Research · curated 15 Jul 2026
DualView: Preventing Indirect Prompt Injection in Personal AI Agents
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
DualView addresses stored/persistent indirect prompt injection, a gap in prior Dual-LLM defenses that matters for defenders running local AI agents with file, shell, and network access that share an environment with humans and other programs.
DualView is a defense presented in an arXiv paper that extends untrusted-data tracking from a personal AI agent's context out into the user's environment (file system, shell, network, and other agents) to block indirect prompt injection, including a newly-highlighted 'stored IPI' variant where an agent saves attacker-controlled data and later rereads it as trusted. Deployed as an OpenClaw plugin using only tool hooks, DualView gives each channel an AgentView (untrusted data shown as symbols) and a HumanView (original data), and reportedly blocked every IPI attack on an IPI benchmark and PinchBench while preserving utility.