Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?
2026-07-20 • Cryptography and Security
Cryptography and SecurityArtificial IntelligenceComputation and LanguageMultiagent Systems
AI summaryⓘ
The authors studied a new kind of threat where AI programs that manage their own settings and memory can be attacked by messing with their own files through normal operating system actions. They created a detailed way to describe these attacks and tested defenses by watching a real AI agent doing different tasks. Their experiments showed that a mix of protection methods—controlling access, smart detection based on the AI’s activity, and regular backups—works well most of the time, though some attacks are still hard to spot. The authors suggest that protecting against these self-targeted attacks needs fresh thinking at the operating system level.
self-hosted AI agentsself-state attacksoperating systemaccess controlmemory protectionintrusion detectionbackup and recoveryattack surfaceworkload profilingsecurity framework
Authors
Yimeng Chen, Nathanaël Denis, Roberto Di Pietro, Jürgen Schmidhuber
Abstract
Self-hosted AI agents read and write their own memory and configuration files to function. An agent may get compromised via corruption of its own state -- a compromise realized via legitimate OS system call invocation. We refer to this class of threats as self-state attacks. In this paper, we investigate the OS resilience to this class of attacks. Formally, we characterize a four-axis attack space (Target, Mechanism, Granularity, Temporal); investigate the structural limits of prevention, detection, and recovery; and introduce a workload-conditioned view of detectability. To instantiate the framework, we collect live activity traces from a representative self-hosted agent running across distinct workload profiles, and realize the attack space as a 23-cell matrix, 43 concrete operations on real self-state files, and injected into those traces. We then evaluate both canonical and workload-conditioned defense strategies. The empirical results show that a layered defense stack (access-control prevention on the instruction and configuration layers, workload-conditioned detection on the memory layer, and periodic backup for recovery) is effective on most attack cells while a small residual attack surface remains structurally indistinguishable at the OS level. These findings suggest that against the newly established class of self-state attacks, OS-level defense needs to be reconsidered, potentially opening new research directions in the field.