ASEval: Automated Trajectory-Level Security Testing for Autonomous Agents

2026-05-07 · Source: cs.SE updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Expert, extended

Summary

ASEval introduces A3S-Bench, a comprehensive security benchmark designed to assess vulnerabilities in LLM-based autonomous agent systems like OpenClaw. This benchmark addresses the expanded attack surface of stateful, multi-turn interactions by proposing a novel multi-dimensional evasion framework. It defines three stealthy attack vectors: Temporal evasion, fragmenting payloads across turns; Spatial evasion, concealing payloads in external artifacts; and Semantic evasion, obscuring malicious intent with benign context. A3S-Bench comprises 2,254 real-world agent execution trajectories, including 1,512 adversarial cases across 34 attack techniques and 20 threat scenarios. Evaluating 10 mainstream LLM backbones with a standard agent framework, the study found that the evasion framework increased the average risk trigger rate from 28.3% to 52.6%, exposing systemic architectural vulnerabilities.

Key takeaway

For AI Security Engineers deploying LLM-based autonomous agents with system-level privileges, recognize that current defenses are inadequate against sophisticated, multi-dimensional evasion attacks. Your security posture must evolve beyond single-turn prompt injection mitigations. Prioritize implementing cross-turn intent tracking, robust provenance tracking for persistent state, and action-grounded security evaluations to detect stealthy threats like fragmented payloads or poisoned artifacts.

Key insights

Autonomous agents exhibit systemic vulnerabilities to multi-dimensional evasion attacks, significantly increasing risk trigger rates.

Principles

• Security analyses must extend beyond single-turn, stateless behaviors.
• Malicious intent can be fragmented across turns or hidden in trusted artifacts.
• Agent-specific risks like memory tampering require tailored defenses.

Method

A3S-Bench uses a three-stage automated pipeline: seed generation for realistic conversations, seed curation for quality, and payload injection with diverse attack techniques and difficulty levels.

In practice

• Evaluate agent security using multi-turn injection and action-grounded scoring.
• Prioritize defenses against sandbox escape and malicious skill injection.

Topics

• Autonomous Agents
• LLM Security
• Prompt Injection
• Security Benchmarking
• Evasion Attacks
• OpenClaw

Code references

• antgroup/Agent3Sigma-Stage
• MoonshotAI/Kimi-K2.5
• openclaw/openclaw

Best for: AI Architect, AI Engineer, Research Scientist, AI Security Engineer, AI Scientist, Machine Learning Engineer

Related on AIssential

• SeClaw: Spec-Driven Security Task Synthesis for Evaluating Autonomous Agents — SeClaw systematically evaluates autonomous LLM agent security by synthesizing tasks from risk specifications and assessing execution trajectories.
• Beyond Prompt Injection — AI agent security must shift from input filtering to deterministic action validation.
• Breaking: Autonomous Agents are a Shitshow — Autonomous agents exhibit widespread vulnerabilities to tool-chaining, goal drift, and memory poisoning attacks.
• The Ethics of Autonomous AI Agents for Offensive Security — Autonomous AI agents in offensive security create novel indeterminacies, challenging existing ethical frameworks and industrializing offensive capabilities to attackers' short-term advantage.
• AI Snitches Get Glitches: Towards Evading Agentic Surveillance — AI agents pose a significant surveillance risk, easily implementable, yet prompt injection techniques offer effective evasion strategies.
• GroundEval: A Deterministic Replacement for LLM-as-Judge in Stateful Agent Evaluation — GroundEval deterministically verifies agent evidence use, exposing flaws LLM-as-judge misses, by analyzing full trajectories.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.SE updates on arXiv.org.