mlsanityData to 7 Oct 2026

Context-to-Execution Integrity for LLM Agents

arXiv 2607.06000 ↗First posted 7 Jul 2026cs.CRcited by 7

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Language-model agents read attacker-writable context to solve tasks. Tool execution needs a separate authority check for protected sink fields, sink-interpreted payloads, and the invocation event. Context-to-Execution Integrity (CXI) is an execution-boundary system for this setting. Policies mark protected sink fields, typed releases carry narrow validated values from writable context to specific destinations, opaque data slots keep evidence as data, and a deterministic gate admits a call only after field authority, exact-effect authorization, and invocation authority all bind to the same action manifest. We evaluate CXI on open-weight field-projection runs, AgentDojo live episodes, a code-agent exact-effect benchmark, manifest-bound ledger faults, proposal-pressure controls, and hosted/API compatibility traces. AgentDojo covers 720 live episodes and 1,739 LLM calls; the code-agent benchmark covers 400 repository episodes with exact-effect authorization and lease-bound execution, yielding 231 safe task completions and zero observed field, effect, or invocation escapes. The accounting reports parser outcomes, authorization outcomes, and task-quality outcomes together with the admission-integrity result. Across the evaluated sinks, CXI admits execution only when field, effect, and invocation authority bind to the same action manifest.

Key facts. Cited by 7 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 30 of its 53 references that are in the map. First posted on arXiv 7 Jul 2026.

Builds on

30 of 53 references.

Closest ancestors · 6

Same direction, newest first

  1. 2026AIRGuard: Guarding Agent Actions with Runtime Authority Control27 May
  2. 2026ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection5 May
  3. 2026Formal Policy Enforcement for Real-World Agentic Systems18 Feb
  4. 2025Defeating Prompt Injections by Design24 Mar
  5. 2025Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents17 Mar
  6. 2023Identifying the Risks of LM Agents with an LM-Emulated Sandbox25 Sep

Other references · 24

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  2. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,767
  3. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  4. 2022FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awarenesscited by 3,611
  5. 2023SWE-bench: Can Language Models Resolve Real-World GitHub Issues?cited by 3,193
  6. 2023FlashAttention-2: Faster Attention with Better Parallelism and Work Partitioningcited by 2,551
  7. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
  8. 2021WebGPT: Browser-assisted question-answering with human feedbackcited by 1,722
  9. 2022Fast Inference from Transformers via Speculative Decodingcited by 1,615
  10. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  11. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  12. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
12 more
  1. 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
  2. 2023AgentBench: Evaluating LLMs as Agentscited by 1,211
  3. 2024OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environmentscited by 1,134
  4. 2023SGLang: Efficient Execution of Structured Language Model Programscited by 1,107
  5. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  6. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  7. 2023FlexGen: High-Throughput Generative Inference of Large Language Models with a Single GPUcited by 567
  8. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
  9. 2024AppWorld: A Controllable World of Apps and People for Benchmarking Interactive Coding Agentscited by 359
  10. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 325
  11. 2024The BrowserGym Ecosystem for Web Agent Researchcited by 152
  12. 2026Prompt Control-Flow Integrity: A Priority-Aware Runtime Defense Against Prompt Injection in LLM Systemscited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 7.

7 papers.

  1. 2026When Memory Becomes Authority: Benchmarking Authority Collapse at the Memory Consolidation Boundarycited by 6
  2. 2026Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actionscited by 5
  3. 2026AID-Guard: Stateful Authorization for Delegated Agent Effectscited by 5
  4. 2026CONTINUITY: Security-Context Contracts for Composable LLM Agent Controlscited by 3
  5. 2026Influence Is Not Authority: When Causal Guardrail Signals Make Legitimate Tool Use Look Like an Attack in Tool-Using LLM Agentscited by 0
  6. 2026Making AI-Assisted Claims Independently Challengeable: Publication Authority and a Protocol for Falsifiable Publication Recordscited by 0
  7. 2026PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026SINGED: Correct Outputs Do Not Certify Safe Execution in LLM Agents
  2. 2026Securing LLM Agents Need Intent-to-Execution Integrity
  3. 2026From Approval to Execution: Reconstruction-Aware Repair Analysis for LLM-Agent Software
  4. 2026SecureClaw: Clawing Back Control of LLM Agents
  5. 2026Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcement
  6. 2026TraceGrant: A Contract-Governed Security Framework for the Task-Effect Lifecycle of Networked LLM Agents
  7. 2025SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks
  8. 2026Boundary-State Control for Tool-Using Language-Model Agents: Commit-Time Consistency under State Drift