Research · curated 21 Jul 2026
DualView: Preventing Indirect Prompt Injection in Personal AI Agents
First reported · updated · 2 reports arxiv.org
Coverage timeline
Why it matters
DualView addresses a gap in prior Dual-LLM defenses—stored indirect prompt injection—that lets attacker prompts survive in a user's real environment and re-enter an agent as trusted data, a concrete risk for defenders deploying local personal AI agents.
DualView is a research system from CompSec Lab @ SNU (arXiv:2607.03821) that defends personal AI agents such as OpenClaw against indirect prompt injection, including 'stored IPI' where attacker-controlled text persists in the file system, shell, or network and is re-read later as trusted data. It extends untrusted-data tracking beyond the agent context by giving each channel two views—AgentView (untrusted data appears as symbols) and HumanView (original data preserved)—deployed as an OpenClaw plugin via tool hooks, and reports blocking every IPI attack on an IPI benchmark and PinchBench while preserving utility.