Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?
Some self-state attacks can look legitimate even to the operating system.
The paper defines self-state attacks as compromises made through an agent’s own memory and configuration writes. It maps the attack space across four axes and tests 43 operations against live traces from a self-hosted agent. Layered defenses worked for most cases, combining access controls, workload-conditioned detection, and backups. A small residual surface remained structurally indistinguishable at the OS level. HF Daily Papers' note
The paper defines self-state attacks as compromises made through an agent’s own memory and configuration writes. It maps the attack space across four axes and tests 43 operations against live traces from a self-hosted agent. Layered defenses worked for most cases, combining access controls, workload-conditioned detection, and backups. A small residual surface remained structurally indistinguishable at the OS level. HF Daily Papers' note
score 4