The paper introduces Session Risk Memory (SRM), a lightweight module that enhances per-action authorization gates with trajectory-level risk assessment, significantly improving detection of distribute…

The paper introduces and analyzes cross-session stored prompt injection, demonstrating that persistent system state transforms prompt injection from a temporary model-level threat into a long-lived, s…

This paper systematically identifies and demonstrates multiple session manipulation attacks against VPN connection tracking frameworks, revealing widespread vulnerabilities in popular VPN services.

BodhiPromptShield is a policy-aware framework that mediates prompt privacy by detecting sensitive data and replacing it with secure placeholders across multiple stages (retrieval, memory, tools) to pr…

This paper proposes HCP, a Handle-Capability Protocol runtime for MCP-style agent systems, which implements eight execution-control invariants to enhance security while preserving MCP-like workflows.

SessionBound is a system that creates short-lived, budgeted, and auditable database sessions for AI agents based on approved enterprise tasks.

The paper proposes the concept of an Agent Operating System (AOS) to provide a necessary systems foundation for managing the unique, non-deterministic, and goal-directed execution characteristics of m…

The paper proposes the concept of an Agent Operating System (AOS) to provide a rigorous, controllable, and accountable systems foundation for running complex, probabilistic, and goal-directed AI agent…

The paper proposes a Secure-driven time synchronization mechanism to resolve the conflict between RTOS timekeeping (which requires periodic interrupts) and the atomicity requirements of trusted comput…

The paper introduces a stateful agent backdoor that allows malicious attacks to persist and execute incrementally across multiple sessions, significantly enhancing the threat model for LLM-based agent…

The paper introduces Platum, a novel framework that synthesizes verified, low-latency runtime monitors for MAVLink protocols, enabling robust enforcement of contextual message validity on resource-con…

The paper proposes an operation-centric, TEE-backed isolation model to constrain self-hosted computer-use agents, preventing malicious or unsafe host-level operations without sacrificing general funct…

The paper introduces the concept of the atomic decision boundary, proving that for autonomous systems to guarantee execution-time admissibility, the decision and the resulting state transition must oc…

The paper introduces AgentSecBench, a security evaluation framework that measures prompt injection, privacy leakage, and tool-use integrity in LLM agents by defining formal security games and testing…

The paper experimentally validates a novel secure two-party computation protocol for running dynamic controllers over secret sharing, demonstrating its feasibility for real-time control systems despit…

This paper introduces ClawTrojan, a benchmark for multi-step trojan attacks against LLM agents, and proposes DASGuard, a dynamic defense mechanism that traces and sanitizes untrusted control content i…

The paper introduces ClawTrojan, a benchmark for multi-step trojan attacks against LLM agents, and proposes DASGuard, a defense mechanism that detects and sanitizes backdoor content planted across mul…

Grimlock is an Agent Guard that enhances security for high-agency systems by enforcing identity, authorization, and scope-bound communication through eBPF and attested TLS channels, without modifying…

The paper introduces mcp-sec-audit, a comprehensive toolkit that assesses Model Context Protocol (MCP) servers for over-privileged and insecure tool capabilities.