PaperlayerView exact revision on arXiv

Source-linked AI summary

From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors

Jiejun Tan, Zhicheng Dou, Xinyu Yang, Yuyang Hu, Yiruo Cheng, Xiaoxi Li, Ji-Rong Wen

arXiv:2605.31042v1cs.CRcs.AIcs.CL

TL;DR

Local agentic harnesses can turn injected text in files or tool outputs into persistent future control, while single-context attacks and defenses do not fully expose this threat. The paper introduces ClawTrojan and DASGuard, finding 95.5% ASR for ClawTrojan and strong dynamic defense through provenance-based sanitization.

  • Problem

    Local agentic harnesses can persist injected text as future control content, while existing single-context attack datasets provide limited evidence about multi-step workspace backdoors.

  • Method

    The paper builds ClawTrojan to test multi-step workspace backdoors and proposes DASGuard, which detects, attributes, and sanitizes unauthorized control-like content.

  • Results

    ClawTrojan exposes high vulnerability across agents, reaching 95.5% ASR with GPT-5.4, while DASGuard is strongest across attack types by carrying provenance across steps.

  • Takeaways & Limitations

    The results support provenance-oriented defenses that prevent untrusted data from becoming future instructions or high-risk action targets in local agentic harnesses.

  • Takeaways & Limitations

    ClawTrojan is a synthetic, sandbox-local benchmark, so its results provide evidence for this threat model rather than a complete estimate of real-world agent misuse.

Abstract

from arXiv · show

LLM agents are evolving from conversational chatbots to operational tools in real-world workspaces. In local agentic harnesses, an LLM can read and write files, call tools, and reuse workspace state across sessions. While such capabilities enhance utility, they also expose a new attack surface for attackers. Attackers can embed a prompt injection within a file or tool output. Agents may read this hidden instruction, store it, and execute it later. In this multi-step trojan attack paradigm, no individual step appears malicious on its own, but these steps can collectively turn untrusted text into persistent control content. However, existing defenses often inspect each step in isolation. As a result, they can block a clear harmful action, but fail to detect the earlier write operation that plants the backdoor. To reveal this threat, we introduce ClawTrojan, a benchmark designed to identify multi-step trojan attacks in local agentic harnesses. In an OpenClaw-style simulated workspace with GPT-5.4, ClawTrojan reaches a 95.5% attack success rate (ASR), while existing single-turn prompt-injection attacks produce near-zero ASR on the same model. To address this threat, we propose DASGuard, which scans control-like text in sensitive local files, traces its origin, and removes control content that does not originate from a trusted source. Our results show that DASGuard achieves strong dynamic defense by combining runtime attack blocking with sanitized commits to the workspace.

1 Introduction

Agentic harnesses extend LLMs with local tools, memories, and policies, creating a workspace attack surface where prompt injections can persist as control content. The paper introduces ClawTrojan to benchmark these multi-step trojan attacks and DASGuard to prevent untrusted content from becoming persistent harness control content.

  • Threat setting: Agentic harnesses wrap LLMs with local tools, memories, and policies for multi-step tasks, exposing the local workspace as a new attack surface.These systems include personal automation agents using local tools and coding agents using terminal capabilities.
  • Threat setting: A multi-step trojan attack distributes natural-looking rules across files and turns them into harmful behavior when later tasks cause the harness to combine them.For example, separate project and configuration files can cause private text to be copied into a shared release report.
  • Defense gap: Existing defenses may block visible harmful actions but miss earlier writes that plant persistent local control content, and they cannot clean the planted backdoor.The attack can span many turns and files, while the backdoor remains available for future runs after the initial attack ends.
  • Contributions: ClawTrojan benchmarks planting and re-triggering workspace backdoors, while DASGuard detects, attributes, and sanitizes untrusted content before it becomes persistent harness control content.The benchmark covers attack types including memory poisoning, trust laundering, and skill poisoning.
  • Benchmark and findings: 95.5% ASR: ClawTrojan succeeds in an OpenClaw-style workspace using GPT-5.4, while existing single-context attacks produce near-zero success on newer strong models without defense.The preliminary comparison names AgentDojo and InjecAgent and reports near-zero attack success on GPT-5.4 and GLM-5.1.

