[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83747-en":3,"doc-seo-83747-105":30,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83747,137441390410,"Hazel","https://ap-avatar.wpscdn.com/avatar/2000252f4ab5702993?_k=1776741390130283984",8,"Research & Report","DualView: Preventing Indirect Prompt Injection in Personal AI Agents","Personal AI agents that run locally can automate web search, email, and file management, but their access to network, filesystem, and shell creates exposure to indirect prompt injection (IPI). Prior Dual LLM defenses replace untrusted content with symbols inside the agent, yet stored IPI arises when the agent later rereads previously written data as trusted tool output. DUALVIEW extends untrusted tracking into the user environment using dual views and synchronized tool calls, blocking stored IPI while keeping utility near the unprotected baseline.","DUALVIEW: Preventing Indirect Prompt Injection in Personal AI Agents  \nJuhee Kim* , Woohyuk Choi* , Taehyun Kang, Youngmin Kim, and Byoungyoung Lee  \nSeoul National University  \narXiv :2607 .0382 1v 1 [ cs .CR] 4 Jul 2026  \nAbstract—Personal AI agents that run on the user’s local machine, such as OpenClaw, automate daily tasks including web search, email, and file management. Their access to computer resources, including the network, file system, and shell, exposes them to indirect prompt injection (IPI) attacks. Prior Dual LLM defenses block IPI by replacing untrusted data with symbols that the agent can reference but not read. However, they track untrusted data only inside the agent’s context, so when the agent saves and later rereads untrusted data, that data, possibly an attacker’s prompt, can return as trusted data rather than as a symbol, which we call stored IPI.  \nOperating on the user’s real environment, which humans and programs share, is what makes agents like OpenClaw practical, and is exactly why a defense that ignores it is incomplete. Preserving symbols in such an environment is hard, because humans and programs need original data. We present DUALVIEW, which extends untrusted data tracking from the agent’s context to the user’s environment, includingthe file system, shell, network, and other agents, by giving each channel two views. In AgentView, the agent sees untrusted data as symbols even after writing it out and reading it back, blocking stored IPI, while HumanView preserves original data for humans and tools. DUALVIEW routes each tool call to the right view and synchronizes data across the two views. DUALVIEW deploys as an OpenClaw plugin using only tool hooks, without changing the agent’s tool-call logic or tool implementations. Since DUALVIEW isolates untrusted data by design, its protection is not limited to known attack templates. In our evaluation on an IPI benchmark and PinchBench, DUALVIEW blocked every IPI attack, including stored IPI, while keeping utility close to the unprotected baseline.  \n1. Introduction  \nPersonal AI agents are useful because they assist users by running in the same computer environment where users already work. Users often allow the agents to read local files, fetch external data, run shell commands, send email, process webhook payloads, and communicate with other agents [1–5] . These capabilities let the agent not only answer questions but also handle routine computer tasks for the user.  \nA representative example is OpenClaw [6], a local-first AI agent that runs on the user’s machine and exposes such tools. A user can ask the agent to “summarize market news and save notes [to](to ./report.md)[ ./report.md](to ./report.md).” To complete the task, the  \n* . Equal contribution.  \nagent searches the web, fetches web pages, and writes a local file. The user’s computer environment is also where humans and non-agent programs continue to read, edit, andreuse the agent’s results.  \nThe same capabilities create the security problem. When an agent reads external data and can act on the user’s resources, it is exposed to indirect prompt injection [7–9] . A remote attacker can place natural-language instructions inside the external data the agent reads. If the backing model misinterprets the attacker-controlled text as an instruction, it can issue tool calls that use the agent’s authorized access to the user’s files, shell, and network. The consequences include arbitrary command execution, exfiltration of local files, and destructive modification of user files. The defense should not simply remove features from the agent, such as file access, shell access, or network access. It must preserve the agent’s ability to complete benign tasks while preventing attackers from using malicious instructions in external data to control the agent’s tool calls.  \nDual LLM pattern. The Dual LLM pattern offers a promising defense direction [10–13] . A privileged LLM decides tool calls while a quarantine","cbCaidQkRD5HvWMR","https://ap.wps.com/l/cbCaidQkRD5HvWMR","pdf",1477164,7,1,19,"English","en",105,"# Introduction\n## Dual LLM pattern\n## Human utility and stored IPI","[{\"question\":\"What problem does DUALVIEW address in personal AI agents?\",\"answer\":\"DUALVIEW targets indirect prompt injection (IPI) that can manipulate agent tool calls when untrusted external text is interpreted as instructions.\"},{\"question\":\"Why do previous Dual LLM defenses still fail against stored IPI?\",\"answer\":\"They track untrusted data only within the agent’s context; when the agent saves and later rereads that data from the user environment, attacker text can re-enter as trusted content.\"},{\"question\":\"How does DUALVIEW prevent stored IPI while preserving usability?\",\"answer\":\"DUALVIEW uses dual views (AgentView and HumanView) to keep untrusted data symbolized for the agent while preserving original data for humans and tools, synchronizing data across tool calls via only tool hooks.\"}]",1784190182,48,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":28},"dualview-preventing-indirect-prompt-injection-in-personal-ai-agents","",{"@graph":36,"@context":86},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/dualview-preventing-indirect-prompt-injection-in-personal-ai-agents/83747/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":24,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-07-27","2026-07-16",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"What problem does DUALVIEW address in personal AI agents?","Question",{"text":76,"@type":77},"DUALVIEW targets indirect prompt injection (IPI) that can manipulate agent tool calls when untrusted external text is interpreted as instructions.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"Why do previous Dual LLM defenses still fail against stored IPI?",{"text":81,"@type":77},"They track untrusted data only within the agent’s context; when the agent saves and later rereads that data from the user environment, attacker text can re-enter as trusted content.",{"name":83,"@type":74,"acceptedAnswer":84},"How does DUALVIEW prevent stored IPI while preserving usability?",{"text":85,"@type":77},"DUALVIEW uses dual views (AgentView and HumanView) to keep untrusted data symbolized for the agent while preserving original data for humans and tools, synchronizing data across tool calls via only tool hooks.","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":93},[94,98,102,106,111,116,120,123,128,131,135],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":107,"doc_module":4,"doc_module_name":46,"category_name":108,"show_sort_weight":109,"slug":110},5,"Comic",60,"comic",{"id":112,"doc_module":4,"doc_module_name":46,"category_name":113,"show_sort_weight":114,"slug":115},6,"Technology",50,"technology",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":22,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":107,"slug":137},"General","general"]