Table 3] The text says 'The Instruction row carries near-zero legitimate runtime writes on any profile,' but Table 3 lists W3 Instruction activity as 'Medium' and §5.1 later notes W3 writes TOOLS.md. Please clarify that the near-zero statement refers to persona/rule files other than TOOLS.md, or revise the wording.
  3. [§4.2; App. F.3] The main text states '600 across the four profiles' task slots, while Appendix F.3 reports one transient HTTP failure in W2 (149/150 slots). Please reconcile the count.
  4. [Table 7] The caption says 'Train/test counts are self-state events averaged over trials,' but the numbers (e.g., W1: 17 train, 100 test) are surprising under a 70/30 event-level split. If the split is session-level, please state that explicitly in the caption, since session-level splits can produce very imbalanced event counts.
  5. [§3.4] The phrase 'the Write activity is highly biased' is vague; consider 'legitimate write activity is highly concentrated in a narrow region of the feature space.'

Circularity Check

2 steps flagged

Empirical 'structurally indistinguishable' residue is B2's own miss set renamed; analytical Claims 1–2 remain independent.

specific steps
  1. self definitional [§4.4.2 (V/C/I formalism); Abstract / §5.4]
    "I (Indistinguishable): TPR a min <0.50 in at least one profile where the target file is agent-writable. ... The empirical results show that a layered defense stack ... is effective on most attack cells while a small residual attack surface remains structurally indistinguishable at the OS level."

    The I class is defined by thresholding the TPR of one detector, B2, at a fixed tau. Re-labeling this detector-relative miss set as 'structurally indistinguishable at the OS level' turns B2's per-event misses into an absolute OS property. The paper itself concedes in G.2 that 'extending the workload-conditioned framework to sliding-window trajectory scoring is the natural way to reclaim some I-cells without moving to a semantic layer' — a trajectory monitor is still an OS-layer defense. Thus the load-bearing conclusion that the residual is OS-structural is the I-definition restated as a finding.

  2. fitted input called prediction [§4.3 (Attack Instantiation) + §4.4.1 (B2 detector)]
    "Granularities G1 to G4 are realized by sizing the modification to the cell’s nominal size band ... with each band’s exact size drawn within bounds calibrated against the per-profile legitimate-write distribution on the chosen target file. ... B2 ... fits per-profile statistics ... from profile W’s legitimate trace alone."

    The G3/G4 attack sizes are chosen using the same per-profile legitimate-write distribution that B2 later learns as its baseline. Small-delta attacks are therefore constructed to fall inside the fitted legitimate distribution, so their low z-scores and I classification are substantially forced by experimental design rather than an independent discovery of an OS-level residual. The result is not entirely vacuous — some in-distribution-sized attacks still score above threshold — but the headline '4 I-cells' is an artifact of fitting the detector and the attack sizes to the same distribution.

full rationale

The paper's two analytical claims are not circular: Claim 1 follows from the A(R) subset L(R) definition together with the VFS feature-tuple premise, and Claim 2 is a direct consequence of the stated feature tuple excluding content; both are formal statements about a deliberately restricted observation space. The circularity is in the empirical layer. The V/C/I taxonomy defines 'Indistinguishable' as 'missed by B2 at tau=2.0', and the abstract/conclusion then promotes those four cells to 'structurally indistinguishable at the OS level'. Appendix G.2 explicitly admits an OS-layer trajectory scorer could reclaim some I-cells without semantic understanding, so the residual is detector-family-relative, not OS-structural. Additionally, the attack granularity bands were calibrated against the same per-profile write distributions that B2 fits, making the four in-distribution cells a constructed worst case rather than a measured inevitability. Appendix G.5 further concedes that other trace distributions 'would change some cell colors.' There is no load-bearing self-citation chain; the issue is definitional renaming of the detector's miss set. Score 6 reflects partial circularity: the central empirical residual claim reduces by construction, while the independent analytical framework keeps the paper from full circularity.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 0 invented entities

The paper's central result depends on threat-model axioms (compromised agent, trusted OS components), the definitional A(R) subset of L(R) condition, and the assertion that the VFS feature tuple is the only OS-observable surface. The empirical V/C/I split additionally depends on hand-chosen thresholds, calibrated attack size bands, and fitted detector baselines. No new physical entities are introduced.

free parameters (5)
  • Detection threshold tau = 2.0
    Uniform z-score threshold chosen conventionally (Section 4.4.2); the V/C/I labels and the 4-I-cell residual depend on it.
  • V/C/I class boundaries = TPR_min >= 0.80 V; 0.50-0.80 C; < 0.50 I
    Ad hoc thresholds in Section 4.4.2 convert detector TPR into structural classes; the C band is arbitrary.
  • Granularity size bands G1-G4 = whole-file; hundreds of bytes; line-scale; <=4 B
    Attack payload sizes are calibrated against per-profile legitimate-write distributions (Section 4.3), so attack cells are built to land inside or outside the baselines.
  • B2 per-profile baseline statistics = per (file, op_type) mean/std of size delta and log inter-arrival
    Fitted on the 70% training split of the collected traces (Section 4.5); all TPR/FPR results are relative to this fit.
  • Recommended backup interval = 15 events
    Chosen for the recommended stack in Section 5.4; loss varies with this interval.
axioms (5)
  • domain assumption Attacker can compromise the agent's decision process via indirect prompt injection; post-compromise behavior is attacker-chosen under the agent's OS principal.
    Section 2.3 threat model; the paper explicitly treats compromise as given and studies only post-compromise self-state operations.
  • domain assumption Self-state attacks satisfy A(R) subset of L(R): attack operations on a resource are a subset of legitimate operations, by Definition 1.
    Section 2.2; this is a definitional characterization, not an empirical finding.
  • domain assumption The OS monitor's complete observable surface is the VFS feature tuple (target-path, op_type, delta-size, mode-delta, delta-t); content semantics are unavailable to OS-layer detection.
    Section 2.4 claims this is 'the exact surface available to any kernel-level monitor'; the paper's own trace collector stores a SHA-256 content prefix, but the detectors ignore it.
  • domain assumption The openclaw-core harness and its four task corpora produce legitimate-write distributions representative of real self-hosted agents.
    Sections 4.1 and F.1-F.3; V/C/I labels are computed only on these traces, and Appendix G.5 admits different baselines would change some cell colors.
  • domain assumption Kernel, monitor, backup, and policy components run under a separate principal and remain uncompromised.
    Section 2.3 trusted components; the recovery sentinel attack in Section 5.3 tests one way this can fail.

pith-pipeline@v1.3.0-alltime-deepseek · 35015 in / 11425 out tokens · 116944 ms · 2026-08-01T16:25:29.423287+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?." pith.science (2026). https://pith.science/paper/WA2BQOVG

@misc{pith2026260717986,
  author       = {Pith},
  title        = {Pith review of: Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WA2BQOVG}},
  note         = {Machine review of arXiv:2607.17986}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Self-hosted AI agents read and write their own memory and configuration files to function. An agent may get compromised via corruption of its own state -- a compromise realized via legitimate OS system call invocation. We refer to this class of threats as self-state attacks. In this paper, we investigate the OS resilience to this class of attacks. Formally, we characterize a four-axis attack space (Target, Mechanism, Granularity, Temporal); investigate the structural limits of prevention, detection, and recovery; and introduce a workload-conditioned view of detectability. To instantiate the framework, we collect live activity traces from a representative self-hosted agent running across distinct workload profiles, and realize the attack space as a 23-cell matrix, 43 concrete operations on real self-state files, and injected into those traces. We then evaluate both canonical and workload-conditioned defense strategies. The empirical results show that a layered defense stack (access-control prevention on the instruction and configuration layers, workload-conditioned detection on the memory layer, and periodic backup for recovery) is effective on most attack cells while a small residual attack surface remains structurally indistinguishable at the OS level. These findings suggest that against the newly established class of self-state attacks, OS-level defense needs to be reconsidered, potentially opening new research directions in the field.

Figures

Figures reproduced from arXiv: 2607.17986 by J\"urgen Schmidhuber, Nathana\"el Denis, Roberto Di Pietro, Yimeng Chen.

Figure 1
Figure 1. Figure 1: Cross-boundary vs. self-state attacks. (a) Cross-boundary attacks target resources outside the agent’s operational [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Prevention-functionality tradeoff under the strict [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Target × Mechanism tile labels under B2 detection alone. Each cell is classified V/C/I from its per-profile mean TPR over within-cell instantiations (§4.4.2); each tile is la￾beled by the worst class of any cell it contains (any I⇒I; else any C⇒C; else V). 132 on memory/*.md), enough to populate every relevant per- (file, op_type) bucket with non-degenerate 𝜎𝑠 rather than the unseen-key fallback used elsew… view at source ↗
Figure 4
Figure 4. Figure 4: Workload-conditioning ablation (B1 vs B2; 30 trials [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

65 extracted references · 1 canonical work pages

  1. [1]

    Nadya Abaev, Denis Klimov, Gerard Levinov, David Mimran, Yuval Elovici, and Asaf Shabtai. 2026. AgentGuardian: Learning Access Control Policies to Govern AI Agent Behavior. arXiv:2601.10440 [cs.CR]

    arXiv 2026

  2. [2]

    Cloud Security Alliance. 2025. MAESTRO: Multi-Agent Environment, Security, Threat, Risk, and Outcome Framework. https://cloudsecurityalliance.org/blog /2025/02/06/agentic-ai-threat-modeling-framework-maestro

    2025

  3. [3]

    Zico Kolter, Matt Fredrikson, Yarin Gal, and Xander Davies

    Maksym Andriushchenko, Alexandra Souly, Mateusz Dziemian, Derek Duenas, Maxwell Lin, Justin Wang, Dan Hendrycks, Andy Zou, J. Zico Kolter, Matt Fredrikson, Yarin Gal, and Xander Davies. 2025. AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents. InThe Thirteenth International Conference on Learning Representations. OpenReview.net, Singapore, 36 ...

    2025

  4. [4]

    Anomaly. 2025. OpenCode: The AI Coding Agent Built for the Terminal. https: //github.com/anomalyco/opencode

    2025

  5. [5]

    Anthropic. 2025. Claude Code. https://docs.claude.com/en/docs/claude- code/overview

    2025

  6. [6]

    Oleg Brodt, Elad Feldman, Bruce Schneier, and Ben Nassi. 2026. The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanism. arXiv:2601.09625 [cs.CR]

    arXiv 2026

  7. [7]

    Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. Agent- Poison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases. InAdvances in Neural Information Processing Systems 37 (NeurIPS 2024). 130185– 130213. doi:10.52202/079017-4136

    doi:10.52202/079017-4136 2024

  8. [8]

    Mihai Christodorescu, Earlence Fernandes, Ashish Hooda, Somesh Jha, Jo- hann Rehberger, Kamalika Chaudhuri, Xiaohan Fu, Khawaja Shams, Guy Amir, Jihye Choi, Sarthak Choudhary, Nils Palumbo, Andrey Labunets, and Nishit V. Pandya. 2025. Systems Security Foundations for Agentic Computing. arXiv:2512.01295 [cs.CR]

    arXiv 2025

  9. [9]

    Manuel Costa, Boris Köpf, Aashish Kolluri, Andrew Paverd, Mark Russi- novich, Ahmed Salem, Shruti Tople, Lukas Wutschitz, and Santiago Zanella- Béguelin. 2025. Securing AI Agents with Information-Flow Control. arXiv:2505.23643 [cs.CR]

