Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?

arXiv:2607.17986 · cs.CR, cs.AI, cs.CL, cs.MA · Submitted 2026-07-20 · Read on arXiv

cs.CR, cs.AI, cs.CL, cs.MA

Submitted: 2026-07-20

Updated: 2026-09-17

Comments: 21 pages, 4 figures

Code: https://github.com/nousresearch/hermesagent

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Trace — 51× in this paper · explained in 2 episodes
• AI Agents — 19× in this paper · explained in 2 episodes
• Core — 16× in this paper · explained in 2 episodes
• Agentic AI — 9× in this paper · explained in 1 episode
• Benchmark — 8× in this paper · explained in 2 episodes
• Ablation — 7× in this paper · explained in 1 episode
• Generative AI — 6× in this paper · explained in 2 episodes
• Aggregation — 5× in this paper · explained in 1 episode
• Benchmarking — 5× in this paper · explained in 4 episodes
• RAG — 4× in this paper · explained in 3 episodes
• Human-in-the-Loop — 3× in this paper · explained in 3 episodes
• Score Function — 3× in this paper · explained in 4 episodes
• Abstraction — 2× in this paper · explained in 1 episode
• Adaptation — 2× in this paper · explained in 1 episode
• Adam — 1× in this paper · explained in 2 episodes
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Adversarial Prompting — 1× in this paper · explained in 1 episode
• Adversarial Robustness — 1× in this paper · explained in 3 episodes
• Agent Memory — 1× in this paper · explained in 1 episode
• Agent Security Bench — 1× in this paper
• Agentic AI systems — 1× in this paper · explained in 1 episode
• Agentic Coding — 1× in this paper · explained in 1 episode
• Agentic System — 1× in this paper · explained in 2 episodes
• Calibration — 1× in this paper · explained in 7 episodes
• Consistency — 1× in this paper · explained in 3 episodes
• Entanglement — 1× in this paper · explained in 4 episodes
• Fidelity — 1× in this paper · explained in 2 episodes
• Generalization — 1× in this paper · explained in 13 episodes
• LLM-as-a-Judge — 1× in this paper · explained in 3 episodes
• Large Language Models (LLMs) — 1× in this paper · explained in 6 episodes
• Provenance — 1× in this paper · explained in 4 episodes
• Reasoning Traces — 1× in this paper · explained in 3 episodes
• Robustness — 1× in this paper · explained in 5 episodes
• True Positive Rate — 1× in this paper
• Verification — 1× in this paper · explained in 2 episodes

Sources

• Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework
• Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• Energy-based Out-of-distribution Detection
• Formalizing and Benchmarking Prompt Injection Attacks and Defenses
• "Your AI, My Shell": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors
• VeriGuard: Enhancing LLM Agent Safety via Verified Code Generation
• ConfusedPilot: Confused Deputy Risks in RAG-based LLMs
• Progent: Securing AI Agents with Privilege Control
• AgentGuardian: Learning Access Control Policies to Govern AI Agent Behavior
• The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanism
• Systems Security Foundations for Agentic Computing
• Securing AI Agents with Information-Flow Control
• Defeating Prompt Injections by Design
• Memory Injection Attacks on LLM Agents via Query-Only Interaction
• WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks
• Memory Poisoning Attack and Defense on Memory Based LLM-Agents
• AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents
• IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems
• GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs