Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing
Summary
Large language model (LLM) agents are increasingly used in high-performance computing (HPC) for tasks like monitoring Slurm jobs and diagnosing build failures. These agents often operate under user credentials, inheriting full access to files and schedulers. This creates a "hijacked authorized agent problem," where adversarial instructions in logs, tool descriptions, or shared files can redirect the agent beyond its assigned task, despite all commands being authenticated. While existing security studies address indirect prompt injection and tool misuse, they typically focus on web or enterprise environments, not HPC. HPC security excels at identity and isolation but lacks mechanisms to represent task intent. This paper defines the threat model for HPC, identifies attack surfaces including schedulers and shared storage, and proposes a research agenda and an empirical benchmark called TaskBound.
Key takeaway
For HPC Administrators or AI Security Engineers deploying LLM agents, recognize that traditional identity and isolation controls are insufficient. Your agents, operating under user credentials, are vulnerable to "hijacked authorized agent" attacks. These stem from indirect prompt injections in logs or shared files. You must implement task-specific intent verification. Consider new security paradigms beyond mere authentication to prevent unauthorized actions within authorized accounts.
Key insights
LLM agents in HPC, operating with user credentials, face a "hijacked authorized agent" risk due to a lack of task intent controls.
Principles
- LLM agents inheriting user credentials create new security vulnerabilities.
- HPC security controls prioritize identity and isolation over task intent.
- Adversarial instructions can redirect agents despite valid authentication.
Method
The paper defines the HPC threat model, identifies attack surfaces, and proposes an empirical benchmark, TaskBound, to evaluate agent security.
In practice
- Inspect logs and shared files for adversarial instructions.
- Evaluate agent behavior beyond authentication checks.
- Consider task-specific authorization mechanisms.
Topics
- LLM Agents
- HPC Security
- Indirect Prompt Injection
- Threat Modeling
- Slurm Scheduler
- TaskBound Benchmark
Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Scientist, AI Security Engineer, Research Scientist
Related on AIssential
See Counsel's argued verdicts on the open AI decisions leaders are weighing →
Editorial summary, takeaway, and curation by AIssential. Original article published by Artificial Intelligence.