mlsanityData to 14 Oct 2026

When Convenience Becomes Risk: A Semantic View of Under-Specification in Host-Acting Agents

arXiv 2603.21231 ↗First posted 22 Mar 2026cs.CR cs.AIcited by 1

Not on the map. Why?

Abstract (arXiv)

Host-acting agents promise a convenient interaction model in which users specify goals and the system determines how to realize them. We argue that this convenience introduces a distinct security problem: semantic under-specification in goal specification. User instructions are typically goal-oriented, yet they often leave process constraints, safety boundaries, persistence, and exposure insufficiently specified. As a result, the agent must complete missing execution semantics before acting, and this completion can produce risky host-side plans even when the user-stated goal is benign. In this paper, we develop a semantic threat model, present a taxonomy of semantic-induced risky completion patterns, and study the phenomenon through an OpenClaw-centered case study and execution-trace analysis. We further derive defense design principles for making execution boundaries explicit and constraining risky completion. These findings suggest that securing host-acting agents requires governing not only which actions are allowed at execution time, but also how goal-only instructions are translated into executable plans.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 18 of its 24 references that are in the map. First posted on arXiv 22 Mar 2026.

Builds on

18 of 24 references.

References · 18

  1. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 2,006
  2. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  3. 2024OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environmentscited by 1,195
  4. 2024AndroidWorld: A Dynamic Benchmarking Environment for Autonomous Agentscited by 468
  5. 2024WorkArena: How Capable Are Web Agents at Solving Common Knowledge Work Tasks?cited by 363
  6. 2025A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memorycited by 67
  7. 2026Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injectionscited by 48
  8. 2025OS Agents: A Survey on MLLM-based Agents for General Computing Devices Usecited by 35
  9. 2026Don't Let the Claw Grip Your Hand: A Security Analysis and Defense Framework for OpenClawcited by 29
  10. 2025AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agentscited by 27
  11. 2025A Survey on the Safety and Security Threats of Computer-Using Agents: JARVIS or Ultron?cited by 23
  12. 2026Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClawcited by 20
6 more
  1. 2026From Storage to Steering: Memory Control Flow Attacks on LLM Agentscited by 19
  2. 2026CaMeLs Can Use Computers Too: System-level Security for Computer Use Agentscited by 17
  3. 2025Secure and Efficient Access Control for Computer-Use Agents via Context Spacecited by 11
  4. 2026OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agentscited by 11
  5. 2026AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Managementcited by 10
  6. 2025Measuring Harmfulness of Computer-Using Agentscited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026RT-SHCUA: Real-Time Self-Hosted Computer-Use Agent for UAV Controlcited by 0