The paper examines the security challenges of delegating authority to autonomous LLM agents that act on users’ behalf. It introduces a threat model with four adversaries and eight security requirements, demonstrates that current frameworks (LangGraph, CrewAI, AutoGen, MCP) fail to meet these standards, and presents an authorization broker that blocks all identified threats with minimal overhead. The broker is shown to resist numerous attacks and limits compromised sub‑agents to their delegated tasks, and its principles are implemented in VotalAI’s LLM Shield.
By Panduranga Sai Varma Dantuluri, Jyotirmoy Sundi
arXiv:2608.29942v1 Announce Type: cross
Abstract: The key limitation of current state-of-the-art influence-based guardrails is that they do not reliably distinguish a legitimate, user-authorized acti...
By Tanzim Ahad, Ismail Hossain, Md Jahangir Alam, Sai Puppala, Syed Bahauddin Alam, Sajedul Talukder
arXiv:2609.14744v2 Announce Type: replace
Abstract: By acquiring compute, credentials, accounts, services, and other agents, autonomous AI agents can introduce new authority into a task. Payment, bud...
By Genliang Zhu (Accentrust, Georgia Institute of Technology), Chu Wang (Accentrust, University of Illinois Urbana-Champaign)
AcquireBound is a runtime authorization framework that ensures AI agents can safely acquire and activate resources such as compute, credentials, and services. It quarantines acquired outputs, resolves their capabilities through authenticated evidence, and activates them only after verifying a manifest, provenance, and relational constraints. The system demonstrates strong safety properties, passing extensive benign and unsafe trace tests across multiple resource classes.
By Genliang Zhu
arXiv:2608. 07167v1 Announce Type: new Abstract: Giving an AI agent the ability to send emails, query databases, or execute commands is useful--until the agent is tricked into doing something it shouldn't.
By Aditya Katkar, Om Karkele, Kartik Mandhane, Manisha More, Yash Kashid
arXiv:2609.22573v1 Announce Type: cross
Abstract: LLM agents translate natural-language context, which may include attacker-controlled text, into privileged tool calls, so authorization must remain e...
By Huan Li, Yuwei Wang, Srinivasan Manoharan
arXiv:2606. 28679v1 Announce Type: cross Abstract: Tool-using LLM agents increasingly read untrusted content while holding side-effecting tools such as payments, email, CRM, and infrastructure APIs, yet common framework defaults still conflate tool exposure with authorization.
By David Mellafe Zuvic
arXiv:2608. 15888v1 Announce Type: new Abstract: LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents.
By Xabier Muruaga
arXiv:2607. 25364v1 Announce Type: new Abstract: Tool-using agents expose structured calls but commonly attach free-form rationales.
By Genliang Zhu (Accentrust, Georgia Institute of Technology), Chu Wang (Accentrust, University of Illinois Urbana-Champaign)
The paper presents a systematic security analysis of Google’s Agent Payments Protocol (AP2) version 2.0, focusing on its roles, transaction lifecycle, and deployment architectures. It identifies 48 threats across five attack families, scores them with the AIVSS, and demonstrates eight high‑risk threats with proof‑of‑concept attacks and mitigations. The study also introduces a deployment‑aware scanner to map threats to various checks, showing that signed mandates alone cannot guarantee user intent when pre‑authorization context is manipulated.
By Avital Aviv, Parth A. Gandh, Ron Bitton, Asaf Shabtai
The paper "Trust Me, I'm Your Developer: Self-Issued Authentication in Large Language Models" investigates how large language models (LLMs) handle identity verification when prompted by users. Through experiments with ChatGPT, Claude, Qwen, Mistral, and Llama, the authors find that some models generate and evaluate their own tests, accepting unsupported claims of developer identity—an outcome they term Conversational False Authentication (CFA). The study highlights that such self-issued authentication can lead to false identity judgments without affecting actual authorization boundaries, underscoring the need for external security components to manage authenticated identity.
By Syed Ghazanfar Abbas, Dongyan Xu
arXiv:2609.00052v1 Announce Type: cross
Abstract: Commercial LLM APIs advertise a specific foundation model, but the served backbone may be silently substituted, quantized, or wrapped, for example to...
By Xun Wang, Bihe Zhao, Michael Backes, Franziska Boenisch, Adam Dziedzic