mlsanityData to 14 Oct 2026

Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework

arXiv 2601.11893 ↗First posted 17 Jan 2026cs.CRcited by 54

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Large Language Model (LLM)-based agent systems are increasingly deployed for complex real-world tasks but remain vulnerable to natural language-based attacks that exploit over-privileged tool use. This paper aims to understand and mitigate such attacks through the lens of privilege escalation, defined as agent actions exceeding the least privilege required for a user's intended task. Based on a formal model of LLM agent systems, we identify novel privilege escalation scenarios, particularly in multi-agent systems, including a variant akin to the classic confused deputy problem. To defend against both known and newly demonstrated privilege escalation, we propose SEAgent, a mandatory access control (MAC) framework built upon attribute-based access control (ABAC). SEAgent monitors agent-tool interactions via an information flow graph and enforces customizable security policies based on entity attributes. Our evaluations show that SEAgent effectively blocks various privilege escalation while maintaining a low false positive rate and negligible system overhead. This demonstrates its robustness and adaptability in securing LLM-based agent systems.

Key facts. Cited by 54 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 37 of its 85 references that are in the map. First posted on arXiv 17 Jan 2026.

Builds on

37 of 85 references.

Closest ancestors · 15

Same direction, newest first

  1. 2025ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents26 Sep
  2. 2025AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection2 Aug
  3. 2025PromptArmor: Simple yet Effective Prompt Injection Defenses21 Jul
  4. 2025LlamaFirewall: An open source guardrail system for building secure AI agents6 May
  5. 2025Progent: Securing AI Agents with Privilege Control16 Apr
  6. 2025ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning26 Mar
  7. 2025Defeating Prompt Injections by Design24 Mar
  8. 2025Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents17 Mar
  9. 2025AgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Management6 Mar
  10. 2025Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents27 Feb
  11. 2024Imprompter: Tricking LLM Agents into Improper Tool Use19 Oct
  12. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
3 more
  1. 2024Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification30 Jul
  2. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
  3. 2024Combining Fine-Tuning and LLM-based Agents for Intuitive Smart Contract Auditing with Justifications24 Mar

Other references · 22

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  2. 2023MetaGPT: Meta Programming for A Multi-Agent Collaborative Frameworkcited by 1,808
  3. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  4. 2023ChatDev: Communicative Agents for Software Developmentcited by 919
  5. 2023API-Bank: A Comprehensive Benchmark for Tool-Augmented LLMscited by 591
  6. 2024Executable Code Actions Elicit Better LLM Agentscited by 564
  7. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
  8. 2025Agent Laboratory: Using LLM Agents as Research Assistantscited by 425
  9. 2024Understanding the planning of LLM agents: A surveycited by 421
  10. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 375
  11. 2024Personal LLM Agents: Insights and Survey about the Capability, Efficiency and Securitycited by 260
  12. 2024Data Interpreter: An LLM Agent For Data Sciencecited by 225
10 more
  1. 2024SecAlign: Defending Against Prompt Injection with Preference Optimizationcited by 210
  2. 2023RAIN: Your Language Models Can Align Themselves without Finetuningcited by 157
  3. 2024Efficient Adversarial Training in LLMs with Continuous Attackscited by 113
  4. 2025Towards Scientific Intelligence: A Survey of LLM-based Scientific Agentscited by 98
  5. 2024AvaTaR: Optimizing LLM Agents for Tool Usage via Contrastive Reasoningcited by 72
  6. 2024SelfDefend: LLMs Can Defend Themselves against Jailbreaking in a Practical Mannercited by 63
  7. 2025Contextual Agent Security: A Policy for Every Purposecited by 59
  8. 2024Towards Effective GenAI Multi-Agent Collaboration: Design and Evaluation for Enterprise Applicationscited by 19
  9. 2024LLM for Mobile: An Initial Roadmapcited by 11
  10. 2018SCLib: A Practical and Lightweight Defense against Component Hijacking in Android Applicationscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 54.

54 papers.

