Search papers, labs, and topics across Lattice.
Tsinghua AIBJTUEastern Institute of Technol- ogyHuaweiNingbo Institute of Digital TwinPKUPolyUSUIBEJun 16, 2026arXiv:2606.18356This paper introduces SafeClawBench, a comprehensive benchmark designed to evaluate the security of tool-using language model agents across six distinct attack families, encompassing 600 controlled adversarial tasks. The evaluation reveals significant variability in semantic failure rates among different models, ranging from 9.0% to 44.2%, and highlights that semantic acceptance does not always correlate with observable harm, as evidenced by 291 sandbox harms occurring despite passing semantic checks. By separating semantic acceptance, audit-visible harm, and sandbox-observed harm, SafeClawBench offers a nuanced framework for assessing and improving the security of LLM agents, enabling clearer insights into their vulnerabilities.
Semantic acceptance rates can be misleading, with up to 44.2% of models failing to prevent observable harm even when they pass initial checks.
Tool-using language-model agents introduce security failures that go beyond unsafe text: they can disclose protected objects, write persistent memory, send messages, modify databases, or trigger harmful code and tool effects. Existing evaluations often collapse these stages into a single attack success rate, making it difficult to tell whether a model merely agreed with an attacker or actually produced observable harm. We introduce SafeClawBench, a staged benchmark for tool-using agent security with 600 controlled adversarial tasks across six attack families: direct and indirect prompt injection, tool-return injection, memory poisoning, memory extraction, and ambiguity-driven unsafe inference. SafeClawBench reports three separate endpoints: semantic attack acceptance, audit-visible harm evidence, and sandbox-observed tool/state harm. Evaluating five agent endpoints under four prompt-level policies, we find that these endpoints capture different failure modes. Without additional prompt protection, semantic failure rates vary widely across models, from 9.0% to 44.2%. Audited harm evidence is narrower than semantic failure, and under a separate executable protocol some matched task identities produce sandbox harm despite passing the Semantic Core call: in a 12,000-row matched analysis, 291 of 347 observed sandbox harms occur in rows that pass the semantic check. Prompt policies change endpoint outcomes, but their effects depend on both model and protocol. SafeClawBench provides a reproducible framework for comparing agent models and prompt-policy conditions without conflating textual compliance, evidence-supported harm, and executable state changes. The open-source dataset is available at https://huggingface.co/datasets/sairights/safeclawbench.
