mlsanityData to 7 Oct 2026

AgentBound: Securing Execution Boundaries of AI Agents

arXiv 2510.21236 ↗First posted 24 Oct 2025cs.CR cs.AI cs.SEcited by 20

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Large Language Models (LLMs) have evolved into AI agents that interact with external tools and environments to perform complex tasks. The Model Context Protocol (MCP) has become the de facto standard for connecting agents with such resources, but security has lagged behind: thousands of MCP servers execute with unrestricted access to host systems, creating a broad attack surface. In this paper, we introduce AgentBound, the first access control framework for MCP servers. AgentBound combines a declarative policy mechanism, inspired by the Android permission model, with a policy enforcement engine that contains malicious behavior without requiring MCP server modifications. We build a dataset containing the 296 most popular MCP servers, and show that access control policies can be generated automatically from source code with 80.9% accuracy. We also show that AgentBound blocks the majority of security threats in several malicious MCP servers, and that the policy enforcement engine introduces negligible overhead. Our contributions provide developers and project managers with a foundation for securing MCP servers while maintaining productivity, enabling researchers and tool builders to explore new directions for declarative access control and MCP security.

Key facts. Cited by 20 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 32 of its 64 references that are in the map. First posted on arXiv 24 Oct 2025.

Builds on

32 of 64 references.

Closest ancestors · 10

Same direction, newest first

  1. 2025A Measurement Study of Model Context Protocol Ecosystem29 Sep
  2. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures24 Jun
  3. 2025We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems16 Jun
  4. 2025Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem31 May
  5. 2025SentinelAgent: Graph-based Anomaly Detection in Multi-Agent Systems30 May
  6. 2025Security of Internet of Agents: Attacks and Countermeasures12 May
  7. 2025MCP Guardian: A Security-First Layer for Safeguarding MCP-Based AI System17 Apr
  8. 2025MCP Bridge: A Lightweight, LLM-Agnostic RESTful Proxy for Model Context Protocol Servers11 Apr
  9. 2025MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits2 Apr
  10. 2024Imprompter: Tricking LLM Agents into Improper Tool Use19 Oct

Other references · 22

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2021Evaluating Large Language Models Trained on Codecited by 8,053
  3. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  4. 2024Large Language Model based Multi-Agents: A Survey of Progress and Challengescited by 752
  5. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 478
  6. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
  7. 2024AutoCodeRover: Autonomous Program Improvementcited by 272
  8. 2025Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directionscited by 257
  9. 2023Auto-GPT for Online Decision Making: Benchmarks and Additional Opinionscited by 250
  10. 2024Magentic-One: A Generalist Multi-Agent System for Solving Complex Taskscited by 221
  11. 2025Large Language Model Agent: A Survey on Methodology, Applications and Challengescited by 194
  12. 2025AI Agents vs. Agentic AI: A Conceptual Taxonomy, Applications and Challengescited by 167
10 more
  1. 2023OpenAgents: An Open Platform for Language Agents in the Wildcited by 136
  2. 2023An Empirical Study of the Non-determinism of ChatGPT in Code Generationcited by 134
  3. 2024Exploring Large Language Model based Intelligent Agents: Definitions, Methods, and Prospectscited by 130
  4. 2024A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systemscited by 74
  5. 2025Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Serverscited by 62
  6. 2025Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategiescited by 42
  7. 2025MCIP: Protecting MCP Safety via Model Contextual Integrity Protocolcited by 33
  8. 2025ToolFuzz -- Automated Agent Tool Testingcited by 18
  9. 2025We Urgently Need Privilege Management in MCP: A Measurement of API Usage in MCP Ecosystemscited by 15
  10. 2014Security of OS-level virtualization technologies: Technical reportcited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 19.

20 papers.

Sort:

By area:

  1. 2026From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agentscited by 29
  2. 2026MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCPcited by 13
  3. 2025SoK: Trust-Authorization Mismatch in LLM Agent Interactionscited by 11
  4. 2026Right to History: A Sovereignty Kernel for Verifiable AI Agent Executioncited by 7
  5. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 5
  6. 2026Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agentscited by 5
  7. 2026SkillGuard: A Permission-Centric Framework for Agent Skill Securitycited by 4
  8. 2026Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluationcited by 4
  9. 2026Synergy: A Next-Generation General-Purpose Agent for Open Agentic Webcited by 2
  10. 2026AgentGuard: An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agentcited by 2
  11. 2026Rewriting the Response Path: Silent Tampering and Provider-Signed Defense in BYOK LLM Agentscited by 0
  12. 2026Engineering Robustness into Personal Agents with the AI Workflow Storecited by 0
8 more
  1. 2026The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilitiescited by 0
  2. 2026Where Is the Tradeoff in Using Third-Party API Routers for Agentic Software Development?cited by 0
  3. 2026The Vulnerability With No CVE: Managing Persistent Gaps Between Mandate and Authority in AI Coding Agentscited by 0
  4. 2026Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecturecited by 0
  5. 2026Do User-Authored Permission Policies Improve Protection Against AI Agent Overreach?cited by 0
  6. 2026Trust propagation and structural containment in Multi-agent LLM pipelinescited by 0
  7. 2026From Approval to Execution: Reconstruction-Aware Repair Analysis for LLM-Agent Softwarecited by 0
  8. 2026On the Effectiveness of Kernel-Level Evidence for Agent Securitycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms
  2. 2025MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols
  3. 2025MCPZoo: A Large-Scale Dataset of Runnable Model Context Protocol Servers for AI Agent
  4. 2026ToolGuardian: Declarative Security for AI Agent-Tool Interactions
  5. 2026Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming
  6. 2026Don't believe everything you read: Understanding and Measuring MCP Behavior under Misleading Tool Descriptions
  7. 2026AgentWall: A Runtime Safety Layer for Local AI Agents
  8. 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents