The threat model in the HPC setting is defined, attack surfaces created by schedulers, shared storage, multi-project accounts, and scientific workflows are identified, and where current controls fall short is examined.
Abstract
Large language model (LLM) agents are starting to take on routine work in high-performance computing (HPC), including monitoring Slurm jobs, diagnosing failed builds, inspecting simulation output, and coordinating scientific workflows. To do this work, an agent commonly acts under its user's credentials and inherits the user's access to files and the scheduler. This arrangement creates a failure mode that ordinary account-level controls do not capture. Adversarial instructions in a log, tool description, shared file, or peer-agent message may redirect the agent beyond the task the user assigned, even though every resulting command is authenticated and permitted for that account. We refer to this as the hijacked authorized agent problem. Existing agent-security studies explain relevant mechanisms, such as indirect prompt injection and tool misuse, but generally evaluate them in web, enterprise, or personal-assistant settings. HPC security, by contrast, has mature controls for identity and isolation but does not ordinarily represent the intent of a particular task. This paper defines the threat model in the HPC setting, identifies attack surfaces created by schedulers, shared storage, multi-project accounts, and scientific workflows, and examines where current controls fall short. It concludes with a research agenda and a plan for an empirical benchmark, TaskBound.
Agentic large language model (LLM) systems gain much of their practical value from tool calling, the capacity to invoke external functions such as web searches, database lookups, and application programming interface (API) requests during multi-step reasoning. Deploying such agents inside Trusted Execution Environments (TEEs) creates a structural tension: the confidential virtual machine (CVM) that protects user data must remain isolated from the host infrastructure, yet the agent must reach beyond the enclave boundary to be useful. The Model Context Protocol (MCP), which is now the main open standard for connecting LLM applications to external tools and data sources, was not designed with TEE constraints in mind, leaving three critical incompatibilities unresolved: transport mechanisms that expose user-derived parameters to untrusted hosts, dynamic capability discovery that violates pre-deployment transparency requirements, and authentication models misaligned with non-targetability guarantees. This paper presents Confidential MCP (C-MCP), a set of backward-compatible extensions to MCP that enable standardized, auditable tool calling within and across TEE boundaries. C-MCP introduces a three-zone enclave-partitioned server topology, a programmable Anonymization Transform Layer (ATL) with formal parameter classification and entropy bounds, and Attested Egress Policies (AEPs) that extend behavioral transparency from static binary attestation to constraints on verifiable runtime tool invocation. We analyze open-source LLM deployment challenges, including tool-calling information minimality, TEE inference overhead accumulation across agentic reasoning steps, and model supply chain integrity, and present concrete domain case studies in healthcare, legal practice, and financial services.
Ankur Aggarwal· International journal of com...· 0 citations
Large language model agents are increasingly connected to high-value resources such as computing infrastructure, credentials, usage budgets, identities, private knowledge, communication channels, and organizational workflows. Existing agent security research mainly studies attacks on instructions, data, and tool behaviors, while high-value resources accessible to agents have received much less attention as direct attack targets. We are the first to identify and systematically study agent resource hijacking, a security blind spot in which attackers induce agents to invoke, consume, transfer, or control high-value resources for their own goals without directly obtaining those resources or their credentials. To study this threat, we introduce ResourceHijackBench together with an automated pipeline for generating resource hijacking cases. We organize high-value agent resources into six categories and construct 300 attack scenarios with 900 attack prompts. Each case runs in an isolated local environment that records actual resource use, allowing attacks to be evaluated from agent behavior rather than text responses alone. Without additional defenses, OpenClaw reaches an average attack success rate of 84.06%. The attack remains effective across different model backends, with average success rates ranging from 69.98% to 89.58%. Existing defenses reduce part of the risk, but the strongest evaluated defense still leaves an average attack success rate of 55.11%. These results show that high-value resources accessible to agents form an important and previously overlooked attack surface, and that current agent defenses are not sufficient to protect them from resource hijacking.
Large Language Model (LLM)-based agents automate complex tasks by integrating external tools such as web browsers, e-mail clients, file readers, and APIs, but this same integration exposes them to indirect prompt injection (IPI) attacks, in which malicious instructions hidden in tool content hijack the agent. A central but often overlooked question is how defending against such attacks affects the LLM and its own task performance and computational efficiency. In this study, we design a comprehensive testbed and a layered defense, Spotlight-Guard, that combines spotlighting-based input isolation, an LLM detection-and-quarantine pipeline, and instruction integrity based on a Hash-based Message Authentication Code (HMAC) into a single framework, and we evaluate it jointly along two axes: security and LLM performance. Experiments on locally hosted 7B-class open-weight models (Qwen-2.5-7B, Mistral-7B, and DeepSeek-Coder) use Attack Success Rate (ASR) for security and benign-task success rate together with confusion-matrix-based metrics (precision, recall, and F1) for task performance, all with bootstrap 95% confidence intervals. Across a stratified, fixed-seed benchmark of 250 adversarial and 250 benign cases per configuration, the full system reduces the ASR from 36.0% to 17.2% while preserving a 97.2% benign-task success rate and raising the detection F1 from 0.749 to 0.892, demonstrating that strong protection need not degrade the model’s task performance. A component ablation isolates each layer’s contribution, an adaptive-attack evaluation confirms a low ASR (6.7%) under attacks crafted to target the pipeline, and an analysis of computational cost (model invocations per request) quantifies the efficiency overhead, characterizing the security–performance trade-off of layered defenses on open-weight LLMs.
Doygun Demirol, Murat Aydoğan· Applied Sciences· 0 citations
This paper presents OS-NLI, a privacy-respecting and modular natural-language interface for operating-system tasks. Unlike vendor-bound assistants, OS-NLI separates intent interpretation from command execution through an architecture comprising a web interface, a retrieval-augmented generation (RAG) layer, an API, an encrypted datastore, and a local execution worker. The LLM is treated as an untrusted suggestion engine: only pre-approved command templates with validated parameters may be queued, and execution requires explicit user confirmation. Sensitive data are protected with TLS in transit and AES-GCM at rest, while the threat model explicitly excludes hosts that are fully compromised at runtime. A prototype was implemented across Windows 11 and Fedora Linux. Evaluation on 60 natural-language queries shows strong task performance for application and utility identification, median answer latency of 1.4 s, and median post-confirmation command-execution latency of 285 ms. Preliminary malicious-input checks indicate that non-allowlisted outputs are rejected before execution. The current prototype still relies on vendor-hosted components for the UI host and LLM, so it is not yet end-to-end auditable; however, the architecture isolates these dependencies and provides a practical migration path to self-hosted deployment. These results support the feasibility of a safer, auditable design for naturallanguage OS interaction.
David Lawrence, Xiaoli Huan· International Conference on...· 0 citations
A four-layer taxonomy mapping 13 vulnerability types across perception, brain, action, and interaction layers is contributed, and seven open problems centered on containment are identified.
Md Jafrin Hossain, Mohammad Arif Hossain, Nirwan Ansari· 0 citations
AI agents issue tool calls on the basis of text they cannot verify, so any party who controls part of the context can forge the appearance of authority. I evaluate 15 contemporary language models against eight attack scenarios derived from a published corpus of real agent incidents and find that refusal varies from 100% down to 38% across fully evaluated models; the most expensive model refused only half of the attacks despite a twentyfold price spread. I present aiAuthZ, an authorization gateway that moves the safety decision off the agent's host. Before a tool call executes, the gateway verifies caller identity with a per-message HMAC-SHA256 signature bound to a single-use nonce and a timestamp window, and it evaluates a role-based and argument-level policy that the agent can neither read nor modify. Every decision joins a SHA-256 hash-chained audit log, and each accepted message yields an HMAC-authenticated QR receipt that achieves 94% mean verification across eight transmission channels, with zero forgeries accepted in 25 wrong-key trials. With the gateway in place, residual attack success falls to 0% for all 15 models at no more than 0.03 ms of added decision latency. On the AgentDojo banking suite, aiAuthZ blocks all seven attacker-directed tool calls the evaluated agents emit, at the cost of one legitimate first-time payment, while a spotlighting baseline allows two injections to succeed. Across nine in-scope case studies from the same incident corpus, aiAuthZ blocks nine of nine, against four of nine for a policy baseline without identity binding. The gateway does not prevent a model from being deceived; it prevents a deceived model from acting beyond the verified user's authority on every call routed through it. The implementation and all experiments are released at https://github.com/Sports-Vision-Inc/aiAuthZ.