ClawTrojan

Benchmarking persistent prompt-injection trojans in local agentic harnesses, with DASGuard as a dynamic defense.

This repository contains the public code and data for the paper "From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors". It includes the ClawTrojan benchmark, the DASGuard defense, sandbox evaluation code, baseline adapters, and reproduction scripts for the paper experiments.

Table of Contents

• Overview
• What Is Included
• Benchmark
• DASGuard
• Results Snapshot
• Setup
• Smoke Checks
• Reproducing Paper-Scale Runs
• Data Note
• Citation

Overview

LLM agents are increasingly used as operational tools inside local agentic harnesses. They can read and write project files, call tools, and reuse workspace state across sessions. These capabilities create a new attack surface: an attacker can place a prompt injection in a file or tool output, induce the agent to store it, and trigger it later.

ClawTrojan studies this multi-step trojan setting. A single turn may appear benign, but a full trajectory can convert untrusted text into persistent control content in the workspace. The benchmark is designed to measure whether an agent or defense can stop the chain before a harmful irreversible outcome.

DASGuard is the defense proposed in the paper. It scans control-like text in sensitive local files, traces where that text came from, and removes or blocks control content that does not originate from a trusted source.