CAITLYN targets agent poisoning by turning missed attacks into reusable defenses
Researchers have introduced CAITLYN, a self-evolving security middleware built for large language model agents that increasingly rely on browsers, filesystems, terminals, APIs, MCP services and automated workflows to complete tasks. The paper focuses on a growing risk in agent systems: prompt injection no longer arrives only as explicit user input, but can be hidden inside webpages, search snippets, local Markdown files, logs, README files or API payloads that an agent treats as trustworthy context. CAITLYN uses a two-layer design. System I handles fast runtime defense, starting with a Tier-0 filter based on executable scripts, signature rules and heuristic detection, then escalating ambiguous cases to a Tier-1 LLM classifier. When new attacks still slip through, System II converts those miss cases into counter examples, synthesizes new defense skills, validates them in a sandbox, reviews them and writes approved entries back into a shared defense skill library. The researchers evaluated the system across AgentDojo-S250, ASPI-S, SafeClawBench-S240 and an Emerging setting designed to test adaptation to new attacks. According to the article, CAITLYN reduced attack success rates while keeping false positives low. In Emerging attack scenarios, CAITLYN-evolved cut attack success rates by about 40 percentage points versus static defenses. The article was originally published by the WeChat account Xinzhiyuan and republished by MarsBit.
