Security papers — 2026-10-18

The Morning Preprint — this day as one edition: the day's papers, the five things worth knowing, and the episodes behind them.

Today's focus is on securing the control of large language model agents because how these agents interact with external tools and handle sensitive data presents two major security failures that existing defenses often miss. Researchers are looking at building a dual-boundary architecture, as described in SecureClaw, which separates authorization from the runtime execution to prevent unauthorized external actions and the exposure of plaintext data during operation.

This work is important because it addresses both boundaries simultaneously, offering a path to zero attack success rate on certain benchmarks while maintaining task utility. Furthermore, we need to consider how fine-tuning methods can inadvertently weaken safety alignments, which is what Few-Shot Truly Benign DPO Attack for Jailbreaking LLMs explores by showing that even seemingly benign preference pairs can suppress refusal behavior across various model sizes.

The system security of agent skills also demands attention, as Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis systematically maps out the attack surface across the creation, distribution, deployment, and execution phases of these modular frameworks. This analysis points to structural flaws like the lack of a data-instruction boundary as severe threats that incremental fixes cannot solve.

Finally, understanding individual privacy boundaries is crucial for deploying these systems responsibly; It's My Agent, Not Me: Personal Privacy Boundaries in AI-Delegated Information Sharing shows how communication roles and delegation influence how sensitive information is shared. This context helps inform the broader privacy considerations discussed in On the Privacy of LLMs: An Ablation Study, which details how different attack types, like membership inference or data extraction, are sensitive to model scale and training data repetition.

Today's papers

SecureClaw: Clawing Back Control of LLM Agents Tool-using large language model agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final output check can intervene. [paper] [episode]
Few-Shot Truly Benign DPO Attack for Jailbreaking LLMs Fine-tuning APIs can weaken safety alignment during fine-tuning, and this paper shows that even benign preference pairs in Direct Preference Optimization can lead to harmful outputs. [paper] [episode]
Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis This paper systematically studies the security of the Agent Skills framework by defining a threat model across its lifecycle and taxonomy. [paper] [episode]
It's My Agent, Not Me: Personal Privacy Boundaries in AI-Delegated Information Sharing This study explores how communication roles and AI delegation influence an individual's privacy boundaries when sharing information with an AI. [paper] [episode]
On the Privacy of LLMs: An Ablation Study This paper provides a unified threat model for LLM privacy by systematically studying how different attacks, like membership inference and backdoor attacks, are sensitive to various system factors. [paper] [episode]

The papers

Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis — The gist The first comprehensive security analysis of the Agent Skills framework reveals that most severe threats arise from structural properties of the framework itself, including the absence of a data-instruction boundary, a single-approval persistent trust model, and the lack [episode]
Few-Shot Truly Benign DPO Attack for Jailbreaking LLMs — The gist The Direct Preference Optimization (DPO) method introduces a strong and harder-to-audit failure mode in fine-tuning LLMs by optimizing models to prefer helpful answers over refusals, which can suppress refusal behavior beyond the training data and transfer to unseen harm [episode]
SecureClaw: Clawing Back Control of LLM Agents — The gist SecureClaw presents a dual-boundary architecture that places authorization at the effect sink and plaintext confinement at the read boundary to secure tool-using LLM agents against unauthorized external actions and runtime plaintext exposure. [episode]
It's My Agent, Not Me: Personal Privacy Boundaries in AI-Delegated Information Sharing — As a diligent and fastidious researcher, I have meticulously analyzed the provided text snippets from arXiv to synthesize a comprehensive and detailed summary of the paper, "It's My Agent, Not Me: Personal Privacy Boundaries in AI-Delegated Information Sharing." The input consist [episode]
On the Privacy of LLMs: An Ablation Study — The gist Large language models are increasingly deployed in interactive and retrieval-augmented settings, raising significant privacy concerns, and this paper introduces a unified threat model to evaluate how key design factors influence various privacy attacks such as Membership [episode]

Important terms

Dual-boundary architecture: A security design that separates authorization from runtime execution to stop unauthorized external actions and protect sensitive data during agent operation.
Few-Shot Truly Benign DPO Attack: Research showing that even seemingly harmless preference pairs in fine-tuning can weaken safety alignments, allowing an LLM to suppress its refusal behavior.
Agent skills security: Analyzing the entire lifecycle of modular agent frameworks—from creation to execution—to map out structural flaws like missing data-instruction boundaries.
Personal Privacy Boundaries: How the roles and delegation within an AI system affect who shares sensitive information, which is key for responsible deployment.