Research map / Multi-agent systems and games / LLM agents

SecureClaw: Clawing Back Control of LLM Agents

NeurIPS 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes SecureClaw, a dual-boundary architecture for tool-using LLM agents that pairs executor-side PREVIEW→COMMIT authorization of external effects with gateway-side opaque-handle confinement of sensitive plaintext, evaluated on AgentDojo, AgentLeak, and ASB with gpt-4o-mini.

Problem

Tool-using LLM agents face unauthorized external actions (prompt injection redirecting effects) and sensitive plaintext exposure inside the runtime that can be relayed through internal channels before output checks apply.

Approach

Separate the two security surfaces: place request-bound authorization at the effect sink (trusted executor commits only the exact canonicalized, policy-authorized request) and place plaintext confinement at the read boundary (gateway returns opaque HMAC handles plus bounded summaries as explicit declassification), with deny-aware safe-continuation recovery.

Key results

• SecureClaw reaches 0.00% ASR on ASB (utility 88.90%) and 0.64% ASR on AgentDojo (4/629), versus 2.38% for DRIFT and 22.89% for Faramesh on AgentDojo.
• On the AgentLeak attacked parity lane SecureClaw has 3.23% any-leak (16/496) versus 72.18% for DRIFT and 93.95% for Plain.
• Bypass suite denies 25/25 adversarial commit attempts and allows 4/4 positive controls; executor-side verification takes about 0.22 ms, single-service authorization about 15 ms.

Surprising findings

• Faramesh matches SecureClaw's 0% ASR on ASB but leaves AgentLeak internal channels (C2, C5) at Plain levels, showing sink-side enforcement alone does not stop internal relay.
• Deny-aware recovery raises ASB utility from 70% to 86% without increasing ASR.

Limitations

• Benign utility on AgentDojo drops (60.82% vs 70.10% for Plain), and residual failures remain in policy-allowed but misaligned actions.
• Main results use a single backbone (gpt-4o-mini); cross-model checks are small spot checks only.
• Trusts gateway, handle store, policy engine, and executor; guarantees fail if these are compromised.

Experimental setup

Datasets: AgentDojo AgentLeak Agent Security Bench (ASB)

Benchmarks: AgentDojo AgentLeak ASB

Metrics: attack success rate benign task success attack utility leak rate per channel latency

Baselines: Plain IPIGuard DRIFT Faramesh

Builds on: AgentDojo AgentLeak Faramesh IPIGuard DRIFT

Closest papers by meaning

• SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks (NeurIPS 2025 · similarity 0.89)
• Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (ICLR 2025 · similarity 0.89)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents (NeurIPS 2025 · similarity 0.89)
• A-MemGuard: A Proactive Defense Framework For LLM-Based Agent Memory (ICML 2026 · similarity 0.88)
• Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents (ICLR 2026 · similarity 0.88)
• PragLocker: Protecting Agent Intellectual Property in Untrusted Deployments via Non-Portable Prompts (ICML 2026 · similarity 0.88)