ActGov is a runtime enforcement framework that validates each action proposed by a large language model (LLM) agent before it interacts with external tools, ensuring that actions stay within task‑scoped authorization boundaries and comply with dynamically constructed policies. It builds policies from tool specifications, benign tasks, and failure traces, verifying updates via SMT‑based counterexample checking. In evaluations on AgentDojo and AgentDyn benchmarks, ActGov consistently reduces indirect prompt‑injection attack success while maintaining task utility, outperforming existing defenses.
Large language model (LLM) agents increasingly execute long-horizon workflows through external tools, allowing untrusted outputs to influence subsequent actions and exceed user authorization. Existing...
arXiv:2609.14987v1 Announce Type: cross Abstract: Large language model (LLM) agents interact with external environments through tool invocation, but tool outputs can also expose them to indirect prom...
arXiv:2606. 10749v1 Announce Type: cross Abstract: Large language model (LLM) agents are rapidly moving from conversational interfaces to software components that plan, invoke tools, maintain memory, and act on external environments.
The paper introduces SARA, a framework that separates action induction from runtime authorization in tool‑augmented LLM agents. By treating these as distinct roles, SARA uses an Action Probe to record action provenance and only authorizes tool calls that align with the user objective and past successful executions. Experiments on AgentDojo and AgentDyn show that SARA reduces action‑to‑side‑effect risk to below 0.63% while preserving task performance.
arXiv:2509. 25624v3 Announce Type: replace-cross Abstract: As LLMs advance into autonomous agents with tool-use capabilities, they introduce security challenges that extend beyond traditional content-based LLM safety concerns.
SecureGARD is a dynamic ontology‑guided governance framework designed to secure tool‑using large language model agents. It grounds heterogeneous tool calls in a shared semantic representation, using an executable ontology combined with episode‑level task state to make deterministic ready, waiting, and forbidden decisions. The system evolves its ontology offline from verified training executions, ensuring logical consistency and protecting entailments, and achieves a 0% attack success rate across multiple benchmarks while improving task utility under attack.
arXiv:2609.37196v1 Announce Type: cross Abstract: Tool-using LLM agents remain vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context, allow...
The paper examines the security challenges of delegating authority to autonomous LLM agents that act on users’ behalf. It introduces a threat model with four adversaries and eight security requirements, demonstrates that current frameworks (LangGraph, CrewAI, AutoGen, MCP) fail to meet these standards, and presents an authorization broker that blocks all identified threats with minimal overhead. The broker is shown to resist numerous attacks and limits compromised sub‑agents to their delegated tasks, and its principles are implemented in VotalAI’s LLM Shield.
arXiv:2606. 09549v1 Announce Type: cross Abstract: Tool-using large language model (LLM) agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final output check can intervene.
arXiv:2605. 18414v2 Announce Type: replace-cross Abstract: Large language models increasingly operate as autonomous agents that select and invoke tools from large registries.
The paper "From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents" examines how coding agents that use execution harnesses to enforce permission boundaries can be tricked into granting overly broad allow-rules. By planting adversarial context in a repository, attackers can steer an agent into requesting a plausibly justified yet dangerously wide permission, which, if approved, lets the agent bypass the harness and execute malicious actions without further human oversight. Experiments on platforms such as Claude Code and Codex CLI show that 58% of trials succeed in eliciting such rules, which then cover 56.9% of category-specific capability tests and enable silent goal completion in 81% of approved cases, thereby undermining the safety promise of human-in-the-loop oversight.
arXiv:2606. 30755v1 Announce Type: cross Abstract: Claw-like AI agents (e.