mlsanityData to 14 Oct 2026

IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems

arXiv 2403.04960 ↗First posted 8 Mar 2024cs.CR cs.AI cs.CLcited by 130

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Large language models (LLMs) extended as systems, such as ChatGPT, have begun supporting third-party applications. These LLM apps leverage the de facto natural language-based automated execution paradigm of LLMs: that is, apps and their interactions are defined in natural language, provided access to user data, and allowed to freely interact with each other and the system. These LLM app ecosystems resemble the settings of earlier computing platforms, where there was insufficient isolation between apps and the system. Because third-party apps may not be trustworthy, and exacerbated by the imprecision of natural language interfaces, the current designs pose security and privacy risks for users. In this paper, we evaluate whether these issues can be addressed through execution isolation and what that isolation might look like in the context of LLM-based systems, where there are arbitrary natural language-based interactions between system components, between LLM and apps, and between apps. To that end, we propose IsolateGPT, a design architecture that demonstrates the feasibility of execution isolation and provides a blueprint for implementing isolation, in LLM-based systems. We evaluate IsolateGPT against a number of attacks and demonstrate that it protects against many security, privacy, and safety issues that exist in non-isolated LLM-based systems, without any loss of functionality. The performance overhead incurred by IsolateGPT to improve security is under 30% for three-quarters of tested queries.

Key facts. Cited by 130 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 15 of its 75 references that are in the map. First posted on arXiv 8 Mar 2024.

Builds on

15 of 75 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar

Other references · 14

  1. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  2. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  3. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
  4. 2023A Survey on Large Language Model based Autonomous Agentscited by 2,242
  5. 2022Large Language Models Encode Clinical Knowledgecited by 1,830
  6. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  7. 2023The Rise and Potential of Large Language Model Based Agents: A Surveycited by 1,439
  8. 2023MemGPT: Towards LLMs as Operating Systemscited by 1,389
  9. 2023Gorilla: Large Language Model Connected with Massive APIscited by 1,332
  10. 2023Cognitive Architectures for Language Agentscited by 429
  11. 2023From Prompt Injections to SQL Injection Attacks: How Protected is Your LLM-Integrated Web Application?cited by 55
  12. 2023LLM Platform Security: Applying a Systematic Evaluation Framework to OpenAI's ChatGPT Pluginscited by 51
2 more
  1. 2023Demystifying RCE Vulnerabilities in LLM-Integrated Appscited by 37
  2. 2020Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviorscited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 5; 2025: 27; 2026: 98.

130 papers.

Sort:

By area:

  1. 2025Defeating Prompt Injections by Designcited by 297
  2. 2024From Persona to Personalization: A Survey on Role-Playing Language Agentscited by 212
  3. 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspectivecited by 96
  4. 2025Design Patterns for Securing LLM Agents against Prompt Injectionscited by 73
  5. 2025DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agentscited by 66
  6. 2025ACE: A Security Architecture for LLM-Integrated App Systemscited by 55
  7. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 46
  8. 2025AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injectioncited by 46
  9. 2026AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocationscited by 38
  10. 2026Towards Verifiably Safe Tool Use for LLM Agentscited by 36
  11. 2025Defending Against Prompt Injection with DataFiltercited by 35
  12. 2026Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystemscited by 31
38 more
  1. 2025LLM Agents Should Employ Security Principlescited by 29
  2. 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challengescited by 28
  3. 2026A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecyclecited by 27
  4. 2025BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agentscited by 24
  5. 2024GoEX: Perspectives and Designs Towards a Runtime for Autonomous LLM Applicationscited by 23
  6. 2025Les Dissonances: Cross-Tool Harvesting and Polluting in Pool-of-Tools Empowered LLM Agentscited by 22
  7. 2025Towards Automating Data Access Permissions in AI Agentscited by 21
  8. 2026From Storage to Steering: Memory Control Flow Attacks on LLM Agentscited by 19
  9. 2026How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Studycited by 19
  10. 2025Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?cited by 18
  11. 2026CaMeLs Can Use Computers Too: System-level Security for Computer Use Agentscited by 17
  12. 2026A Framework for Formalizing LLM Agent Securitycited by 16
  13. 2026Agent-Sentry: Bounding LLM Agents via Execution Provenancecited by 15
  14. 2026Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agentscited by 15
  15. 2026ARGUS: Defending LLM Agents Against Context-Aware Prompt Injectioncited by 14
  16. 2025Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systemscited by 12
  17. 2025Secure and Efficient Access Control for Computer-Use Agents via Context Spacecited by 11
  18. 2025SoK: Trust-Authorization Mismatch in LLM Agent Interactionscited by 11
  19. 2026AgentGuardian: Learning Access Control Policies to Govern AI Agent Behaviorcited by 11
  20. 2025MindGuard: Intrinsic Decision Inspection for Securing LLM Agents Against Metadata Poisoningcited by 10
  21. 2026AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Managementcited by 10
  22. 2026Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malwarecited by 10
  23. 2025Preventing Prompt Injection with Type-Directed Privilege Separationcited by 9
  24. 2025Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworkscited by 9
  25. 2026Defense Against Indirect Prompt Injection via Tool Result Parsingcited by 9
  26. 2026The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanismcited by 9
  27. 2026Reframing LLM Agent Security as an Agent-Human Interaction Problemcited by 9
  28. 2025Maris: A Formally Verifiable Privacy Policy Enforcement Paradigm for Multi-Agent Collaboration Systemscited by 8
  29. 2026Security Considerations for Artificial Intelligence Agentscited by 8
  30. 2024Large Language Models meet Network Slicing Management and Orchestrationcited by 7
  31. 2025Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigmscited by 7
  32. 2026When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agentcited by 7
  33. 2026Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesiscited by 7
  34. 2026Behavioral Integrity Verification for AI Agent Skillscited by 7
  35. 2026Assessing Automated Prompt Injection Attacks in Agentic Environmentscited by 7
  36. 2025Agentic Services Computingcited by 6
  37. 2025Trusted AI Agents in the Cloudcited by 6
  38. 2026Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectivescited by 6

50 most cited of 130 All 130 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
  2. 2026Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions
  3. 2025The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise
  4. 2025Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents
  5. 2025Security Concerns for Large Language Models: A Survey
  6. 2025Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks
  7. 2026On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models
  8. 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem