mlsanityData to 14 Oct 2026

AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection

arXiv 2508.01249 ↗First posted 2 Aug 2025cs.CR cs.AI cs.CLcited by 46

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

Large Language Model (LLM) agents offer a powerful new paradigm for solving various problems by combining natural language reasoning with the execution of external tools. However, their dynamic and non-transparent behavior introduces critical security risks, particularly in the presence of prompt injection attacks. In this work, we propose a novel insight that treats the agent runtime traces as structured programs with analyzable semantics. Thus, we present AgentArmor, a program analysis framework that converts agent traces into graph intermediate representation-based structured program dependency representations (e.g., CFG, DFG, and PDG) and enforces security policies via a type system. AgentArmor consists of three key components: (1) a graph constructor that reconstructs the agent's runtime traces as graph-based intermediate representations with control and data flow described within; (2) a property registry that attaches security-relevant metadata of interacted tools & data, and (3) a type system that performs static inference and checking over the intermediate representation. By representing agent behavior as structured programs, AgentArmor enables program analysis for sensitive data flow, trust boundaries, and policy violations. We evaluate AgentArmor on the AgentDojo benchmark, the results show that AgentArmor can reduce the ASR to 3%, with the utility drop only 1%.

Key facts. Cited by 46 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 39 of its 59 references that are in the map. First posted on arXiv 2 Aug 2025.

Builds on

39 of 59 references.

Closest ancestors · 12

Same direction, newest first

  1. 2025PromptArmor: Simple yet Effective Prompt Injection Defenses21 Jul
  2. 2025DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents13 Jun
  3. 2025SAFEFLOW: A Principled Protocol for Trustworthy and Transactional Autonomous Agent Systems9 Jun
  4. 2025To Protect the LLM Agent Against the Prompt Injection Attack with Polymorphic Prompt6 Jun
  5. 2025Progent: Securing AI Agents with Privilege Control16 Apr
  6. 2025Defeating Prompt Injections by Design24 Mar
  7. 2025Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents17 Mar
  8. 2025AGrail: A Lifelong Agent Guardrail with Effective and Adaptive Safety Detection17 Feb
  9. 2025RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage13 Feb
  10. 2024BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents5 Jun
  11. 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems8 Mar
  12. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents17 Feb

Other references · 27

  1. 2024A Survey on the Memory Mechanism of Large Language Model based Agentscited by 634
  2. 2022LLM-Planner: Few-Shot Grounded Planning for Embodied Agents with Large Language Modelscited by 462
  3. 2024Understanding the planning of LLM agents: A surveycited by 421
  4. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 375
  5. 2024Defending Against Indirect Prompt Injection Attacks With Spotlightingcited by 267
  6. 2024Personal LLM Agents: Insights and Survey about the Capability, Efficiency and Securitycited by 260
  7. 2024SecAlign: Defending Against Prompt Injection with Preference Optimizationcited by 210
  8. 2024EASYTOOL: Enhancing LLM-based Agents with Concise Tool Instructioncited by 154
  9. 2023On the Exploitability of Instruction Tuningcited by 116
  10. 2023Jatmo: Prompt Injection Defense by Task-Specific Finetuningcited by 106
  11. 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspectivecited by 96
  12. 2024Attention Tracker: Detecting Prompt Injection Attacks in LLMscited by 95
15 more
  1. 2024AvaTaR: Optimizing LLM Agents for Tool Usage via Contrastive Reasoningcited by 72
  2. 2025Contextual Agent Security: A Policy for Every Purposecited by 59
  3. 2025ACE: A Security Architecture for LLM-Integrated App Systemscited by 55
  4. 2025Can Indirect Prompt Injection Attacks Be Detected and Removed?cited by 52
  5. 2025PromptShield: Deployable Detection for Prompt Injection Attackscited by 50
  6. 2024Defense Against Prompt Injection Attack by Leveraging Attack Techniquescited by 40
  7. 2025Defending Against Prompt Injection With a Few DefensiveTokenscited by 33
  8. 2025Defending against Indirect Prompt Injection by Instruction Detectioncited by 32
  9. 2024"My agent understands me better": Integrating Dynamic Human-like Memory Recall and Consolidation in LLM-Based Agentscited by 29
  10. 2024Permissive Information-Flow Analysis for Large Language Modelscited by 22
  11. 2024FATH: Authentication-based Test-time Defense against Indirect Prompt Injection Attackscited by 22
  12. 2024ATM: Adversarial Tuning Multi-agent System Makes a Robust Retrieval-Augmented Generatorcited by 19
  13. 2025Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instructioncited by 16
  14. 2024Applying Pre-trained Multilingual BERT in Embeddings for Improved Malicious Prompt Injection Attacks Detectioncited by 7
  15. 2025Prompt Inject Detection with Generative Explanation as an Investigative Toolcited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 6; 2026: 40.

