From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors

Researchers found that local LLM agents can be backdoored through multi-step prompt injection across workspace files and sessions.

The ClawTrojan benchmark showed high attack success on GPT-5.4, even when individual steps looked benign.

Because existing defenses often inspect each action separately, they can miss instructions spread over several steps.

DASGuard is proposed as a runtime defense that traces and sanitizes control-like text from untrusted sources to protect agent workflows.