Pith. sign in

REVIEW 2 major objections 6 minor 54 references

Execution-security research for AI coding agents is balkanized into 17 categories that almost never talk to one another, and five cross-cutting gaps no single paper addresses.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-11 02:40 UTC pith:5SNN4AUG

load-bearing objection Solid, auditable SoK that actually organizes execution-security work for coding agents and names five real cross-category gaps; the search-coverage caveat is real but already owned. the 2 major comments →

arxiv 2607.05743 v1 pith:5SNN4AUG submitted 2026-07-07 cs.CR cs.AI

The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities

Mohammadreza Rashidi This is my paper
classification cs.CR cs.AI
keywords AI coding agentsexecution securitysandboxingaccess controlTOCTOUModel Context Protocolsystematization of knowledgepolicy enforcement
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

AI coding agents now read repositories and run shell commands with little oversight, so a growing literature asks whether the execution layer around them is actually safe. That literature is scattered: isolation, access control, policy fragility, TOCTOU races, Model Context Protocol threats, identity delegation, provenance, egress control, and related topics are published separately and rarely cite across categories. This paper verifies 39 papers from 2023–2026 against their primary sources, organizes them into 17 mechanism categories, and confirms four patched CVEs that hit production agent harnesses. Reading across categories, rather than inside any one, surfaces five gaps: isolation and capability systems are almost never compared on a shared benchmark; defenses are not re-tested under measured 69–98% denylist failure rates; TOCTOU and MCP are treated as separate fields despite sharing the same validate-then-act structure; every enforcement scheme assumes an honest policy author; and benign out-of-scope actions at rates up to 17.1% are addressed by no access-control paper in the corpus. Broader agentic-AI surveys mention sandboxing only as one item among many, so this work supplies the missing dedicated map of execution security and a research agenda aimed at the five gaps.

Core claim

The paper claims that execution-security work for AI coding agents is balkanized: 39 verified papers fall into 17 mechanism categories that rarely cite one another, and reading across those categories reveals five structural gaps that no individual paper addresses—missing shared isolation-versus-capability benchmarks, defenses never re-evaluated under known real-world policy fragility, TOCTOU and MCP studied as separate literatures despite identical state-validation structure, universal assumption of an honest policy author, and unaddressed scope-creep rates up to 17.1%.

What carries the argument

A verified 17-category taxonomy of 39 papers (plus four NVD-confirmed CVEs), re-read through four root causes and a pipeline-stage lens, so cross-category absences become visible as five concrete research gaps rather than isolated missing citations.

Load-bearing premise

That the iterative search and 2023–present inclusion rules produced a corpus representative enough that missing cross-citations and shared benchmarks inside those 39 papers are real field-level gaps rather than coverage holes.

What would settle it

Find peer-reviewed or widely circulated work, outside this corpus, that already runs isolation architectures and capability models head-to-head on a shared attacker suite, or that re-evaluates a published sandbox under ShellSieve-style real denylist bypasses, and shows the claimed gaps are already closed.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. This SoK systematizes 39 execution-security papers (2023–2026) on AI coding agents into 17 mechanism categories, each verified against primary abstract pages, and confirms four NVD-listed CVEs affecting production harnesses (including two in Claude Code). Reading across categories, the authors identify five cross-cutting gaps: no shared isolation-vs-capability evaluation; defenses not re-tested under measured 69–98% denylist fragility; TOCTOU and MCP treated as separate literatures despite a shared validate-then-act structure; universal honest-policy-author assumption; and scope-creep rates up to 17.1% unaddressed by access-control work. They further collapse the taxonomy onto four root causes (RC1–RC4) and a pipeline-stage/role reading, release a machine-readable corpus with mechanical count checkers, and close with a research agenda aimed at the five gaps rather than restating individual papers’ future work. Broader agentic-AI surveys are positioned as leaving execution security without a dedicated systematization.

