# Agent Security

Tool-using LLM agents turn model output into real actions, making indirect prompt injection an execution-security problem. SecureGARD inserts an executable ontology between planning and tool execution, grounding heterogeneous tool calls into shared semantic actions and judging each as ready, waiting, or forbidden against the current task state. Under benign and indirect-injection settings on AgentDojo, ASB, and AgentDyn, the observed attack success rate is 0% on both backbones, with higher task utility under attack than the compared baselines.

Tool-using LLM agents turn model output into real actions, making indirect prompt injection an execution-security problem. SecureGARD inserts an executable ontology between planning and tool execution, grounding heterogeneous tool calls into shared semantic actions and judging each as ready, waiting, or forbidden against the current task state. Under benign and indirect-injection settings on AgentDojo, ASB, and AgentDyn, the observed attack success rate is 0% on both backbones, with higher task utility under attack than the compared baselines.

NVIDIA announced NVIDIA Sentry at GTC Berlin, a security framework that runs on BlueField-4 DPUs and places monitoring and policy enforcement for AI agents' access to models, tools and data in a separate hardware trust domain beyond host software. Earlier agent security relied on software runtime boundaries, so an agent that escaped its sandbox could alter or disable its own restrictions; Sentry inspects agent-to-model traffic through the DOCA Tower transparent proxy and reads runtime state outside the host with DOCA Argus, containing agents at millisecond scale. The framework is planned for availability early next year, and developers can begin with DOCA Argus, DOCA Flow and other libraries and microservices to experiment with out-of-band observability and infrastructure enforcement.

NVIDIA announced NVIDIA Sentry at GTC Berlin, a security framework that runs on BlueField-4 DPUs and places monitoring and policy enforcement for AI agents' access to models, tools and data in a separate hardware trust domain beyond host software. Earlier agent security relied on software runtime boundaries, so an agent that escaped its sandbox could alter or disable its own restrictions; Sentry inspects agent-to-model traffic through the DOCA Tower transparent proxy and reads runtime state outside the host with DOCA Argus, containing agents at millisecond scale. The framework is planned for availability early next year, and developers can begin with DOCA Argus, DOCA Flow and other libraries and microservices to experiment with out-of-band observability and infrastructure enforcement.

For multimodal-LLM phone agents, MobileInject places one malicious objective in both the screenshot and the interface text and runs 108 executable risk instances on a resettable Android emulator. Prior evaluations mostly watched a single text channel or judged only whether an attack succeeded; with exposure counts matched, one appearance per channel reached 85.4% attack success and 0% benign completion, while repeating within one channel reached only 72.9% or 27.8%. In 30 of 108 paired instances, neither single channel succeeded but the aligned pair did.

For multimodal-LLM phone agents, MobileInject places one malicious objective in both the screenshot and the interface text and runs 108 executable risk instances on a resettable Android emulator. Prior evaluations mostly watched a single text channel or judged only whether an attack succeeded; with exposure counts matched, one appearance per channel reached 85.4% attack success and 0% benign completion, while repeating within one channel reached only 72.9% or 27.8%. In 30 of 108 paired instances, neither single channel succeeded but the aligned pair did.

MemForm splits how an LLM agent's long-term memory is formed into five intervenable interfaces, and across six models and two response formats all five showed behavior being rewritten.

MemForm splits how an LLM agent's long-term memory is formed into five intervenable interfaces, and across six models and two response formats all five showed behavior being rewritten.

ASPIRE is an open-ended prompt-injection red-teaming framework for LLM agents that maintains an evolving Agent Security Behavior Graph, uses complementary Explore and Exploit experts to propose consequence-centric test skeletons, has a separate realizer build concrete payloads and trigger queries, and updates the graph and cross-run strategy memory from trajectory evidence; on AgentDojo and AgentDyn it raises attack success to as high as 54.1% while covering more consequences, injection methods, environments, and behavior paths.

ASPIRE is an open-ended prompt-injection red-teaming framework for LLM agents that maintains an evolving Agent Security Behavior Graph, uses complementary Explore and Exploit experts to propose consequence-centric test skeletons, has a separate realizer build concrete payloads and trigger queries, and updates the graph and cross-run strategy memory from trajectory evidence; on AgentDojo and AgentDyn it raises attack success to as high as 54.1% while covering more consequences, injection methods, environments, and behavior paths.

The authors introduce CredLeak-Bench, a sandboxed benchmark that measures leakage through actual submissions of synthetic credentials across directed authentication, autonomous inbox monitoring, and recovery settings with paired legitimate controls; evaluating seven models, they find every model leaks in both primary settings, phishing can induce disclosure without any authentication request, most leakage-reducing mitigations also impair legitimate task completion, and recovery ranges only from 0% to 24.2%.

The authors introduce CredLeak-Bench, a sandboxed benchmark that measures leakage through actual submissions of synthetic credentials across directed authentication, autonomous inbox monitoring, and recovery settings with paired legitimate controls; evaluating seven models, they find every model leaks in both primary settings, phishing can induce disclosure without any authentication request, most leakage-reducing mitigations also impair legitimate task completion, and recovery ranges only from 0% to 24.2%.

The work builds a ten-mechanism taxonomy across 40 coding agent harnesses and rates 400 harness–mechanism cells (205 confirmed implemented, 83 confirmed absent, 112 unresolved), then introduces HarnessSecurity-Bench, which runs 2,500 trials under GLM-5.2 on 23 tasks across five attack surfaces with separate deterministic oracles for six harnesses, finding that enabling auto-approve raises attack success from 29.2% to 95.6%, that network isolation and read-only mode cut attack success from 57.1% and 8.3% to 0.8% at utility losses of 24.5 and 34.0 percentage points, and that command allowlisting and denylisting reduce attack effects with a small utility loss and a utility gain respectively.

The work builds a ten-mechanism taxonomy across 40 coding agent harnesses and rates 400 harness–mechanism cells (205 confirmed implemented, 83 confirmed absent, 112 unresolved), then introduces HarnessSecurity-Bench, which runs 2,500 trials under GLM-5.2 on 23 tasks across five attack surfaces with separate deterministic oracles for six harnesses, finding that enabling auto-approve raises attack success from 29.2% to 95.6%, that network isolation and read-only mode cut attack success from 57.1% and 8.3% to 0.8% at utility losses of 24.5 and 34.0 percentage points, and that command allowlisting and denylisting reduce attack effects with a small utility loss and a utility gain respectively.

The work proposes Self-Reflection Fine-Tuning (SRFT): it injects attack instructions into clean expert trajectories, samples the agent's own potentially failing actions under the attacked context, and has an expert model generate structured self-reflection reasoning that contrasts unsafe and optimal actions, which then supervises fine-tuning; instantiated as SR-Agent on Llama-3.1-8B-Instruct and Qwen3-8B, it reduces AgentDojo attack success rate from 7.59% to 1.26% and from 16.97% to 1.05% respectively, and keeps a low attack success rate under the RL-Hammer adaptive attack.

The work proposes Self-Reflection Fine-Tuning (SRFT): it injects attack instructions into clean expert trajectories, samples the agent's own potentially failing actions under the attacked context, and has an expert model generate structured self-reflection reasoning that contrasts unsafe and optimal actions, which then supervises fine-tuning; instantiated as SR-Agent on Llama-3.1-8B-Instruct and Qwen3-8B, it reduces AgentDojo attack success rate from 7.59% to 1.26% and from 16.97% to 1.05% respectively, and keeps a low attack success rate under the RL-Hammer adaptive attack.