This paper presents SpecBox, a runtime system for LLM agents that uses speculative sandbox preallocation to improve resource utilization and reduce interactive tail latency.

Sandlock is a lightweight, unprivileged Linux process sandbox that enforces fine-grained policies over filesystem, network, and syscalls for running untrusted AI agent code, achieving strong isolation…

This paper presents the first longitudinal measurement of Google's Privacy Sandbox APIs adoption across the Web, revealing their stagnating usage and impending retirement.

The paper introduces COBALT, a Z3 SMT-based formal verification engine, to proactively detect arithmetic vulnerabilities (CWE-190/191/195) in the critical infrastructure surrounding frontier AI models…

ZitPit is an open-source system that enforces a strict, durable policy boundary for external artifacts before they are allowed to execute on protected developer or CI hosts, addressing the gap in curr…

The paper introduces the Open Agent Passport (OAP), a deterministic pre-action authorization framework that intercepts and validates AI agent tool calls against a declarative policy, achieving a 0% su…

The paper introduces dynamic, per-request separator generation for Polymorphic Prompt Assembling (PPA), significantly reducing the blast-radius vulnerability to prompt injection attacks by ensuring un…

The paper introduces a secure, manifest-based framework that allows unprivileged processes to safely update and promote narrowly scoped privileged software components without requiring full administra…

The paper introduces GrantBox, a new security sandbox that evaluates how well LLM agents handle real-world tool privileges, finding that agents remain highly vulnerable to sophisticated attacks.

The paper proposes a novel pre-model safeguard that uses small draft models (SLMs) to predict the safety of prompts, significantly reducing false-negative rates while maintaining low computational ove…

PragLocker is a novel prompt protection scheme that secures valuable LLM agent prompts against theft and reuse by other proprietary models by making them non-portable.

ChainCaps introduces a novel runtime capability budgeting system that prevents 'permission laundering' in complex tool-using agents, significantly reducing attack success rates while maintaining benig…

APEX is a research system that adapts HTTP 402-style payment gating for autonomous agents, enabling programmatic spend governance using real-world fiat payment workflows like UPI.

The paper introduces SCOUT, a dynamic detector allocation framework that improves prompt-injection defense by predicting detector reliability and latency to optimize the trade-off between safety and o…

PS-UIE proposes a privilege-separated architecture to continuously enforce the integrity of file-backed user-space executable objects within Confidential Virtual Machines (CVMs) like AMD SEV-SNP.

The paper introduces Temporary Power Adjusting Withholding (T-PAW), a generalized and more potent block withholding attack than the existing PAW attack, demonstrating that this attack can yield signif…

The paper proposes and tests a novel, non-security 'Recuse Signal'—an in-band signal—to allow operators to tell autonomous LLM agents to voluntarily withdraw access, demonstrating that compliant agent…

Space Fabric introduces a novel satellite-based Trusted Execution Architecture (TEE) that establishes trust for orbital computing by generating cryptographic secrets and binding workload execution to…

The paper analyzes a large dataset of JavaScript packages to demonstrate that a small number of vulnerable dependencies can propagate vulnerabilities across a disproportionately large number of packag…