mlsanityData to 7 Oct 2026

DualView: Preventing Indirect Prompt Injection in Personal AI Agents

arXiv 2607.03821 ↗First posted 4 Jul 2026cs.CR cs.AIcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

Personal AI agents that run on the user's local machine automate daily tasks including web search, email, and file management. Their access to computer resources, including the network, file system, and shell, exposes them to indirect prompt injection (IPI) attacks. Prior Dual LLM defenses block IPI by replacing untrusted data with symbols that the agent can reference but not read. However, they track untrusted data only inside the agent's context, so when the agent saves and later rereads untrusted data, that data, possibly an attacker's prompt, can return as trusted data rather than as a symbol, which we call stored IPI. Operating on the user's real environment is what makes agents like OpenClaw practical, and is exactly why a defense that ignores it is incomplete. Preserving symbols in such an environment is hard, because humans and programs need original data. We present DualView, which extends untrusted data tracking from the agent's context to the user's environment, including the file system, shell, network, and other agents, by giving each channel two views. In AgentView, the agent sees untrusted data as symbols even after writing it out and reading it back, blocking stored IPI, while HumanView preserves original data for humans and tools. DualView routes each tool call to the right view and synchronizes data across the two views. DualView deploys as an OpenClaw plugin using only tool hooks, without changing the agent's tool-call logic or tool implementations. DualView deterministically prevents instructions in untrusted data from directly steering the agent's tool calls; this guarantee does not depend on recognizing the evaluated attack templates. In our evaluation on an IPI benchmark and PinchBench, DualView blocked every tested IPI attack, including stored IPI. On PinchBench, its utility drop was within 1.8 to 6.4 points.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 47 of its 78 references that are in the map. First posted on arXiv 4 Jul 2026.

Builds on

47 of 78 references.

Closest ancestors · 23

Same direction, newest first

  1. 2026AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents13 Jun
  2. 2026CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents14 Jan
  3. 2025ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data10 Dec
  4. 2025Attention is All You Need to Defend Against Indirect Prompt Injection Attacks in LLMs9 Dec
  5. 2025DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents13 Jun
  6. 2025LlamaFirewall: An open source guardrail system for building secure AI agents6 May
  7. 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
  8. 2025SAGA: A Security Architecture for Governing AI Agentic Systems27 Apr
  9. 2025Les Dissonances: Cross-Tool Harvesting and Polluting in Pool-of-Tools Empowered LLM Agents4 Apr
  10. 2025ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning26 Mar
  11. 2025Defeating Prompt Injections by Design24 Mar
  12. 2025AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents24 Mar
11 more
  1. 2025Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents17 Mar
  2. 2025Memory Injection Attacks on LLM Agents via Query-Only Interaction5 Mar
  3. 2025RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage13 Feb
  4. 2025MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents7 Feb
  5. 2024The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents21 Dec
  6. 2024Imprompter: Tricking LLM Agents into Improper Tool Use19 Oct
  7. 2024Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems9 Oct
  8. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
  9. 2024AirGapAgent: Protecting Privacy-Conscious Conversational Agents8 May
  10. 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems8 Mar
  11. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar

Other references · 24

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  2. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  4. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  5. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  6. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  7. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
  8. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
  9. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
  10. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 325
  11. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
  12. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 237
12 more
  1. 2024Defending Against Indirect Prompt Injection Attacks With Spotlightingcited by 233
  2. 2024SecAlign: Defending Against Prompt Injection with Preference Optimizationcited by 179
  3. 2025DataSentinel: A Game-Theoretic Detection of Prompt Injection Attackscited by 124
  4. 2024Optimization-based Prompt Injection Attack to LLM-as-a-Judgecited by 123
  5. 2025Securing AI Agents with Information-Flow Controlcited by 108
  6. 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspectivecited by 91
  7. 2025Contextual Agent Security: A Policy for Every Purposecited by 55
  8. 2025ACE: A Security Architecture for LLM-Integrated App Systemscited by 52
  9. 2023Demystifying RCE Vulnerabilities in LLM-Integrated Appscited by 35
  10. 2024Permissive Information-Flow Analysis for Large Language Modelscited by 22
  11. 2026Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systemscited by 16
  12. 2026Optimizing Agent Planning for Security and Autonomycited by 10

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Agent Data Injection Attacks are Realistic Threats to AI Agents
  2. 2026Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs
  3. 2026Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks
  4. 2025Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?
  5. 2026Silent Failures in Agentic Security Evaluation: A Validated Harness for Tool-Call Mediation Under Indirect Prompt Injection
  6. 2026CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution
  7. 2026SIR: Self-improving Red-teaming for Compute Use Agents
  8. 2025Preventing Prompt Injection with Type-Directed Privilege Separation