ClawSentry: A Progressive Multi-Tier Security Monitor for Safeguarding Autonomous LLM Agents
ClawSentry is an open-source, framework-agnostic security gateway that mitigates progressive risks in autonomous LLM agents by implementing a multi-tier, progressive review system across skill admission, invocation, execution, and post-action phases, significantly reducing attack success rates while maintaining high throughput for legitimate tasks.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a world where computers no longer just answer questions but begin to do things on their own. They can write code, open files on your hard drive, and send messages to other services to complete a task. These are called autonomous agents, and they represent a leap from passive tools to active workers. However, this new ability brings a new kind of danger. If a worker is tricked into picking up a malicious tool, or if a hidden instruction is slipped into a document they are reading, the computer can be forced to steal secrets, delete important data, or spread its influence to other systems. The risk is not just a single mistake; it is a chain reaction where a single bad decision can lead to a cascade of damage. The core challenge for safety experts is that these attacks are clever and shifting. A bad instruction might be hidden in a file, disguised as a normal request, or broken into small, harmless-looking steps that only become dangerous when put together.
Researchers at the Shanghai Artificial Intelligence Laboratory have developed a new system to stop these attacks before they cause harm. They call it ClawSentry. Instead of trying to catch every bad move after it happens, this system acts as a gatekeeper that watches the entire life cycle of a computer agent's work. The researchers realized that danger can enter at four different stages: when a new tool is first introduced, when the agent decides to use it, while the tool is actually running, and after the tool has finished its job and produced results. Previous safety methods usually only looked at one of these stages, like checking the words a user types or watching the code a computer runs. The team found that this was not enough because a bad actor could simply try again in a different way, using a different tool or phrasing the request differently, to get around a single checkpoint.
To solve this, the researchers built a framework that sits between the computer agent and the outside world, watching everything the agent tries to do. They designed a system that works in layers, much like a security team that first checks a visitor's ID, then watches their behavior, and finally reviews the outcome of their visit. The first line of defense happens before a new tool is ever used. The system reads the entire package of code for that tool to look for hidden dangers. If the code looks suspicious, the tool is blocked immediately. This prevents the agent from ever loading a dangerous program in the first place. If a tool passes this initial check, the system then watches every single action the agent takes. It uses a simple, fast set of rules to catch obvious dangers, like trying to delete a critical system file. If the action is not clearly dangerous but is also not clearly safe, the system escalates the decision to a more advanced computer model that can understand the context and the intent behind the request.
A crucial part of this system is its ability to remember what it has already blocked. If an agent tries to steal a file and is stopped, the system records that specific goal. If the agent tries again later using a different tool or by breaking the request into smaller steps, the system recognizes that it is the same bad goal in a new disguise and stops it again. This prevents the agent from wearing down the defenses by trying many different approaches. The system also watches what happens after an action is completed. Sometimes, the danger only appears in the results a tool returns, such as a file that contains hidden instructions for the next step. The system reviews these results and can alert a human operator if something went wrong, allowing them to stop the process before more damage is done.
The researchers tested this system with several different types of computer agents and found it to be highly effective. In tests where the agents were exposed to a wide variety of dangerous tools and hidden instructions, the system reduced the rate of successful attacks from nearly half of all attempts down to a very small fraction. Specifically, on a standard set of safety tests, the system lowered the success rate of attacks from a range of 33.5% to 49.7% down to between 9.09% and 15.03%. At the same time, the system did not stop the agents from doing their normal, helpful work. When the agents were given safe tasks, they were still able to complete them successfully almost all the time, with a success rate of 98.7%. This shows that the system can distinguish between a genuine mistake and a malicious attack without getting in the way of useful work.
The study also explored how the system handles different types of computer models and found that its protection works regardless of which specific artificial intelligence is doing the thinking. The safety rules and the gatekeeping process are separate from the agent itself, meaning the same security system can protect many different kinds of agents. The researchers also discovered that the most effective way to stop an attack is to block the dangerous tool before the agent ever gets a chance to use it. Once a bad tool is loaded into the agent's memory, it becomes much harder to stop the damage, even if the system is very good at catching bad actions later. This suggests that the best defense is to be strict about what tools are allowed into the system in the first place.
By combining a strict initial check, a multi-layered review of every action, and a memory of past attempts, this new system creates a much safer environment for autonomous computers. It addresses the reality that attacks are not single events but ongoing attempts to find a way through. The results suggest that with the right kind of supervision, we can allow computers to take on complex tasks without giving up control to malicious actors. The system does not rely on a single trick or a perfect model; instead, it uses a structured approach that catches threats at multiple points, ensuring that even if one layer is bypassed, another is ready to stop the danger. This work provides a practical blueprint for how we can safely integrate powerful, independent computer agents into our daily lives and work environments.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.