ARES: Securing Agents for Computer Use Through Endpoint Resource Mediation and Behavioral Guardrails

Abstract

Large language model (LLM)-based agents are evolving into agents for computer use (ACUs) that read files, invoke applications, communicate over networks, and operate graphical interfaces, moving the effective security boundary from model inputs and outputs to autonomous actions that alter endpoint state. Conventional identity and access controls remain applicable and necessary, but they are authorized based on identity, resource, and network policy rather than on the semantic scope of the active task or the provenance of the instruction that triggered an action. This paper presents ARES (Agent Resource Enforcement and Security), an action-centric framework that inserts enforceable authorization between agent-generated tool calls and protected resources, combining a Resource Proxy Layer for interception, a Behavioral Guardrail Engine for task- and context-aware authorization, and a Multi-Agent Trust Boundary Manager for provenance and taint propagation. We implement ARES-lite and evaluate it against file exfiltration through indirect prompt injection, prompt infection propagation, and internal-network access abuse. Under the controlled replay-based evaluation, integrated ARES-lite reduced the observed attack-success rate from 100% under the permissive baseline to 0% across the three evaluated scenarios, while preserving the predefined handling of eight benign and ambiguous tasks with no false positives. A closed-loop evaluation in which the agent re-plans after an intervention, an adversarial boundary-case suite covering path aliasing, address encoding, look-alike destinations, and taint laundering, and a comparison against representative prompt-filtering and tool-allowlist defenses further characterize the enforcement path; a model and temperature sweep show that baseline exposure varies with model capability, whereas the mediated outcome does not.