Significance. If the corpus and gap analysis hold, this is the first dedicated systematization of execution-layer security for AI coding agents, filling a clear hole left by broader agentic-security surveys that treat sandboxing as one item among many. The work is practically useful: it grounds urgency in four patched CVEs and Pwn2Own scoping, surfaces actionable evaluation baselines (ShellSieve/YoloFS corpora, SandboxEscapeBench/RedCode), and gives a falsifiable research agenda. Strengths that raise confidence include the primary-source verification protocol (with two misattributions corrected), NVD confirmation of CVEs, a released CSV corpus plus count/verifier tooling so taxonomy counts cannot silently drift, and explicit single-category assignment rules with limitations stated. For an SoK, that combination of auditability and synthesis is a real contribution even without new attacks or defenses.

major comments (2)
  1. [§1, abstract, §6] §1, abstract, and §6: The load-bearing “balkanization / rarely cite one another across categories” claim is supported mainly by selective examples and by gap-specific non-citations (e.g., Gap 3: TOCTOU vs MCP). A systematic cross-category citation matrix or simple rate (fraction of references that leave the citing paper’s category) over the 39-paper corpus would make the field-level claim falsifiable rather than impressionistic. Without it, the strongest defensible claim is “within this verified corpus, these five absences hold,” which is still valuable but should be stated that way in the abstract and conclusion if a full citation graph is not added.
  2. [§6, §9] §6.1–6.5 and §9: Gaps are argued from absences inside the 39-paper corpus, while §3.1/§9 correctly note iterative (not exhaustive) search and possible missing venues/preprints. For each gap, add one short falsification condition (e.g., “Gap 1 is closed if any isolation paper evaluates head-to-head against PORTICO/SEAgent on SandboxEscapeBench or RedCode”) so readers can distinguish “not in our corpus” from “does not exist in the field.” This is a framing fix, not a demand for new experiments, but it is load-bearing for how strongly the five gaps can be asserted outside the released corpus.
minor comments (6)
  1. [Table 1, §3.3] Table 1 and §3.3: Several categories have n=1. The prose already flags this as ambiguous (nascent vs incomplete search); a one-line note in Table 1’s caption would help readers weight those rows without re-reading §8–§9.
  2. [Table 2, Figure 16, Appendix C] Table 2 / Figure 16: Secondary RC attributions marked (x) are useful but sparsely justified in the main text. A short appendix paragraph per multi-RC category (or expanding Appendix C) would make the interpretive mapping easier to audit.
  3. [Figure 18] Figure 18: The similarity heatmap is dense; a short caption sentence naming the three highest off-diagonal pairs that map to Gaps 1–3 would help readers connect the figure to the gap narrative without decoding the full matrix.
  4. [§2.3] §2.3: Pwn2Own Berlin 2026 material is strong evidence of real attack surface; ensure every claim about awards/targets is tied to the cited ZDI/SecurityWeek sources so the section remains fully checkable if those pages move.
  5. [§4] §4 category flow strips (Figures 1–15): Icon language is clear once learned; a single legend early in §4 would reduce first-pass friction for readers who skip the methodology.
  6. [References, Appendix A] References: A few arXiv IDs and author spellings should be re-checked against the released corpus file after any taxonomy edits so the mechanical verifier and bibliography stay aligned.

Circularity Check

0 steps flagged

No circularity: SoK organizes independently published papers and NVD CVEs; gaps and root causes are interpretive synthesis, not predictions forced by fitted inputs or self-citation.

full rationale

This paper is a systematization of knowledge, not a derivation of quantitative predictions from parameters or uniqueness theorems. The load-bearing claims are (i) a verified 39-paper corpus organized into 17 mechanism categories, (ii) four NVD-confirmed CVEs, and (iii) five cross-cutting gaps argued from the absence of shared benchmarks, cross-citations, and re-evaluations inside that corpus. Category labels, RC1–RC4 root-cause mappings, and pipeline-stage tables are explicit interpretive lenses over other authors’ work (ShellSieve, YoloFS, TOCTOU-Bench, MCP surveys, OverEager, IsolateGPT, PORTICO, etc.), not results obtained by fitting a quantity and then re-labeling it as a prediction. The author does not cite prior work of his own as a uniqueness or foundational theorem; the corpus entries and related surveys are by other groups. Absence of cross-category evaluation is an observational claim about the collected literature (with coverage limitations stated in §3.1 and §9), not a self-definitional identity. No equation, fitted parameter, or self-citation chain reduces a claimed result to its inputs by construction. Score 0 is therefore appropriate.

