WeClawArena: An Auditable Sandbox and Benchmark for Cross-User Agents Collaboration and Security in Human-Centered Agent Networks

The Problem: Agents Acting for Multiple Users Create New Security Risks

AI agents are moving beyond single-user tools toward persistent personal agents that act on behalf of individual users and collaborate with other agents. Think of each person having their own AI assistant that manages files, schedules, and handles tasks—but these assistants sometimes need to work together across different people's workspaces. This creates a novel security problem: how do you let agents collaborate while preventing one compromised agent from damaging another user's data or impersonating them? Existing benchmarks test whether agents can use tools or work together, but they don't model realistic personal workspaces or examine how harmful actions propagate through multi-agent networks.

WeClawArena: A Sandbox That Records Everything

The authors introduce WeClawArena, a sandbox and benchmark designed specifically for testing cross-user agent collaboration under security constraints. The sandbox is "auditable"—it records all peer messages, tool calls, resource operations, governance decisions, and final workspace states so researchers can trace exactly what went wrong when an attack succeeds.

The benchmark contains 124 base collaborative tasks spanning six domains (likely covering scenarios like shared document editing, joint scheduling, or coordinated file management). Each base task expands into five variants: one benign version and four attack-vector variants. This structure lets researchers isolate whether failures stem from legitimate collaboration breakdowns or from security vulnerabilities.

The key innovation is separating utility metrics from security metrics. Rather than reporting a single "success rate," WeClawArena measures task completion separately from attack success—so a researcher can see, for instance, whether an agent completed its task while also leaking private information.

Why This Matters

As personal agents become deployed in real systems, the security stakes are high. A malicious agent or a compromised agent could exploit collaborative workflows to access another user's files, forge communications, or manipulate shared records. Current agent benchmarks don't capture these risks because they either assume a single user or lack realistic workspace isolation. WeClawArena closes this gap by:

• Providing a realistic testbed: Tasks occur over actual personal workspaces with actual access control constraints, not toy environments.
• Enabling diagnosis: The audit trail lets researchers pinpoint whether failures stem from authority violations, privacy leaks, evidence poisoning, or invalid permission chains.
• Scaling evaluation: 620 task variants allow systematic exploration of attack surfaces across different collaboration patterns.

The benchmark essentially asks: given two agents that need to cooperate, how robustly can we keep them from hurting each other? For a future where personal AI agents coordinate across thousands of users, answering that question is not optional.