Security papers — 2026-10-18

The Morning Preprint — this day as one edition: the day's papers, the five things worth knowing, and the episodes behind them.

Today's focus is on securing the control of large language model agents because how these agents interact with external tools and handle sensitive data presents two major security failures that existing defenses often miss. Researchers are looking at building a dual-boundary architecture, as described in SecureClaw, which separates authorization from the runtime execution to prevent unauthorized external actions and the exposure of plaintext data during operation.

This work is important because it addresses both boundaries simultaneously, offering a path to zero attack success rate on certain benchmarks while maintaining task utility. Furthermore, we need to consider how fine-tuning methods can inadvertently weaken safety alignments, which is what Few-Shot Truly Benign DPO Attack for Jailbreaking LLMs explores by showing that even seemingly benign preference pairs can suppress refusal behavior across various model sizes.

The system security of agent skills also demands attention, as Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis systematically maps out the attack surface across the creation, distribution, deployment, and execution phases of these modular frameworks. This analysis points to structural flaws like the lack of a data-instruction boundary as severe threats that incremental fixes cannot solve.

Finally, understanding individual privacy boundaries is crucial for deploying these systems responsibly; It's My Agent, Not Me: Personal Privacy Boundaries in AI-Delegated Information Sharing shows how communication roles and delegation influence how sensitive information is shared. This context helps inform the broader privacy considerations discussed in On the Privacy of LLMs: An Ablation Study, which details how different attack types, like membership inference or data extraction, are sensitive to model scale and training data repetition.

Today's papers

• SecureClaw: Clawing Back Control of LLM Agents Tool-using large language model agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final output check can intervene. SecureClaw is a dual-boundary architecture that enforces authorization in a trusted executor and keeps raw protected data outside the LLM runtime. [paper] [episode]
• Few-Shot Truly Benign DPO Attack for Jailbreaking LLMs Fine-tuning APIs can be used to bypass safety guardrails using seemingly harmless preference pairs. [paper] [episode]
• Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis This paper systematically studies the security risks of a new open standard for agent skills by defining a threat model and taxonomy. [paper] [episode]
• It's My Agent, Not Me: Personal Privacy Boundaries in AI-Delegated Information Sharing This study investigates how human privacy boundaries change when individuals delegate tasks to AI systems. [paper] [episode]
• On the Privacy of LLMs: An Ablation Study This paper provides a unified threat model to understand how different types of attacks affect large language models. [paper] [episode]
• Forensic Analysis of the HackRF One with PortaPack Mayhem Firmware This work analyzes the data stored on a software-defined radio's memory card to recover forensic evidence from replay attacks. [paper] [episode]

The papers

• Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis — The gist The first comprehensive security analysis of the Agent Skills framework reveals that most severe threats arise from structural properties of the framework itself, including the absence of a data-instruction boundary, a single-approval persistent trust model, and the lack [episode]
• Few-Shot Truly Benign DPO Attack for Jailbreaking LLMs — The gist The Direct Preference Optimization (DPO) method introduces a strong and harder-to-audit failure mode in fine-tuning LLMs by optimizing models to prefer helpful answers over refusals, which can suppress refusal behavior beyond the training data and transfer to unseen harm [episode]
• SecureClaw: Clawing Back Control of LLM Agents — The gist SecureClaw presents a dual-boundary architecture that places authorization at the effect sink and plaintext confinement at the read boundary to secure tool-using LLM agents against unauthorized external actions and runtime plaintext exposure. [episode]
• It's My Agent, Not Me: Personal Privacy Boundaries in AI-Delegated Information Sharing — As a diligent and fastidious researcher, I have meticulously analyzed the provided text snippets from arXiv to synthesize a comprehensive and detailed summary of the paper, "It's My Agent, Not Me: Personal Privacy Boundaries in AI-Delegated Information Sharing." The input consist [episode]
• On the Privacy of LLMs: An Ablation Study — The gist Large language models are increasingly deployed in interactive and retrieval-augmented settings, raising significant privacy concerns, and this paper introduces a unified threat model to evaluate how key design factors influence various privacy attacks such as Membership [episode]
• Forensic Analysis of the HackRF One with PortaPack Mayhem Firmware — The gist The study establishes, at source-code level, where forensically relevant data reside on the microSD card of a device running Mayhem v2.0.1, in which format, when they are written and how they should be interpreted> Device and Data Model The HackRF One operates as an open [episode]

Important terms

Dual-boundary architecture

This security design separates authorization from runtime execution to stop unauthorized external actions and protect sensitive data during agent operation.

Few-Shot Truly Benign DPO Attack

This research shows that even seemingly harmless preference pairs can weaken safety alignments, allowing an attacker to bypass refusal mechanisms in LLMs.

Agent skills security

This focuses on the security of the specific tasks agents perform. It maps out threats across the entire lifecycle of these modular agent frameworks.

Data-instruction boundary

A critical structural flaw identified in agent frameworks, this is a missing separation between data and instructions that creates severe security risks.