The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities

• URL: http://arxiv.org/abs/2607.05743v1
• Date: Tue, 07 Jul 2026 01:56:18 GMT
• Title: The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities
• Abstract summary: Papers on sandbox isolation, capability and access control, policy enforcement, time-of-check-to-time-of-use (TOCTOU) races, Model Context Protocol (MCP) threats, identity delegation, execution provenance, network egress control, and static analysis of agent-generated code are published independently and rarely cite one another.<n>We systematize 39 papers published between 2023 and 2026 into 17 categories, each verified directly against its source.<n>Reading across categories surfaces five cross-cutting gaps that no single paper addresses.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: AI coding agents now read repositories, call tools, and execute shell commands with limited human oversight, and a fast-growing body of work studies whether the execution layer around them is actually safe. That literature is scattered. Papers on sandbox isolation, capability and access control, policy enforcement, time-of-check-to-time-of-use (TOCTOU) races, Model Context Protocol (MCP) threats, identity delegation, execution provenance, network egress control, and static analysis of agent-generated code are published independently and rarely cite one another. We systematize 39 papers published between 2023 and 2026 into 17 categories, each verified directly against its source. The same verification protocol also confirms four disclosed, patched CVEs directly affecting production agent harnesses. Reading across categories surfaces five cross-cutting gaps that no single paper addresses. (1) Isolation architectures and capability models are almost never evaluated against one another on a shared benchmark. (2) Policy-enforcement studies report failure rates from 69% to 98% of real denylists, yet no isolation paper re-evaluates its own defense under that adversarial setting. (3) TOCTOU and MCP threats are analyzed as separate literatures despite both being instances of the same state-validation problem. (4) Every enforcement mechanism assumes an honest policy author, leaving policy-authoring error itself unaddressed. (5) Benign but out-of-scope agent actions occurring at rates up to 17.1% under realistic prompting are addressed by no access-control or capability paper in the corpus. Existing broader surveys of agentic AI security discuss sandboxing only as one item among many defenses, leaving execution security without a dedicated systematization. This paper is written to fill that gap. We conclude with a research agenda directed at the five gaps.

Related papers

• Zero-Knowledge Predicate Proofs Between AI Agents: A Measured, Cross-Protocol Gateway and the Source-Integrity Gap [0.0]
  Multi-agent AI platforms move quickly from staging to production, but the way agents establish trust remains rudimentary.<n>We take provable data minimisation between agents from proposal to running system.<n>A 32-bit threshold predicate proves in 6.2 ms and verifies in 1.0 ms with a 608-byte Bulletproofs proof.
  arXiv  Detail & Related papers  (2026-08-30T23:16:17Z)
• Agent Safety Should Be a Runtime Contract [7.813225070853552]
  Agent safety should be a runtime contract enforced by the harness.<n> preventive face blocks dangerous actions before they happen.<n> evidential face requires verifiable proof that good actions actually happened.
  arXiv  Detail & Related papers  (2026-08-11T08:01:05Z)
• On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models [2.8528615301556997]
  Large Language Models (LLMs) have undergone a shift from stateless conversational interfaces to autonomous agents.<n>A compromised reasoning step can trigger unauthorized data access, irreversible state changes, or cascading failures.<n>To quantify the state of the field, we conducted a systematic literature review under PRISMA 2020 guidelines.
  arXiv  Detail & Related papers  (2026-08-11T06:11:26Z)
• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens [65.53494487819053]
  Claw-like AI agents (e.g., OpenClaw) are always-on processes with persistent access to credentials, files, tools, and external services.<n>We adopt a computer-system analogy: treating a Claw-like agent as an agentic computer system whose gateway runtime plays an OS-like mediation role.<n>We develop SafeClawArena, a benchmark of 406 adversarial tasks across four attack surfaces.
  arXiv  Detail & Related papers  (2026-06-29T18:00:45Z)
• Does AI Reviewer See the Full Picture? Attacking and Defending Multimodal Peer Review [48.61205783234013]
  PaperGuard is the first comprehensive benchmark designed to evaluate and defend AI-generated peer-review against domain-specific, cross-modal attacks.<n>Our framework is built on three pillars: (1) a new multimodal peer-review dataset spanning multiple scientific domains; (2) a unified suite of attacks, including black-box prompt injections and white-box perturbations; and (3) a practical defense, motivated by the long-term challenge of academic papers, that uses chunk-based embedding search to efficiently localize and mitigate harmful instructions.
  arXiv  Detail & Related papers  (2026-06-10T22:06:35Z)
• When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI [6.1511441479993225]
  Agentic AI systems that plan, invoke tools, maintain persistent memory, and delegate tasks to peer agents introduce a threat surface that differs materially from standalone model inference.<n> Confidential computing offers a hardware-rooted alternative: Trusted Execution Environments (TEEs) isolate agent code and data from privileged system software.<n>This survey synthesizes the design space in four parts: (i) a unified taxonomy of six TEE platforms covering deployment roles and performance tradeoffs; (ii) an agent-centric threat model spanning perception, planning, memory, action, and coordination layers mapped to nine security goals; (iii) a comparative survey of CC
  arXiv  Detail & Related papers  (2026-05-04T23:09:16Z)
• When the Agent Is the Adversary: Architectural Requirements for Agentic AI Containment After the April 2026 Frontier Model Escape [0.0]
  This paper analyzes four categories of current containment approaches.<n>We categorize five behavioral incidents from the public disclosure and situate them within 698 real-world AI scheming incidents.
  arXiv  Detail & Related papers  (2026-04-25T19:41:00Z)
• Parallax: Why AI Agents That Think Must Never Act [0.0]
  This paper introduces Parallax, a paradigm for safe autonomous AI execution grounded in four principles.<n>We present OpenParallax, an open-source reference implementation in Go, and evaluate it usingAssume-Compromise Evaluation.<n>Across 280 adversarial test cases in nine attack categories, Parallax blocks 98.9% of attacks with zero false positives under its default configuration, and 100% of attacks under its maximum-security configuration.
  arXiv  Detail & Related papers  (2026-04-14T17:20:48Z)
• Agents of Chaos [50.53354213047402]
  We report an exploratory red-teaming study of autonomous language-model-powered agents deployed in a live laboratory environment.<n>Twenty AI researchers interacted with the agents under benign and adversarial conditions.<n>Our findings establish the existence of security-, privacy-, and governance-relevant vulnerabilities in realistic deployment settings.
  arXiv  Detail & Related papers  (2026-02-23T16:28:48Z)
• Authenticated Workflows: A Systems Approach to Protecting Agentic AI [0.0]
  We introduce authenticated, the first complete trust layer for enterprise agentic AI.<n>We enforce intent (operations satisfy organizational policies) and integrity (operations are cryptographically authentic) at every boundary crossing.<n>This delivers deterministic security--operations either carry valid cryptographic proof or are rejected.
  arXiv  Detail & Related papers  (2026-02-11T03:04:50Z)
• AI Security Beyond Core Domains: Resume Screening as a Case Study of Adversarial Vulnerabilities in Specialized LLM Applications [71.27518152526686]
  Large Language Models (LLMs) excel at text comprehension and generation, making them ideal for automated tasks like code review and content moderation.<n>LLMs can be manipulated by "adversarial instructions" hidden in input data, such as resumes or code, causing them to deviate from their intended task.<n>This paper introduces a benchmark to assess this vulnerability in resume screening, revealing attack success rates exceeding 80% for certain attack types.
  arXiv  Detail & Related papers  (2025-12-23T08:42:09Z)
• Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols [80.68060125494645]
  We study adaptive attacks by an untrusted model that knows the protocol and the monitor model.<n>We instantiate a simple adaptive attack vector by which the attacker embeds publicly known or zero-shot prompt injections in the model outputs.
  arXiv  Detail & Related papers  (2025-10-10T15:12:44Z)
• A LLM Assisted Exploitation of AI-Guardian [57.572998144258705]
  We evaluate the robustness of AI-Guardian, a recent defense to adversarial examples published at IEEE S&P 2023. We write none of the code to attack this model, and instead prompt GPT-4 to implement all attack algorithms following our instructions and guidance. This process was surprisingly effective and efficient, with the language model at times producing code from ambiguous instructions faster than the author of this paper could have done.
  arXiv  Detail & Related papers  (2023-07-20T17:33:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.