Agent Security Center:Agent Risk Detection and Prevention Overview

Prompt Attack and Jailbreak Protection

Attackers may craft inputs to induce agents into bypassing security policies, executing unintended operations, or disclosing system prompts. Agent Security Center identifies and blocks various prompt attack techniques, including direct, indirect, and recursive prompt injection, instruction override, prompt leakage, and jailbreak methods such as role assumption, scenario assumption, DAN, developer mode, Few-Shot/Many-Shot, task shifting, reverse induction, refusal suppression, obfuscation/Token smuggling, and adversarial attacks. This helps agents consistently adhere to established security policies.

Content Compliance Protection

Non-compliant agent output can expose enterprises to regulatory risks. Agent Security Center performs compliance checks on agent output, covering politically sensitive, violent, prohibited, pornographic, inappropriate values, religious, advertising, and privacy-related content, helping enterprises maintain compliance at the content level.

Sensitive Data Exfiltration Protection

Agents may inadvertently disclose personal information, customer data, or credentials when processing requests. Agent Security Center identifies sensitive content in agent output, including personal profiles, identity information, financial information, health information, as well as passwords, verification codes, access tokens, and authentication keys, and promptly alerts on data exfiltration risks.

Behavior Deviation and Goal Hijacking Protection

Attackers may embed malicious instructions within normal tasks to induce agents to deviate from their intended goals and perform actions inconsistent with the design intent. Agent Security Center detects behavior deviation risks such as task goal hijacking, ensuring that agents execute business operations as expected.

Model Resource Abuse Protection

Malicious inputs may cause agents to enter extended reasoning loops, repetitive output, or random string generation, abnormally consuming compute resources. Agent Security Center identifies such model resource abuse behaviors, helping enterprises control operational costs and maintain service stability.

Knowledge and Memory Poisoning Protection

Attackers may inject malicious content into RAG knowledge bases, vector databases, or document repositories to manipulate the information that agents retrieve and reference, thereby affecting agent output and behavior. Agent Security Center detects RAG knowledge base poisoning, helping enterprises maintain the trustworthiness of knowledge sources.

Knowledge Access Configuration Risk Detection

Overly permissive visibility or access control settings on knowledge bases can lead to data leakage. Agent Security Center detects access configuration defects such as overly broad RAG permissions on knowledge bases and recommends privilege minimization.

Access Control

Agents may access unauthorized resources during runtime. Agent Security Center provides an LLM API allowlist capability that denies agents access to model services outside the allowlist, allowing them to reach only trusted LLM endpoints. It also detects unauthorized tool invocations and other behaviors to reduce the agent's attack surface.

Tool Abuse and Exploitation Protection

Attackers may leverage an agent's tool invocation capabilities to launch command/code injection, SQL injection, SSRF probing, or other attacks, or abuse tools to access objects beyond their authorization. Agent Security Center detects injection attacks, SSRF, and unauthorized object access at the tool invocation layer, preventing attackers from exploiting agent tool capabilities for privilege escalation.

Tool and Skill File Risk Detection

Skill files may contain embedded malicious instructions or risky configurations. Agent Security Center performs security scanning on Skill files to identify high, medium, and low-risk Skills and malicious Skill files. It also detects unauthorized resource access (such as path traversal to read or write sensitive files) and MCP tool poisoning, blocking supply chain risks at the Skill loading and invocation stage.

Malicious Code Generation Protection

Attackers may induce agents to generate malicious code, intrusion scripts, or XSS output. Agent Security Center identifies malicious code generation and cross-site scripting attacks, preventing agents from becoming attack vectors.

Threat Intelligence Integration

Agent Security Center integrates threat intelligence capabilities to perform threat detection on URLs accessed by agents. By default, it applies the same enforcement actions as Cloud Firewall to block agent access to malicious addresses.

Agent Runtime Configuration Risk Detection

Without runtime protection configurations such as sandbox isolation, the attack surface of agents expands. Agent Security Center detects agent runtime configuration risks and recommends enabling sandbox isolation and other hardening measures.

Transport and Network Security Detection

Plaintext communication exposes request parameters, credentials, and other sensitive information. Agent Security Center detects transport and network configuration defects such as model endpoints, MCP endpoints, knowledge bases, Ragflow, and HTTP/API tools not using HTTPS, as well as HTTP tools with certificate verification disabled, and recommends enabling encrypted communication.

Credential Leakage and Weak Password Detection

Credentials exposed in plaintext in code or configurations can lead to data breaches and resource theft. Agent Security Center detects credential risks such as hardcoded AKSK in code nodes, plaintext password storage in Gateway configurations, and weak login passwords, and recommends adopting secure credential management practices.

Authentication Configuration Risk Detection

Improper authentication configurations can lead to unauthorized access. Agent Security Center detects authentication configuration issues such as Gateway without strong token authentication, unisolated DM/group sessions, DM/group access policy defects, and incorrect reverse proxy configurations, and recommends strengthening authentication and session isolation.

Agent Over-Authorization Detection

When an agent has excessive permissions, a compromise can amplify the attack impact. Agent Security Center detects over-authorization configurations such as globally enabled Elevated tools, and recommends minimizing agent permissions.

Supply Chain Component Risk Detection

Supply chain components such as plugins and Skills can be maliciously exploited if not properly managed. Agent Security Center detects supply chain configuration risks such as unrestricted plugin systems and enabled Skills watcher dynamic refresh.

Other Configuration Risk Detection

Agent Security Center also detects configuration risks such as Gateway bound to 0.0.0.0, logging/sessions without sensitive information filtering, and configuration file directory permission defects, and provides corresponding hardening recommendations.

AI Security Defense Enablement Detection

Workflows without AI security guardrails may have risk exposures such as compliance violations, prompt injection bypasses, and sensitive data leakage. Agent Security Center detects workflows that have not integrated AI security guardrails and recommends enabling real-time protection.

Vulnerability Detection

Known vulnerabilities in agent frameworks can be exploited if not patched in a timely manner. Agent Security Center performs version comparison detection against multiple known security vulnerabilities in components such as OpenClaw, helping enterprises identify and remediate at-risk older versions. It also integrates with the Vulnerabilities feature to perform version comparison detection against multiple known security vulnerabilities in OpenClaw, helping enterprises identify and remediate at-risk older versions in a timely manner.

Agent Baseline Check

In agent security scenarios, baseline checks complement configuration and component security protection. It supports detection of AI-related baseline risks (such as the Alibaba Cloud Standard - OpenClaw Security Baseline) and is linked with CSPM (CSPM) and the Baseline Risk to enable unified security baseline management. It performs automated security baseline checks on OpenClaw (formerly Clawdbot) configurations, covering two major categories of check items: service configuration and identity authentication, helping identify and remediate unsafe configurations.

Agent Identity Spoofing Detection

Attackers may forge agent identities, hijack sessions, or bypass authentication to impersonate legitimate agents and perform operations. Agent Security Center detects agent identity spoofing, helping enterprises verify the true identity of agents and prevent unauthorized identities from performing sensitive operations.