Jul 2026· Journal of innovative research and technology· 0 citations
TL;DR
A comprehensive framework based on Tool-Flow Taint Analysis designed to mitigate data exfiltration in Large Language Model agents is introduced, providing a critical foundation for securing next-generation autonomous agents against sophisticated data-stealing attacks in enterprise environments.
Abstract
The rapid integration of Large Language Models into autonomous agentic systems has introduced unprecedented capabilities for task automation, reasoning, and tool utilization. However, equipping these agents with the ability to access external APIs, internal databases, and arbitrary web resources significantly broadens the attack surface for data exfiltration. Malicious actors can leverage prompt injection and indirect prompt injection techniques to hijack the agent control flow, forcing it to retrieve sensitive information and transmit it to attacker-controlled destinations. Existing security mechanisms, which predominantly rely on static prompt filtering or heuristic anomaly detection, fail to maintain context across complex, multi-step tool invocations. This paper introduces a comprehensive framework based on Tool-Flow Taint Analysis designed to mitigate data exfiltration in Large Language Model agents. By adapting classical dynamic taint analysis principles to the semantic and operational workflows of agent toolchains, the proposed architecture tracks sensitive data from predefined sources through intermediate natural language reasoning steps to potential external sinks. We establish robust semantic taint propagation rules capable of operating within the non-deterministic environment of Large Language Models. Extensive experimental evaluations demonstrate that the proposed system achieves high efficacy in intercepting exfiltration attempts while maintaining a low false-positive rate and negligible latency overhead. The findings provide a critical foundation for securing next-generation autonomous agents against sophisticated data-stealing attacks in enterprise environments.
The results show that TraceGrant provides a unified governance layer that connects trusted user intent, runtime evidence, concrete tool execution, and verified task completion.
Bohao Liao, Jing-Chao Wang, Qipeng Song et al.· 0 citations
AEGIS is presented, a policy enforcement component that enables administrators to define fine-grained safeguards against resource abuse across heterogeneous MCP tools and modalities and detects and mitigates abusive behaviors while preserving the flexibility of MCP-based agent ecosystems.
S. Priya, Teryl Taylor, F. Araujo· 2026 56th Annual IEEE Intern...· 0 citations
AgentFlow, a flow-centric policy language and runtime enforcement model for specifying where data may travel in agent systems, is presented and results are preliminary and scoped to the modeled policy-visible agent behaviors and evaluated benchmarks.
MTGuard is proposed, a hybrid analysis-based defense framework designed to safeguard the use of MCP tools in LLM agents by leveraging lifecycle-aware static-dynamic co-analysis and effectively mitigates multiple categories of harmful tool use across different LLM agents while maintaining performance on benign user tasks.
Ping He, Yuexiang Xie, Yaliang Li et al.· arXiv.org· 0 citations
Large language model agents place outputs from external skills into their execution context, allowing attacker-controlled data to influence later privileged actions. Existing defenses mainly classify untrusted content or authorize proposed operations. They do not directly address how an agent's future authority should change once untrusted data enters its state. We present SkillGuard, a harness-level enforcement layer that treats this event as contamination and restricts future capabilities to disconnect the resulting state from deployer-defined forbidden states. Given sound skill summaries and policies, SkillGuard represents security-relevant transitions with a Skill Impact Graph, specifies admissible control over skill parameters via steerability signatures, and mediates invocations with an inline reference monitor. Following contamination, it computes weighted capability restrictions using binary, fractional, or fractional-flow strategies without auxiliary language-model inference. We evaluate SkillGuard on four AgentDojo suites with two backend LLMs, Gemini 2.5 Flash and Llama3.3-70B, against an LLM-only No Defense baseline and three defenses at different system layers: Spotlighting, CaMeL, and AttriGuard. We construct a compositional attack benchmark in which each attack combines observations individually insufficient to induce target violation and evaluate the same baselines on it. Under AgentDojo's Tool Knowledge attacks, SkillGuard eliminates attack success on three of four suites for both backends and reduces it to 4.8% and 14.3% on Slack. Against compositional attacks, it outperforms every baseline on Llama and matches the strongest baseline on Gemini at higher benign utility. Fractional-flow restriction preserves substantially more capabilities than binary restriction at the same attack success rate. Across both settings, SkillGuard adds no model calls or token overhead.
Wu-Jie Xiong, Rabimba Karanjai, Yang Lu et al.· 0 citations
Indirect prompt injection (IPI) plants instructions in the content a tool-using LLM agent reads, steering the agent into harmful tool calls. The strongest defenses are system-level, leveraging techniques such as task-conditional tool screening to prevent execution of malicious tools, and information-flow control to avoid tool execution with untrusted parameters. However, as agents grow more capable, users delegate more to automation. Consequently, tool execution sequences and parameter values are increasingly determined at runtime and cannot be reliably screened from solely user's query without significant utility loss. We present ROPE (Routed Origin Policy Enforcement), which is anchored in a structural notion of trust: a value may reach a state-changing tool only if it traces unforgeably to the user, a source the user explicitly named, or the user's own authoritative records. Enforcement is then a deterministic origin check over an audited set of sensitive tool parameters, and the only reliance on a language model involves solely the trusted user request, out of the attacker's reach. Our approach admits two provable guarantees: 1) at every step of a trajectory, no value whose only origin is attacker-writable content reaches an origin-guarded parameter, and 2) no rewording of an injection changes an admission decision. We evaluate across four agent models on open-ended agent suites, ROPE holds attack success rate to 1.6--2.6\% while retaining 82--100\% of undefended clean utility, significantly exceeding state-of-the-art system-level defenses in utility while attaining comparable or better security. Further, we show that optimizing the injection against ROPE is largely ineffective, while long-horizon attacks that defeat prior system-level defenses achieve zero success rate. Our code and logs are available at https://github.com/xhOwenMa/ROPE .
Xinhang Ma, Chaowei Xiao, William Yeoh et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
