You need an evolutionary female police system to "track down killers".

  It's the first time in the history of the world.

Today's AI Agents are more than just "talking" models in the chat window -- they're accessing browsers, file systems, terminals, APIs, MCP services, and all kinds of automated workflows, and they're really starting to perform tasks for users.

The problem becomes even more dangerous: the agent not only listens to what the user says, but also actively reads the outside world. Search results, web pages, local files, tool returns, logs, README, API payloads can all go into its context and become the basis for its next action.

A malicious instruction hidden on a web page may be more concealed and dangerous than an explicit attack prompt.

This leads to a whole new security paradox: the more active the agent, the more external information it relies on; and the more external information, the more poisoned the intruder can be.

Traditional prompt injection is usually understood as a malicious prompter for explicit user input.

But in an Agent scenario, an attack can be more concealed: it could be a hidden text in a web page, a search result summary, a description in a local Markdown file, or a field that an API calls back once.

These content may appear to be ordinary information, but may carry malicious targets such as "ignoring the original instructions", "calling a tool", "leaking the file content", "changing the next step plan".

What's even more troubling is that real Agent systems often require low latency, low cost, and sustainable operation. It's not always realistic to call on an expensive large model to perform security scrutiny whenever external content encounters; they rely entirely on artificial rules and are easily bypassed by new attacks.

To solve this problem, the researchers proposed CAITLYN, the core idea of which is hardcore: not just to let the agent passively hit, passively detect, but to let it automatically summarize failures after a new type of attack, synthesize new defense skills and immerse those skills in a replicable defense skill library.

Link to the paper:https://arxiv.org/abs/2608.27990

The main page of the project:https://xiaoyuxu1.github.io/Caitlyn-project/

Code address:https://github.com/liangzid/caitlyn

In other words, CAITLYN is not a one-time written static firewall, but a continually evolving Agent security middleman: the front intercepts attacks, the rear absorbs failures, and turns "leakage fish" into a new weapon.

CAITLYN's overall framework. The system consists of two parts: rapid-running defense and counter-case-driven defense evolution.

CAITLYN project LOGO

CAITLYN's system design can be broadly divided into two layers. The first layer is System I: Fast Running Defense. The second layer is System II: Reverse Driven Defense Evolution.

In System I, external content first enters Tier-0 filters. Low-cost defense skills such as executable scripts, signature rules, and inspirational detection are used. Their goal is to quickly handle high confidence risks: direct interception if hit; and more complex judgment processes if not hit.

CAITLYN uses a Tier-1 LLM classifier for more ambiguous and difficult-to-judge inputs. It does not allow large models to take over everything, but uses large models in places that require more semantic judgment to strike a balance between cost, latency and detectability.

When certain new attacks still bypass existing lines of defense, System II takes over the follow-up process. The system converts these miss cases into counter examples and then generates new defense entries by constructing hints, synthesizing defense skills, sandbox verification, reviewing and rewriting the process.

The most critical part of CAITLYN is that it turns this "bypassed" thing into a fuel for systemic evolution. Once an attack escapes the current defense, it is no longer just a log of failure, but is transformed into the next round of defense synthetic input.

The new defenses produced are not randomly written into the system, but need to be verified and reviewed: they must be able to stop counterattacks while avoiding harm to normal content. The accepted skills will be rewritten into a shared defense library for subsequent Agent calls.

This makes CAITLYN more like a continuously updated security middleman rather than a single detector. It can put the pressure on the rules library to be maintained manually, partially transformed into the process of learning and synthesizing the system from counter-cases.

The researchers evaluated CAITLYN in a number of Agent and attack settings, including Agent Dojo-S250, ASPI-S, SafeClawBench-S240, and Emerging settings, which emphasized the ability to adapt to new attacks.

Experiments have shown that CAITLYN can significantly reduce the success rate of attacks while maintaining a low failure rate. Static defenses are still easily bypassed, especially in emerging attack scenarios, while CAITLYN-evolved can reduce the success rate of attacks by about 40 percentage points through the addition of defense skills.

Compared to the CAITLYN-evolved, ASR is significantly lower compared to static baselines.

In sequential synthesis settings, CAITLYN also demonstrates continuous accumulation capabilities: As new attacks are gradually exposed, the system can continuously synthesize active skills and add them to a defense library.

Sequential defense synthetic curves. The system gradually accumulates defensive capabilities after new attacks appear.

In a real Agent system, the security module must not only be "accurate", but also be fast enough, cheap enough, and easy enough to deploy. Otherwise, it will become a bottleneck for the entire Agent workflow.

CAITLYN's design therefore emphasizes layering: low-cost skills prioritize dealing with common risks, LLM intervenes only on more complex cases, and long-term evolutionary modules deploy new attacks as skills that can be rapidly deployed in the future.

CAITLYN maintains a stable detection capability across multiple attack datasets.

In the age of Agents, Prompt Injection is no longer just a Prompt-level combat technique, but a system security issue.

An agent can read documents, access web pages, and call tools, which means that external content can influence its decision-making path.

The real danger is that an attack doesn't have to look like an attack. It can be a web description, a search result summary, a README file, an API returns text, or even a log returns a tool.

CAITLYN's meaning is that it moves the defense from "man-written rules" to "system from failure to synthesis rules". When an attack bypasses the line of defense, it not only fails once, but becomes the training material for the next round of defense evolution.

1. CAITLYN, a set of self-defense intermediates aimed at LLM agents, is proposed to be used to deal with the emergence of new types of prompt injection attacks.

2. The design of System I + System II is a two-tiered architecture that combines rapid runtime scanning, LLM classification and counter-case-driven defense synthesis.

3. Build a replicable defense skill library that allows defense capabilities to be accumulated from single failures and replicated in subsequent missions.

4. In the emerging attack scenario, the success rate of attacks decreased by about 40 percentage points to verify the effectiveness of the system in multi-agent and attack settings.

The development of AI Agents is driven by the use of stronger tools, longer task chains, and more complex external environments.

The future Agent security system cannot rely solely on single-entry scrutiny, nor can it rely entirely on man-made maintenance rules. Like the immune system, it needs to know which content can be trusted, which content should be intercepted, which failures should be remembered, and transformed into new defense capabilities.

As attacks begin to change, the defense system must evolve as well.