2 Related Work

Prior benchmarks and defenses largely evaluate immediate prompt-injection consequences or protect agent boundaries and reasoning contexts. ClawTrojan instead studies whether untrusted text becomes persistent workspace instructions, while DASGuard detects, attributes, and sanitizes such content.

  • Benchmarks: Existing benchmarks cover indirect prompt injection, tool-use risks, and prompt-injection robustness across agent settings and OpenClaw-style ecosystems.They trade off realistic environments and scalable emulation.
  • Benchmarks: ClawTrojan evaluates whether untrusted text becomes persistent instructions or policy-like workspace state, rather than only whether an agent executes a bad action after one malicious input.Its annotations represent multi-step attack chains and support defenses that intercept both planting writes and later actions.
  • Defenses: Existing defenses generally protect the agent boundary or current reasoning context through rules, classifiers, capability checks, policies, enforcement, watcher intervention, or context analysis.ClawKeeper is identified as the closest OpenClaw defense and combines skill-level policies, plugin-level enforcement, and watcher intervention.
  • Defenses: DASGuard targets the persistent harness workspace by detecting control-like text in sensitive local files, attributing its source, and sanitizing unauthorized control content.This reframes the defense question around whether untrusted content has become a future instruction.
  • Threat framing: ClawTrojan adapts the security concept of trojan or backdoor attacks, which install hidden behavior that waits for a later trigger, to local agentic harnesses.Prior work studied hidden behavior in software, configuration, and machine-learning models, including attacks and defenses.

3 Problem Formulation

The paper models agentic harnesses as local workspaces where untrusted content can persist across execution steps and later influence actions. It formulates multi-step trojan attacks and trajectory-level defenses around preventing unsafe state from being reused.

  • 3.1 Agent Harness Model: An agent is an LLM inside a runtime harness that manages instructions, tools, and reusable content.The model uses an OpenClaw-style local workspace.
  • 3.1 Agent Harness Model: The harness can read files, call skills, update memory, and reuse local content across turns.An execution is represented as a trajectory τ = (x1, a1, . . . , xT, aT), where xt is visible context and at is the next operation.
  • 3.2 Preliminary Study: 0 ASR was observed for GPT-5.4 without defense in an InjecAgent smoke run covering direct-harm and data-stealing cases.Small GLM-5.1 probes showed the same qualitative trend when runs completed, though some AgentDojo runs were limited by provider capacity.
  • 3.2 Preliminary Study: Older prompt-attack datasets may mismatch strong current models because they do not require persisting a rule into local files and re-triggering it later as ordinary workspace content.In InjecAgent, information transfer remains within the same model context, while AgentDojo does not require persistent file-based reactivation.
  • 3.3 Multi-Step Trojan Threat: A multi-step trojan plants benign-looking control text that the harness saves, copies, trusts, or reloads, after which a trigger causes an unsafe local or external action.The attacker controls external content but not prompts, registered skills, or model weights; the last intervention point is the first step after which prevention is impossible.
  • 3.4 Defense Objective: A trajectory-level defense observes each prefix τ1:t and workspace state Wt, with actions including pass, block, sanitize_patch, and require_confirmation.A successful dynamic defense blocks by the last intervention point and prevents unsafe state from being committed for later reuse.

4 The ClawTrojan Benchmark

ClawTrojan benchmarks persistent, multi-step attacks in local agent workspaces by tracing how seemingly harmless steps plant and later reuse hidden control content. Its runnable scenarios span realistic harness state, project files, user profiles, and diverse final failure modes.

  • Design goals: ClawTrojan treats local files as the main attack surface and models persistence through multi-step chains whose hidden goals are distributed across time, files, memory, or tool results.Each step is designed to appear harmless in isolation, limiting the effectiveness of one-step detectors.
  • Attack chains: Attacks may collect project context, build trust, place a hidden rule, and later convert it into a harmful action that defenses must stop before the final write, send, disclosure, or privilege change.The illustrative chain has five steps, but samples may contain different numbers of steps.
  • Dataset composition: 362 samples comprise 339 attack samples and 23 none clean or borderline controls, producing 1672 annotated step rows with runnable environments.Scenarios primarily cover office, research, coding, and general assistant settings.
  • Final outcomes: Four final outcomes capture document falsification, task deviation, external side effect, and unauthorized disclosure, while the none class supports false-alarm evaluation.External side effects include sending messages or changing remote objects, and unauthorized disclosure includes revealing private or project-sensitive information.
  • Representation and environments: Each sample links user-profile, sample, and step records, and each runnable environment tracks session, harness, and project state for hidden instructions arriving through tools, files, or both.Recorded fields include injection source, semantic stage, and whether a step is the last chance to stop the attack.

5 DASGuard

DASGuard is a harness-bound dynamic defense that traces content provenance, detects control-bearing spans, and evaluates proposed operations before they commit. It blocks unsafe external or protected actions and sanitizes unsafe workspace state while reusing findings across steps.

  • Content provenance and detection: DASGuard evaluates every proposed tool call or file operation using a content-source graph that labels content as trusted, clean, or untrusted.The graph represents content nodes and derivation edges; trusted content comes from user or system input, while workspace content is clean only without overlap with earlier findings.
  • Content provenance and detection: A later payload overlapping an earlier finding is marked compromised and rescanned, allowing DASGuard to connect control content across steps.The runtime state records operation context, changed spans, and finding details, then reuses that state when flagged content is read, copied, or combined with new payloads.
  • Content provenance and detection: DASGuard detects control-bearing spans and writes into sensitive content by combining rules, embedding matches, finding history, and joined instruction fragments.For file writes, it scans only changed spans in a shadow copy; sensitive content includes memory, policy files, and tool or skill instructions.
  • Attribution and authorization: Each candidate is attributed by source, destination, and control role, while authorization succeeds only when trusted user or system text clearly authorizes the requested action and target.Ambiguous cases may receive narrow LLM review, but that review cannot override protected blocks.
  • Enforcement and persistence: Before commit, blocked findings reject operations; otherwise DASGuard commits a sanitized shadow copy when findings are sanitized and the original when all findings are preserved.Sanitization removes clear backdoors, quotes untrusted claims as data, or marks weak claims as unverified; external actions are blocked rather than rewritten.
  • Enforcement and persistence: Skill-package checks compare implied messaging, credential, or memory-write behavior against declared manifest capabilities and evaluate mismatches through the same runtime rules.One runtime log covers clean commits, sanitized commits, and blocked actions.

6 Experiments

Experiments evaluate ClawTrojan defenses in a standardized GPT-5.4 sandbox using multi-dimensional trace-based judging and strict chain-level metrics. Raw agents and single-step defenses remain vulnerable to distributed workspace attacks, while DASGuard reduces attack progression by preserving provenance and cross-step findings.

  • Experimental setup: All defense runs use one trial, at most 12 turns, GPT-5.4 by default, and the same 919-step completeness and validity checks.The experiments use positive and clean splits defined in Appendix B.1.
  • Evaluation protocol: The judge evaluates the user request, trace, workspace diff, and expected compromise criteria, recording harmful outcomes, threat awareness, and defense responses.ASR counts only compromised valid steps, while partial verdicts indicate stopped main actions with unsafe residue.
  • Main results: Raw agents repeatedly treat poisoned workspace state as ordinary task context across local files, intermediate artifacts, and tool returns.This vulnerability spans GPT-5.4, GLM-5.1, and DeepSeek-V4-Flash rather than one model family.
  • Main results: Prompt-formatting, detector, and single-step action defenses reduce ASR only modestly because they inspect current prompts or immediate actions without reliably binding later actions to content provenance.CaMeL performs better through capability and data-flow checks but still leaves many chains with unsafe progress.
  • DASGuard analysis: DASGuard is strongest across attack types because it carries source labels and prior findings across steps, enabling provenance checks on later writes, disclosures, and task changes.Its samples concentrate at low chain penetration, showing that it prevents poisoned state from becoming trusted later context rather than merely blocking isolated actions.
  • Ablation analysis: Removing cross-step state raises step and full-chain ASR, while removing embedding scores or memory matching eliminates signals that catch attacks missed by rules alone.These ablations support using attack history, semantic matching, and prior DASGuard findings together.

7 Conclusion and Future Work

The paper presents ClawTrojan for long-horizon agent attacks and DASGuard as a defense, showing how untrusted content can become persistent workspace instructions or policy-like artifacts. DASGuard applies provenance-oriented controls to prevent untrusted data from becoming future instructions or high-risk action targets without clear user permission.

