arXiv cs.AI· Puyu Zeng, Mingang Chen, Zheli Liu, Qibing Ren·· 9 天前AI 评分58
研究提出智能体资源劫持攻击与 ResourceHijackBench 基准
Beyond Direct Access: Resource Hijacking in LLM Agents
AI 导读
论文首次系统研究智能体资源劫持，即攻击者诱导智能体把外部 API、GPU、服务器及部署审批等工作流用于自身目标，而无需直接获取这些资源或凭证。
正文 · 原文
Abstract:Large language model agents are increasingly connected to high-value resources, including external APIs, GPUs and servers, and workflows such as deployment and approval. Existing agent security research mainly focuses on attacks against information and agent behavior, while high-value resources have received less attention as attack targets themselves. To our knowledge, we are the first to identify and systematically study agent resource hijacking, in which attackers induce agents to use high-value resources for their own goals without directly obtaining those resources or their credentials. We introduce ResourceHijackBench, an executable benchmark and automated case-generation pipeline that covers six categories of high-value resources. It contains 300 attack scenarios and 900 attack prompts, and each case runs in an isolated local environment that records actual resource use. Resource hijacking remains effective across four model backends, with average attack success rates of 70.0% to 89.6%, and it also appears across two agent harnesses, with average ASRs of 84.1% on OpenClaw and 72.3% on Codex. In paired comparisons, resource hijacking achieves ASRs 62.4 to 84.0 percentage points higher than direct resource acquisition across the four model backends. Real-world experiments also demonstrate the practical effectiveness of resource hijacking. Among the three existing defenses we evaluate, the lowest average ASR is still 55.1%. We further propose ResGate, a pre-execution resource authorization defense that combines model-based resource-use extraction with deterministic policy enforcement based on trusted requester identity metadata, reducing the average ASR on OpenClaw to 23.6%. These results show that preventing direct access alone is not enough to protect resources that agents can still use on an attacker's behalf, and that explicit resource authorization can help reduce this risk.
| Comments: | 21 pages, 5 figures, 20 tables |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2608.15108 [cs.CR] |
| (or arXiv:2608.15108v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2608.15108 arXiv-issued DOI via DataCite |
Submission history
From: Puyu Zeng [view email]
[v1]
Sat, 15 Aug 2026 08:16:59 UTC (238 KB)
[v2]
Thu, 8 Oct 2026 16:05:57 UTC (753 KB)
来源：arXiv cs.AI · arxiv.org