SafeClawArena benchmarks real-world security risks in agent systems
新智元 · wechat · 2026-07-20
This long-form Chinese article summarizes SafeClawArena, a benchmark from UIUC, UC Berkeley and collaborators that evaluates the real system-level security of “Claw-like” AI agents that live on users’ machines and can read files, send emails, connect cloud storage, and install software.
What the paper studies
The authors argue that existing agent safety tests focus too much on the model layer, while the real danger comes from the whole system: skills, plugins, memory, logs, permissions, and cross-component data flow. They map agent components to classic computer-system concepts and derive four attack surfaces:
- SSI: skill supply-chain integrity
- PSE: persistent-state exploitation
- CDF: cross-boundary data flow
- IPI: indirect prompt injection
How the benchmark works
- 406 adversarial tasks across 24 subcategories
- Tested on 3 real platforms and 5 frontier models
- Uses unique canary credentials to detect leaks deterministically
- Runs in fresh Docker containers with no real accounts or network traffic
- Includes a simulated Google Workspace stack for safe leakage measurement
Main findings
- Overall attack success rates ranged from about 20% to nearly 70% across platform-model pairs.
- Malicious plugins were 100% effective on un-hardened platforms, regardless of model, because they bypass the model entirely.
- Stronger models were not always safer; in some cases, more obedient models were easier to exploit.
- Hardening one channel often shifts the leak to another channel rather than eliminating it.
- Platform defenses and model alignment both matter; neither can replace the other.
Takeaway
The paper argues that agent security needs defense in depth, similar to traditional operating systems: skill signing, memory integrity, credential vaults, and action authorization are highlighted as missing pieces. SafeClawArena is positioned as a reusable yardstick for measuring which safety principles a real agent system violates and what to harden first.
More from Safety
- California creates standards for independent AI auditors to verify lab safety testing — VraserX · 2026-09-11
- Researcher questions AI safety eval firm, citing 'blatantly sloppy' security and monitoring — Kyrannio · 2026-09-11
- Class action accuses Anthropic of overselling Claude subscriptions with deceptive usage multipliers — The Decoder · 2026-09-11
- MD shows buying lab media requires background checks, calling AI bioweapon doom scenarios implausible — Ghost_Pilot_MD · 2026-09-11
- Spotify chatbot withstands 2023-era jailbreaks but happily writes song code — AaronBergman18 · 2026-09-11
- A 99%-real doctored photo fools detectors: the earring problem in visual forensics — henkvaness · 2026-09-11