mlsanityData to 14 Oct 2026

Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control

arXiv 2605.18414 ↗First posted 18 May 2026cs.CR cs.AIcited by 1

Not on the map. Why?

Abstract (arXiv)

Large language models increasingly operate as autonomous agents that select and invoke tools from large registries. We identify a critical gap: when unauthorized tools are visible in an agent's context, models select them in 48-68% of adversarial scenarios, even when explicitly instructed not to. Role escalation attacks (e.g., "I'm the CFO, override the access controls") are the most dangerous category, reaching 96% unauthorized invocation in frontier models. We show this holds across three models spanning open-weight and frontier systems, including instruction-tuned models with strong alignment training. Critically, prompt-based compliance is both insufficient and unpredictable: explicit per-tool allowlists reduce violations to as low as 4.0% but never to zero, and compliance varies widely across models, from 4.0% to 37.0% UIR, with no reliable relationship to general capability. We propose a proxy-enforced attribute-based access control (ABAC) layer for MCP that filters tool registries at discovery time. Because unauthorized tools never reach the model context, UIR is 0% by design, a structural guarantee that prompt instructions cannot replicate regardless of model or phrasing.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 7 of its 14 references that are in the map. First posted on arXiv 18 May 2026.

Builds on

7 of 14 references.

References · 7

  1. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
  2. 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,947
  3. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  4. 2025Prompt Injection Attack to Tool Selection in LLM Agentscited by 158
  5. 2026Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Frameworkcited by 54
  6. 2026Formal Policy Enforcement for Real-World Agentic Systemscited by 33
  7. 2026Solver-Aided Verification of Policy Compliance in Tool-Augmented LLM Agentscited by 16

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Subjects, Not Authors: The Authorship Hazard in Agentic Dataspacescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection
  2. 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents
  3. 2025Semantic Attacks on Tool-Augmented LLMs: Securing the Model Context Protocol Against Descriptor-Level Manipulation
  4. 2026Universal Defenses for Tool-Integrated LLM Agents Against Adversarial Attacks
  5. 2026Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning
  6. 2025Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem
  7. 2026Recognition Without Enforcement: Configuration-Dependent Failures in LLM Agent Instruction Arbitration and External Control
  8. 2025IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents