Awesome Agent Skills Security

🛡️ A curated list of resources on securing AI agent tool use and skill ecosystems — attacks, defenses, frameworks, benchmarks, and standards.

AI agents increasingly use external tools, plugins, and skills to interact with the world. This creates a new attack surface: agent skills security. This list covers the threats, defenses, and research landscape for securing these capabilities.

Contents

• Threat Frameworks & Standards
• Surveys & Systematizations
• Attack Research
  • Prompt Injection via Tools
  • Tool Poisoning & Supply Chain
  • Privilege Escalation & Excessive Agency
  • Data Exfiltration & Privacy
  • Indirect Prompt Injection
  • Cross-Plugin Attacks
  • Backdoor Attacks on Agents
  • Agent Deception & Manipulation
  • Jailbreaking & Guardrail Bypass
• Defense Research
  • Permission & Access Control
  • Runtime Monitoring & Sandboxing
  • Input/Output Validation
  • Formal Verification & Analysis
  • Evaluation & Red Teaming
• Benchmarks & Datasets
• Tools & Frameworks
• Agent Skill Specifications
• Industry Reports & Blog Posts
• Related Awesome Lists
• Contributing

Threat Frameworks & Standards

• OWASP Agentic AI Threats and Mitigations — First in a series from the OWASP Agentic Security Initiative (ASI), providing threat-model-based reference for agentic threats.
• OWASP Top 10 for LLM Applications — Includes LLM01: Prompt Injection, LLM06: Excessive Agency, LLM07: Insecure Plugin Design, LLM08: Excessive Autonomy.
• MITRE ATLAS™ — Adversarial Threat Landscape for AI Systems. Tactics, techniques, and case studies for attacks on ML/AI systems.
• NIST AI Risk Management Framework — Federal framework for managing AI risks, including autonomous agent risks.
• NIST SP 800-218A: Secure Software Development for AI — Secure development practices specific to AI-enabled systems.
• EU AI Act — European regulation with specific provisions for high-risk AI systems including autonomous agents.
• Anthropic Responsible Scaling Policy — AI Safety Levels (ASL) framework addressing agent capability thresholds.
• IETF draft-klrc-aiagent-auth-01: AI Agent Authentication and Authorization — Kasselman et al., IETF WIMSE-adjacent, 2026. Proposes a model for authentication and authorization of AI agent interactions using existing OAuth 2.0 and WIMSE standards; covers delegation chains, agent identity, and trust establishment without defining new protocols.
• IETF draft-niyikiza-oauth-attenuating-agent-tokens-00: Attenuating Authorization Tokens for Agentic Delegation Chains — Niyikiza (Tenuo), OAuth WG, March 2026. Defines Attenuating Authorization Tokens (AATs): JWT-based credentials encoding tool-level argument constraints with a cryptographically enforced monotonic attenuation invariant — any holder can derive a more restrictive token but never a more permissive one. Extends Rich Authorization Requests (RFC 9396) with delegation-chain semantics.
• 📄 Certifying Ghosts: How Cybersecurity AI Agents Break the EU Cyber Resilience Act — Mayoral-Vilches, 2026. Argues autonomous vulnerability-discovery-and-exploitation agents invalidate the EU Cyber Resilience Act's core assumptions of slow, human-paced disclosure and fixed product security states, contending that because attackers and defenders now wield identical AI capabilities, meaningful compliance requires continuous agent-operated monitoring rather than static certification.

Surveys & Systematizations

• 📄 A Survey on LLM-based Autonomous Agents: Common Attacks and Defenses — Wu et al., 2024. Comprehensive taxonomy of attacks on LLM agents across perception, cognition, and action stages.
• 📄 Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents — Zhang et al., 2024. Formalization of 10 attack scenarios, 10 agents, 398 adversarial environments.
• 📄 Security of AI Agents — He et al., 2024. Systematization of knowledge covering threat models for AI agents with tool access.
• 📄 Not All Agents Are Created Equal: A Survey on Software-use Agent Security — Hua et al., 2025. Survey specifically on software-use agents and their unique security challenges.
• 📄 A Survey on the Honesty of Large Language Models — Xie et al., 2024. Covers agent deception, sycophancy, and honesty in tool-use contexts.
• 📄 A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models — Xu et al., 2024. Systematic study of jailbreak attacks relevant to agent guardrail bypass.
• 📄 Prompt Injection Attacks and Defenses in LLM-Integrated Applications — Liu et al., 2024. Comprehensive taxonomy of injection attacks across direct and indirect vectors.
• 📄 The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies — Gan et al., 2024. Survey with practical case studies of security failures.
• 📄 Self-Evolving Agents: A Survey — Gao et al., 2025. How self-evolving agents create emergent security risks.
• 📄 Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies — Lin et al., 2026. Uses a Module-Lifecycle Attack Surface matrix to show self-evolution transforms attack persistence from session-bounded to permanent — adversarial effects become encoded across generations, self-amplify, and propagate through agent populations without sustained attacker access, with 17 of 25 attack vectors rated critical.
• 📄 From Thinker to Society: Security in Hierarchical Autonomy Evolution of AI Agents — Zhang et al., 2026. Hierarchical Autonomy Evolution (HAE) framework organizing agent security into cognitive, execution, and societal tiers.
• 📄 Characterizing Faults in Agentic AI: A Taxonomy of Types, Symptoms, and Root Causes — Shah et al., 2026. Empirical taxonomy of reliability failures in agentic AI systems combining LLM reasoning with tool invocation.
• 📄 Security Considerations for Multi-agent Systems — 2026. Systematic threat landscape of MAS with 193 threat items across 9 categories; evaluates 16 frameworks finding none achieves majority coverage.
• 📄 The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey — Kim et al., USENIX Security 2026. First systematic survey of AI agent security covering design space, attack landscape, and defense mechanisms with case studies on securing agentic systems.
• 📄 Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats — Deng et al., 2026. Five-layer lifecycle-oriented security framework analyzing compound threats across initialization, input, inference, decision, and execution stages of autonomous LLM agents.
• 📄 OpenClaw as Language Infrastructure: A Case-Centered Survey of a Public Agent Ecosystem in the Wild — He et al., Preprints 2026. Case-centered survey of the OpenClaw public-agent ecosystem whose Security dimension synthesizes governance, skill-supply-chain (ClawHub), and deployment risks of an open skill ecosystem alongside Platform, Societies, and Deployment.
• 📄 AgenticCyOps: Securing Multi-Agentic AI Integration in Enterprise Cyber Operations — Mitra et al., 2026. Holistic architectural security framework decomposing attack surfaces across component, coordination, and ecosystem layers of enterprise multi-agent systems.
• 📄 MCP-in-SoS: Risk Assessment Framework for Open-Source MCP Servers — Kumar et al., 2026. System-of-systems risk assessment framework for evaluating security risks of open-source MCP server deployments in production agent systems.
• 📄 SoK: The Attack Surface of Agentic AI — Tools, and Autonomy — Dehghantanha & Homayoun, 2026. Systematization mapping trust boundaries and security risks of agentic LLM systems; proposes taxonomy spanning prompt injection, RAG poisoning, tool exploits, and multi-agent threats with metrics like Unsafe Action Rate and Privilege Escalation Distance.
• 📄 Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation — Ling et al., 2026. Systems-oriented synthesis of 247 papers organizing LLM agent security around information flow, delegated authority, and persistent state, identifying prompt injection and tool-mediated hijacking as dominant threats while flagging emerging state-corruption and multi-agent propagation risks.
• 📄 Data Agents Under Attack: Vulnerabilities in LLM-Driven Analytical Systems — Wang et al., 2026. Systematic security study of LLM data agents identifying eight risks across interpretation, execution, and policy layers plus an attack taxonomy of fourteen techniques, demonstrating substantial gaps across six open-source and production analytics platforms.
• 📄 Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents — Lahjouji & Colaco, 2026. Organizes privacy research in LLM agents around data sources rather than attack types — spanning database queries, external APIs, and inter-agent communication — and identifies governance gaps including the need for information-flow control and benchmarks covering an agent's complete data ecosystem.
• 📄 Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations — Jamshidi et al., 2026. Empirical security analysis of a self-hosted multi-agent LLM system where model outputs trigger privileged operations, measuring compromise probability, boundary failures, and privilege drift as attacker capability and agent count scale.
• 📄 LLM Agents Security Duality: A Comprehensive Survey of Self-Security and Empowered Cybersecurity — Xu et al., 2026. 73-page survey mapping the dual role of LLM agents in security — cataloguing agent-facing vulnerabilities and mitigations while examining how the same agents empower offensive and defensive cybersecurity, and highlighting the tension between self-protection and capability.
• 📄 Agent Security Meets Regulatory Reality: A Practitioner Systematization of Autonomous-Agent Threats and Controls in Regulated Financial Systems — Mohan & Srinivasa, 2026. Maps agentic threats (prompt injection, agent identity, auditability, tool abuse, data residency) to financial-sector regulatory requirements and documents production agent-to-agent patterns and controls for compliance-bound deployments.
• 📄 The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities — Rashidi, 2026. Systematizes 39 execution-security papers (2023–2026) on AI coding agents that read repositories, call tools, and run shell commands with limited oversight, exposing fragmentation across isolation, access control, TOCTOU, and MCP threat research along with five critical gaps including the absence of shared benchmarks for evaluating isolation architectures.
• 📄 Security and Privacy in Agentic AI: Grand Challenges and Future Directions — Jenkins et al., 2026. Horizon-scanning report from thirty international experts across academia, industry, and government identifying the grand challenges and future research directions for the security and privacy of increasingly agentic AI.
• 📄 Trust but Verify? Uncovering the Security Debt of Autonomous Coding Agents — Sakib et al., 2026. Empirical study of thousands of agent-authored pull requests finding 38.9% contain at least one security smell (misconfigurations, leaked credentials, supply-chain issues), with human collaborators introducing the majority of leaked secrets in agent-assisted workflows.
• 📄 Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation — Badhe & Tiwari, 2026. Introduces SkillSec-Eval, a lifecycle framework for evaluating security of reusable LLM agent skills with a threat taxonomy spanning repository admission, semantic retrieval, planner selection, execution, and skill evolution — showing risks extend well beyond the runtime execution stage.

Attack Research

Prompt Injection via Tools

• 📄 Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — Greshake et al., AISec 2023. Foundational work on indirect prompt injection through tool outputs.
• 📄 Inject My PDF: Prompt Injection for Your Resume — Practical injection through document processing tools.
• 📄 InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents — Zhan et al., ACL 2024. 1,054 test cases, 17 tools, two attack types (direct harm, data stealing).
• 📄 Automatic and Universal Prompt Injection Attacks against Large Language Models — Liu et al., 2024. Automated generation of injection attacks.
• 📄 WIPI: A New Web Threat for LLM-Driven AI Agents — Liu et al., 2024. Web-based indirect prompt injection targeting browsing agents.
• 📄 GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines — Isbarov et al., 2026. Evaluates prompt injection in live GitHub workflows by provisioning ephemeral repositories and triggering real workflow runs, documenting eleven attacks across four AI providers that compromise credential handling and repository permissions.
• 📄 Prompt Injection as Role Confusion — Ye, Cui & Hadfield-Menell, ICML 2026. Shows prompt injection succeeds because LLMs infer privilege from unreliable stylistic cues rather than structural role tags; "destyling" untrusted text to look less like internal formats drops attack success from 61% to 10%, framing injection defense as perpetual whack-a-mole absent genuine role perception.
• 📄 On the Inseparability of Instructions and Data in Shared-Embedding Sequence Models — Pant et al., 2026. Proves perfect prompt-injection prevention is mathematically impossible in shared-embedding architectures lacking enforced control-data separation, formalizing tool authorization, refusal, and memory writes as control-authoritative actions and arguing injection requires architectural instruction/data channel separation rather than better in-pipeline classification or alignment.

