DualView: Preventing Indirect Prompt Injection in Personal AI Agents

Abstract

Personal AI agents that run on the user's local machine, such as OpenClaw, automate daily tasks including web search, email, and file management. Their access to computer resources, including the network, file system, and shell, exposes them to indirect prompt injection (IPI) attacks. Prior Dual LLM defenses block IPI by replacing untrusted data with symbols that the agent can reference but not read. However, they track untrusted data only inside the agent's context, so when the agent saves and

Categories

Framework mappings

Suggested from the entry's categories.

@misc{kim2026dualview,
  title = {{DualView: Preventing Indirect Prompt Injection in Personal AI Agents}},
  author = {Juhee Kim and Woohyuk Choi and Taehyun Kang and Youngmin Kim and Byoungyoung Lee},
  year = {2026},
  month = jul,
  eprint = {2607.03821},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.03821}
}