发现智能体执行环境中的隐蔽安全漏洞，提升开放世界下的AI系统安全性。
Red-Teaming Agent Execution Contexts: Open-World Security Evaluation on OpenClaw
- 将攻击环境操纵建模为多目标优化问题，兼顾风险与任务正常性。
- 在42个案例中识别出高价值被攻陷上下文，部分模型仍能完成任务但行为不安全。
- 适合关注AI系统安全评估的研究者和开发者参考。
智能体语言模型日益依赖可变的执行上下文（如文件、内存、工具、技能和辅助资源），带来超越用户显式指令的安全风险。本文提出DeepTrap，一个自动化框架，用于发现OpenClaw中的上下文漏洞。DeepTrap将对抗性上下文操控建模为黑盒轨迹级优化问题，平衡风险实现、良性任务保持与隐蔽性。其结合风险条件评估、多目标轨迹评分、奖励引导束搜索及基于反思的深度探测，识别高价值被攻陷上下文。我们构建了一个包含42个案例的基准，覆盖六类漏洞与七种操作场景，并对九个目标模型进行攻击与效用评分。结果表明，上下文被攻陷后可能引发严重不安全行为，同时仍能完成用户任务，证明仅评估最终响应不足以保障安全。研究强调需开展以执行为中心的智能体AI安全评估。代码已开源：https://github.com/ZJUICSR/DeepTrap。
原文摘要 · Abstract (English)
Agentic language-model systems increasingly rely on mutable execution contexts, including files, memory, tools, skills, and auxiliary artifacts, creating security risks beyond explicit user prompts. This paper presents DeepTrap, an automated framework for discovering contextual vulnerabilities in OpenClaw. DeepTrap formulates adversarial context manipulation as a black-box trajectory-level optimization problem that balances risk realization, benign-task preservation, and stealth. It combines risk-conditioned evaluation, multi-objective trajectory scoring, reward-guided beam search, and reflection-based deep probing to identify high-value compromised contexts. We construct a 42-case benchmark spanning six vulnerability classes and seven operational scenarios, and evaluate nine target models using attack and utility grading scores. Results show that contextual compromise can induce substantial unsafe behavior while preserving user-facing task completion, demonstrating that final-response evaluation is insufficient. The findings highlight the need for execution-centric security evaluation of agentic AI systems. Our code is released at: https://github.com/ZJUICSR/DeepTrap
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。