A new arXiv paper proposes ActGuard, a defense that audits an LLM agent's planned tool calls before they are executed. The approach targets indirect prompt injection, where malicious instructions hidden in tool outputs can hijack an agent's behavior. The authors position it as an alternative to existing defenses such as prompt hardening and content filtering.
A revised arXiv paper introduces DualView, a defense aimed at indirect prompt injection attacks targeting personal AI agents that operate locally with access to the network, file system, and shell. The work addresses how such agents can be manipulated through untrusted content they encounter while carrying out everyday tasks like web search, email, and file management. The submission is a replacement version of an existing preprint, so the full technical details are in the paper itself.
A new arXiv preprint describes an approach for finding indirect prompt injection vulnerabilities in MCP servers without needing system access or live interaction. The method works from descriptions alone, targeting third-party audits of closed-source, remotely hosted, or commercially gated software where conventional analysis is not possible. The authors position it as a way to assess critical systems that analysts cannot directly inspect or probe.
A new arXiv preprint outlines a neurosymbolic approach for protecting AI-driven security operations centers from attacks on their data pipelines. The work focuses on indirect prompt injection through log poisoning, a vector where adversaries plant malicious text in logs that downstream language models then process. The proposed framework aims to verify pipeline integrity and mitigate such threats rather than relying on LLM defenses alone.