Research · curated 21 Jul 2026
DualView: Preventing Indirect Prompt Injection in Personal AI Agents
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
DualView addresses a real gap in existing Dual LLM defenses — stored/persistent indirect prompt injection where malicious prompts survive in the shared user environment and re-enter the agent as trusted data — which matters to defenders deploying local AI agents with file, shell, and network access.
DualView is a research system from CompSec Lab @ SNU (arXiv:2607.03821) that defends personal AI agents like OpenClaw against indirect prompt injection, including a variant called 'stored IPI' where attacker-controlled text persists in the user's file system, shell, or network and is re-read later as trusted data. DualView extends untrusted-data tracking from the agent context into the user's environment by maintaining two views (AgentView shows untrusted data as symbols; HumanView preserves originals) and deploys as an OpenClaw plugin using tool hooks; in evaluation on an IPI benchmark and PinchBench it blocked every IPI attack while keeping utility near the unprotected baseline.