Agent Security Needs Redefinition through a Holistic Framework
On the map: LLM safety and security → Prompt injection and agent security
Abstract (arXiv)
Agent security is widely treated as a question about action content. Defenses ask whether an instruction looks malicious. Benchmarks ask whether an agent performs a harmful sounding action. We argue that agent security is fundamentally a contextual problem, and that the current content based framing systematically misdefines it. A command to ``delete user data'' might be a routine administrative request or a prompt injection attacking production systems, and the content alone cannot distinguish the two. Authorization context can. Across every injection task in AgentDojo and WASP, the same action is one an authenticated user would plausibly request in a routine workflow, which makes the conflation a structural property of evaluating security through content. We operationalize contextual security through four properties that must hold jointly and be evaluated continuously across the agent's trajectory. Source Authorization asks who issued the command. Task Alignment specifies the agent's authorized objective. Action Alignment evaluates whether each action serves that objective. Data Isolation governs information flows across privilege boundaries. Under this reframing, indirect prompt injection becomes a Source Authorization violation. Snapshot benchmarks are structurally incapable of evaluating Data Isolation. Existing defenses are reorganized around the property they actually approximate. The contextual reframing changes which defenses are coherent, which evaluations measure something useful, and which attack patterns evaluation can see at all.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 21 of its 36 references that are in the map. First posted on arXiv 24 Jul 2026.
Builds on
21 of 36 references.
Closest ancestors · 11
Same direction, newest first
- 2026A Framework for Formalizing LLM Agent Security19 Mar
- 2025PromptArmor: Simple yet Effective Prompt Injection Defenses21 Jul
- 2025Design Patterns for Securing LLM Agents against Prompt Injections10 Jun
- 2025AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents9 May
- 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
- 2025WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks22 Apr
- 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents11 Oct
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
- 2024Get my drift? Catching LLM Task Drift with Activation Deltas2 Jun
- 2024Goal-guided Generative Prompt Injection Attack on Large Language Models6 Apr
- 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned23 Aug
Other references · 10
- 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,302
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2023A Survey on Large Language Model based Autonomous Agentscited by 2,203
- 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
- 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
- 2025Securing AI Agents with Information-Flow Controlcited by 108
- 2025PropensityBench: Evaluating Latent Safety Risks in Large Language Models via an Agentic Approachcited by 19
- 2025COSMIC: Generalized Refusal Direction Identification in LLM Activationscited by 15
Built on by
Citing papers per year: 2026: 2.
2 papers.