This work operationalizes contextual security through four properties that must hold jointly and be evaluated continuously across the agent's trajectory, which changes which defenses are coherent, which evaluations measure something useful, and which attack patterns evaluation can see at all.
Abstract
Agent security is widely treated as a question about action content. Defenses ask whether an instruction looks malicious. Benchmarks ask whether an agent performs a harmful sounding action. \textbf{We argue that agent security is fundamentally a contextual problem, and that the current content based framing systematically misdefines it.} A command to ``delete user data''might be a routine administrative request or a prompt injection attacking production systems, and the content alone cannot distinguish the two. Authorization context can. Across every injection task in AgentDojo and WASP, the same action is one an authenticated user would plausibly request in a routine workflow, which makes the conflation a structural property of evaluating security through content. We operationalize contextual security through four properties that must hold jointly and be evaluated continuously across the agent's trajectory. Source Authorization asks who issued the command. Task Alignment specifies the agent's authorized objective. Action Alignment evaluates whether each action serves that objective. Data Isolation governs information flows across privilege boundaries. Under this reframing, indirect prompt injection becomes a Source Authorization violation. Snapshot benchmarks are structurally incapable of evaluating Data Isolation. Existing defenses are reorganized around the property they actually approximate. The contextual reframing changes which defenses are coherent, which evaluations measure something useful, and which attack patterns evaluation can see at all.
Open Security Benchmark is presented, a framework that benchmarks agentic AI on security posture management work and surfaces a curated enterprise environment that evaluates posture investigation across two modalities: text-to-SQL over a relational snapshot and each vendor's native API over a served instance of the same environment.
Gal Engelberg, Michael Arenzon, Leon Goldberg· arXiv.org· 0 citations
Agentic artificial intelligence expands the enterprise security boundary because autonomous agents can plan
tasks, retain memory, invoke tools, call APIs, and initiate business actions. Authentication at session start is therefore
insufficient when later actions may be influenced by untrusted content, poisoned memory, compromised tools, or excessive
delegated privilege. This paper proposes the Zero Trust Agentic AI Security Framework (ZT-AASF), a vendor-neutral
architecture that applies continuous verification to consequential agent actions. The framework separates six control
planes: identity and delegation, context and data trust, policy and risk decision, tool and action enforcement, runtime
observability, and containment and recovery. A contextual authorization model evaluates delegated scope, source
provenance, data sensitivity, tool risk, behavioral deviation, and action impact before execution. A design-level evaluation
against ten OWASP agentic risk classes produces 27 of 30 control-coverage points for ZT-AASF versus 5 of 30 for a
conventional integration baseline. These values represent architectural coverage, not measured attack-prevention rates.
The results indicate that moving enforcement from the session boundary to the action boundary can reduce implicit trust,
constrain privilege propagation, and improve auditability while preserving useful autonomy.
Sachin Suryawanshi· International Journal of Inn...· 0 citations
Autonomous LLM agents increasingly act on a user's behalf: they hold credentials, call tools and services, and spawn sub-agents that act further on their behalf. This turns a long-standing distributed-systems question -- who is authorized to do what, on whose authority -- into an urgent and largely unsolved problem, because the component driving each agent is a language model an adversary can hijack. We argue that agent security must be evaluated under an untrusted-model assumption: a correct system is one in which a fully prompt-injected agent still cannot exceed the authority explicitly delegated to it. Against this standard we make three contributions. First, we give a threat model for multi-agent delegation centered on four adversaries -- confused deputy, token theft and replay, prompt-injection privilege escalation, and compromised sub-agents -- and derive eight security requirements a governed agent system must meet. Second, we show the gap is real: a default agent runtime modeling common practice (broad bearer credentials, authorization gated inside the model) fails all four threats, and across four widely used frameworks -- LangGraph, CrewAI, AutoGen, and the Model Context Protocol (MCP) authorization model -- three provide no built-in confinement and one only partial; no existing standard alone covers the requirement set. Third, we implement and adversarially evaluate an authorization broker that closes the gap. It blocks all four threats; it resists 11 direct attacks on its design and accepts 0 of 200,000 forged tokens; it confines a compromised sub-agent to its delegated task (a mean of 1.5 reachable actions versus all 8,100 under bearer delegation, across 2,000 randomized scenarios); and it enforces at microsecond cost (about 2.6 microseconds per decision), negligible against model inference. These principles are also realized in production in VotalAI's LLM Shield.
Panduranga Sai Varma Dantuluri, Jyotirmoy Sundi· 0 citations
NiyamAI is presented, an intent bound runtime guardrail architecture providing cryptographically verifiable execution integrity for autonomous agents and subjects its own enforcement mechanism to 18 adversarial vectors across six classes, disclosing two implementation vulnerabilities identified and remediated during development.
Aditya Katkar, Om Karkele, Kartik Mandhane et al.· 1 citation
The right unit of safety in agentic AI is the trajectory-with-checkable-evidence, not the model, and this work formalizes an Agent Trajectory Schema and Evidence Chain, state a compositional gating proposition based on standard monitor composition, and outline a research agenda.
Albus W. Ng, Yibin Han, Jusheng Zhang et al.· 0 citations
A policy algebra is proposed that defines the reliability envelope within which agent capability may be exercised and provides researchers and practitioners with formal correctness conditions, executable decision semantics, and trace evidence for building agents that are not only capable, but reliably capable.
Bhaskar Tripathi, Anurag Kumar, R. Kumar et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
