arXiv AI September 23, 2026 By Kaiyuan Zhang, Yuke Peng, Ke Jiang, Yinqian Zhang

ActGov: Governing LLM Agent Actions via Policy-Constrained Validation

ActGov is a runtime enforcement framework that validates each action proposed by a large language model (LLM) agent before it interacts with external tools, ensuring that actions stay within task‑scoped authorization boundaries and comply with dynamically constructed policies. It builds policies from tool specifications, benign tasks, and failure traces, verifying updates via SMT‑based counterexample checking. In evaluations on AgentDojo and AgentDyn benchmarks, ActGov consistently reduces indirect prompt‑injection attack success while maintaining task utility, outperforming existing defenses.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

Hugging Face Trending Papers

5d ago

ActGov: Governing LLM Agent Actions via Policy-Constrained Validation

Large language model (LLM) agents increasingly execute long-horizon workflows through external tools, allowing untrusted outputs to influence subsequent actions and exceed user authorization. Existing...

llms agents benchmarks

arXiv AI

Sep 15

ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents

arXiv:2609.14987v1 Announce Type: cross Abstract: Large language model (LLM) agents interact with external environments through tool invocation, but tool outputs can also expose them to indirect prom...

By Bingzheng Wang, Xiaoyan Gu, Wentao Wang, Xingyou Yang, Hongcheng Li, Rong Yin

llms agents benchmarks

arXiv AI

Jun 10

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation

arXiv:2606. 10749v1 Announce Type: cross Abstract: Large language model (LLM) agents are rapidly moving from conversational interfaces to software components that plan, invoke tools, maintain memory, and act on external environments.

By Yuchen Ling, Shengcheng Yu, Zhenyu Chen, Chunrong Fang

llms agents benchmarks

arXiv AI

Aug 28

When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents

The paper introduces SARA, a framework that separates action induction from runtime authorization in tool‑augmented LLM agents. By treating these as distinct roles, SARA uses an Action Probe to record action provenance and only authorizes tool calls that align with the user objective and past successful executions. Experiments on AgentDojo and AgentDyn show that SARA reduces action‑to‑side‑effect risk to below 0.63% while preserving task performance.

By Xiaokun Guo, Zhen Xu, Dongdong Huo, Yanqiu Zhang, Wei Wang, Qinfu Yang, Dongjin Yu, Yu Wang

llms agents multimodal

arXiv AI

Jul 21

STAC: When Innocent Tools Form Dangerous Chains for LLM Agents

arXiv:2509. 25624v3 Announce Type: replace-cross Abstract: As LLMs advance into autonomous agents with tool-use capabilities, they introduce security challenges that extend beyond traditional content-based LLM safety concerns.

By Jing-Jing Li, Jianfeng He, Chao Shang, Devang Kulshreshtha, Xun Xian, Yi Zhang, Hang Su, Sandesh Swamy, Yanjun Qi

llms agents multimodal benchmarks safety

arXiv AI

Sep 2

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems

The paper examines the security challenges of delegating authority to autonomous LLM agents that act on users’ behalf. It introduces a threat model with four adversaries and eight security requirements, demonstrates that current frameworks (LangGraph, CrewAI, AutoGen, MCP) fail to meet these standards, and presents an authorization broker that blocks all identified threats with minimal overhead. The broker is shown to resist numerous attacks and limits compromised sub‑agents to their delegated tasks, and its principles are implemented in VotalAI’s LLM Shield.

By Panduranga Sai Varma Dantuluri, Jyotirmoy Sundi

llms agents

One email a morning, machine-written

Related stories

ActGov: Governing LLM Agent Actions via Policy-Constrained Validation

ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation

When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents

STAC: When Innocent Tools Form Dangerous Chains for LLM Agents

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems