ToolHazard：面向基于LLM的智能体安全评估与对齐的对抗性环境扩展

摘要

集成外部工具的大语言模型（LLM）智能体容易遭受环境状态中嵌入的间接提示注入攻击。然而，现有研究大多依赖手动实现或复用的环境、基于LLM的随机工具模拟以及预定义的注入位置，限制了跨更广泛领域的可扩展安全研究。为弥合这一差距，我们提出**ToolHazard**，一个可扩展的对抗环境合成框架，该框架减少了人工工程投入，并支持通过额外的种子领域和算力进行扩展。通过环境模拟器、攻击者智能体和用户模拟器，ToolHazard合成可执行的有状态环境，发现可行的注入点并生成环境特定的攻击载荷，同时构建基于状态的长程任务。基于ToolHazard，我们构建了**ToolHazard-Bench**，用于在复杂工作流程和多样化环境攻击下对智能体进行压力测试。实验揭示了智能体的重大安全漏洞，并表明注入时机和位置会影响攻击效果。此外，ToolHazard生成的对齐数据在ToolHazard-Bench和AgentDojo上均提升了安全性，同时保持了良性任务的效用。

English

Large language model (LLM) agents integrated with external tools are vulnerable to indirect prompt injections embedded in environmental states. However, existing studies largely rely on manually implemented or reused environments, stochastic LLM-based tool simulation, and predefined injection locations, limiting scalable security research across broader domains. To bridge this gap, we propose **ToolHazard**, a scalable adversarial environment synthesis framework that reduces human engineering and supports expansion with additional seed domains and compute. Through an Environment Simulator, an Attacker Agent, and a User Simulator, ToolHazard synthesizes executable stateful environments, discovers viable injection points and generates environment-specific payloads, and constructs state-grounded long-horizon tasks. Based on ToolHazard, we build **ToolHazard-Bench** for stress-testing agents under complex workflows and diverse environmental attacks. Experiments reveal substantial agent vulnerabilities and show that injection timing and placement affect attack effectiveness. Moreover, ToolHazard-generated alignment data improves security on both ToolHazard-Bench and AgentDojo while preserving benign task utility.