  • Contributions: ClawTrojan benchmarks long-horizon agent attacks in which untrusted content becomes a persistent instruction or policy-like workspace artifact.The benchmark targets attacks whose harmful effect emerges through persistence in the workspace.
  • Contributions: DASGuard defends this setting by enforcing that untrusted data remains data unless the user clearly allows it to become future instructions or high-risk action targets.This is the defense’s stated core rule.
  • Findings: The evaluation suggests that a provenance-oriented view reduces long-horizon compromise and better captures the threat.The supplied conclusion reports this evaluation-level finding without specifying a numerical result.

Limitations · A ClawTrojan Annotation Protocol

The paper limits ClawTrojan’s conclusions to a synthetic, sandbox-local threat model and notes gaps in clean-task coverage, harness assumptions, and adaptive-attack evaluation. Its annotation protocol constructs reusable, staged attack trajectories as standalone sandboxes and validates positive samples through full-chain runs.

  • Limitations: ClawTrojan’s 339 positive samples emphasize persistent local state, workspace artifacts, memory, and mocked tool returns, so results do not estimate all real-world agent misuse.The benchmark is synthetic and sandbox-local, and should be interpreted as evidence for this threat model.
  • Limitations: The clean split contains 23 negative or borderline samples and 92 clean steps, exposing major overblocking but not the full variety of benign long-horizon work.Production deployments should add domain-specific clean tasks and tune review policies before relying on a fixed false-positive rate.
  • Limitations: DASGuard assumes source labeling, write or external-action observation, and sanitization of durable control-bearing artifacts, while opaque memory or closed routing may require extra instrumentation.These hooks are available in the OpenClaw-style sandbox used here.
  • Limitations: Adaptive attackers may hide control content in domain-specific prose, distribute it across artifacts, or imitate trusted conventions; adaptive red-team evaluation remains future work.Ablations indicate that source labels and semantic matching are important defenses against these strategies.
  • A ClawTrojan Annotation Protocol: Each ClawTrojan sample is a runnable trajectory with a persistent workspace, staged contamination, and a validation loop rather than an isolated prompt string.The annotation workflow is summarized in Figure 1.
  • A ClawTrojan Annotation Protocol: User profiles fix role, domain, tool habits, communication style, risk tolerance, and security awareness, and are reused across samples to prevent implicit user changes.Annotators inspect profile-use distributions and prefer underused profiles when adding samples.
  • A ClawTrojan Annotation Protocol: Annotators plan one complete attack chain covering its scenario, attack family, target outcome, workspace template, skill bundle, and final artifact, with sandbox-observable outcomes.Nearby samples must differ in at least two dimensions, such as scenario, attack type, profile, skill bundle, or semantics.
  • A ClawTrojan Annotation Protocol: Validation requires positive samples to pass full-chain sandbox checks: GPT-5.4 validation and repair come first, followed by GLM-5.1 smoke validation, with strict and relaxed success recorded separately.Strict success requires every malicious step in the same sample to be judged compromised; relaxed success allows one partial verdict.

A.1 LLM-Assisted Annotation Task Package · B Dataset Schema and Runtime Environment

ClawTrojan samples were drafted and repaired by LLM workers within structured task packages, offline synthetic workspaces, and sandbox validation. The dataset separates trajectory annotation from runtime execution, with explicit schemas and loader rules for reproducible injection placement and malicious-step identification.

