为自主大模型代理设计分层安全监控系统，防止恶意技能造成数据泄露。
ClawSentry: A Progressive Multi-Tier Security Monitor for Safeguarding Autonomous LLM Agents
- 构建四层级风险监控机制，覆盖技能引入到执行后全过程
- 在真实测试中将恶意行为识别率从39.55%降至2.61%
- 支持多平台框架且不修改原代理代码，适合部署于生产环境
随着大语言模型代理从对话转向执行代码、读取本地文件和调用外部工具，单个被恶意技能劫持的代理可能引发数据外泄、权限提升或连锁攻击。我们提出代理风险具有渐进性，可发生在控制循环的四个环节：技能准入、调用意图、执行效果与行动后果；而危险目标可能通过不同形式、工具或对话轮次反复出现。现有防护措施通常局限于单一生命周期边界或单次调用。基于此威胁模型，我们提出ClawSentry——一个开源、框架无关的代理运行时安全监督网关。在技能包首次执行前，先通过确定性证据底限进行审计（FSPR），未决问题交由有限读取的代理评审（环节A）。运行时采用三级渐进式决策引擎：确定性L1层、规则锚定的L2语义审查层、只读的L3证据搜索代理，仅对残留歧义进行上下文审查；会话级反绕过机制识别工具切换和重述尝试（环节B-C）；事后路径将高危证据非回溯式注入后续审查（环节D）。Agent Harness Protocol（AHP）抽象使同一策略适用于Codex、Claude Code、Kimi CLI和Gemini CLI，无需修改代理内部结构。在SkillInject测试中，使用Codex/GPT-5.4时，上下文相关恶意行为识别率（ASR）从39.55%降至2.61%，上下文正确响应率（TSR）仅从83.78%微降至83.05%。在全技能安全基准上，五个工作代理的无保护状态中ASR为33.5%-49.7%，启用ClawSentry后降至9.09%-15.03%，清洁技能的总体正确响应率仍保持在98.7%。
原文摘要 · Abstract (English)
As large language model (LLM) agents move from conversation to executing code, reading local files, and orchestrating external tools, a single agent hijacked by a malicious third-party skill can cause data exfiltration, privilege escalation, or cascading compromise. We argue that agentic risk is progressive: it can enter at four loci of the agent control loop--skill admission, invocation-time intent, execution-time effect, and post-action consequence--while a denied dangerous objective can reappear across surface forms, tools, or turns; existing safeguards are typically local to one lifecycle boundary or one call. Guided by this threat model, we present ClawSentry, an open-source, framework-agnostic security supervision gateway for agent runtimes. Before a skill package is ever executed, First-use Skill Package Review (FSPR) audits it under a deterministic evidence floor, escalating unresolved cases to bounded read-only agentic review (locus A). At runtime, a three-tier progressive decision engine--a deterministic L1 layer, a rule-anchored L2 semantic reviewer, and a read-only L3 evidence-seeking agent--spends contextual review only on the residual ambiguity, while a session-level anti-bypass mechanism recognizes tool-switching and rephrased retries (loci B--C); a post-action path feeds high-severity evidence non-retroactively into later review (locus D). An Agent Harness Protocol (AHP) abstraction applies one policy across Codex, Claude Code, Kimi CLI, and Gemini CLI without modifying agent internals. On SkillInject with Codex/GPT-5.4, contextual ASR falls from 39.55% to 2.61% while contextual TSR moves only from 83.78% to 83.05%. Across five Work Agents on the full SkillsSafety benchmark, ClawSentry confines ASR to 9.09--15.03% from 33.5--49.7% unprotected, and aggregate TSR on clean skills remains 98.7%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。