Tool Poisoning & Supply Chain

• 📄 ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP — Liu et al., 2026. Distributes a malicious MCP instruction across multiple tool descriptions using Shamir's secret sharing, so each fragment individually passes inspection and the harmful instruction is reconstructed only once enough shares are aggregated during agent interaction — evading per-tool poisoning scanners.
• 📄 PhantomSkill: Malicious Code Injection in Agent Skill Ecosystems — Lin & Yu, 2026. Attack framework whose VulMask technique disguises malicious code as ordinary insecure implementations inside skill auxiliary resources, activating harmful behavior only under attacker-controlled conditions to evade skill-scanning defenses.
• 📄 Dynamic Malicious Skills in Agentic AI — Chen et al., 2026. Shows that malicious instructions embedded in skill documentation (e.g., SKILL.md) can induce an agent to dynamically inject harmful logic into an otherwise benign skill at execution time, demonstrated across OpenHands and Claude Code.
• 📄 Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners — Jia et al., 2026. SkillCamo hides harmful operational instructions inside images bundled with a skill, bypassing scanners that rely only on text descriptions, manifests, and source code while remaining recoverable by multimodal agents at deployment.
• 📄 "Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild — Liu et al., USENIX Security 2026. Large-scale analysis of 98,380 skills across two major registries identifies 157 confirmed-malicious skills (632 vulnerabilities, 13 attack techniques), characterizing two archetypes — credential-exfiltrating data thieves and decision-subverting agent hijackers — and showing that shadow features absent from public documentation mark all advanced attacks.
• 📄 Harmless Yet Harmful: Neutral Prompting Attacks for Stealthy Hallucination Steering in Agent Skills — Hsu et al., 2026. Introduces neutral prompting attacks that covertly increase package hallucinations in coding agents, creating downstream software supply chain risk while evading existing skill-focused defenses.
• 📄 Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search — Shen et al., 2026. Tree-structured Injection for Payloads (TIP): black-box attack generating natural-language payloads to seize control of MCP-enabled agents; achieves >95% attack success in undefended settings and >50% against four defense approaches with an order of magnitude fewer queries than prior adaptive attacks.
• 📄 Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning — Huang et al., 2026. STRIDE/DREAD threat modeling of MCP across five components; systematic comparison of tool poisoning defenses in seven major MCP clients reveals insufficient static validation; proposes multi-layered defense strategy.
• 📄 Are AI-assisted Development Tools Immune to Prompt Injection? — Huang et al., 2026. First empirical analysis of prompt injection via tool-poisoning across seven MCP clients (Claude Desktop, Claude Code, Cursor, Cline, Continue, Gemini CLI, Langflow); reveals significant security disparities with Cursor most susceptible.
• 📄 Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks — Schmotz et al., 2026. Benchmark measuring agent vulnerability to malicious skill/config files; demonstrates data exfiltration, destructive actions, and ransomware-like behavior via AGENTS.md/CLAUDE.md injection.
• 📄 ToolSword: Unveiling Safety Issues of LLMs in Tool Learning Across Three Stages — Ye et al., ACL 2024. Identifies safety issues across tool selection, tool calling, and result handling.
• 📄 Compromising Agents via MCP — Invariant Labs, 2025. Tool poisoning attacks via Model Context Protocol servers.
• 📄 Osmosis Distillation: Model Hijacking with the Fewest Samples — Shi et al., 2026. Supply-chain attack via poisoned synthetic training data.
• 📄 Personality Self-Replicators — 2026. Agent personality files as self-replicating genetic material.
• 📄 Poisoned Playbooks: Demystifying Knowledge Poisoning Effects on AI Security Agents — Park et al., 2026. Studies how malicious write-ups injected into security knowledge sources compromise RAG-based, action-taking security agents, introducing a "Verification Boundary" framework that classifies how agents evaluate retrieved claims and showing verification prompting and multi-source retrieval falter under sparse-evidence and zero-day conditions.
• 📄 Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains — Jia et al., 2026. Treats agent skills as dependency-bearing artifacts and empirically maps the skill supply chain, surfacing security-relevant signals hidden in inter-skill dependencies and governance gaps that let malicious or vulnerable skills propagate risk transitively.
• 📄 KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems — Choi et al., 2026. Sequential document-poisoning attack that plants strategically crafted retrievable documents to progressively redirect an agentic RAG system's multi-step reasoning chain, requiring no system access.
• 📄 Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol — Rashidi, 2026. Shows invisible Unicode TAG-block characters can smuggle malicious payloads into MCP tool descriptions that reach the model while staying hidden from human reviewers during approval, measuring the resulting approval-view fidelity gap across three independent server implementations.
• 📄 Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting — Spira et al., 2026. Adversarial hallucination squatting preemptively registers the resource names (popular repositories, skills) that LLMs predictably hallucinate, so agents pull attacker-hosted prompts at scale — reaching up to 100% hallucination rates in skill installation and enabling remote code execution and botnet establishment under weak, channel-free threat models.
• 📄 Skills That Don't Exist: A Large-Scale Study of Hallucinated Skill Recommendation in LLM Agents — Yuan et al., 2026. Measures skill-name hallucination across 15,000 prompts, finding LLM agents invent non-existent skill names at ~36% rates and opening an exploitable supply-chain vector where attackers pre-register malicious packages under the fabricated names before victims unknowingly install them.
• 📄 Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware — Ji et al., 2026. Introduces SkillCloak, which defeats static agent-skill malware scanners through evasion, alongside SkillDetonate, a runtime detector that catches malicious skill behavior via execution monitoring rather than code inspection.
• 📄 Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions Against AI Coding Agents — Bagmar & Saraf, 2026. First systematic evaluation of package-install-time supply-chain attacks delivered through ordinary project-setup documentation (README, requirements, Makefile): editing docs alone redirects coding agents to untrusted registries, vulnerable versions, or plausible wrong names, showing install-time security rests on the harness-model pairing — source-based attacks like registry redirection are missed almost everywhere absent a deterministic pre-install name/source/version check.
• 🔗 MCP Security Notification: Tool Poisoning Attacks — Official MCP security advisory on tool description poisoning.
• 🔗 Invariant Labs: MCP Security Research — Analysis of cross-tool contamination, rug pulls, and tool shadowing via MCP.

Privilege Escalation & Excessive Agency

• 📄 Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents — Yang et al., NeurIPS 2024. Backdoor attacks on agent reasoning and tool calling.
• 📄 Pandora's White-Box: Precise Training Data Detection and Extraction in Large Language Models — Relevant to agents leaking training data through tool outputs.
• 📄 R-Judge: Benchmarking Safety Risk Awareness for LLM Agents — Yuan et al., ACL 2024. 162 records across 27 risk scenarios for evaluating agent safety awareness.
• 📄 TrustAgent: Towards Safe and Trustworthy LLM-based Agents — Zhang et al., 2024. Agent-constitution-based approach to limiting excessive agency.
• 📄 FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion — Rao et al., 2026. Splits prohibited content across interactions, stores it in long-term agent memory in benign-appearing form, then reconstructs it via retrieval — evading access-control checks without the disallowed request ever appearing explicitly in the user query.
• 📄 Post-Training Local LLM Agents for Linux Privilege Escalation with Verifiable Rewards — Normann et al., 2026. Two-stage post-training pipeline (SFT + RL with verifiable rewards) producing a 4B model that achieves 95.8% success on privilege escalation, nearly matching Claude Opus 4.6 at 100× lower inference cost.
• 📄 When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agents — Yang et al., 2026. Shows LLM agents routinely choose tools carrying more privilege than a task requires, and proposes a privilege-aware post-training method that steers agents toward sufficient lower-privilege alternatives to shrink the excessive-agency attack surface.
• 📄 (A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents — Zhang et al., 2026. Identifies two attack surfaces in VLM-based mobile agents — a perception gap between human and machine vision, and interception of the agent's execution pipeline — letting malicious apps hijack agent actions and achieve arbitrary command execution without any granted permissions.

