Beyond Direct Access: Resource Hijacking in LLM Agents

2026-08-15

AI Summary

This study addresses the security blind spot of high-value resource hijacking in LLM agents by systematically analyzing this attack surface and proposing a dedicated evaluation benchmark. We construct an automated attack generation pipeline alongside an isolated sandbox environment to enable behavior-level resource monitoring. Empirical evaluations across 300 scenarios and 900 prompts demonstrate an 84% attack success rate, revealing that existing defenses remain vulnerable with a 55% failure risk. This work fills the critical gap in agent resource security assessment and exposes significant deficiencies in current defense mechanisms. Consequently, it provides essential empirical evidence and benchmark support for developing next-generation security frameworks for LLM agents, establishing a foundational baseline for future research in mitigating resource-centric threats within autonomous AI systems.

Abstract

Large language model agents are increasingly connected to high-value resources such as computing infrastructure, credentials, usage budgets, identities, private knowledge, communication channels, and organizational workflows. Existing agent security research mainly studies attacks on instructions, data, and tool behaviors, while high-value resources accessible to agents have received much less attention as direct attack targets. We are the first to identify and systematically study agent resource hijacking, a security blind spot in which attackers induce agents to invoke, consume, transfer, or control high-value resources for their own goals without directly obtaining those resources or their credentials. To study this threat, we introduce ResourceHijackBench together with an automated pipeline for generating resource hijacking cases. We organize high-value agent resources into six categories and construct 300 attack scenarios with 900 attack prompts. Each case runs in an isolated local environment that records actual resource use, allowing attacks to be evaluated from agent behavior rather than text responses alone. Without additional defenses, OpenClaw reaches an average attack success rate of 84.06%. The attack remains effective across different model backends, with average success rates ranging from 69.98% to 89.58%. Existing defenses reduce part of the risk, but the strongest evaluated defense still leaves an average attack success rate of 55.11%. These results show that high-value resources accessible to agents form an important and previously overlooked attack surface, and that current agent defenses are not sufficient to protect them from resource hijacking.

Problem

• Resource Hijacking
• LLM Agents
• Agent Security
• High-value Resources
• Attack Surface

Innovation

• Resource Hijacking
• ResourceHijackBench
• LLM Agent Security
• Automated Attack Generation
• Behavior-based Evaluation