skyvern

🐉 Automate Browser-based workflows using LLMs and Computer Vision 🐉 Skyvern automates browser-based workflows using LLMs and computer vision. It provides a Playwright-compatible SDK that adds AI functionality on top of playwright, as well as a no-code workflow builder to help both technical and...

ClawGuard

ClawGuard 🛡️ 中文版 Our Project:https://github.com/SafeAgent-Beihang/clawguard ClawGuard is a security toolkit designed to mitigate risks associated with autonomous agents, such as OpenClaw and other LLM-driven entities. As agents gain more autonomy to execute code, access APIs, and manage files,...

ConcoLLMic

ConcoLLMic: Agentic Concolic Execution Paper : IEEE S&P 2026 ConcoLLMic is the first language- and theory-agnostic concolic executor powered by LLM agents. Unlike traditional symbolic execution tools that require language-specific implementations and struggle with constraint solving, ConcoLLMic:...

anamnesis-release

Anamnesis: LLM Exploit Generation Evaluation This repository contains the evaluation framework for studying how LLM agents generate exploits from vulnerability reports in the presence of exploit mitigations. Given a bug report and proof-of-concept trigger, agents analyze vulnerable software and...

llm-agent-testbed

🛡️ LLM Agent Security Testbed Empirical Vulnerability & Defense Harness for Tool-Calling LLM Agents A disciplined security testbed testing whether tool-equipped LLM agents can be manipulated into unauthorized data exfiltration via prompt injection, role-claim social engineering, and confused-deput...

ShadowMem

ShadowMem: Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory This repository contains the official code release for the paper Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory. ShadowMem is a defensive framework that maintains a dedicated, safety-focused...

AgentWatcher

AgentWatcher AgentWatcher is a detection-based defense against indirect prompt injection in LLM agents. It first runs causal context attribution over untrusted context to find the most influential contexts, then applies a monitor LLM that classifies those contexts under explicit, customizable...

ActGuard

ActGuard ActGuard is a pre-execution action-auditing defense against indirect prompt injection in tool-using LLM agents. This repository contains the final ActGuard implementation and the AgentDojo-based runtime needed to evaluate it. The release contains only the final, full ActGuard...

Defenses-for-Tool-Integrated-LLM

Universal Defences for Tool-Integrated LLM Agents Against Adversarial Attacks This repository contains the code and experiments for our project on defending tool-integrated large language model LLM agents against adversarial attacks. Overview We build upon Agent Security Bench ASB to evaluate how...

benign-instruction-bench

Passing the Test You Trained On Re-evaluating prompt-injection detectors where LLM agents actually use them: on the tool outputs an agent reads. Teams pick injection detectors by their benchmark scores. We check whether those scores predict behavior inside an agent, and find that they mostly...

opentaint

El motor de analisis de taint de codigo abierto para la era de la IA Analisis de taint formal para la seguridad de aplicaciones — encuentra lo que los motores de coincidencia de patrones AST pasan por alto, permite a los agentes LLM aplicar vulnerabilidades como reglas, escala donde ninguno puede...

agentic-dm-gateway

Agentic DM Gateway Security control plane for LLM agents over private chat typically Discord DMs. It sits in front of your agent. It decides who may talk, whether the session is unlocked, whether the process is paused, and whether this message is safe enough to forward. Your model and tools stay...

RAISED: Self-Distillation for Robustness to Prompt Injection in LLM Agents

Tool-using language-model agents are vulnerable to indirect prompt injection because they must act on untrusted external content. Existing training-time defenses can reduce attack success rates, but often at the cost of general capabilities. We show that training-based defenses induce substantial...

Compromise Is Not Consequence: Evaluating Task-Scoped Authorization in LLM Agents with Paired Replay

A tool-using model can follow a malicious instruction even when its credentials are valid. We study whether task-scoped authorization contains the resulting tool execution. Our paired-replay testbed samples a model request once and submits the same action, resource, and arguments to broad bearer,...

SkillPoison: Progressive Skill Poisoning Via Successful Experiences

Self-improving LLM agents increasingly distill successful experiences into persistent, reusable skills. Existing skill attack methods corrupt this learning pipeline by injecting malicious triggers, behaviors, or false facts into individual experiences or extracted skills. However, such attacks ar...

Understanding and Enhancing Backdoor Persistency in LLM Agent Post-Training

Developers can build LLM agents by adapting third-party models through benign post-training. We study a supply-chain threat in which an attacker supplies a model with a backdoor: hidden behavior that produces malicious outputs when a particular input pattern appears. Focusing on...

Towards a Unified Misuse Monitoring Benchmark

LLM agents increasingly act in multi-actor environments, exposing them to misuse from multiple sources: decomposition attacks, where a harmful request is split into innocuous sub-requests, and prompt injection attacks, where a compromised tool delivers a malicious instruction. Existing evaluation...

VulValidate: Auditing Function-Level Vulnerability Labels with Executable Evidence

Reliable learning-based vulnerability detection requires high-quality labels, yet datasets built from vulnerability-fixing commits may label functions as vulnerable simply because they were changed by a security patch. We present VulValidate, a framework that uses LLM agents to coordinate dynamic...

APEX: Active Protection at Execution Boundaries for LLM Agents

Indirect prompt injection IPI hides adversarial instructions in content that large language model LLM agents read at runtime. As agents compose heterogeneous capability units, including Tools, MCP servers, and Skills, the carriers of injection multiply, and defenses built to recognize attack...

Chaining Skills to Hijack LLM Agents

LLM agents use skills to improve performance on specialized tasks. To complete a user request, an agent may invoke several skills in sequence, allowing information produced under one skill to guide the next. Because skills may come from open-source repositories, this handoff can also carry...