Data Exfiltration & Privacy

• 📄 AgentSCOPE: Evaluating Contextual Privacy Across Agentic Workflows — Ngong et al., 2026. 80%+ of agentic pipelines leak private data at intermediate stages.
• 📄 Silent Egress: LLM-Driven Data Exfiltration via Steganographic Channels — Demonstrates covert channels for data theft through agent outputs.
• 📄 Privacy Risks of General-Purpose AI Systems: A Foundation for Investigating Practitioner Perspectives — GPAIS privacy risks including agent data handling.
• 📄 IMMACULATE: A Framework for Analyzing Information Exposure in Agent-Based Systems — Multi-turn agent information leakage analysis.
• 📄 AgentRaft: Automated Detection of Data Over-Exposure in LLM Agents — Lin et al., 2026. Automated detection framework for identifying data over-exposure vulnerabilities in LLM agent integrations.
• 📄 You Told Me to Do It: Measuring Instructional Text-induced Private Data Leakage in LLM Agents — Kao et al., 2026. Identifies the Trusted Executor Dilemma where high-privilege agents execute adversarial README instructions at up to 85% success rate; 0% human detection rate across 15 participants.
• 📄 An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios — Baek et al., 2026. Joint Singapore–Korea AI Safety Institute study showing tool-using agents leak sensitive information even under benign, non-adversarial user requests, extending leakage analysis beyond prompt-injection and jailbreak exfiltration.
• 📄 Differential Privacy in Generative AI Agents: Analysis and Optimal Tradeoffs — Yang & Zhu, 2026. Probabilistic framework for analyzing privacy leakage in AI agents via differential privacy, deriving token-level and message-level bounds relating leakage to temperature and message length.
• 📄 Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity? — Goel & Gurevych, 2026. Evaluates whether computer-use agents respect contextual integrity when handling personal information across applications, finding most leak sensitive data through visual co-location of sensitive items, oversharing of personal state, and sending content to the wrong recipients.
• 📄 ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using LLM Agents — Hu et al., 2026. Audits whether task-private information is routed only to authorized tools and downstream sinks across an executed multi-tool trajectory using 2,150 cases with backend audit logs, formalizing a need-to-know disclosure boundary and showing that successful task completion does not imply appropriate privacy disclosure.
• 📄 What Happens Locally, Leaks Globally: Detecting Privacy Leakage Risks in MCP Servers — Yan et al., 2026. Cross-language static analysis framework that detects protocol-induced credential and PII leakage in multilingual MCP servers, finding leakage in over 10% of analyzed servers.
• 📄 Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policies — Rani, 2026. Formalizes behavioral privacy leakage in multi-round negotiation agents, where an adversary infers private reservation values from concession trajectories and timing, and proposes an (ε,δ)-differentially-private stochastic negotiation policy that cuts adversarial inference accuracy 43–50% while keeping success and utility above 90%.
• 📄 PiSAs: Benchmarking Contextual Integrity in Multi-User Agentic Systems — Gupta et al., 2026. Benchmark for cross-user data spillage in shared agentic systems with dual contextual-integrity annotations (task-appropriateness and per-user access), measuring leakage through outputs, inter-agent messages, and shared memory — and finding even state-of-the-art models fail to reliably restrict transmission to authorized users.

