mlsanityData to 14 Oct 2026

SoK: Trust-Authorization Mismatch in LLM Agent Interactions

arXiv 2512.06914 ↗First posted 7 Dec 2025cs.CR cs.AIcited by 11

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Large Language Models (LLMs) are evolving into autonomous agents capable of executing complex workflows via standardized protocols (e.g., MCP). However, this paradigm shifts control from deterministic code to probabilistic inference, creating a fundamental Trust-Authorization Mismatch: static permissions are structurally decoupled from the agent's fluctuating runtime trustworthiness. In this Systematization of Knowledge (SoK), we survey more than 200 representative papers to categorize the emerging landscape of agent security. We propose the Belief-Intention-Permission (B-I-P) framework as a unifying formal lens. By decomposing agent execution into three distinct stages-Belief Formation, Intent Generation, and Permission Grant-we demonstrate that diverse threats, from prompt injection to tool poisoning, share a common root cause: the desynchronization between dynamic trust states and static authorization boundaries. Using the B-I-P lens, we systematically map existing attacks and defenses and identify critical gaps where current mechanisms fail to bridge this mismatch. Finally, we outline a research agenda for shifting from static Role-Based Access Control (RBAC) to dynamic, risk-adaptive authorization.

Key facts. Cited by 11 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 82 of its 134 references that are in the map. First posted on arXiv 7 Dec 2025.

Builds on

82 of 134 references.

Closest ancestors · 33

Same direction, newest first

  1. 2025AgentBound: Securing Execution Boundaries of AI Agents24 Oct
  2. 2025Uncertainty-Aware, Risk-Adaptive Access Control for Agentic Systems using an LLM-Judged TBAC Model13 Oct
  3. 2025A Vision for Access Control in LLM-based Agent Systems13 Oct
  4. 2025Traceability and Accountability in Role-Specialized Multi-Agent LLM Pipelines8 Oct
  5. 2025A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory29 Sep
  6. 2025A Measurement Study of Model Context Protocol Ecosystem29 Sep
  7. 2025ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents26 Sep
  8. 2025Secure and Efficient Access Control for Computer-Use Agents via Context Space26 Sep
  9. 2025Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools25 Sep
  10. 2025LLMZ+: Contextual Prompt Whitelist Principles for Agentic LLMs23 Sep
  11. 2025Risk Analysis Techniques for Governed LLM-based Multi-Agent Systems6 Aug
  12. 2025AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection2 Aug
21 more
  1. 2025An Adversary-Resistant Multi-Agent LLM System via Credibility Scoring30 May
  2. 2025SentinelAgent: Graph-based Anomaly Detection in Multi-Agent Systems30 May
  3. 2025LLM Agents Should Employ Security Principles29 May
  4. 2025MPMA: Preference Manipulation Attack Against Model Context Protocol16 May
  5. 2025A survey of agent interoperability protocols: Model Context Protocol (MCP), Agent Communication Protocol (ACP), Agent-to-Agent Protocol (A2A), and Agent Network Protocol (ANP)4 May
  6. 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
  7. 2025Progent: Securing AI Agents with Privilege Control16 Apr
  8. 2025StruPhantom: Evolutionary Injection Attacks on Black-Box Tabular Agents Powered by Large Language Models14 Apr
  9. 2025CheatAgent: Attacking LLM-Empowered Recommender Systems via LLM Agent13 Apr
  10. 2025Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents17 Mar
  11. 2025Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents27 Feb
  12. 2025Mimicking the Familiar: Dynamic Command Generation for Information Theft Attacks in LLM Tool-Learning System17 Feb
  13. 2025MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents7 Feb
  14. 2024From Allies to Adversaries: Manipulating LLM Tool-Calling through Adversarial Injection13 Dec
  15. 2024Imprompter: Tricking LLM Agents into Improper Tool Use19 Oct
  16. 2024Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems9 Oct
  17. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
  18. 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems8 Mar
  19. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
  20. 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks2 Mar
  21. 2023Evil Geniuses: Delving into the Safety of LLM-based Agents20 Nov

