Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Agent Audit: A Security Analysis System for LLM Agent Applications

Haiyue Zhang, Yi Nian, Yue Zhao

Abstract

What should a developer inspect before deploying an LLM agent: the model, the tool code, the deployment configuration, or all three? In practice, many security failures in agent systems arise not from model weights alone, but from the surrounding software stack: tool functions that pass untrusted inputs to dangerous operations, exposed credentials in deployment artifacts, and over-privileged Model Context Protocol (MCP) configurations. We present Agent Audit, a security analysis system for LLM agent applications. Agent Audit analyzes Python agent code and deployment artifacts through an agent-aware pipeline that combines dataflow analysis, credential detection, structured configuration parsing, and privilege-risk checks. The system reports findings in terminal, JSON, and SARIF formats, enabling direct integration with local development workflows and CI/CD pipelines. On a benchmark of 22 samples with 42 annotated vulnerabilities, Agent Audit detects 40 vulnerabilities with 6 false positives, substantially improving recall over common SAST baselines while maintaining sub-second scan times. Agent Audit is open source and installable via pip, making security auditing accessible for agent systems. In the live demonstration, attendees scan vulnerable agent repositories and observe how Agent Audit identifies security risks in tool functions, prompts, and more. Findings are linked to source locations and configuration paths, and can be exported into VS Code and GitHub Code Scanning for interactive inspection.

Agent Audit: A Security Analysis System for LLM Agent Applications

Abstract

What should a developer inspect before deploying an LLM agent: the model, the tool code, the deployment configuration, or all three? In practice, many security failures in agent systems arise not from model weights alone, but from the surrounding software stack: tool functions that pass untrusted inputs to dangerous operations, exposed credentials in deployment artifacts, and over-privileged Model Context Protocol (MCP) configurations. We present Agent Audit, a security analysis system for LLM agent applications. Agent Audit analyzes Python agent code and deployment artifacts through an agent-aware pipeline that combines dataflow analysis, credential detection, structured configuration parsing, and privilege-risk checks. The system reports findings in terminal, JSON, and SARIF formats, enabling direct integration with local development workflows and CI/CD pipelines. On a benchmark of 22 samples with 42 annotated vulnerabilities, Agent Audit detects 40 vulnerabilities with 6 false positives, substantially improving recall over common SAST baselines while maintaining sub-second scan times. Agent Audit is open source and installable via pip, making security auditing accessible for agent systems. In the live demonstration, attendees scan vulnerable agent repositories and observe how Agent Audit identifies security risks in tool functions, prompts, and more. Findings are linked to source locations and configuration paths, and can be exported into VS Code and GitHub Code Scanning for interactive inspection.
Paper Structure (24 sections, 3 figures, 2 tables)

This paper contains 24 sections, 3 figures, 2 tables.

Table of Contents

  1. Introduction
  2. System Architecture
  3. Overview
  4. Agent-Aware Code Analysis
  5. Tool Boundary Detection.
  6. Intra-procedural Taint Analysis.
  7. Prompt Injection Surface Detection.
  8. Credential and Configuration Analysis
  9. Credential Detection.
  10. MCP Configuration Security.
  11. Privilege Escalation Detection.
  12. Confidence-Based Tiering
  13. Evaluation
  14. Agent-Vuln-Bench (AVB)
  15. Detection Results
  16. ...and 9 more sections

Figures (3)

  • Figure 1: System architecture of Agent Audit. Four specialized scanners feed into a unified rule engine with confidence-based tiering.
  • Figure 2: Distribution of Agent Audit's 57 detection rules across the 10 OWASP Agentic Security Initiative categories. Four additional cross-cutting rules (not shown) cover credentials, MCP supply chain, and privilege escalation.
  • Figure 3: Per-set recall comparison on AVB. Agent Audit achieves 100% recall on injection/RCE and MCP vulnerability sets, where existing tools have limited or zero coverage.