    Pith/arXiv arXiv 2025

  10. [10]

    Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Car- lini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. 2025. Defeating Prompt Injections by Design. arXiv:2503.18813 [cs.CR]

    Pith/arXiv arXiv 2025

  11. [11]

    Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. 2024. AgentDojo: A Dynamic Environment to Eval- uate Prompt Injection Attacks and Defenses for LLM Agents. InAdvances in Neural Information Processing Systems 37 (NeurIPS 2024). 82895–82920. doi:10.5 2202/079017-2636

    2024

  12. [12]

    Dorothy E. Denning. 1987. An Intrusion-Detection Model.IEEE Transactions on Software EngineeringSE-13, 2 (1987), 222–232. doi:10.1109/TSE.1987.232894

    arXiv 1987

  13. [13]

    Shen Dong, Shaochen Xu, Pengfei He, Yige Li, Jiliang Tang, Tianming Liu, Hui Liu, and Zhen Xiang. 2025. Memory Injection Attacks on LLM Agents via Query- Only Interaction. arXiv:2503.03704 [cs.LG]

    arXiv 2025

  14. [14]

    Ivan Evtimov, Arman Zharmagambetov, Aaron Grattafiori, Chuan Guo, and Ka- malika Chaudhuri. 2025. WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks. arXiv:2504.18575 [cs.CR]

    Pith/arXiv arXiv 2025

  15. [15]

    Paul Gauthier. 2024. Aider: AI Pair Programming in Your Terminal. https: //aider.chat

    2024

  16. [16]

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not What You’ve Signed Up For: Compromis- ing Real-World LLM-Integrated Applications with Indirect Prompt Injection. In AISec @ ACM CCS. 79–90. doi:10.1145/3605764.3623985

    arXiv 2023

  17. [17]

    Idan Habler and Amy Chang. 2026. Identifying and Remediating a Persistent Memory Compromise in Claude Code. Cisco Blogs. https://blogs.cisco.com/ai /identifying-and-remediating-a-persistent-memory-compromise-in-claude- code Accessed: 2026-04-28

    2026

  18. [18]

    Norman Hardy. 1988. The Confused Deputy: (or Why Capabilities Might Have Been Invented).ACM SIGOPS Operating Systems Review22, 4 (1988), 36–38. doi:10.1145/54289.871709

    arXiv 1988

  19. [19]

    Javitz and Alfonso Valdes

    Harold S. Javitz and Alfonso Valdes. 1994.The NIDES Statistical Component: Description and Justification. Technical Report A010. SRI International. https: //www.csl.sri.com/papers/statreport/

    1994

  20. [20]

    Zimo Ji, Daoyuan Wu, Wenyuan Jiang, Pingchuan Ma, Zongjie Li, Yudong Gao, Shuai Wang, and Yingjiu Li. 2026. Taming Various Privilege Escala- tion in LLM-Based Agent Systems: A Mandatory Access Control Framework. arXiv:2601.11893 [cs.CR]

    arXiv 2026

  21. [21]

    Kim and Eugene H

    Gene H. Kim and Eugene H. Spafford. 1994. The Design and Implementation of Tripwire: A File System Integrity Checker. InProceedings of the 2nd ACM Conference on Computer and Communications Security (CCS ’94). 18–29. doi:10 .1145/191177.191183

    arXiv 1994

  22. [22]

    Juhee Kim, Woohyuk Choi, and Byoungyoung Lee. 2025. Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents. arXiv:2503.15547 [cs.CR]

    Pith/arXiv arXiv 2025

  23. [23]

    Satyapriya Krishna, Kalpesh Krishna, Anhad Mohananey, Steven Schwarcz, Adam Stambler, Shyam Upadhyay, and Manaal Faruqui. 2025. Fact, Fetch, and Reason: A Unified Evaluation of Retrieval-Augmented Generation. InProceed- ings of the 2025 Conference of the Nations of the Americas Chapter of the Asso- ciation for Computational Linguistics: Human Language Tec...

    doi:10.18653/v1/2025.naacl-long.243 2025

  24. [24]

    Cognition Labs. 2024. Devin: The First AI Software Engineer. https://devin.ai

    2024

  25. [25]

    Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. 2018. A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks. InAdvances in Neural Information Processing Systems 31 (NeurIPS 2018). 7167–

    2018

  26. [26]

    Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. 2008. Isolation Forest. InIEEE International Conference on Data Mining. 413–422. doi:10.1109/ICDM.2008.17

    doi:10.1109/icdm.2008.17 2008

  27. [27]

    Owens, and Yixuan Li

    Weitang Liu, Xiaoyun Wang, John D. Owens, and Yixuan Li. 2020. Energy-based Out-of-distribution Detection. InAdvances in Neural Information Processing Sys- tems 33 (NeurIPS 2020). 21464–21475. arXiv:2010.03759 [cs.LG] https://procee dings.neurips.cc/paper/2020/hash/f 5496252609c43eb8a3d147ab9b9c006- Abstract.html

    Pith/arXiv arXiv 2020

  28. [28]

    Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2024. Formalizing and Benchmarking Prompt Injection Attacks and Defenses. InPro- ceedings of the 33rd USENIX Security Symposium (SEC ’24). USENIX Association, 1831–1847. arXiv:2310.12815 [cs.CR] https://www.usenix.org/conference/usen ixsecurity24/presentation/liu-yupei

    arXiv 2024

  29. [29]

    Your AI, My Shell

    Yue Liu, Yanjie Zhao, Yunbo Lyu, Ting Zhang, Haoyu Wang, and David Lo. 2025. "Your AI, My Shell": Demystifying Prompt Injection Attacks on Agentic AI Cod- ing Editors. arXiv:2509.22040 [cs.CR]

    Pith/arXiv arXiv 2025

  30. [30]

    Microsoft. 2025. Taxonomy of Failure Mode in Agentic AI Systems. https: //www.microsof t.com/en-us/security/blog/2025/04/24/new-whitepaper- outlines-the-taxonomy-of-failure-modes-in-ai-agents/

    2025

  31. [31]

    Lesly Miculicich, Mihir Parmar, Hamid Palangi, Krishnamurthy Dj Dvijotham, Mirko Montanari, Tomas Pfister, and Long T. Le. 2025. VeriGuard: Enhancing LLM Agent Safety via Verified Code Generation. arXiv:2510.05156 [cs.SE]

    arXiv 2025

  32. [32]

    MITRE. 2026. ATLAS: Adversarial Threat Landscape for AI Systems. https: //atlas.mitre.org/. Accessed: 2026-04

    2026

  33. [33]

    MITRE Corporation. 2024. ATT&CK for Enterprise. https://attack.mitre.org/m atrices/enterprise/

    2024

  34. [34]

    Nous Research. 2025. Hermes Agent. https://github.com/nousresearch/hermes- agent

    2025

  35. [35]

    Oasis Research Team. 2026. ClawJacked: OpenClaw Vulnerability Enables Full Agent Takeover. https://www.oasis.security/blog/openclaw-vulnerability

    2026

  36. [36]

    OpenClaw Community. 2025. OpenClaw: Your Own Personal AI Assistant. ht tps://github.com/openclaw/openclaw

    2025

  37. [37]

    OWASP. 2026. OWASP Top 10 for Agentic Applications for 2026. https://genai. owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/

    2026

  38. [38]

    OWASP Agentic Security Initiative. 2025. Agentic AI – Threats and Mitigations. https://genai.owasp.org/resource/agentic- ai- threats- and- mitigations/. Accessed: 2026-04

    2025

  39. [39]

    Qwibit. 2026. NanoClaw: A Lightweight, Containerized Personal AI Agent. ht tps://github.com/qwibitai/nanoclaw

    2026

  40. [40]

    Ayush RoyChowdhury, Mulong Luo, Prateek Sahu, Sarbartha Banerjee, and Mo- hit Tiwari. 2024. ConfusedPilot: Confused Deputy Risks in RAG-based LLMs. arXiv:2408.04870 [cs.CR]

    Pith/arXiv arXiv 2024

  41. [41]

    Maddison, and Tatsunori Hashimoto

    Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris J. Maddison, and Tatsunori Hashimoto. 2024. Identifying the Risks of LM Agents with an LM-Emulated Sandbox. InIn- ternational Conference on Learning Representations. OpenReview.net, 70 pages. https://proceedings.iclr.cc/paper_files/paper/2024/hash/7274ed909a...

    2024

  42. [42]

    Mickaël Salaün. 2026. Landlock: Unprivileged Access Control. https://docs.ker nel.org/userspace-api/landlock.html

    2026

  43. [43]

    Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, and Dawn Song. 2025. Progent: Programmable Privilege Control for LLM Agents. arXiv:2504.11703 [cs.CR]

    Pith/arXiv arXiv 2025

  44. [44]

    Stolfo, Shlomo Hershkop, Linh H

    Salvatore J. Stolfo, Shlomo Hershkop, Linh H. Bui, Ryan Ferster, and Ke Wang

  45. [45]

    Balachandra Devarangadi Sunil, Isheeta Sinha, Piyush Maheshwari, Shantanu Todmal, Shreyan Mallik, and Shuchi Mishra. 2026. Memory Poisoning Attack and Defense on Memory Based LLM-Agents. arXiv:2601.05504 [cs.CR]

    arXiv 2026

  46. [46]

    Open Interpreter Team. 2024. Open Interpreter. https://github.com/OpenInter preter/open-interpreter

    2024

  47. [47]

    Poskitt, and Jun Sun

    Haoyu Wang, Christopher M. Poskitt, and Jun Sun. 2026. AgentSpec: Customiz- able Runtime Enforcement for Safe and Reliable LLM Agents. InProceedings of the 48th International Conference on Software Engineering (ICSE ’26). 12 pages. arXiv:2503.18666 [cs.AI] https://arxiv.org/abs/2503.18666

    Pith/arXiv arXiv 2026

  48. [48]

    Wazuh, Inc. 2024. Wazuh File Integrity Monitoring: How It Works. https://do cumentation.wazuh.com/current/user-manual/capabilities/file-integrity/how- it-works.html

    2024

  49. [49]

    Wazuh, Inc. 2024. Wazuh: The Open Source Security Platform. https://wazuh. com/

    2024

  50. [50]

    Yuhao Wu, Franziska Roesner, Tadayoshi Kohno, Ning Zhang, and Umar Iqbal

  51. [51]

    Zhen Xiang, Linzhi Zheng, Yanjie Li, Junyuan Hong, Qinbin Li, Han Xie, Jiawei Zhang, Zidi Xiong, Chulin Xie, Carl Yang, Dawn Xiaodong Song, and Bo Li. 2024. GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning. arXiv:2406.09187 [cs.LG]

    Pith/arXiv arXiv 2024

  52. [52]

    Junjie Ye, Sixian Li, Guanyu Li, Caishuang Huang, Songyang Gao, Yilong Wu, Qi Zhang, Tao Gui, and Xuanjing Huang. 2024. ToolSword: Unveiling Safety Issues of Large Language Models in Tool Learning Across Three Stages. InProceed- ings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Comput...

    doi:10.18653/v1/2024.acl-long.119 2024

  53. [53]

    Zonghao Ying, Xiao Yang, Siyang Wu, Yumeng Song, Yang Qu, Hainan Li, Tian- lin Li, Jiakai Wang, Aishan Liu, and Xianglong Liu. 2026. Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw. arXiv:2603.12644 [cs.CR]

    arXiv 2026

  54. [54]