Indirect Prompt Injection

• 📄 CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts — Cheng et al., 2026. Inference-time defense using Tree-sitter parsing and multi-layer analysis to detect and neutralize adversarial instructions hidden in code contexts before they reach the LLM.
• 📄 Agent Data Injection Attacks are Realistic Threats to AI Agents — Choi et al., 2026. Introduces agent data injection (ADI) attacks — an underexplored indirect-prompt-injection class where malicious data disguised as trusted data drives unintended actions — demonstrated against real-world agents including Claude, Codex, and Gemini CLI.
• 📄 DualView: Preventing Indirect Prompt Injection in Personal AI Agents — Kim et al., 2026. Extends untrusted-data tracking across a personal AI agent's entire environment to prevent indirect prompt injection, including the stored variant where the agent writes and later re-reads attacker-controlled data.
• 📄 Prismata: Confining Cross-Site Prompt Injection in Web Agents — Villa et al., 2026. Enforces contextual least privilege for autonomous web agents — restricting what an agent can see and act upon based on the origin of the content — so third-party and user-generated web content cannot hijack the agent via cross-site prompt injection.
• 📄 AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations — He et al., 2026. Defense against indirect prompt injection using causal attribution to trace which tool outputs triggered suspicious agent actions.
• 📄 IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection — Chen et al., 2026. Open-source proxy that rewrites live responses from whitelisted domains with 820 benchmark payloads to evaluate browser agents against realistic indirect prompt injection.
• 📄 How Much Can We Trust LLM Search Agents? Measuring Endorsement Vulnerability to Web Content Manipulation — Chen et al., 2026. SearchGEO framework with a five-mode attack taxonomy measures how attacker-published web pages get transformed into endorsed recommendations across 13 LLM search-agent backends over 308 cases each.
• 📄 ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents — Chang et al., ICLR 2026. Formats injected payloads to mimic native chat templates (optionally primed by persuasive multi-turn dialogue) so agents elevate them to system-level trust; transfers across models and largely bypasses prompt-based defenses. Code.
• 📄 Adaptive Attacks and Defenses Against Indirect Prompt Injection — Chen et al., 2024. Adaptive attackers bypassing static defenses.
• 📄 HouYi: A Black-box Prompt Injection Attack on LLM-integrated Applications — Liu et al., 2023. Systematic methodology for finding injection vulnerabilities.
• 📄 DMAST: Dual-Modality Multi-Stage Adversarial Safety Training — Liu et al., 2026. Cross-modal DOM injection corrupting both visual and text channels.

Agent Deception & Manipulation

• 📄 Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents — Li & Shi, 2026. Studies the principal-loyalty tension in multi-party agent interactions, where an agent must resist adversarial manipulation by counterparties without over-refusing its own principal's legitimate cooperative requests.
• 📄 Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction — Yang et al., 2026. MemPoison shows how attackers can plant triggerable backdoors into long-term agent memory through ordinary dialogue, bypassing selective memory extraction and rewriting pipelines.
• 📄 When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents — Zhang et al., 2026. Shows untrusted external content delivered via a single email can be silently written into a persistent personal agent's long-term memory and later reused as trusted state, enabling long-term compromise without detection.
• 📄 Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses — Karamchandani et al., 2026. Presents FARMA, an attack that corrupts an LLM agent's reasoning history through forged memory traces, alongside SENTINEL, a structural-analysis defense that detects such tampering.
• 📄 Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems — Weckbecker et al., 2026. Single subliminally prompted agent spreads persistent bias through entire multi-agent network, degrading truthfulness of other agents.
• 📄 FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems — Li et al., 2026. Prompt-only attack that manipulates planner-executor workflow formation in multi-agent systems, plus FlowGuard as an input-side defense.
• 📄 Intentional Deception as Controllable Capability in LLM Agents — Starace & Soule, 2026. Systematic study of engineered deception in multi-agent LLM interactions using 36 behavioral profiles for defensive design.
• 📄 Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem — Xiong et al., 2026. Empirical security study of a deployed decentralized agent ecosystem finding reputation can be manipulated at minimal cost, alongside placeholder registrations and widespread Sybil attacks that undermine the trust infrastructure meant to make autonomous agents trustless.
• 📄 When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents — Torres et al., 2026. GhostWriter poisons the long-term memory of tool-using personal agents via a hidden injected payload (≈98% injection, ≈60% activation against state-of-the-art agents); the paper proposes Agentic Memory Sentry (AM-Sentry), pairing a memory-saving policy with a retrieval screen to sharply cut success while preserving utility.
• 📄 MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents — Gao et al., 2026. Benchmark of 1,227 hand-validated persistent-memory poisoning cases (four attack types, three injection channels, three memory substrates across ten model families) with a three-tier taxonomy — direct single-record (L1), compositional multi-record (L2), and context-triggered dormant (L3) corruption — showing write-time defenses like consistency checks suppress L1 but fail on L2/L3, motivating adaptive context-sensitive memory defenses.
• 📄 Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems — Gadgil et al., 2026. Sandboxed study of prompt injection through persistent memory files across Claude Code and OpenAI Codex (Claude Haiku 4.5, Opus 4.7, GPT-5.2, GPT-5.5): while agents rarely overwrite their own memory from untrusted external content,