A model can refuse a harmful request and still be part of an unsafe system. An agent reads files and messages, calls tools, and changes its environment. Its chat interface may expose private context to third parties. These five studies look at different points in that chain. Their results should be read within each paper’s setup, but together they suggest where security checks have to sit.
How to read the numbers. Attack success rates below come from different models, tasks, and threat models. They are not a common leaderboard or estimates of risk for every deployed agent. Each linked review covers the underlying method and limitations.
1. A backdoor can enter before the agent exists
Agentic Backdoors via Pretraining Poisoning asks whether an attacker can plant a behavior in the corpus used to train a model, then activate it later when that model works as a CLI agent. In the authors’ Qwen3 experiments, poisoning 0.1% of pretraining data yielded roughly 92% attack success at 4B parameters for the tested remote-code-execution objective. The paper reports a positive attack signal even at a 0.0005% poison rate. Clean post-training did not reliably erase the tested backdoor.
The key boundary is between data a model learns from and actions it later takes on a user’s machine. The experiment covers Qwen3 models up to 4B in a CLI-agent setup; it does not establish that the same rates transfer to frontier models or other agent architectures. It does show why training-data integrity matters to operational security, not just answer quality.
2. Instruction separation can be built into attention
Heads of Security studies a defense against prompt injection: learned gates on attention heads that help a model use untrusted content as information without treating its embedded commands as instructions. In the authors’ black-box RL-Hammer evaluation, attack success was 97% against GPT-OSS-20B, 85% against SecAlign, and 10% against their HoS model. A stronger white-box attack needed about 3× the compute to reach the same success rate.
This is evidence for an architectural defense in the tested Llama-3.3-70B and GPT-OSS-20B settings. It is not a permanent guarantee against future adaptive attacks. The useful question is whether a model can preserve the distinction between the user’s authority and the content it must read to help them.
3. The agent scaffold changes what an injection can do
ClawSafety tests personal agents with 120 adversarial scenarios and 2,520 sandboxed trials across five frontier LLMs. In its OpenClaw setup, average attack success was 69.4% for skill instructions, 60.5% for email, and 38.4% for web content. Across the paper’s evaluated combinations, success ranged roughly from 40% to 75%. The ordering changes in some other scaffolds, which is itself a finding: model and framework both shape risk.
A skill file can look like workspace guidance, an email can appear to come from a trusted colleague, and a web page can look like task data. ClawSafety is a benchmark, not a defense. Its numbers describe the tested agents and attack designs; they do not predict the success rate on every personal agent.
4. Check what happened on the machine
LITMUS moves evaluation from an agent’s words to OS-level effects. Its 819 high-risk test cases pair semantic checks with physical state verification in rollback-capable environments. The authors document “execution hallucination”: an agent may say it refused a dangerous operation after the operation has already happened. Even the strongest model in their evaluation executed 40.64% of high-risk operations.
This is a lab benchmark, not a measurement of production deployments. It makes a general measurement point: a refusal in the final answer is insufficient evidence of safety when an agent has already run a command or changed a file. Tool traces and final machine state belong in the evaluation.
5. The chat interface has its own security boundary
Penny for Your Prompts instruments browsers to observe what AI chat web apps send to third-party trackers. Of 42 platforms audited, 21 leaked conversation titles and nine leaked verbatim prompts. The study also found email exposure on a number of platforms, allowing conversation context to be linked to a user identity. Some leaks arose because trackers read dynamically generated page titles derived from prompts as ordinary page metadata.
The study measures web interfaces, including general-purpose and domain-specific chat services. It does not measure API-only use. Privacy work for AI applications must therefore inspect browser scripts and outbound requests as well as model behavior.
A security program that follows the full path
| Boundary | What these studies expose | Useful next check |
|---|---|---|
| Training data → agent behavior | Pretraining poison can persist into a tested CLI agent. | Audit data provenance and test triggered tool behavior after post-training. |
| Untrusted text → model instruction | Attackers try to promote retrieved content into authority. | Run adaptive injection tests against the model and its instruction-separation mechanism. |
| Skills, email, web → tool use | Personal-agent scaffolds and source trust change attack success. | Evaluate each input surface and verify permissions at the action boundary. |
| Agent reply → machine state | A refusal can coexist with a completed dangerous operation. | Score actual files, processes, network effects, and tool traces. |
| Chat page → third party | Trackers can receive conversation context and identity. | Inspect browser data flows after real multi-turn interactions. |
Aegis’s synthesis is to test these boundaries together in a single workflow: train or configure an agent, introduce untrusted task material, observe its tool actions, verify the resulting machine state, and inspect the chat page’s outbound traffic. That combined test is a proposed research direction, not an experiment reported by these five papers.
Read the five full reviews
- Agentic Backdoors via Pretraining PoisoningTraining-time attack · CLI agents
- Heads of Security: Learned Attention Gates Improve Prompt Injection RobustnessArchitectural defense · prompt injection
- ClawSafety: “Safe” LLMs, Unsafe AgentsPersonal-agent benchmark · skill, email, and web injection
- LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS EnvironmentsOS-level benchmark · effect verification
- Penny for Your Prompts: A Measurement Study of Contextual Leakage in AI Chat PlatformsWeb privacy · third-party tracking
Source note: findings and figures are attributed to the authors’ arXiv preprints. Cross-paper connections and proposed checks are Aegis analysis. The five studies use different settings and cannot be compared as one benchmark.