Agent Resource Hijacking: study finds 89.6% hijack rate on top LLMs as existing guardrails fail
机器之心 · wechat · 2026-10-22
A SJTU study defines a new attack surface, Agent Resource Hijacking: instead of stealing keys, attackers trick AI agents into spending the organization's GPUs and paid APIs on their behalf.
Key findings
- ResourceHijackBench: 300 parent attack scenarios, 900 prompts, behavior-level evaluation in isolated sandboxes.
- Hijack success rates: GPT-5.5 89.6%, DeepSeek-V4-Pro 84.1%, Qwen3.8-Max 82.8%, Gemini-3.5-Flash 70.0% — stronger models are more effective trojan horses.
- Direct credential requests succeed only 3.4–7.6%, but indirect hijacking jumps 62.4–84.0 points; alignment defends against leaks, not proxy execution.
- Framework-agnostic: 84.1% (OpenClaw) and 72.3% (Codex) average success.
- Real-world demos: an agent refusing to reveal its API key while still burning paid model quota; another fine-tuning on corporate GPUs via a Lark group chat.
ResGate defense
- Two-stage decoupling: a lightweight model extracts semantics (no security judgments), then deterministic code authorizes against a frozen YAML whitelist with default-deny and injected requestor identity.
- Attack success drops from 84.1% to 23.6% (12.7% for compute), while legitimate task success stays at 89.3%.
Takeaway: agent security must shift from content safety to asset governance — LLMs interpret intent, deterministic code holds the authority.
More from coding & agent
- Claude cut a 2.6-hour video export to 20 minutes — but only after being told to rebuild the server — byhewar · 2026-10-23
- 3 flight-booking rules my AI agent checks that I'd never do by hand — Efistoffeles · 2026-10-23
- OpenJet claims Qwen3.8-27B coding runs 1.9x faster than llama.cpp on one RTX 3090 — JeremyCMorgan · 2026-10-23
- Building an autonomous SEO agent in Hermes with three skills: programmatic pages, Keywords Everywhere, DataForSEO — EXM7777 · 2026-10-23
- Building a sports betting AI agent with onchain execution and human approval by default: architecture and lessons — Dry-Comfortable-2678 · 2026-10-23
- How do you audit AI agent decisions in regulated workflows? A field survey — Ok_Way_1993 · 2026-10-23