Impact

Data privacy Research

Security research involving user or training data privacy

107 matching entries

Data privacy research results

107 entries

Persistent Agent Memory Poisoning and Incomplete Repair

Published 7/29/2026

Analyzed 8/13/2026

MemSecBench follows malicious agent-memory content from initial write through persistence, retrieval, action selection, execution, and attempted selective repair. Its controlled Write–Execute–Forget protocol evaluates 310 human-reviewed cases across two harnesses, four memory backends, three model backends, and seven evidence-gated lifecycle checkpoints.

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Evaluated models: GPT-5.5, DeepSeek V4-Pro, MiniMax-M3

Source: arXiv

Workspace Agent Runtime Safety Failures Across Risk Carriers

Published 7/29/2026

Analyzed 8/13/2026

AgentS4D measures unsafe actions and state changes across complete workspace-agent executions rather than treating task completion or isolated model responses as safety evidence. Its 328 sandboxed cases introduce risky content through user requests, documents, web resources, tools, third-party skills, and persistent memory, then compare the same cases across four agent harnesses and five model backends.

AgentS4D: Benchmarking Runtime Risks across the Execution Lifecycle of LLM-Based Workspace Agents

Evaluated models: GPT-5.5, Gemini 3.1 Pro, DeepSeek V4-Pro +2 more

Source: arXiv

Incomplete MCP Tool-Call Attack Detection

Published 7/28/2026

Analyzed 8/13/2026

The MTGuard study evaluates unsafe Model Context Protocol tool calls originating from compromised server data, host-side execution changes, and malicious user-controlled resources. Its hybrid monitor combines pre-execution parameter inspection, behavioral observation, and post-execution result verification across browser-automation and financial-analysis agents.

Hybrid Analysis for Secure MCP Tool Use in LLM Agents

Evaluated models: GPT-5.6 Luna, DeepSeek V4 Flash, DeepSeek V4-Pro

Source: arXiv

Long-Context Enterprise Agent Policy Adherence Failures

Published 7/28/2026

Analyzed 8/13/2026

HANDBOOK.md measures whether an agent can apply detailed organizational rules while completing realistic, multi-step enterprise tasks. The vendor-authored benchmark includes 65 resettable MCP-backed workflows, policy documents of 20 to 124 pages, and 824 deterministic rubric checks covering required decisions, prohibited actions, and final environment state.

HANDBOOK.md: A Benchmark for Long-Context Agentic Instruction Following

Evaluated models: Claude Fable 5, GPT-5.6 Sol, Claude Opus 4.8 +16 more

Source: arXiv

Third-Party Agent Skill Supply-Chain Execution Risks

Published 7/22/2026

Analyzed 8/13/2026

OpenSkillRisk evaluates whether agent harnesses safely handle third-party skills that introduce risky behavior through otherwise plausible, benign tasks. The benchmark assembles 263 risky skills from public agent-skill ecosystems and tests three CLI-agent harnesses against seven risk categories using isolated task workspaces, mocked external services, and execution-level evidence.

OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills

Evaluated models: GPT-5.1 Codex Mini, GPT-5.3 Codex, GPT-5.4 +10 more

Source: arXiv

Black-Box System Prompt Leakage in Real-World LLM Applications

Published 6/17/2026

Analyzed 7/20/2026

The paper reports a reproducible black-box evaluation showing that adversarial user queries can cause deployed LLM applications to reveal hidden system prompts. In the authors’ measurement of 1,200 applications across six commercial platforms, 1,064 applications leaked prompt content (81.0%–93.5% per anonymized platform). This is a paper-reported result, not independently verified here. LeakBench and the official artifact repository provide defensive benchmark materials for controlled testing…

Understanding and Mitigating Prompt Leaking Attacks in Real-World LLM-Based Applications

Evaluated models: Llama 2 7B Chat, Llama 3.1 8B Instruct, Mistral 7B Instruct v0.3 +5 more

Source: arXiv

Agent Skill Injection

Published 4/1/2026

Analyzed 4/10/2026

LLM-based personal agents are vulnerable to Indirect Prompt Injection (IPI) defense bypasses via declarative context reframing and implicit file provenance trust. Attackers can bypass agent safety filters by phrasing malicious instructions as declarative compliance alerts rather than imperative commands. Because agents are designed to report discrepancies as expected behavior, declarative framing bypasses intent-sensitive safety mechanisms. Additionally, attackers can exploit the agent's…

ClawSafety: Safe LLMs, Unsafe Agents

Evaluated models: Claude Sonnet 4.6, Gemini 2.5 Pro, DeepSeek V3 +2 more

Source: arXiv

Agent Document Instruction Injection

Published 3/1/2026

Analyzed 4/10/2026

High-privilege LLM agents with filesystem and network access are vulnerable to documentation-embedded instruction injection, an issue termed the "Trusted Executor Dilemma." When autonomously processing external workflow documents (e.g., README.md files or setup guides) during software installation workflows, agents implicitly trust and execute embedded text instructions without verifying their underlying intent. Attackers can embed syntactically valid, malicious directives (such as data…

You Told Me to Do It: Measuring Instructional Text-induced Private Data Leakage in LLM Agents

Evaluated models: GPT-4o, o3, o3-mini +5 more

Source: arXiv

Agent Lifecycle Compound Threats

Published 3/1/2026

Analyzed 4/10/2026

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Taming openclaw: Security analysis and mitigation of autonomous llm agent threats

Evaluated models: Not reported

Source: arXiv

Arbitrary Agent Topology Breach

Published 3/1/2026

Analyzed 4/10/2026

A vulnerability in LLM-based Multi-Agent Systems (LLM-MAS) allows an attacker who controls a single arbitrary agent to map and extract the system's entire confidential communication topology. Unlike prior attacks that rely on direct identity queries and administrative privileges, this attack infers topology stealthily purely from contextual and linguistic signals (stylometry, role-specific syntax), bypassing standard keyword-based and identity-filtering defenses. The exploit relies on a…

WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference

Evaluated models: Llama 3 70B, Llama 3.1 8B, Mistral Large 12B +3 more

Source: arXiv

Related research categories