WeClawArena：一個用於以人為中心的代理網路中跨用戶代理協作與安全性之可審計沙盒與基準測試

摘要

近期在持久化個人代理框架方面的進展，使得以人為中心的代理網絡成為現實的部署目標：每位使用者可由一個 AI 代理提供服務，該代理代表使用者行事、維護狀態，並透過社交與任務關係與其他代理通訊。在這些網絡中，日常工具使用演變為多方持有代理之間的協作，涉及個人工作空間，而檔案、記錄、工具與政策在持有者之間無法直接互通可見。現有的代理基準測試雖涵蓋工具使用與協作，但既未提供具備真實使用者數位工作空間的端到端沙盒以進行可驗證的跨使用者代理協作，也未測試有害行為如何透過以人為中心的代理網絡傳播。我們提出 WeClawArena——一個用於個人工作空間上多方持有代理協作的可審計基準測試與運行時沙盒。WeClawArena 針對協作式工具使用任務，其中個人工作空間同時承擔操作工具與個人約束的雙重角色。該基準測試涵蓋六個跨使用者任務領域中的 124 個基礎任務，並擴展為 620 個情境變體，每個基礎任務配有一個良性對照組與四個攻擊向量變體。沙盒記錄同儕訊息、工具呼叫、資源操作、受治理決策與最終工作空間狀態。WeClawArena 分別報告效用與攻擊成功率，並依據有界運行時證據對攻擊成功進行審計，支援任務故障、隱私洩漏、投毒證據與無效權限路徑的診斷。

English

Recent advances in persistent personal-agent frameworks are making human-centered agent networks realistic deployment targets: each user can be served by an AI agent that acts on the user's behalf, maintains state, and communicates with other agents through social and task relations. In these networks, everyday tool use becomes multi-party owned-agent collaboration over personal workspaces, where files, records, tools, and policies are not directly visible across owners. Existing agent benchmarks study tool use and collaboration, but they do not provide an end-to-end sandbox for verifiable cross-user agent collaboration with realistic user digital workspaces or test how harmful actions can travel through the human-centered agent network. We introduce WeClawArena, an auditable benchmark and runtime sandbox for multi-party owned-agent collaboration over personal workspaces. WeClawArena targets collaborative tool-use tasks in which personal workspaces serve as both operational tools and personal constraints. The benchmark contains 124 base tasks across six cross-user task domains and expands them into 620 scenario variants, with one benign control and four attack-vector variants per base task. The sandbox records peer messages, tool calls, resource operations, governed decisions, and final workspace states. WeClawArena reports utility and attack success rate separately and audits attack success from bounded runtime evidence, supporting diagnosis of task breakdown, privacy leakage, poisoned evidence, and invalid authority paths.