Axiom & Free-Parameter Ledger

0 free parameters · 5 axioms · 3 invented entities

As an SoK, the paper introduces almost no free parameters and no physical entities. Load-bearing content is definitional (what counts as execution security), methodological (search and single-category assignment), and interpretive (four root causes and five gaps as analytical constructs). The central claim rests on the representativeness of the verified corpus and on treating missing cross-citations as evidence of balkanization.

axioms (5)
  • ad hoc to paper A paper is in-scope iff it addresses the execution-layer boundary between an LLM agent’s decisions and OS/filesystem/network/tool substrate and was published/posted 2023–writing time (§3.1).
    Inclusion boundary defines the 39-paper corpus; different boundary would change category counts and gap claims.
  • ad hoc to paper Each paper is assigned to exactly one of 17 categories by primary mechanism (§3.3), even when multi-faceted (e.g., SEAgent, FORGE).
    Single-label rule understates overlap; taxonomy structure depends on it.
  • domain assumption Absence of cross-category citation or shared benchmark evaluation inside the corpus is evidence of field-level gaps (§6, §9).
    Standard SoK inference from non-citation; paper acknowledges it is indirect.
  • domain assumption NIST NVD listings are authoritative for CVE product, version, and CVSS for the four cited incidents (§2.3).
    Grounds the claim that execution risk is non-speculative without independent exploit reproduction.
  • domain assumption Execution security is distinct from model-level alignment/prompt-injection defense (§2.1).
    Separates the paper’s scope from the broader surveys it excludes from the taxonomy.
invented entities (3)
  • Seventeen-category execution-security taxonomy independent evidence
    purpose: Organize the 39-paper corpus by primary mechanism for cross-reading.
    Analytical construct of the SoK; falsifiable via the released CSV and alternative re-labelings.
  • Four root causes RC1–RC4 (no data/control separation; checked-once-trusted-forever; permitted≠intended-now; author-built attacker model) no independent evidence
    purpose: Collapse mechanism categories onto recurring design defects (§5.1).
    Interpretive synthesis; useful lens but not independently measured outside this paper’s mapping.
  • Five cross-cutting gaps (isolation-vs-AC evaluation; enforcement-fragility re-eval; TOCTOU–MCP vocabulary; honest policy author; scope creep) no independent evidence
    purpose: State what no single paper addresses and drive the research agenda (§6, §10).
    Core contribution; grounded in corpus absences rather than new experiments.

pith-pipeline@v1.1.0-grok45 · 28974 in / 3515 out tokens · 38124 ms · 2026-07-11T02:40:21.041155+00:00 · methodology

0 comments
read the original abstract

AI coding agents now read repositories, call tools, and execute shell commands with limited human oversight, and a fast-growing body of work studies whether the execution layer around them is actually safe. That literature is scattered. Papers on sandbox isolation, capability and access control, policy enforcement, time-of-check-to-time-of-use (TOCTOU) races, Model Context Protocol (MCP) threats, identity delegation, execution provenance, network egress control, and static analysis of agent-generated code are published independently and rarely cite one another. We systematize 39 papers published between 2023 and 2026 into 17 categories, each verified directly against its source. The same verification protocol also confirms four disclosed, patched CVEs directly affecting production agent harnesses. Reading across categories surfaces five cross-cutting gaps that no single paper addresses. (1) Isolation architectures and capability models are almost never evaluated against one another on a shared benchmark. (2) Policy-enforcement studies report failure rates from 69% to 98% of real denylists, yet no isolation paper re-evaluates its own defense under that adversarial setting. (3) TOCTOU and MCP threats are analyzed as separate literatures despite both being instances of the same state-validation problem. (4) Every enforcement mechanism assumes an honest policy author, leaving policy-authoring error itself unaddressed. (5) Benign but out-of-scope agent actions occurring at rates up to 17.1% under realistic prompting are addressed by no access-control or capability paper in the corpus. Existing broader surveys of agentic AI security discuss sandboxing only as one item among many defenses, leaving execution security without a dedicated systematization. This paper is written to fill that gap. We conclude with a research agenda directed at the five gaps.

Figures

Figures reproduced from arXiv: 2607.05743 by Mohammadreza Rashidi.

Figure 2
Figure 2. Figure 2: Category 2 (escape and adversarial benchmarks): risky task [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 1
Figure 1. Figure 1: Category 1 (isolation architectures): agent’s reach [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 5
Figure 5. Figure 5: Category 5 (time-of-check to time-of-use): validated state [PITH_FULL_IMAGE:figures/full_fig_p005_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Category 6 (mcp-specific threats and defenses): tool metadata [PITH_FULL_IMAGE:figures/full_fig_p005_6.png] view at source ↗
Figure 9
Figure 9. Figure 9: Category 9 (identity and credential delegation): human grant [PITH_FULL_IMAGE:figures/full_fig_p006_9.png] view at source ↗
Figure 7
Figure 7. Figure 7: Category 7 (systems-security framing): survey practice [PITH_FULL_IMAGE:figures/full_fig_p006_7.png] view at source ↗
Figure 10
Figure 10. Figure 10: Category 10 (execution provenance and auditability): action trace [PITH_FULL_IMAGE:figures/full_fig_p006_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Category 11 (network egress control): network boundary [PITH_FULL_IMAGE:figures/full_fig_p007_11.png] view at source ↗
Figure 14
Figure 14. Figure 14: Category 14 (skill and plugin packaging security): third-party [PITH_FULL_IMAGE:figures/full_fig_p007_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Categories 15–17, the foundational work the corpus inherits [PITH_FULL_IMAGE:figures/full_fig_p007_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: Seventeen taxonomy categories collapse onto four recurring root causes. Dashed edges indicate a category addresses the root cause as a [PITH_FULL_IMAGE:figures/full_fig_p009_16.png] view at source ↗
Figure 17
Figure 17. Figure 17: The same four causal chains, each instantiated by one representative paper from the corpus. The break point (red) is a different step in each [PITH_FULL_IMAGE:figures/full_fig_p011_17.png] view at source ↗
Figure 18
Figure 18. Figure 18: Pairwise similarity across the seventeen taxonomy categories, scored by cosine similarity of each category’s root-cause weight vector plus a [PITH_FULL_IMAGE:figures/full_fig_p013_18.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

54 extracted references · 54 canonical work pages · 32 internal anchors

  1. [1]

    SoK: The attack surface of agentic AI, tools, and autonomy,

    A. Dehghantanha and S. Homayoun, “SoK: The attack surface of agentic AI, tools, and autonomy,”arXiv preprint arXiv:2603.22928, 2026

    work page arXiv 2026

  2. [2]

    A survey on agentic security: Applications, threats and defenses,

    A. Shahriar, M. N. Rahman, S. Ahmed, F. Sadeque, and M. R. Parvez, “A survey on agentic security: Applications, threats and defenses,” arXiv preprint arXiv:2510.06445, 2025

    work page arXiv 2025

  3. [3]

    Prompt injection attacks on agentic coding assistants: A systematic analysis of vulnerabilities in skills, tools, and protocol ecosystems,

    N. Maloyan and D. Namiot, “Prompt injection attacks on agentic coding assistants: A systematic analysis of vulnerabilities in skills, tools, and protocol ecosystems,”arXiv preprint arXiv:2601.17548, 2026

    work page arXiv 2026

  4. [4]

    Clawed and dangerous: Can we trust open agentic systems?

