SafeClawArena benchmarks real-world security risks in agent systems
新智元 · wechat · 2026-07-20
This long-form Chinese article summarizes SafeClawArena, a benchmark from UIUC, UC Berkeley and collaborators that evaluates the real system-level security of “Claw-like” AI agents that live on users’ machines and can read files, send emails, connect cloud storage, and install software.
What the paper studies
The authors argue that existing agent safety tests focus too much on the model layer, while the real danger comes from the whole system: skills, plugins, memory, logs, permissions, and cross-component data flow. They map agent components to classic computer-system concepts and derive four attack surfaces:
- SSI: skill supply-chain integrity
- PSE: persistent-state exploitation
- CDF: cross-boundary data flow
- IPI: indirect prompt injection
How the benchmark works
- 406 adversarial tasks across 24 subcategories
- Tested on 3 real platforms and 5 frontier models
- Uses unique canary credentials to detect leaks deterministically
- Runs in fresh Docker containers with no real accounts or network traffic
- Includes a simulated Google Workspace stack for safe leakage measurement
Main findings
- Overall attack success rates ranged from about 20% to nearly 70% across platform-model pairs.
- Malicious plugins were 100% effective on un-hardened platforms, regardless of model, because they bypass the model entirely.
- Stronger models were not always safer; in some cases, more obedient models were easier to exploit.
- Hardening one channel often shifts the leak to another channel rather than eliminating it.
- Platform defenses and model alignment both matter; neither can replace the other.
Takeaway
The paper argues that agent security needs defense in depth, similar to traditional operating systems: skill signing, memory integrity, credential vaults, and action authorization are highlighted as missing pieces. SafeClawArena is positioned as a reusable yardstick for measuring which safety principles a real agent system violates and what to harden first.
More from Safety
- Study: AI reviewing AI misses most reward hacking; best models miss 25%+ of hacks — ronbodkin · 2026-10-26
- Fangcun AI, China's first independent frontier AI safety lab, launches with DeepSeek eval report — JacquesThibs · 2026-10-26
- ESR on the Bugpocalypse: locking down frontier models only hands the game to Chinese open weights — colinmcnamara · 2026-10-26
- OpenCode breach exposed AI API keys of 1.4% of Console users — thione · 2026-10-26
- DHS orders DeepSeek products removed from US civilian agency systems — thione · 2026-10-26
- One hacker breached 100+ company websites using AI, scope unknown — thione · 2026-10-26