[Paper] ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection
Paper Overview
Research areas: cs.CR, cs.AI Authors: Wei Zhao, Zhe Li, Peixin Zhang, Jun Sun Published: 2026-04-13 arXiv: 2604.11790Summary
Tool-augmented Large Language Model (LLM) agents have demonstrated impressive capabilities in automating complex, multi-step real-world tasks, yet remain vulnerable to indirect prompt injection. Adversaries exploit this weakness by embedding malicious instructions within tool-returned content, which agents directly incorporate into their conversation history as trusted observations.This vulnerability manifests across three major attack channels:
1. Web and local content injection — malicious instructions hidden in web pages or local files retrieved by the agent. 2. MCP server injection — adversarial payloads delivered through MCP (Model Context Protocol) servers. 3. Skill file injection — malicious directives embedded in skill files consumed by the agent.
Proposed Solution
This paper proposes ClawGuard, a novel runtime security framework that:- Enforces user-confirmed rulesets at every tool call boundary;
- Transforms alignment-dependent, unreliable defenses into a deterministic, auditable mechanism;
- Intercepts adversarial tool calls before any real-world effects can occur.
Original Abstract (excerpt)
> Tool-augmented Large Language Model (LLM) agents have demonstrated impressive capabilities in automating complex, multi-step real-world tasks, yet remain vulnerable to indirect prompt injection. Adversaries exploit this weakness by embedding malicious instructions within tool-returned content, which agents directly incorporate into their conversation history as trusted observations.--- *Auto-collected on 2026-04-15*