WeClawArena is introduced, an auditable benchmark and runtime sandbox for multi-party owned-agent collaboration over personal workspaces and audits attack success from bounded runtime evidence, supporting diagnosis of task breakdown, privacy leakage, poisoned evidence, and invalid authority paths.
Abstract
Recent advances in persistent personal-agent frameworks are making human-centered agent networks realistic deployment targets: each user can be served by an AI agent that acts on the user's behalf, maintains state, and communicates with other agents through social and task relations. In these networks, everyday tool use becomes multi-party owned-agent collaboration over personal workspaces, where files, records, tools, and policies are not directly visible across owners. Existing agent benchmarks study tool use and collaboration, but they do not provide an end-to-end sandbox for verifiable cross-user agent collaboration with realistic user digital workspaces or test how harmful actions can travel through the human-centered agent network. We introduce WeClawArena, an auditable benchmark and runtime sandbox for multi-party owned-agent collaboration over personal workspaces. WeClawArena targets collaborative tool-use tasks in which personal workspaces serve as both operational tools and personal constraints. The benchmark contains 124 base tasks across six cross-user task domains and expands them into 620 scenario variants, with one benign control and four attack-vector variants per base task. The sandbox records peer messages, tool calls, resource operations, governed decisions, and final workspace states. WeClawArena reports utility and attack success rate separately and audits attack success from bounded runtime evidence, supporting diagnosis of task breakdown, privacy leakage, poisoned evidence, and invalid authority paths.
RedAgentBench is introduced, an executable framework for autonomous red-teaming and faithful measurement that shows that executable evaluation can improve safety measurement and identify actionable intervention points.
Zixing Chen, Xingyuan Liu, Jie Zhu et al.· 1 citation
AgentFlow, a flow-centric policy language and runtime enforcement model for specifying where data may travel in agent systems, is presented and results are preliminary and scoped to the modeled policy-visible agent behaviors and evaluated benchmarks.
Large language model (LLM)-based agents are evolving into agents for computer use (ACUs) that read files, invoke applications, communicate over networks, and operate graphical interfaces, moving the effective security boundary from model inputs and outputs to autonomous actions that alter endpoint state. Conventional identity and access controls remain applicable and necessary, but they are authorized based on identity, resource, and network policy rather than on the semantic scope of the active task or the provenance of the instruction that triggered an action. This paper presents ARES (Agent Resource Enforcement and Security), an action-centric framework that inserts enforceable authorization between agent-generated tool calls and protected resources, combining a Resource Proxy Layer for interception, a Behavioral Guardrail Engine for task- and context-aware authorization, and a Multi-Agent Trust Boundary Manager for provenance and taint propagation. We implement ARES-lite and evaluate it against file exfiltration through indirect prompt injection, prompt infection propagation, and internal-network access abuse. Under the controlled replay-based evaluation, integrated ARES-lite reduced the observed attack-success rate from 100% under the permissive baseline to 0% across the three evaluated scenarios, while preserving the predefined handling of eight benign and ambiguous tasks with no false positives. A closed-loop evaluation in which the agent re-plans after an intervention, an adversarial boundary-case suite covering path aliasing, address encoding, look-alike destinations, and taint laundering, and a comparison against representative prompt-filtering and tool-allowlist defenses further characterize the enforcement path; a model and temperature sweep show that baseline exposure varies with model capability, whereas the mediated outcome does not.
Changhee Kim, Seong-je Cho· Electronics· 0 citations
The results show that TraceGrant provides a unified governance layer that connects trusted user intent, runtime evidence, concrete tool execution, and verified task completion.
Bohao Liao, Jing-Chao Wang, Qipeng Song et al.· 0 citations
AI coding agents are evolving from solitary tools into collaborative teammates that discover and invoke one another's specialized skills. But the coordination channel itself can leak a skill's intellectual property. Protocols such as MCP and A2A run implementations server-side, yet they still publish each skill's description and typed schemas to every peer, offer no way to hide a skill's existence, and cannot guarantee that a wrapped system prompt stays off the wire. Application-layer privacy filters help, but act only after the model has decided to emit sensitive text. We take a complementary, protocol-layer route: Skill-as-API, a coordination protocol whose public view of a skill is limited to its name, description, typed input/output schemas, and trust tier. The skill body is closure-captured in the owner's process and never crosses the wire. Four layers add access control and narrow the prompt-injection surface structurally rather than by filtering content. We provide an open-source Python implementation over XMTP with 1.8-2.9 s cross-continent hot-reconnect latency, and a software-engineering case study in which three agents coordinate a pull-request review while each retains ownership of its proprietary analysis prompts.
Zi-Wei Zhao, Yu Gu, Haofeng Liang et al.· 0 citations
The threat model in the HPC setting is defined, attack surfaces created by schedulers, shared storage, multi-project accounts, and scientific workflows are identified, and where current controls fall short is examined.
Jie Li· arXiv.org· 2 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
