Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing

2026-07-20

AI Summary

This study addresses the security threat posed by authorized large language model (LLM) agents in high-performance computing (HPC) environments that are hijacked via external malicious instructions to perform unauthorized operations—a scenario termed “hijacked authorized agents.” It presents the first systematic characterization of the attack surface under realistic HPC conditions, including job schedulers, shared storage, multi-project accounts, and scientific workflows. The work exposes a fundamental limitation in current identity and isolation mechanisms: their inability to constrain the intent of agent-executed tasks. To address this gap, the paper introduces the concept of a “task-intent security boundary” and develops TaskBound, the first security evaluation benchmark tailored for LLM agents in HPC. This framework provides both theoretical grounding and empirical support for defending against indirect prompt injection and tool misuse.

Abstract

Large language model (LLM) agents are starting to take on routine work in high-performance computing (HPC), including monitoring Slurm jobs, diagnosing failed builds, inspecting simulation output, and coordinating scientific workflows. To do this work, an agent commonly acts under its user's credentials and inherits the user's access to files and the scheduler. This arrangement creates a failure mode that ordinary account-level controls do not capture. Adversarial instructions in a log, tool description, shared file, or peer-agent message may redirect the agent beyond the task the user assigned, even though every resulting command is authenticated and permitted for that account. We refer to this as the hijacked authorized agent problem. Existing agent-security studies explain relevant mechanisms, such as indirect prompt injection and tool misuse, but generally evaluate them in web, enterprise, or personal-assistant settings. HPC security, by contrast, has mature controls for identity and isolation but does not ordinarily represent the intent of a particular task. This paper defines the threat model in the HPC setting, identifies attack surfaces created by schedulers, shared storage, multi-project accounts, and scientific workflows, and examines where current controls fall short. It concludes with a research agenda and a plan for an empirical benchmark, TaskBound.

Problem

• LLM-agent security
• high-performance computing
• authorized agent hijacking
• adversarial instructions
• HPC security

Innovation

• hijacked authorized agent
• LLM-agent security
• high-performance computing
• TaskBound
• adversarial instruction