# SecureClaw: Clawing Back Control of LLM Agents

**Authors:** Yuhan Ma, Stefan Schmid  
**arXiv:** [2606.09549](https://arxiv.org/abs/2606.09549)  
**Date:** 2026-06-08  
**Summary page:** https://www.summarizepaper.com/en/paper/2606.09549v1/

## Key points

- SecureClaw is a dual-boundary architecture designed to address security failures faced by large language model (LLM) agents
- It secures both boundaries simultaneously by enforcing authorization at the effect sink and implementing plaintext confinement at the read boundary
- The architecture includes a PREVIEW$\rightarrow$COMMIT protocol for writes that change external state, ensuring only trusted executors can commit authorized requests
- Through rigorous evaluation, SecureClaw emerges as a standout defense with impressive security outcomes, including 0% attack success rate on ASB and low leak rates on AgentDojo and AgentLeak
- In practice, SecureClaw prevents exposure of sensitive information to the runtime by providing handles and summarized data for processing, safeguarding against unauthorized disclosure

## Summary

, , , , 

SecureClaw is a dual-boundary architecture designed to address the security failures faced by tool-using large language model (LLM) agents. These failures include unauthorized external actions and exposure of sensitive plaintext within the runtime before any final output check can intervene. Existing defenses typically focus on protecting either the planner/runtime or the action sink, leaving one surface vulnerable. In response to this challenge, SecureClaw introduces a novel approach that secures both boundaries simultaneously. Authorization is enforced at the effect sink, while plaintext confinement is implemented at the read boundary. Sensitive reads pass through a trusted gateway that replaces raw values with opaque handles and provides bounded summaries as an explicit declassification interface in evaluated deployments. Furthermore, SecureClaw implements a PREVIEW$\rightarrow$COMMIT protocol for writes that change external state. This protocol ensures that only a trusted executor can commit the exact canonical request authorized by policy, preventing unauthorized changes to external systems. The runtime retains the ability to plan over summaries and symbolic references but is restricted from directly accessing secrets or performing side effects. Through rigorous evaluation across AgentDojo, AgentLeak, and Agent Security Bench (ASB), SecureClaw emerges as the standout defense in a common harness setting. It not only maintains task utility but also achieves impressive security outcomes, including a 0% attack success rate (ASR) on ASB, 0.64% ASR on AgentDojo, and just 3.23% overall leak on AgentLeak's attacked parity lane – which measures final-output and internal-relay leakage. To illustrate its effectiveness in practice, consider an email-and-finance workflow where an agent must inspect an invoice and take appropriate action based on its contents. SecureClaw ensures that sensitive information from the invoice is not exposed to the runtime; instead, it receives a handle and a summarized version of the data for processing. This approach prevents malicious actors from manipulating the agent into sending confidential information to unauthorized recipients. Overall, SecureClaw's innovative design strikes a balance between usability and security by enforcing strict controls at both boundaries of LLM agents' operations. Its capability-style design ensures that authority is carried by unforgeable references, safeguarding against potential attacks and data leaks effectively.