为自主AI代理构建可形式化验证的安全框架，防止恶意行为。
ClawLess: A Security Model of AI Agents
- 通过细粒度安全模型动态控制代理权限
- 在最坏威胁下仍能保障系统安全，无须依赖内部可信
- 用BPF实现用户态内核拦截，落地执行安全策略
由大语言模型驱动的自主AI代理具备推理、规划与执行复杂任务的能力，但其自主检索信息和运行代码的特性引入了重大安全风险。现有方法通过训练或提示来约束代理行为，无法提供根本性安全保证。我们提出ClawLess，一个在最坏威胁模型下（代理本身可能恶意）仍能强制执行形式化验证策略的安全框架。该框架对系统实体、信任范围与权限进行细粒度建模，表达可随代理运行时行为动态调整的策略。这些策略被转化为具体安全规则，并通过增强BPF的用户空间内核进行系统调用拦截来强制执行。该方法实现了形式化安全模型与实际执行的衔接，确保无论代理内部设计如何，安全性始终成立。
原文摘要 · Abstract (English)
Autonomous AI agents powered by Large Language Models can reason, plan, and execute complex tasks, but their ability to autonomously retrieve information and run code introduces significant security risks. Existing approaches attempt to regulate agent behavior through training or prompting, which does not offer fundamental security guarantees. We present ClawLess, a security framework that enforces formally verified policies on AI agents under a worst-case threat model where the agent itself may be adversarial. ClawLess formalizes a fine-grained security model over system entities, trust scopes, and permissions to express dynamic policies that adapt to agents' runtime behavior. These policies are translated into concrete security rules and enforced through a user-space kernel augmented with BPF-based syscall interception. This approach bridges the formal security model with practical enforcement, ensuring security regardless of the agent's internal design.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。