Sort:

By area:

  1. 2026Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guaranteescited by 18
  2. 2026A Framework for Formalizing LLM Agent Securitycited by 16
  3. 2026From Skill Text to Skill Structure: The Scheduling-Structural-Logical Representation for Agent Skillscited by 16
  4. 2026FORTIS: Benchmarking Over-Privilege in Agent Skillscited by 13
  5. 2026When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agentscited by 13
  6. 2026The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneckcited by 11
  7. 2026ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuationcited by 11
  8. 2026Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malwarecited by 10
  9. 2026Reframing LLM Agent Security as an Agent-Human Interaction Problemcited by 9
  10. 2026SOK: A Taxonomy of Attack Vectors and Defense Strategies for Agentic Supply Chain Runtimecited by 8
  11. 2026Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesiscited by 7
  12. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 7
38 more
  1. 2026Bounded Agents: Delegation Security for Multi-Agent AI Systemscited by 7
  2. 2026AI Agents Under EU Lawcited by 5
  3. 2026No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skillscited by 5
  4. 2026Deontic Policies for Runtime Governance of Agentic AI Systemscited by 5
  5. 2026AID-Guard: Stateful Authorization for Delegated Agent Effectscited by 5
  6. 2026MasDrift: Benchmarking Authorization Preservation Across Multi-Agent Architecturescited by 4
  7. 2026PlanTwin: Privacy-Preserving Planning Abstractions for Cloud-Assisted LLM Agentscited by 3
  8. 2026SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systemscited by 3
  9. 2026AgentGuard: An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agentcited by 3
  10. 2026Parallax: Why AI Agents That Think Must Never Actcited by 2
  11. 2026"I Strongly Suspect This Website Is a Scam": Benchmarking PII Leakage and Detection without Defense in Autonomous Web Agentscited by 2
  12. 2026Agent Hacks Agent: Autoresearch for Production-Agent Red-Teamingcited by 2
  13. 2026AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systemscited by 2
  14. 2026VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflowscited by 2
  15. 2026Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Controlcited by 1
  16. 2026The Importance of Out-of-Band Metadata for Safe Autonomous Agents: The Redpanda Agentic Data Planecited by 1
  17. 2026One Goal, Many Commands: Characterizing Denylist Fragility in AI Agentscited by 1
  18. 2026ClawArena-Team: Benchmarking Subagent Orchestration and Dynamic Workflows in Language-Model Agentscited by 1
  19. 2026Towards an Agent Operating System - Lessons from Classical and Cloud OScited by 1
  20. 2026Multi-Agent AI Safety as an Institutional Design Problemcited by 1
  21. 2026Covert Assistance: Helpful LLM Agents Evade Oversight in Multi-Agent Systemscited by 1
  22. 2026Chain-of-Authorization: Embedding authorization into large language modelscited by 0
  23. 2026AutoSpec: Safety Rule Evolution for LLM Agents via Inductive Logic Programmingcited by 0
  24. 2026Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agentscited by 0
  25. 2026Agent Safety Is Action Alignmentcited by 0
  26. 2026The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilitiescited by 0
  27. 2026Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?cited by 0
  28. 2026Binding Biometrics with AI Agent Identifiers for Delegation of Authoritycited by 0
  29. 2026"Allow" to Achieve, Over-Privileged Inadvertently: The Unintended Cost of Task-Completion-Driven Pop-up Decisions in Mobile GUI Agentscited by 0
  30. 2026Beyond Direct Access: Resource Hijacking in LLM Agentscited by 0
  31. 2026If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundarycited by 0
  32. 2026Can AI Agents Deliver Verifiable Network-Wide Outcomes Across Authority Boundaries?cited by 0
  33. 2026Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelinescited by 0
  34. 2026Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systemscited by 0
  35. 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0
  36. 2026Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challengescited by 0
  37. 2026CART: Closed-Loop Adaptive Red Teaming for Large Language Modelscited by 0
  38. 2026AuthorityLens: Rethinking LLM-Based Agent Systems Through the Lens of Authoritycited by 0

50 most cited of 54 All 54 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise
  2. 2026Evaluating Privilege Usage of Agents with Real-World Tools
  3. 2025Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks
  4. 2026AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization
  5. 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies
  6. 2025LLM Agents Should Employ Security Principles
  7. 2025Secure and Efficient Access Control for Computer-Use Agents via Context Space
  8. 2026PrivEscalate: Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation ↗