SafeClawArena benchmarks real-world security risks in agent systems

新智元 · wechat · 2026-07-20

This long-form Chinese article summarizes SafeClawArena, a benchmark from UIUC, UC Berkeley and collaborators that evaluates the real system-level security of “Claw-like” AI agents that live on users’ machines and can read files, send emails, connect cloud storage, and install software.

What the paper studies

The authors argue that existing agent safety tests focus too much on the model layer, while the real danger comes from the whole system: skills, plugins, memory, logs, permissions, and cross-component data flow. They map agent components to classic computer-system concepts and derive four attack surfaces:

SSI: skill supply-chain integrity
PSE: persistent-state exploitation
CDF: cross-boundary data flow
IPI: indirect prompt injection

How the benchmark works

406 adversarial tasks across 24 subcategories
Tested on 3 real platforms and 5 frontier models
Uses unique canary credentials to detect leaks deterministically
Runs in fresh Docker containers with no real accounts or network traffic
Includes a simulated Google Workspace stack for safe leakage measurement

Main findings

Overall attack success rates ranged from about 20% to nearly 70% across platform-model pairs.
Malicious plugins were 100% effective on un-hardened platforms, regardless of model, because they bypass the model entirely.
Stronger models were not always safer; in some cases, more obedient models were easier to exploit.
Hardening one channel often shifts the leak to another channel rather than eliminating it.
Platform defenses and model alignment both matter; neither can replace the other.

Takeaway

The paper argues that agent security needs defense in depth, similar to traditional operating systems: skill signing, memory integrity, credential vaults, and action authorization are highlighted as missing pieces. SafeClawArena is positioned as a reusable yardstick for measuring which safety principles a real agent system violates and what to harden first.

Original post →

SafeClawArena benchmarks real-world security risks in agent systems

More from Safety