Language Is a Security Surface for Agent Guards
cs.CR, cs.AI, cs.CL, cs.LG
Submitted: 2026-10-15
Updated: 2026-10-15
Comments: Accepted at the NeurIPS 2026 Workshop on Agents in the Wild: Safety, Security, and Beyond (AIWILD). 9 pages plus appendices
License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
Sources
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
- ToolSafe: Enhancing Tool Invocation Safety of LLM-based agents via Proactive Step-level Guardrail and Feedback
- TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories
- LlamaFirewall: An open source guardrail system for building secure AI agents
- The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents
- Flaw or Artifact? Rethinking Prompt Sensitivity in Evaluating LLMs
- Towards a Science of AI Agent Reliability
- Agent-SafetyBench: Evaluating the Safety of LLM Agents
- Building a Foundational Guardrail for General Agentic Systems via Synthetic Data
- AgentDoG: A Diagnostic Guardrail Framework for AI Agent Safety and Security
- Low-Resource Languages Jailbreak GPT-4
- Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
- Identifying the Risks of LM Agents with an LM-Emulated Sandbox
- InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents
- AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
- Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
- GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning
- Quantifying Language Models' Sensitivity to Spurious Features in Prompt Design or: How I learned to start worrying about prompt formatting
- All Languages Matter: On the Multilingual Safety of Large Language Models
- PolyGuard: A Multilingual Safety Moderation Tool for 17 Languages
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Estimating the Social Cost of Corporate Data Breaches
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills