ClawSafety: "Safe" LLMs, Unsafe Agents (April 2026)

Free

120 adversarial scenarios across 5 high-privilege domains (SWE/finance/medical/legal/DevOps), 3 injection channels (skill files, email, web); 40–75% attack success rate; safety depends on model + framework stack, not model alone

FreeFree tier

Type

Open Source

Visit Website GitHub (40 stars)

About ClawSafety: "Safe" LLMs, Unsafe Agents (April 2026)

ClawSafety is a benchmark introduced in a 2026 paper that systematically evaluates the safety of personal AI agents against prompt injection attacks. It comprises 120 adversarial test scenarios across five high-privilege professional domains (software engineering, finance, healthcare, law, and DevOps), embedding malicious content through three real-world channels: workspace skill files, emails from trusted senders, and web pages. The benchmark was used to test five frontier LLMs as agent backbones across 2,520 sandboxed trials, revealing attack success rates between 40% and 75%. A key finding is that agent safety depends not only on the backbone model but also on the agent framework, as demonstrated by cross-scaffold experiments on three different frameworks. Action-trace analysis further shows which models maintain boundaries against credential forwarding and destructive actions. Code and data are planned for public release.

Key Features

120 adversarial test scenarios across 5 high-privilege domains: software engineering, finance, healthcare, law, and DevOps

3 injection channels: workspace skill files, emails from trusted senders, and web pages

Evaluates 5 frontier LLMs as agent backbones with 2,520 sandboxed trials

Attack success rates ranging from 40% to 75% depending on model and injection vector

Cross-scaffold experiments on 3 different agent frameworks to assess framework impact on safety

Action-trace analysis to identify model boundaries on credential forwarding and destructive actions

Pros & Cons

Pros

Realistic, high-privilege workspaces (SWE, finance, healthcare, law, DevOps) rather than synthetic chat environments
Multiple injection channels (skill files, email, web) reflecting real agent workflows
Includes cross-scaffold experiments revealing that safety depends on framework as well as model
Action-trace analysis provides granular insight into model behavior on dangerous actions
Large-scale evaluation with 2,520 trials across multiple models

Cons

Only 5 frontier LLMs tested, limiting generalizability to other models
120 scenarios may not cover all possible real-world attack vectors or domains
Benchmark conducted in sandboxed environments, not fully real-world production systems
Code and data not yet publicly released at time of paper publication

Best For

Evaluating the safety of personal AI agents against prompt injection attacksTesting and comparing the robustness of different LLM-based agent frameworksResearch on adversarial vulnerabilities in high-privilege agent environmentsBenchmarking model safety in realistic professional workspaces beyond chat settings

FAQ

What is ClawSafety?

ClawSafety is a benchmark for evaluating the safety of personal AI agents against adversarial prompt injection attacks, introduced in an arXiv paper (2604.01438).

Which domains does ClawSafety cover?

It covers five high-privilege professional domains: software engineering, finance, healthcare, law, and DevOps.

What are the injection channels used?

Adversarial content is embedded in three channels: workspace skill files, emails from trusted senders, and web pages.

Why does ClawSafety claim that safety depends on more than just the LLM model?

Cross-scaffold experiments on three different agent frameworks showed that attack success rates vary significantly depending on the framework, indicating the full deployment stack matters.

Is ClawSafety's code available?

The paper states that code and data will be made available at a URL provided in the paper.