    S. Chen, Q. Wang, G. Yu, X. Wang, and L. Zhu, “Clawed and dangerous: Can we trust open agentic systems?”arXiv preprint arXiv:2603.26221, 2026

    work page arXiv 2026

  5. [5]

    CVE-2024-21626: runc con- tainer escape via leaked file descriptor referencing the host working directory,

    NIST National Vulnerability Database, “CVE-2024-21626: runc con- tainer escape via leaked file descriptor referencing the host working directory,” MITRE / NIST NVD, Tech. Rep., 2024, “Leaky Vessels”; also assigned GHSA-xr7r-f8xq-vfvv

    work page 2024

  6. [6]

    CVE-2025-53773: Command injection in GitHub copilot and visual studio,

    ——, “CVE-2025-53773: Command injection in GitHub copilot and visual studio,” MITRE / NIST NVD, Tech. Rep., 2025, cVSS 3.1 base score 7.8 (High); affects Visual Studio 2022 17.14.0 to 17.14.11

    work page 2025

  7. [7]

    CVE-2025-59536: Code injection in Claude Code via startup trust dialog bypass,

    ——, “CVE-2025-59536: Code injection in Claude Code via startup trust dialog bypass,” MITRE / NIST NVD, Tech. Rep., 2025, cVSS 3.1 base score 8.8 (High); CWE-94; fixed in Claude Code 1.0.111; GHSA-4fgq-fpq9-mr3g

    work page 2025

  8. [8]

    CVE-2026-21852: Data exfiltration in Claude Code project- load flow before trust confirmation,

    ——, “CVE-2026-21852: Data exfiltration in Claude Code project- load flow before trust confirmation,” MITRE / NIST NVD, Tech. Rep., 2026, cVSS 3.1 base score 7.5 (High); fixed in Claude Code 2.0.65

    work page 2026

  9. [9]

    Systems security foundations for agentic computing,

    M. Christodorescu, E. Fernandes, A. Hooda, S. Jha, J. Rehberger, K. Chaudhuri, X. Fu, K. Shams, G. Amir, J. Choi, S. Choudhary, N. Palumbo, A. Labunets, and N. V . Pandya, “Systems security foundations for agentic computing,”arXiv preprint arXiv:2512.01295, 2025

    work page arXiv 2025

  10. [10]

    A vision for access control in llm-based agent systems,

    X. Li, D. Huang, J. Li, H. Cai, Z. Zhou, W. Dong, X. Wang, and Y . Liu, “A vision for access control in llm-based agent systems,” arXiv preprint arXiv:2510.11108, 2025

    work page arXiv 2025

  11. [11]

    OW ASP top 10 for large language model applications,

    OW ASP Foundation, “OW ASP top 10 for large language model applications,” https://owasp.org/ www-project-top-10-for-large-language-model-applications/, 2025

    work page 2025

  12. [12]

    Pwn2Own Berlin 2026: Coding agents category rules and day one results,

    Zero Day Initiative, “Pwn2Own Berlin 2026: Coding agents category rules and day one results,” https://www.thezdi.com/blog/2026/5/13/ pwn2own-berlin-2026-day-one-results, 2026, category and eligibility rules per the event announcement; targets Claude Code, OpenAI Codex, and Cursor

    work page 2026

  13. [13]

    Hackers earn over $1.29 million at Pwn2Own Berlin 2026,

    E. Kovacs, “Hackers earn over $1.29 million at Pwn2Own Berlin 2026,” SecurityWeek, https://www.securityweek.com/, 2026, 47 unique zero-days; total payout $1,298,250

    work page 2026

  14. [14]

    Don't Let AI Agents YOLO Your Files: Shifting Information and Control to Filesystems for Agent Safety and Autonomy

    S. W. Zhong, J. Liao, J. Liu, M. Zheng, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau, “Don’t let ai agents yolo your files: Shifting information and control to filesystems for agent safety and autonomy,” arXiv preprint arXiv:2604.13536, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  15. [15]

    IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems

    Y . Wu, F. Roesner, T. Kohno, N. Zhang, and U. Iqbal, “Isolategpt: An execution isolation architecture for llm-based agentic systems,” in Network and Distributed System Security Symposium (NDSS), 2025, arXiv:2403.04960

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  16. [16]

    cellmate: Sand- boxing browser ai agents,

    L. Meng, H. Feng, I. Shumailov, and E. Fernandes, “cellmate: Sand- boxing browser ai agents,”arXiv preprint arXiv:2512.12594, 2025

    work page arXiv 2025

  17. [17]

