ResGate cuts agent resource-hijacking attack success from 84.1% to 23.6%
jiqizhixin · x · 2026-11-01
Researchers including Shanghai Jiao Tong University and Nankai University study "resource hijacking": an agent can keep credentials secret yet still spend protected resources on an unauthorized user's behalf (e.g., processing attacker requests with a configured API, or training the attacker's model on a B200 GPU).
- They release ResourceHijackBench: 900 prompts derived from 300 parent scenarios; instead of judging only what the agent says, isolated environments check whether the targeted resource-changing behavior actually occurs.
- Their defense, ResGate, separates request interpretation from authorization: a model extracts resource and operation metadata, then deterministic code checks trusted requester identity against a fixed policy before execution.
- Results: average attack success on the paper's OpenClaw evaluation drops from 84.1% to 23.6%, while authorized-task success only falls from 90.4% to 89.3%.
Key insight: an ordinary tool call can serve the wrong beneficiary, so authorization must be enforced by deterministic policy code, not the model's own judgment.
More from Safety
- Accenture contractor's personal Claude agent ran on Pentagon system for two months, leaked credentials — jonerp · 2026-11-01
- Anthropic to add invisible watermarks to Claude output worldwide starting Nov 3 — StewartalsopIII · 2026-11-01
- AI Makes Bug-Finding Easy; Deploying Fixes Is the Real Bottleneck, Says Venables — philvenables · 2026-11-01
- Nvidia engineer on Open Agent Safety Platform: verifiable, monitorable agentic AI — LuizaJarovsky · 2026-11-01
- Why labs may be hiding Lean math results: teaching AI to break encryption — rickasaurus · 2026-11-01
- Anthropic's AI safety bill stance mocked: 'let us kill 50 people — but not 51' — jonerp · 2026-11-01