    Tongxin Yuan, Zhiwei He, Lingzhong Dong, Yiming Wang, Ruijie Zhao, Tian Xia, Lizhen Xu, Binglin Zhou, Fangqi Li, Zhuosheng Zhang, Rui Wang, and Gongshen Liu. 2024. R-Judge: Benchmarking Safety Risk Awareness for LLM Agents. InFindings of the Association for Computational Linguistics: EMNLP 2024. 1467–1490. doi:10.18653/v1/2024.findings-emnlp.79

    doi:10.18653/v1/2024.findings-emnlp.79 2024

  55. [55]

    Qiusi Zhan, Richard Fang, Henil Shalin Panchal, and Daniel Kang. 2025. Adap- tive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents. InFindings of the Association for Computational Linguistics: NAACL 2025. Association for Computational Linguistics, Albuquerque, New Mexico, 7116–

    2025

  56. [56]

    Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. InFindings of the Association for Computational Linguistics: ACL

    2024

  57. [57]

    Hanrong Zhang, Jingyuan Huang, Kai Mei, Yifei Yao, Zhenting Wang, Chenlu Zhan, Hongwei Wang, and Yongfeng Zhang. 2025. Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents. InInternational Conference on Learning Representations. 24 pages. arXiv:2410.02644 [cs.CR] https://openreview.net/forum?id=V4y0CpX4hK

    Pith/arXiv arXiv 2025

  58. [58]

    Xing, Hao Zhang, Joseph E

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. 2023. Judging LLM-as-a-Judge with MT- Bench and Chatbot Arena. InAdvances in Neural Information Processing Systems 36 (NeurIPS 2023). 46595–46623. doi:10.52202/075280-2020

    doi:10.52202/075280-2020 2023

  59. [59]

    Yusheng Zheng, Yanpeng Hu, Tong Yu, and Andi Quinn. 2025. AgentSight: System-Level Observability for AI Agents Using eBPF. InProceedings of the 4th Workshop on Practical Adoption Challenges of ML for Systems. 110–115

    2025

  60. [60]

    set channels.telegram.enabledto false

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2025. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models. InProceedings of the 34th USENIX Security Symposium (SEC ’25). Article 197, 18 pages. https://www.usenix.org/conference/usenixsecurity 25/presentation/zou-poisonedrag A Open Science We release th...

    2025

  61. [2005]

    InInternational Symposium on Methodologies for Intelligent Sys- tems (ISMIS) (Lecture Notes in Computer Science 3488)

    Anomaly Detection in Computer Security and an Application to File Sys- tem Accesses. InInternational Symposium on Methodologies for Intelligent Sys- tems (ISMIS) (Lecture Notes in Computer Science 3488). 14–28. doi:10.1007/1142 5274_2 13 Yimeng Chen, Nathanaël Denis, Roberto Di Pietro, and Jürgen Schmidhuber

    work page doi:10.1007/1142

  62. [2024]

    doi:10.18653/v1/2024.findings-acl.624

    Association for Computational Linguistics, Bangkok, Thailand, 10471– 10506. doi:10.18653/v1/2024.findings-acl.624

    doi:10.18653/v1/2024.findings-acl.624 2024

  63. [2025]

    InProceedings of the Network and Distributed System Security Sympo- sium

    IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems. InProceedings of the Network and Distributed System Security Sympo- sium. 18 pages. arXiv:2403.04960 [cs.CR] doi:10.14722/ndss.2025.241131

    Pith/arXiv arXiv 2025

  64. [7132]

    doi:10.18653/v1/2025.findings-naacl.395

    doi:10.18653/v1/2025.findings-naacl.395 2025

  65. [7177]

    arXiv:1807.03888 [stat.ML] https://papers.nips.cc/paper/7947-a-simple- unified-framework-for-detecting-out-of-distribution-samples-and-adversar ial-attacks

    Pith/arXiv arXiv