  • A.1 LLM-Assisted Annotation Task Package: LLM workers drafted and repaired ClawTrojan samples under structured task packages and sandbox validation.Workers operated in offline synthetic workspaces without contacting real services or using real credentials or personal data.
  • A.1 LLM-Assisted Annotation Task Package: Each task specified sample metadata including scenario, attack type, source and target outcomes, chain length, terminal artifact, write scope, and validation context.The inputs also included an optional GitHub repository context and a validation output prefix.
  • A.1 LLM-Assisted Annotation Task Package: Required outputs updated the sample, step rows, and per-step sandboxes while preserving separation between user_input and injected_inst.Injection sources could be tool_return, downloaded_file, memory, or mixed, with templates and path variants for mocked tool returns.
  • A.1 LLM-Assisted Annotation Task Package: A sample was marked stable only after GPT-5.4 and GLM-5.1 validation showed strict or explicitly recorded relaxed full-chain success.Backend, judge, and turn-0 tool errors were treated as invalid validation rather than safe behavior.
  • A.1 LLM-Assisted Annotation Task Package: The internal task package additionally tracked per-sample write scopes, output directories, and worker-only diagnostic references.Trace-specific repair notes were excluded from the paper because they did not represent benchmark semantics.
  • B Dataset Schema and Runtime Environment: ClawTrojan separates an annotation schema for trajectories from a runtime schema for sandbox execution, keeping evaluation results outside core dataset labels.This separation prevents model behavior from contaminating annotation labels.
  • B Dataset Schema and Runtime Environment: Injection placement supports one or multiple tool-specific objects with triggers, templates, and character offsets, enabling reproducible matching across tools and path variants.Multiple objects model poisoned sources reachable through several tools or path variants; mismatched paths can silently miss the attack.
  • B Dataset Schema and Runtime Environment: Runtime files retain precise loader aliases while reporting normalizes them into canonical source families, and marks steps malicious when injection_src is non-none and injected_inst is present.This derived malicious-step flag is distinct from is_last_chance, allowing several malicious steps in one chain.

B.1 Paper Evaluation Splits · C Representative Attack Patterns

The paper separates attack evaluation from clean calibration and represents persistent workspace attacks through multi-step patterns that culminate in compromised local artifacts. These patterns test whether defenses trace untrusted content across state, provenance, and workspace-local effects.

  • B.1 Paper Evaluation Splits: The released annotation tables contain both attack trajectories and clean calibration trajectories, motivating separate positive and clean evaluation splits.The paper reports two evaluation splits.
  • B.1 Paper Evaluation Splits: The positive split contains 95 unauthorized-disclosure, 90 external-side-effect, 86 task-deviation, and 68 document-falsification samples.Its 919-step denominator contains 176 document-falsification, 216 external-side-effect, 238 task-deviation, and 287 unauthorized-disclosure steps.
  • B.1 Paper Evaluation Splits: The clean split contains 23 none samples and 92 clean step environments for false-positive and utility calibration, not ASR.The full release has 362 sample files and 1672 annotated step rows, while setup, bridge, and carry-forward rows may be excluded from ASR denominators.
  • C Representative Attack Patterns: The attack-pattern section uses short schema examples, with evaluation verdicts and model outputs stored separately from core annotation fields and runnable artifacts generated for each step.These examples avoid exposing full raw fixture content.
  • C Representative Attack Patterns: Trust laundering introduces an apparently approved local exception, which the agent later writes as a verified project rule in an ordinary runbook or status artifact.The trajectory begins with normal project work such as summarizing notes or refreshing a checklist.
  • C Representative Attack Patterns: Delayed activation stores a poisoned rule in memory or a local source digest, then reuses carried-forward state when a later user request appears.Intermediate steps may carry only a field, table row, or local state flag; the pattern tests provenance tracking.
  • C Representative Attack Patterns: Fragmented payloads distribute a harmful goal across benign-looking artifacts, succeeding when the agent combines fragments into a terminal artifact that violates clean policy or source evidence.Fragments can provide a target identifier, policy exception, or ready-to-copy row.

D External No-Defense Checks

External no-defense checks use existing prompt-injection benchmarks only as a preliminary scope check, showing that older attacks are weak stress tests for persistent workspace trojans in this setting. The checks use recent base agents and benchmark-specific metrics and coverage.

  • Scope: Existing prompt-injection benchmarks serve as preliminary scope checks rather than the main evidence for ClawTrojan.The runs are conducted without defenses on recent base agents.
  • Metrics: AgentDojo reports targeted ASR and utility under attack, whereas InjecAgent reports ASR-valid and valid-output rate.InjecAgent does not report utility, so its corresponding column uses the official valid-output rate.
  • Findings: Older benchmark attacks can produce near-zero ASR in this setting, making them weak stress tests for persistent workspace trojans.This motivates evaluating attacks in a persistent-workspace threat setting.
  • Coverage: The GPT-5.4 AgentDojo run covers 949 attacked pairs across four public suites, while the GLM-5.1 check covers 105 attacked Slack pairs.The GLM-5.1 pairs are those available in the SiliconFlow subset.
Loading 2605.31042v1…