自身狀態攻擊對自託管AI代理：作業系統防禦能走多遠？

摘要

自托管AI代理通过读写自身的内存和配置文件来实现功能。代理可能因自身状态的损坏而受到攻击——这种攻击是通过合法的操作系统系统调用实现的。我们将这类威胁称为自状态攻击。本文研究了操作系统对此类攻击的韧性。形式上，我们定义了一个四轴攻击空间（目标、机制、粒度、时间维度）；探讨了预防、检测和恢复的结构性局限；并引入了基于工作负载条件的可检测性视角。为了实例化该框架，我们从运行于不同工作负载配置文件下的代表性自托管代理中收集实时活动轨迹，并将攻击空间实现为一个23单元的矩阵，包含43个针对实际自状态文件的具体操作，并将这些操作注入到轨迹中。随后，我们评估了经典防御策略与工作负载条件化防御策略。实证结果表明，分层防御体系（指令层和配置层采用访问控制预防、内存层采用工作负载条件化检测、恢复采用定期备份）对大多数攻击单元有效，但仍存在少量残余攻击面在操作系统层面结构上无法区分。这些发现表明，针对新确立的自状态攻击类别，操作系统层面的防御需要重新审视，可能为这一领域开辟新的研究方向。

English

Self-hosted AI agents read and write their own memory and configuration files to function. An agent may get compromised via corruption of its own state -- a compromise realized via legitimate OS system call invocation. We refer to this class of threats as self-state attacks. In this paper, we investigate the OS resilience to this class of attacks. Formally, we characterize a four-axis attack space (Target, Mechanism, Granularity, Temporal); investigate the structural limits of prevention, detection, and recovery; and introduce a workload-conditioned view of detectability. To instantiate the framework, we collect live activity traces from a representative self-hosted agent running across distinct workload profiles, and realize the attack space as a 23-cell matrix, 43 concrete operations on real self-state files, and injected into those traces. We then evaluate both canonical and workload-conditioned defense strategies. The empirical results show that a layered defense stack (access-control prevention on the instruction and configuration layers, workload-conditioned detection on the memory layer, and periodic backup for recovery) is effective on most attack cells while a small residual attack surface remains structurally indistinguishable at the OS level. These findings suggest that against the newly established class of self-state attacks, OS-level defense needs to be reconsidered, potentially opening new research directions in the field.