mlsanityData to 14 Oct 2026

AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents

arXiv 2509.07764 ↗First posted 9 Sep 2025cs.CRcited by 27

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Large Language Models (LLMs) have been increasingly integrated into computer-use agents, which can autonomously operate tools on a user's computer to accomplish complex tasks. However, due to the inherently unstable and unpredictable nature of LLM outputs, they may issue unintended tool commands or incorrect inputs, leading to potentially harmful operations. Unlike traditional security risks stemming from insecure user prompts, tool execution results from LLM-driven decisions introduce new and unique security challenges. These vulnerabilities span across all components of a computer-use agent. To mitigate these risks, we propose AgentSentinel, an end-to-end, real-time defense framework designed to mitigate potential security threats on a user's computer. AgentSentinel intercepts all sensitive operations within agent-related services and halts execution until a comprehensive security audit is completed. Our security auditing mechanism introduces a novel inspection process that correlates the current task context with system traces generated during task execution. To thoroughly evaluate AgentSentinel, we present BadComputerUse, a benchmark consisting of 60 diverse attack scenarios across six attack categories. The benchmark demonstrates a 87% average attack success rate on four state-of-the-art LLMs. Our evaluation shows that AgentSentinel achieves an average defense success rate of 79.6%, significantly outperforming all baseline defenses.

Key facts. Cited by 27 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 22 of its 44 references that are in the map. First posted on arXiv 9 Sep 2025.

Builds on

22 of 44 references.

Closest ancestors · 6

Same direction, newest first

  1. 2025Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents17 Mar
  2. 2025AgentGuard: Repurposing Agentic Orchestrator for Safety Evaluation of Tool Orchestration13 Feb
  3. 2024Attacking Vision-Language Computer Agents via Pop-ups4 Nov
  4. 2024Imprompter: Tricking LLM Agents into Improper Tool Use19 Oct
  5. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
  6. 2024GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning13 Jun

Other references · 16

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  2. 2023A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questionscited by 1,601
  3. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  4. 2024OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environmentscited by 1,195
  5. 2023Poisoning Language Models During Instruction Tuningcited by 269
  6. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 258
  7. 2024OmniParser for Pure Vision Based GUI Agentcited by 198
  8. 2024PLeak: Prompt Leaking Attacks against Large Language Model Applicationscited by 127
  9. 2024AgentInstruct: Toward Generative Teaching with Agentic Flowscited by 89
  10. 2024We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMscited by 65
  11. 2024The Dawn of GUI Agent: A Preliminary Case Study with Claude 3.5 Computer Usecited by 63
  12. 2024Instruction Backdoor Attacks Against Customized LLMscited by 62
4 more
  1. 2024AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulationcited by 33
  2. 2025A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluationscited by 27
  3. 2024Privacy Preserving Prompt Engineering: A Surveycited by 25
  4. 2023LLM in the Shell: Generative Honeypotscited by 19

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 4; 2026: 23.

27 papers.

Sort:

By area:

  1. 2026AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purificationcited by 29
  2. 2026CaMeLs Can Use Computers Too: System-level Security for Computer Use Agentscited by 17
  3. 2025TraceAegis: Securing LLM-Based Agents via Hierarchical and Behavioral Anomaly Detectioncited by 12
  4. 2025Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systemscited by 12
  5. 2025Secure and Efficient Access Control for Computer-Use Agents via Context Spacecited by 11
  6. 2026The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanismcited by 9
  7. 2026When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agentscited by 8
  8. 2026Visual Confused Deputy: Exploiting and Defending Perception Failures in Computer-Using Agentscited by 7
  9. 2025Trusted AI Agents in the Cloudcited by 6
  10. 2026Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agentscited by 6
  11. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Surveycited by 4
  12. 2026How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcementcited by 4
15 more
  1. 2026Agents at Risk: How Users Unwittingly Undermine LLM Safetycited by 3
  2. 2026Untrusted Content Masking for Web Agents with Security Guaranteescited by 3
  3. 2026From Secure Agentic AI to Secure Agentic Web: Challenges, Threats, and Future Directionscited by 1
  4. 2026When Convenience Becomes Risk: A Semantic View of Under-Specification in Host-Acting Agentscited by 1
  5. 2026SeClaw: Spec-Driven Security Task Synthesis for Evaluating Autonomous Agentscited by 1
  6. 2026DoubtProbe: Black-Box Jailbreak Defense via Structural Verification and Semantic Auditingcited by 1
  7. 2026Prismata: Confining Cross-Site Prompt Injection in Web Agentscited by 1
  8. 2026Misleading the Planner through Deceptive Resumes: Registration-Time Injection in Centralized Multi-Agent Systemscited by 1
  9. 2026Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliabilitycited by 0
  10. 2026Provably Secure Agent Guardrailcited by 0
  11. 2026ACLE-MCP: Attested Capability Leases for Execution-Time Trust in Remote LLM Tool Usecited by 0
  12. 2026AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agentscited by 0
  13. 2026Architecting the Secure AI-SOC: A Neurosymbolic Framework for Pipeline Integrity and Threat Mitigationcited by 0
  14. 2026Securing Computer-Use Agents Against Branch Steering Attackscited by 0
  15. 2026Kairos: Transactional Security Enforcement at the System Boundary for LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization
  2. 2026ClawSentry: A Progressive Multi-Tier Security Monitor for Safeguarding Autonomous LLM Agents
  3. 2026Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats
  4. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
  5. 2026TraceGrant: A Contract-Governed Security Framework for the Task-Effect Lifecycle of Networked LLM Agents
  6. 2024AgentMonitor: A Plug-and-Play Framework for Predictive and Secure Multi-Agent Systems
  7. 2026AgentGuard: An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agent
  8. 2026Securing LLM Agents Need Intent-to-Execution Integrity