Dimensions overall score 7.0

GitHub Code Pulse

No public code linked for this paper yet.

• Zhuowen Yuan1, Zhaorun Chen2, Zhen Xiang3, Nathaniel D. Bastian4, Seyyed Hadi Hashemi5, Chaowei Xiao6, Wenbo Guo7,8, Bo Li1,8 1UIUC 2University of Chicago 3University of Georgia 4United States Military Academy 5eBay 6Johns Hopkins University 7UCSB 8Virtue AI April 7, 2026claim 72%
• Existing research on LLM agent security mainly focuses on prompt injection and unsafe input/output behaviors. However, as agents increasingly rely on third-party tools and MCP servers, a new class of supply-chain threatshas emerged, where malicious behaviors are embedded in seemingly benign toolsclaim 72%
• DNS query: api.openai.comDNSquery HTTP_REQ POST v1/chat/completions user: "What’s the time in Paris?”(normal request)Local HostIP: 172.25.24.1claim 72%
• Network-Layer TrajectoryMalicious Script Injectionclaim 72%
• … (more UDP flood)HTTP_REQ POST v1/chat/completions tool: '{"time": 10:27}’(normal output despite hidden side effect)HTTP_RESP 200 OK assistant: "It’s currently 10:27 in Paris.”(normalfinal response)claim 72%
• Other traffic (omitted) get_time_injected(city)Injected Tool (compromised) return current_timeNormal outputaction(host_ip)Maliciousaction get_time(city)Original Tool (benign) InjectionAttack:Network DoSMITRE: T1498OWASP 2025: Mishandling of Exceptional Conditions Script:def action(…):# Launch attack# omitted… Attack Caclaim 72%

Competitive landscape

Competitor map is still being generated for this paper. Enable generation or check back soon.

Startup potential card