46 papers.

Sort:

By area:

  1. 2026Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Frameworkcited by 54
  2. 2026The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysiscited by 30
  3. 2026The Attack and Defense Landscape of Agentic AI: A Comprehensive Surveycited by 28
  4. 2025From Code Foundation Models to Agents and Applications: A Comprehensive Survey and Practical Guide to Code Intelligencecited by 15
  5. 2026Agent-Sentry: Bounding LLM Agents via Execution Provenancecited by 15
  6. 2026Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agentscited by 15
  7. 2025TraceAegis: Securing LLM-Based Agents via Hierarchical and Behavioral Anomaly Detectioncited by 12
  8. 2025Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systemscited by 12
  9. 2025SoK: Trust-Authorization Mismatch in LLM Agent Interactionscited by 11
  10. 2026AgentGuardian: Learning Access Control Policies to Govern AI Agent Behaviorcited by 11
  11. 2026AgenTRIM: Tool Risk Mitigation for Agentic AIcited by 11
  12. 2026The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneckcited by 11
34 more
  1. 2026AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Managementcited by 10
  2. 2025Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworkscited by 9
  3. 2026Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attackscited by 9
  4. 2026Reframing LLM Agent Security as an Agent-Human Interaction Problemcited by 9
  5. 2026VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skillscited by 9
  6. 2026Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memorycited by 7
  7. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 7
  8. 2026Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden Statescited by 7
  9. 2026Agentic LLM Reasoning in a Self-Driving Laboratory for Air-Sensitive Lithium Halide Spinel Conductorscited by 6
  10. 2026SMCP: Secure Model Context Protocolcited by 5
  11. 2026No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skillscited by 5
  12. 2026Web Agents Should Adopt the Plan-Then-Execute Paradigmcited by 4
  13. 2026GRADE: Graph Representation of LLM Agent Dependency and Executioncited by 4
  14. 2026Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systemscited by 3
  15. 2026Grounded Continuation: A Linear-Time Runtime Verifier for LLM Conversationscited by 3
  16. 2026AgentLens: Interpretable Safety Steering via Mechanistic Subspaces for Multi-Turn Coding Agentcited by 3
  17. 2025AgentCrypt: Advancing Privacy and (Secure) Computation in AI Agent Collaborationcited by 2
  18. 2026LLM-enabled Applications Require System-Level Threat Monitoringcited by 2
  19. 2026When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systemscited by 2
  20. 2026AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systemscited by 2
  21. 2026ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injectioncited by 2
  22. 2026Causality Laundering: Denial-Feedback Leakage in Tool-Calling LLM Agentscited by 1
  23. 2026Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injectioncited by 1
  24. 2026ActGov: Governing LLM Agent Actions via Policy-Constrained Validationcited by 1
  25. 2026Skynet: Workflow-Level Anomaly Detection for Agentic AI via Semantic and Structural Modelingcited by 0
  26. 2026Authority Is Not a String: A Capability-Scoped Harness for Prompt-Injection-Resistant Coding Agentscited by 0
  27. 2026No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Serverscited by 0
  28. 2026Render Before Reading: Visual Rendering as a Prompt Injection Defensecited by 0
  29. 2026PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agentscited by 0
  30. 2026Organising Trajectory Evidence for Language-Model Agent Assurance: Fragments, Methods, and the Residualcited by 0
  31. 2026Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injectioncited by 0
  32. 2026G-CARB: Graph-Localized Conformal Agent Risk Budget for Compositional Harmcited by 0
  33. 2026APEX: Active Protection at Execution Boundaries for LLM Agentscited by 0
  34. 2026Kairos: Transactional Security Enforcement at the System Boundary for LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents
  2. 2026ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection
  3. 2026AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization
  4. 2026AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs
  5. 2025AgentGuard: Repurposing Agentic Orchestrator for Safety Evaluation of Tool Orchestration
  6. 2026Agentproof: Static Verification of Agent Workflow Graphs
  7. 2025AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents
  8. 2026TraceCompiler: Skill-Guided Mining and Compilation of LLM Agent Traces into Mostly Deterministic Workflows