    Agentbay: A hybrid interaction sandbox for seamless human-ai intervention in agentic systems,

    Y . Piao, H. Min, H. Su, L. Zhang, L. Wang, Y . Yin, X. Wu, Z. Xu, L. Qu, H. Liet al., “Agentbay: A hybrid interaction sandbox for seamless human-ai intervention in agentic systems,”arXiv preprint arXiv:2512.04367, 2025

    work page arXiv 2025

  18. [18]

    DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback

    Y . Dong, J. He, S. Liu, Y . Hou, D. Du, Z. Xu, S. Yu, B. Yang, Y . Xia, and H. Chen, “Deltabox: Scaling stateful ai agents with millisecond- level sandbox checkpoint/rollback,”arXiv preprint arXiv:2605.22781, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  19. [19]

    Fault-tolerant sandboxing for ai coding agents: A trans- actional approach to safe autonomous execution,

    B. Yan, “Fault-tolerant sandboxing for ai coding agents: A trans- actional approach to safe autonomous execution,”arXiv preprint arXiv:2512.12806, 2025

    work page arXiv 2025

  20. [20]

    Quantifying Frontier LLM Capabilities for Container Sandbox Escape

    R. Marchand, A. O. Cathain, J. Wynne, P. M. Giavridis, S. Dev- erett, J. Wilkinson, J. Gwartz, and H. Coppock, “Quantifying fron- tier llm capabilities for container sandbox escape,”arXiv preprint arXiv:2603.02277, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  21. [21]

    RedCode: Risky Code Execution and Generation Benchmark for Code Agents

    C. Guo, X. Liu, C. Xie, A. Zhou, Y . Zeng, Z. Lin, D. Song, and B. Li, “Redcode: Risky code execution and generation benchmark for code agents,” inAdvances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track, 2024, arXiv:2411.07781

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  22. [22]

    SandboxEval: Towards Securing Test Environment for Untrusted Code

    R. Rabin, J. Hostetler, S. McGregor, B. Weir, and N. Judd, “Sandbox- eval: Towards securing test environment for untrusted code,”arXiv preprint arXiv:2504.00018, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  23. [23]

    Identifying the Risks of LM Agents with an LM-Emulated Sandbox

    Y . Ruan, H. Dong, A. Wang, S. Pitis, Y . Zhou, J. Ba, Y . Dubois, C. J. Maddison, and T. Hashimoto, “Identifying the risks of LM agents with an LM-emulated sandbox,” inInternational Conference on Learning Representations (ICLR), 2024, arXiv:2309.15817

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  24. [24]

    InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents

    Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents,” inFindings of the Association for Computational Linguistics: ACL, 2024, arXiv:2403.02691

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  25. [25]

    AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents

    E. Debenedetti, J. Zhang, M. Balunovi ´c, L. Beurer-Kellner, M. Fis- cher, and F. Tram`er, “AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,” inNeural Information Processing Systems Datasets and Benchmarks Track (NeurIPS D&B), 2024, arXiv:2406.13352

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  26. [26]

    AgentBound: Securing Execution Boundaries of AI Agents

    C. Buhler, M. Biagiola, L. D. Grazia, and G. Salvaneschi, “Agent- bound: Securing execution boundaries of ai agents,”arXiv preprint arXiv:2510.21236, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  27. [27]

    Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents

    I. Santos-Grueiro, “Lingering authority: Revocable resource- and-effect capabilities for coding agents,”arXiv preprint arXiv:2606.22504, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  28. [28]

    Taming various privilege escalation in llm-based agent systems: A mandatory access control framework,

    Z. Ji, D. Wu, W. Jiang, P. Ma, Z. Li, Y . Gao, S. Wang, and Y . Li, “Taming various privilege escalation in llm-based agent systems: A mandatory access control framework,”arXiv preprint arXiv:2601.11893, 2026

    work page arXiv 2026

  29. [29]

    Before the tool call: Deterministic pre-action autho- rization for autonomous ai agents,

    U. Uchibeke, “Before the tool call: Deterministic pre-action autho- rization for autonomous ai agents,”arXiv preprint arXiv:2603.20953, 2026

    work page arXiv 2026

  30. [30]

    Formal Policy Enforcement for Real-World Agentic Systems

    N. Palumbo, S. Choudhary, J. Choi, G. Amir, P. Chalasani, and S. Jha, “Formal policy enforcement for real-world agentic systems,”arXiv preprint arXiv:2602.16708, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  31. [31]

    One Goal, Many Commands: Characterizing Denylist Fragility in AI Agents

    C. Chen and Z. Lin, “One goal, many commands: Characterizing denylist fragility in ai agents,”arXiv preprint arXiv:2606.15549, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  32. [32]

    Mind the Gap: Time-of-Check to Time-of-Use Vulnerabilities in LLM-Enabled Agents

    D. Lilienthal and S. Hong, “Mind the gap: Time-of-check to time-of-use vulnerabilities in llm-enabled agents,”arXiv preprint arXiv:2508.17155, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  33. [33]

    Atomicity for agents: Expos- ing, exploiting, and mitigating toctou vulnerabilities in browser-use agents,

    L. Jiang, Z. Liu, H. Luo, and Z. Lin, “Atomicity for agents: Expos- ing, exploiting, and mitigating toctou vulnerabilities in browser-use agents,”arXiv preprint arXiv:2603.00476, 2026

    work page arXiv 2026

  34. [34]

    arXiv preprint arXiv:2603.22489 , year =

    C. Huang, X. Huang, N. P. Tran, and A. M. Fard, “Model context protocol threat modeling and analyzing vulnerabilities to prompt in- jection with tool poisoning,”arXiv preprint arXiv:2603.22489, 2026

    work page arXiv 2026

  35. [35]

    Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions

    X. Hou, Y . Zhao, S. Wang, and H. Wang, “Model context protocol (mcp): Landscape, security threats, and future research directions,” arXiv preprint arXiv:2503.23278, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  36. [36]

    Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers

    M. M. Hasan, H. Li, E. Fallahzadeh, G. K. Rajbahadur, B. Adams, and A. E. Hassan, “Model context protocol (mcp) at first glance: Studying the security and maintainability of mcp servers,”arXiv preprint arXiv:2506.13538, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  37. [37]

    Mcp-guard: A multi-stage defense-in-depth framework for securing model context protocol in agentic ai,

    W. Xing, Z. Qi, Y . Qin, Y . Li, C. Chang, J. Yu, C. Lin, Z. Xie, and M. Han, “Mcp-guard: A multi-stage defense-in-depth framework for securing model context protocol in agentic ai,”arXiv preprint arXiv:2508.10991, 2026

    work page arXiv 2026

  38. [38]

    Reframing LLM Agent Security as an Agent-Human Interaction Problem

    P. Wang, Y . Li, and Y . Tian, “Reframing llm agent security as an agent-human interaction problem,”arXiv preprint arXiv:2605.24309, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  39. [39]

    Towards Cybersecurity SuperIntelligence (CSI): What's the best harness for cybersecurity?

    V . Mayoral-Vilches, F. Balassone, M. Sanz-Gomez, P. Z. Landa, D. S. Prieto, M. O. Alvarez, D. Quarta, and M. Pinzger, “Towards cybersecurity superintelligence (csi): What’s the best harness for cybersecurity?”arXiv preprint arXiv:2605.28334, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  40. [40]

    Authenticated Delegation and Authorized AI Agents

    T. South, S. Marro, T. Hardjono, R. Mahari, C. D. Whitney, D. Green- wood, A. Chan, and A. Pentland, “Authenticated delegation and authorized ai agents,”arXiv preprint arXiv:2501.09674, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  41. [41]

    Governing dynamic capabilities: Cryptographic binding and reproducibility verification for ai agent tool use,

    Z. Zhou, “Governing dynamic capabilities: Cryptographic binding and reproducibility verification for ai agent tool use,”arXiv preprint arXiv:2603.14332, 2026

    work page arXiv 2026

  42. [42]

    Agent-Sentry: Bounding LLM Agents via Execution Provenance

    R. Sequeira, S. Damianakis, U. Iqbal, and K. Psounis, “Agent-sentry: Bounding llm agents via execution provenance,”arXiv preprint arXiv:2603.22868, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  43. [43]

