mlsanityData to 7 Oct 2026

Contextual Agent Security: A Policy for Every Purpose

arXiv 2501.17070 ↗First posted 28 Jan 2025cs.CR cs.CL cs.LGcited by 55

Not on the map. Why?

Cited by 41 in LLM agents and tool use, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Judging an action's safety requires knowledge of the context in which the action takes place. To human agents who act in various contexts, this may seem obvious: performing an action such as email deletion may or may not be appropriate depending on the email's content, the goal (e.g., to erase sensitive emails or to clean up trash), and the type of email address (e.g., work or personal). Unlike people, computational systems have often had only limited agency in limited contexts. Thus, manually crafted policies and user confirmation (e.g., smartphone app permissions or network access control lists), while imperfect, have sufficed to restrict harmful actions. However, with the upcoming deployment of generalist agents that support a multitude of tasks (e.g., an automated personal assistant), we argue that we must rethink security designs to adapt to the scale of contexts and capabilities of these systems. As a first step, this paper explores contextual security in the domain of agents and proposes contextual agent security (Conseca), a framework to generate just-in-time, contextual, and human-verifiable security policies.

Key facts. Cited by 55 papers in the map (data through 7 Oct 2026). Builds on 32 of its 84 references that are in the map. First posted on arXiv 28 Jan 2025.

Builds on

32 of 84 references.

References · 32

  1. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  2. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  3. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  4. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  5. 2022A Generalist Agentcited by 802
  6. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  7. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  8. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 520
  9. 2023Identifying the Risks of LM Agents with an LM-Emulated Sandboxcited by 514
  10. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
  11. 2023Detecting Language Model Attacks with Perplexitycited by 411
  12. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
20 more
  1. 2024A Survey on Knowledge Distillation of Large Language Modelscited by 276
  2. 2024A Comprehensive Survey of Hallucination Mitigation Techniques in Large Language Modelscited by 266
  3. 2024Defending Against Indirect Prompt Injection Attacks With Spotlightingcited by 233
  4. 2023Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theorycited by 218
  5. 2023The Capacity for Moral Self-Correction in Large Language Modelscited by 171
  6. 2023Agents: An Open-source Framework for Autonomous Language Agentscited by 116
  7. 2024The Ethics of Advanced AI Assistantscited by 103
  8. 2023Evaluating Language-Model Agents on Realistic Autonomous Taskscited by 94
  9. 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspectivecited by 91
  10. 2024AirGapAgent: Protecting Privacy-Conscious Conversational Agentscited by 90
  11. 2024Against The Achilles' Heel: A Survey on Red Teaming for Generative Modelscited by 55
  12. 2020UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threatscited by 53
  13. 2024Large Language Models for Forecasting and Anomaly Detection: A Systematic Literature Reviewcited by 50
  14. 2024A theory of appropriateness with applications to generative artificial intelligencecited by 25
  15. 2015Android Permissions Remystified: A Field Study on Contextual Integritycited by 15
  16. 2018Discovering Smart Home Internet of Things Privacy Norms Using Contextual Integritycited by 10
  17. 2018SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detectioncited by 6
  18. 2015Implicit Contextual Integrity in Online Social Networkscited by 3
  19. 2015Precise, Dynamic Information Flow for Database-Backed Applicationscited by 1
  20. 2022Blockaid: Data Access Policy Enforcement for Web Applicationscited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 13; 2026: 42.

55 papers.

Sort:

By area:

  1. 2025Progent: Securing AI Agents with Privilege Controlcited by 121
  2. 2026Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Frameworkcited by 50
  3. 2025AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injectioncited by 39
  4. 2025Firewalls to Secure Dynamic LLM Agentic Networkscited by 34
  5. 2026The Attack and Defense Landscape of Agentic AI: A Comprehensive Surveycited by 26
  6. 2025ceLLMate: Sandboxing Browser AI Agentscited by 14
  7. 2026ARGUS: Defending LLM Agents Against Context-Aware Prompt Injectioncited by 13
  8. 2025PSG-Agent: Personality-Aware Safety Guardrail for LLM-based Agentscited by 12
  9. 2025Policy-as-Prompt: Turning AI Governance Rules into Guardrails for AI Agentscited by 12
  10. 2025Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systemscited by 12
  11. 2025Secure and Efficient Access Control for Computer-Use Agents via Context Spacecited by 10
  12. 2025Systems Security Foundations for Agentic Computingcited by 9
38 more
  1. 2026AI Agents May Always Fall for Prompt Injectionscited by 9
  2. 2026Reframing LLM Agent Security as an Agent-Human Interaction Problemcited by 8
  3. 2026Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agentscited by 8
  4. 2026VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skillscited by 8
  5. 2025Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworkscited by 7
  6. 2026Security Considerations for Artificial Intelligence Agentscited by 7
  7. 2026Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malwarecited by 6
  8. 2025Network-Level Prompt and Trait Leakage in Local Research Agentscited by 5
  9. 2026AC4A: Access Control for Agentscited by 5
  10. 2025Personalizing Agent Privacy Decisions via Logical Entailmentcited by 4
  11. 2026An AI Agent Execution Environment to Safeguard User Datacited by 3
  12. 2026Web Agents Should Adopt the Plan-Then-Execute Paradigmcited by 3
  13. 2026Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AIcited by 3
  14. 2026SUDP: Secret-Use Delegation Protocol for Agentic Systemscited by 2
  15. 2026Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agentscited by 2
  16. 2026Janus: a Playground for User-Involved Agentic Permission Managementcited by 2
  17. 2026How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcementcited by 2
  18. 2026AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systemscited by 2
  19. 2025MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agentscited by 1
  20. 2026Spider-Sense: Intrinsic Risk Sensing for Efficient Agent Defense with Hierarchical Adaptive Screeningcited by 1
  21. 2026Attacks and Mitigations for Distributed Governance of Agentic AI under Byzantine Adversariescited by 1
  22. 2026Language-Based Agent Controlcited by 1
  23. 2026Governance by Construction for Generalist Agentscited by 1
  24. 2026Efficient and Sound Probabilistic Verification for AI Agentscited by 1
  25. 2026Autoformalization of Agent Instructions into Policy-as-Codecited by 1
  26. 2026Prismata: Confining Cross-Site Prompt Injection in Web Agentscited by 1
  27. 2026Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecturecited by 1
  28. 2026Engineering Robustness into Personal Agents with the AI Workflow Storecited by 0
  29. 2026Data Flow Control: Data Safety Policies for AI Agentscited by 0
  30. 2026ClayBuddy: A Framework, Evaluation, & Mitigation of Coding Agent Failurescited by 0
  31. 2026AI Snitches Get Glitches: Towards Evading Agentic Surveillancecited by 0
  32. 2026MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agentscited by 0
  33. 2026DualView: Preventing Indirect Prompt Injection in Personal AI Agentscited by 0
  34. 2026Agent Data Injection Attacks are Realistic Threats to AI Agentscited by 0
  35. 2026Empirical Evaluation of Task-Based Permission Scoping Architecture for AI Agentscited by 0
  36. 2026Reflections on Trusting Trust, Revisited: Contaminating Self-Modifying AI Coding Agents with Poisoned Benchmarkscited by 0
  37. 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0
  38. 2026From Alignment to Access Control: A Framework for GenAI Policy Enforcementcited by 0

50 most cited of 55 All 55 (JSON)