arXiv cs.AI· Hao Chen, Wenhui Dong, Ye Chen, Jiezhi Yao, Chenbo Xia, Yuwen Qu, Renxiang Wang, Fudong Yuan, Camil Hamami, Chenglong Pan, Xinquan Yue, Ziyu Wang, Fengyu Ye, Chenyang Si, Caifeng Shan·· 13 小时前AI 评分40
CoSec：评估 LLM 智能体在社区环境中的安全性基准
CoSec: Benchmarking Agent Security in Communities
AI 导读
研究者提出 CoSec，一个可执行基准，用于评估 LLM 智能体在社区内及跨社区运行时的隐私与授权执行情况。该基准包含 208 个典型场景，覆盖固定与演变的社区边界，以及通过对话、环境内容、持久记忆和组合工作流发起的攻击。测试显示智能体常能完成良性任务，却违反隐私与授权边界，任务效用并不等于合规。
正文 · 原文
Authors:Hao Chen, Wenhui Dong, Ye Chen, Jiezhi Yao, Chenbo Xia, Yuwen Qu, Renxiang Wang, Fudong Yuan, Camil Hamami, Chenglong Pan, Xinquan Yue, Ziyu Wang, Fengyu Ye, Chenyang Si, Caifeng Shan
Abstract:LLM agents operate in persistent collaborative environments involving multiple users, communities, memories, files, and tools. Community boundaries may remain fixed or evolve with changes in membership, roles, composition, and relationships. Agents must complete legitimate tasks and prevent unauthorized disclosure of protected information. Existing evaluations do not fully examine these risks in agent systems. We introduce \textbf{CoSec}, an executable benchmark for evaluating privacy and authorization enforcement in LLM agent systems operating within and across communities. CoSec contains 208 canonical scenarios spanning fixed and evolving boundaries, protected information belonging to the agent owner or other participants, and attacks through dialogue, environmental content, persistent memory, and composed workflows. CoSec executes complete agent systems with persistent sessions, memory, files and tools. It verifies information flows against the active authorization state using execution traces and artifacts. Across harness and model configurations, agents frequently complete benign tasks but violate privacy and authorization boundaries. Privacy behavior varies across harnesses, attack surfaces, and community states, revealing how memory, files, tools, and workflows can carry protected information beyond its authorized scope. These findings show that task utility does not imply privacy or authorization compliance and that authorization in community settings remains an unresolved security challenge for persistent LLM agents.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2609.34790 [cs.CR] |
| (or arXiv:2609.34790v4 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2609.34790 arXiv-issued DOI via DataCite |
Submission history
From: Hao Chen [view email]
[v1]
Mon, 28 Sep 2026 10:00:05 UTC (707 KB)
[v2]
Tue, 29 Sep 2026 04:44:54 UTC (1,099 KB)
[v3]
Mon, 19 Oct 2026 14:30:19 UTC (708 KB)
[v4]
Wed, 21 Oct 2026 03:27:50 UTC (708 KB)
来源：arXiv cs.AI · arxiv.org