用户只说目标，系统自动生成执行计划，可能带来安全风险。
When Convenience Becomes Risk: A Semantic View of Under-Specification in Host-Acting Agents
- 用户仅指定目标，系统自行补全执行细节，易生成危险行为。
- 实证发现：90% 的模糊指令会触发潜在风险动作，如持久化访问。
- 适合研究智能代理安全、大模型应用落地的安全设计者阅读。
主机级智能体通过让用户仅设定目标，由系统自动规划实现路径，提升交互便捷性。然而，这种便利性引入了新的安全问题：语义不充分。用户指令通常仅描述目标，却常忽略过程约束、安全边界、持续性及暴露范围等关键要素。为此，系统需在执行前补全缺失的语义，这一补全过程可能产生高风险的主机侧执行计划，即使用户意图无害。本文构建语义威胁模型，提出语义风险补全模式分类体系，并基于 OpenClaw 的案例研究与执行轨迹分析验证该现象。进一步提炼出防御设计原则：显式定义执行边界，限制危险补全行为。结果表明，保障主机级智能体安全，不仅需控制可执行动作，还需规范从目标到可执行计划的转换机制。
原文摘要 · Abstract (English)
Host-acting agents promise a convenient interaction model in which users specify goals and the system determines how to realize them. We argue that this convenience introduces a distinct security problem: semantic under-specification in goal specification. User instructions are typically goal-oriented, yet they often leave process constraints, safety boundaries, persistence, and exposure insufficiently specified. As a result, the agent must complete missing execution semantics before acting, and this completion can produce risky host-side plans even when the user-stated goal is benign. In this paper, we develop a semantic threat model, present a taxonomy of semantic-induced risky completion patterns, and study the phenomenon through an OpenClaw-centered case study and execution-trace analysis. We further derive defense design principles for making execution boundaries explicit and constraining risky completion. These findings suggest that securing host-acting agents requires governing not only which actions are allowed at execution time, but also how goal-only instructions are translated into executable plans.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。