Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents

AgentSecGraph static analysis maps security-sensitive operations in LLM agent code across 67 repositories, surfacing one confirmed vulnerability and 23,866 candidates.

AgentSecGraph constructs a candidate-centered Security-Aware Agent Dependency Graph for each security-sensitive operation, augmenting operation identity with agent relevance, source and dependency evidence, trust-boundary context, guard evidence, and external-effect semantics. The accompanying AgentSecBench corpus covers 67 real-world LLM-agent repositories across 11 ecosystems and 37,542 source files, yielding 23,866 static security-sensitive operation candidates across 65 repositories. Corpus-wide analysis recovers dependency evidence for 9,821 candidates (41.15%) and guard evidence for 3,075 (12.88%), completing in 50.8 minutes. A reproduction-backed evaluation establishes 22 security-sensitive behaviors across 13 repositories, including one confirmed vulnerability and one pending disclosure candidate, while Security-ADG preserves 91.1% of reference context versus 20.0% for a sink-only view.