Other references · 49

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  3. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  4. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  6. 2023Gorilla: Large Language Model Connected with Massive APIscited by 1,332
  7. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
  8. 2025Why Do Multi-Agent LLM Systems Fail?cited by 604
  9. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
  10. 2023Trustworthy LLMs: a Survey and Guideline for Evaluating Large Language Models' Alignmentcited by 401
  11. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 364
  12. 2024Alignment faking in large language modelscited by 360
37 more
  1. 2023HaluEval: A Large-Scale Hallucination Evaluation Benchmark for Large Language Modelscited by 341
  2. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 278
  3. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 264
  4. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decodingcited by 247
  5. 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 191
  6. 2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 127
  7. 2025Securing AI Agents with Information-Flow Controlcited by 121
  8. 2024Vaccine: Perturbation-aware Alignment for Large Language Models against Harmful Fine-tuning Attackcited by 115
  9. 2025MCP-Bench: Benchmarking Tool-Using LLM Agents with Complex Real-World Tasks via MCP Serverscited by 109
  10. 2024Large Multimodal Agents: A Surveycited by 105
  11. 2024On the Resilience of LLM-Based Multi-Agent Collaboration with Faulty Agentscited by 99
  12. 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspectivecited by 96
  13. 2024Attention Tracker: Detecting Prompt Injection Attacks in LLMscited by 95
  14. 2025HalluLens: LLM Hallucination Benchmarkcited by 92
  15. 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editingcited by 79
  16. 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 66
  17. 2025Collaborative Memory: Multi-User Memory Sharing in LLM Agents with Dynamic Access Controlcited by 61
  18. 2025LLM-based Agents Suffer from Hallucinations: A Survey of Taxonomy, Methods, and Directionscited by 50
  19. 2023The Persuasive Power of Large Language Modelscited by 47
  20. 2025Defending Against Prompt Injection with DataFiltercited by 35
  21. 2025Red Teaming the Mind of the Machine: A Systematic Evaluation of Prompt Injection and Jailbreak Vulnerabilities in LLMscited by 34
  22. 2025MCIP: Protecting MCP Safety via Model Contextual Integrity Protocolcited by 34
  23. 2024Embedding-based classifiers can detect prompt injection attackscited by 27
  24. 2025Multi-Agent Security Tax: Trading Off Security and Collaboration Capabilities in Multi-Agent Systemscited by 27
  25. 2024Unique Security and Privacy Threats of Large Language Models: A Comprehensive Surveycited by 23
  26. 2025GraphTracer: Graph-Guided Failure Tracing in LLM Agents for Robust Multi-Turn Deep Searchcited by 23
  27. 2021threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learningcited by 22
  28. 2024Permissive Information-Flow Analysis for Large Language Modelscited by 22
  29. 2024Is the System Message Really Important to Jailbreaks in Large Language Models?cited by 20
  30. 2024Contextualized Sequence Likelihood: Enhanced Confidence Scores for Natural Language Generationcited by 16
  31. 2025VeriLA: A Human-Centered Evaluation Framework for Interpretable Verification of LLM Agent Failurescited by 14
  32. 2024Systematically Analyzing Prompt Injection Vulnerabilities in Diverse LLM Architecturescited by 12
  33. 2024Multi-Programming Language Sandbox for LLMscited by 10
  34. 2025Digital Forensics in the Age of Large Language Modelscited by 10
  35. 2024Intrusion Tolerance for Networked Systems through Two-Level Feedback Controlcited by 8
  36. 2024Generative AI Agents in Autonomous Machines: A Safety Perspectivecited by 7
  37. 2024LLM-Virus: Evolutionary Jailbreak Attack on Large Language Modelscited by 7

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 11.

11 papers.

  1. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 7
  2. 2026Do Coding Agents Understand Least-Privilege Authorization?cited by 6
  3. 2026Agent-Fence: Mapping Security Vulnerabilities Across Deep Research Agentscited by 3
  4. 2026From Secure Agentic AI to Secure Agentic Web: Challenges, Threats, and Future Directionscited by 1
  5. 2026The Importance of Out-of-Band Metadata for Safe Autonomous Agents: The Redpanda Agentic Data Planecited by 1
  6. 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systemscited by 1
  7. 2026VATS: Exploiting Implicit Authority in Error-Path Injection via Systematic Mutationcited by 0
  8. 2026"Allow" to Achieve, Over-Privileged Inadvertently: The Unintended Cost of Task-Completion-Driven Pop-up Decisions in Mobile GUI Agentscited by 0
  9. 2026Do User-Authored Permission Policies Improve Protection Against AI Agent Overreach?cited by 0
  10. 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0
  11. 2026SoK: Decentralized Agent Economic Infrastructurecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Securing LLM Agents Need Intent-to-Execution Integrity
  2. 2026ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
  3. 2025The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise
  4. 2026Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents
  5. 2025The Trust Paradox in LLM-Based Multi-Agent Systems: When Collaboration Becomes a Security Vulnerability
  6. 2026Hybrid Inspection and Task-Based Access Control in Zero-Trust Agentic AI
  7. 2026Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework
  8. 2026LLM-Based Agents for Software and Systems Security: Approaches, Applications, and Assessment