Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?

Hugging Face Daily Papers Papers
ai-agents security operating-system self-state-attacks defenses research ai-safety

Summary

This paper investigates OS resilience against self-state attacks on self-hosted AI agents, characterizing an attack space and evaluating layered defense strategies. It finds that while a layered defense stack is effective, a small residual attack surface remains structurally indistinguishable at the OS level.

Self-hosted AI agents read and write their own memory and configuration files to function. An agent may get compromised via corruption of its own state -- a compromise realized via legitimate OS system call invocation. We refer to this class of threats as self-state attacks. In this paper, we investigate the OS resilience to this class of attacks. Formally, we characterize a four-axis attack space (Target, Mechanism, Granularity, Temporal); investigate the structural limits of prevention, detection, and recovery; and introduce a workload-conditioned view of detectability. To instantiate the framework, we collect live activity traces from a representative self-hosted agent running across distinct workload profiles, and realize the attack space as a 23-cell matrix, 43 concrete operations on real self-state files, and injected into those traces. We then evaluate both canonical and workload-conditioned defense strategies. The empirical results show that a layered defense stack (access-control prevention on the instruction and configuration layers, workload-conditioned detection on the memory layer, and periodic backup for recovery) is effective on most attack cells while a small residual attack surface remains structurally indistinguishable at the OS level. These findings suggest that against the newly established class of self-state attacks, OS-level defense needs to be reconsidered, potentially opening new research directions in the field.
Original Article
View Cached Full Text

Cached at: 07/21/26, 10:36 AM

Paper page - Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?

Source: https://huggingface.co/papers/2607.17986

Abstract

Self-hostedAIagentsreadandwritetheirownmemoryandconfigurationfilestofunction.Anagentmaygetcompromisedviacorruptionofitsownstate--acompromiserealizedvialegitimateOSsystemcallinvocation.Werefertothisclassofthreatsasself-stateattacks.Inthispaper,weinvestigatetheOSresiliencetothisclassofattacks.Formally,wecharacterizeafour-axisattackspace(Target,Mechanism,Granularity,Temporal);investigatethestructurallimitsofprevention,detection,andrecovery;andintroduceaworkload-conditionedviewofdetectability.Toinstantiatetheframework,wecollectliveactivitytracesfromarepresentativeself-hostedagentrunningacrossdistinctworkloadprofiles,andrealizetheattackspaceasa23-cellmatrix,43concreteoperationsonrealself-statefiles,andinjectedintothosetraces.Wethenevaluatebothcanonicalandworkload-conditioneddefensestrategies.Theempiricalresultsshowthatalayereddefensestack(access-controlpreventionontheinstructionandconfigurationlayers,workload-conditioneddetectiononthememorylayer,andperiodicbackupforrecovery)iseffectiveonmostattackcellswhileasmallresidualattacksurfaceremainsstructurallyindistinguishableattheOSlevel.Thesefindingssuggestthatagainstthenewlyestablishedclassofself-stateattacks,OS-leveldefenseneedstobereconsidered,potentiallyopeningnewresearchdirectionsinthefield.

View arXiv pageView PDFAdd to collection

Get this paper in your agent:

hf papers read 2607\.17986

Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash

Models citing this paper0

No model linking this paper

Cite arxiv.org/abs/2607.17986 in a model README.md to link it from this page.

Datasets citing this paper0

No dataset linking this paper

Cite arxiv.org/abs/2607.17986 in a dataset README.md to link it from this page.

Spaces citing this paper0

No Space linking this paper

Cite arxiv.org/abs/2607.17986 in a Space README.md to link it from this page.

Collections including this paper0

No Collection including this paper

Add this paper to acollectionto link it from this page.

Similar Articles

Self-Sovereign Agent

Hugging Face Daily Papers

This paper investigates self-sovereign agents—AI systems capable of autonomously sustaining their own operations without human involvement—analyzing technical barriers and discussing critical security, societal, and governance challenges for their deployment.