    Firewalls to Secure Dynamic LLM Agentic Networks

    S. Abdelnabi, A. Gomaa, E. Bagdasarian, P. O. Kristensson, and R. Shokri, “Firewalls to secure dynamic llm agentic networks,”arXiv preprint arXiv:2502.01822, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  44. [44]

    SecureVibeBench: Benchmarking Secure Vibe Coding of AI Agents via Reconstructing Vulnerability-Introducing Scenarios

    J. Chen, H. Huang, Y . Lyu, J. An, J. Shi, C. Yang, T. Zhang, H. Tian, Y . Li, Z. Li, X. Zhou, X. Hu, and D. Lo, “Secure- vibebench: Benchmarking secure vibe coding of ai agents via reconstructing vulnerability-introducing scenarios,”arXiv preprint arXiv:2509.22097, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  45. [45]

    Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks

    Y . Qu, Y . Zhang, Y . Zhang, G. Deng, Y . Li, L. Y . Zhang, and Y . Liu, “Overeager coding agents: Measuring out-of-scope actions on benign tasks,”arXiv preprint arXiv:2605.18583, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  46. [46]

    Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis

    Z. Li, J. Wu, X. Ling, X. Cui, and T. Luo, “Towards secure agent skills: Architecture, threat taxonomy, and security analysis,”arXiv preprint arXiv:2604.02837, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  47. [47]

    Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real- world LLM-integrated applications with indirect prompt injection,” inACM Workshop on Artificial Intelligence and Security (AISec), 2023, arXiv:2302.12173

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  48. [48]

    Prompt Injection attack against LLM-integrated Applications

    Y . Liu, G. Deng, Y . Li, K. Wang, T. Zhang, Y . Liu, H. Wang, Y . Zheng, and Y . Liu, “Prompt injection attack against LLM-integrated applica- tions,”arXiv preprint arXiv:2306.05499, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  49. [49]

    Universal and Transferable Adversarial Attacks on Aligned Language Models

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,”arXiv preprint arXiv:2307.15043, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  50. [50]

    R-Judge: Benchmarking Safety Risk Awareness for LLM Agents

    T. Yuan, Z. He, L. Dong, Y . Wang, R. Zhao, T. Xia, L. Xu, B. Zhou, F. Li, Z. Zhang, R. Wang, and G. Liu, “R-Judge: Benchmarking safety risk awareness for LLM agents,” inFindings of the Association for Computational Linguistics: EMNLP, 2024, arXiv:2401.10019

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  51. [51]

    MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents

    K. Zhu, X. Yang, J. Wang, W. Guo, and W. Y . Wang, “MELON: Provable defense against indirect prompt injection attacks in AI agents,”arXiv preprint arXiv:2502.05174, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  52. [52]

    PromptArmor: Simple yet Effective Prompt Injection Defenses

    T. Shi, K. Zhu, Z. Wang, Y . Jia, W. Cai, W. Liang, H. Wang, H. Alzahrani, J. Lu, K. Kawaguchi, B. Alomair, X. Zhao, W. Y . Wang, N. Gong, W. Guo, and D. Song, “PromptArmor: Simple yet effective prompt injection defenses,”arXiv preprint arXiv:2507.15219, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  53. [53]

    ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection

    S. Weng, Y . Feng, J. Zhang, X. Xie, J. Yu, and J. Liu, “ARGUS: De- fending LLM agents against context-aware prompt injection,”arXiv preprint arXiv:2605.03378, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  54. [54]

    AI Agents May Always Fall for Prompt Injections

    S. Abdelnabi and E. Bagdasarian, “AI agents may always fall for prompt injections,”arXiv preprint arXiv:2605.17634, 2026. Appendix A. Per-Paper Classification of the Corpus Table 5 lists every one of the 39 papers that enter the tax- onomy, together with its category, root-cause attribution, and pipeline-stage role, so that the taxonomy in Section 4 can b...

    work page internal anchor Pith review Pith/arXiv arXiv 2026