Securing Autonomous LLM Agents Against Threats

Summary & Methodology Analysis

ClawSentry addresses the security lifecycle of autonomous agents by implementing a multi-tier monitor that sits alongside existing agent harnesses. It uses an Agent Harness Protocol (AHP) to abstract event streams, enabling the application of consistent security policies across diverse environments like Codex, Claude Code, Kimi CLI, and Gemini CLI. This approach avoids modifying agent internals, allowing for integration without disrupting the underlying codebase of the agent infrastructure. By processing events through deterministic and semantic analyzers, the system establishes an envelope of safe execution behavior that persists across session-level interactions to catch rephrased retry attacks. Performance results demonstrate that this layered approach significantly reduces exploit success while preserving the utility of the agent for intended tasks, as shown by the high aggregate TSR of 98.7 percent on clean skills during evaluation on the SkillsSafety benchmark. On the SkillInject benchmark, contextual ASR for Codex and GPT-5.4 dropped from 39.55 percent to 2.61 percent, while keeping contextual TSR nearly stable at 83.05 percent compared to the original 83.78 percent. Despite these gains, the architecture is limited by its inability to address threats that originate outside of the defined lifecycle boundaries, such as host OS compromise or base model weight poisoning, which refers to the injection of malicious data into the model parameters during the training or fine-tuning phase. Additionally, the system provides only reporting at the post-action stage because current agent harnesses lack the necessary hooks to retract or rewrite tool outputs once execution has completed.