arXiv AI
Aug 18
Bounded Agents: Delegation Security for Multi-Agent AI Systems
arXiv:2608. 15888v1 Announce Type: new Abstract: LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents.
Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems
The paper examines the security challenges of delegating authority to autonomous LLM agents that act on users’ behalf. It introduces a threat model with four adversaries and eight security requirements, demonstrates that current frameworks (LangGraph, CrewAI, AutoGen, MCP) fail to meet these standards, and presents an authorization broker that blocks all identified threats with minimal overhead. The broker is shown to resist numerous attacks and limits compromised sub‑agents to their delegated tasks, and its principles are implemented in VotalAI’s LLM Shield.
Related stories
arXiv AI
Sep 23
ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
ActGov is a runtime enforcement framework that validates each action proposed by a large language model (LLM) agent before it interacts with external tools, ensuring that actions stay within task‑scoped authorization boundaries and comply with dynamically constructed policies. It builds policies from tool specifications, benign tasks, and failure traces, verifying updates via SMT‑based counterexample checking. In evaluations on AgentDojo and AgentDyn benchmarks, ActGov consistently reduces indirect prompt‑injection attack success while maintaining task utility, outperforming existing defenses.
arXiv AI
Sep 7
CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls
The paper introduces CONTINUITY, a framework that ensures secure composition of large language model (LLM) agent controls by using assume‑guarantee contracts and authenticated security contexts. It models each component with signed root grants, provenance commitments, and other mechanisms to carry security context across transitions, formalizing end‑to‑end consequence integrity. A reference verifier and fault‑injection suite demonstrate that the full configuration prevents harmful effects while completing all benign tasks and correctly escalating ambiguous cases.
arXiv AI
Jun 10
Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
arXiv:2606. 10749v1 Announce Type: cross Abstract: Large language model (LLM) agents are rapidly moving from conversational interfaces to software components that plan, invoke tools, maintain memory, and act on external environments.
arXiv AI
Oct 7
APEX: Active Protection at Execution Boundaries for LLM Agents
The paper introduces APEX, an active defense for large language model agents that protects against indirect prompt injection by enforcing safety at execution boundaries. APEX uses an evidence‑gated prevention contract and deception‑based exposure to ensure that only authorized effects, endorsed by the task, are executed. Evaluation shows APEX achieves near‑zero attack success across multiple benchmarks and capability‑unit types, outperforming 13 baseline defenses.
Hugging Face Trending Papers
Sep 21
ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
Large language model (LLM) agents increasingly execute long-horizon workflows through external tools, allowing untrusted outputs to influence subsequent actions and exceed user authorization. Existing...
arXiv AI
Sep 25
AgentKernel: The Trust-Native Agentic Operating System
AgentKernel proposes a trust‑native operating system for AI agents, arguing that current governance layers are insufficient because they share the same process trust boundary as the agents. The OS introduces a mandatory enforcement boundary organized into four pillars—Identity, Perception, Cognition, and Execution—each adapting classical OS security principles to address semantic‑level failures such as prompt injection, memory poisoning, and tool misuse. By wrapping the agent lifecycle in this structured, non‑bypassable framework, AgentKernel aims to provide a unified security layer that can enforce identity, input mediation, memory governance, and execution control across the entire agent lifecycle.
arXiv AI
Aug 11
Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control
arXiv:2605. 18414v2 Announce Type: replace-cross Abstract: Large language models increasingly operate as autonomous agents that select and invoke tools from large registries.
arXiv AI
Sep 23
When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems
The paper discusses how large language model agents now act as privileged principals with kernel‑grade authority, yet lack the trusted mediation traditionally required for operating‑system security. It introduces a taxonomy that distinguishes between provenance‑based deterministic checks and content‑semantic checks, identifying a central mediation gap in distinguishing data from instruction and authorized from unauthorized actions. The authors argue that this gap creates an irreducible risk of undetected attacks whenever inputs and actions are not pre‑enumerated, and they propose defenses across runtime monitoring, architectural separation, and authorization while critiquing current evaluation practices. They extend the analysis to AI‑native operating systems where the model itself serves as the arbitration core, outlining design constraints, challenges, and a research agenda.
arXiv AI
Aug 13
Cryptographically verifiable authorization for autonomous AI agents: A falsifiable hypothesis and proof-of-concept
arXiv:2607. 21325v2 Announce Type: replace-cross Abstract: Autonomous AI agents increasingly execute actions, invoke tools, and operate on protected resources with limited human oversight.
arXiv AI
Jul 24
Toward cryptographically verifiable authorization for autonomous AI agents: A security hypothesis, preliminary formal model, and proof-of-concept implementation
arXiv:2607. 21325v1 Announce Type: cross Abstract: Autonomous AI agents increasingly execute actions, invoke tools, and operate on protected resources with limited human oversight.
arXiv AI
Sep 25
Cryptographically verifiable authorization for autonomous AI agents: a falsifiable hypothesis and proof of concept
arXiv:2607. 21325v3 Announce Type: replace-cross Abstract: Autonomous AI agents increasingly execute actions, invoke tools, and operate on protected resources with limited human oversight.