Pith. sign in

REVIEW 3 major objections 4 minor 77 references

Rethinking Agent Security as a Networking Problem

T0 review · 3 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper argues that the network—not the LLM—is the right place to enforce AI-agent security, via a sidecar that mediates every request as allow, redact, or deny under a central control plane.

desk verdict A well-grounded position paper that usefully reframes agent security as an egress-control problem, but the semantic-engine soft spot is real. read the letter →

arxiv 2608.12172 v1 pith:CPVO4LCX submitted 2026-08-12 cs.MA

Van Tran , Taveesh Sharma , Tajveer Singh Dhesi , Nick Feamster This is my paper · ORCID
classification cs.MA
keywords AIagentsecuritynetwork-basedenforcementsidecararchitecturecontextualintegritypromptinjectioncentralizedcontrolcapability-basedaccessdeterministic
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that current defenses fail because they ask the AI agent itself to detect threats and follow privacy rules, and an LLM's reasoning can be hijacked by prompt injection. It proposes treating the network as the enforcement point: every request, inter-agent message, and external call passes through a sidecar that can allow, redact, deny, or escalate, using rules issued by a control plane the agent cannot reach. What matters if this is right: agents' security no longer depends on how well the LLM behaves, because deterministic controls stop actions even when reasoning is compromised and semantic checks decide whether a data flow is appropriate in context. The paper frames this as borrowing proven networking principles—centralized control, capability-based access, least privilege—and adding a context-aware semantic layer that classic rules lack.

What carries the argument

The carrying mechanism is the sidecar-plus-control-plane pair. The sidecar is a policy enforcement point that intercepts every agent action, classifies it as deterministic or semantic, and applies the corresponding engine; the control plane lives in the trusted zone and compiles declarative policies into rules the sidecars can execute. The semantic engine operationalizes contextual integrity as a check_flow(sender, recipient, task, labels) function, turning privacy norms into checks a choke point can run. This is information flow control where contextual integrity norms are the label policy and the network is the reference monitor.

What would settle it

Run the proposed sidecar on a live agent, poison the agent's memory so it labels a bookings request as belonging to a health task with a different recipient role, and observe whether the semantic engine approves the flow; if a single manipulated context label converts deny into allow, the architecture's strong-guarantee claim is falsified.

Watch

Extended reading notes

Core claim

The central claim is that the network is the natural place to enforce privacy and security controls for AI agents, instantiated as a reference architecture in which each agent is paired with a sidecar that mediates every action as allow, redact, or deny, and a control plane outside the agent's reach compiles and pushes policies. Deterministic enforcement constrains what an agent may do regardless of whether its reasoning is compromised; context-aware semantic enforcement, grounded in contextual integrity norms of the form (sender role, recipient role, subject, information type, transmission principle), decides whether an action is appropriate. The paper argues these two abstractions work only together: deterministic rules alone cannot catch oversharing with an approved endpoint, and semantic reasoning alone reduces to guardrails enforced by the entity being protected. The proposed check_flow(sender, recipient, task, labels) evaluated at every hop effectively makes information-flow control with contextual integrity norms the agent-security mechanism, treating the agent execution graph as the unit protected rather than the packet 5-tuple.

Load-bearing premise

The architecture assumes the sidecar's semantic engine can learn the true context of an action from the agent, and that this context cannot be manipulated; the paper's own limitations section concedes an attacker may manipulate the context the agent supplies, which would let the semantic engine authorize a disallowed flow.

Editorial extensions

If this is right

  • If deployed, prompt-injected agents cannot exfiltrate data through approved channels unless the sidecar's semantic engine is fooled, because no action reaches an external service without passing through an enforcement point.
  • Enterprises can apply one security layer across different models and frameworks, since sidecars sit outside agent implementations and do not require modifying the agent.
  • Agent reach becomes off by default: a capability must be explicitly granted before an agent can send data or contact a destination, and capabilities are issued by the control plane rather than claimed by the agent.
  • Privacy norms expressed as contextual-integrity flows can be audited and refined because all decisions and execution context are recorded.
  • Egress control is the feasible first step; ingress filtering is harder because a malicious sender can evade inspection, which the paper presents as a research direction.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the sidecar architecture matures, agent security may start to be specified as data-plane policy: organizations could write contextual-integrity norms once and have every agent framework compile them, much as software-defined networking decoupled routing policy from switch hardware.
  • A testable extension is a reference implementation evaluated on prompt-injection suites: measuring how often the semantic engine's context is actually spoofable would quantify the gap the paper's own limitation concedes.
  • The ingress discussion points toward sender-attached verifiable labels agreed upon ahead of time, shifting trust from inspecting content to authenticating metadata—a form of capability-based data provenance.
  • Even if semantic context cannot be made fully trustworthy, the deterministic layer alone would still block unauthorized endpoints and enforce capabilities, reducing the attack surface even when oversharing through approved endpoints remains hard.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. This position paper argues that AI agent security should be enforced at the network layer rather than by the agent itself. It critiques agent-centric defenses (prompting, fine-tuning, output filters) as relying on nondeterministic LLM reasoning that is vulnerable to prompt injection. It proposes a reference architecture with a centralized control plane and per-agent sidecars that mediate all external actions using deterministic rules (ACLs, RBAC, capabilities) plus a context-aware semantic engine that decides allow/deny/redact/escalate based on policies such as contextual integrity. The paper identifies open research questions including ingress filtering, dynamic roles, and risk-aware routing. It is explicitly a position paper with no implementation or formal evaluation.

Significance. If the architectural thesis is accepted, the paper offers a useful reframing that imports mature networking principles (SANE/Ethane-style centralized control, capability-based access, off-by-default) into agent security. The reference architecture is concrete enough to guide system-building, and the paper candidly lists limitations (context manipulation, egress-only scope, dynamic environments). The paper does not provide proofs, experiments, or code; its contribution is a research agenda and a conceptual separation of deterministic and semantic enforcement. The main risk is that the semantic engine—an essential component for detecting oversharing with approved endpoints—may inherit the same adversarial-evasion problems attributed to agent-centric defenses.

major comments (3)
  1. [5 (Limitations), 4.1.2] The semantic engine is a load-bearing component for privacy guarantees, but the paper does not address direct adversarial attacks on that engine. In §4.1.2, the context-aware semantic engine evaluates requests that include tool outputs, outbound message content, and inter-agent traffic—untrusted data that can carry injected instructions. The critique in §2.2 that LLM-based reasoning is "nondeterministic... susceptible to prompt injection... bypassed by adversarial inputs" applies verbatim if the semantic engine is implemented as an LLM or learned classifier. Section 5 only concedes that "an attacker may manipulate the context supplied by the agent," not that the engine itself can be attacked through the content it inspects. Since §3.1 concedes that deterministic rules alone cannot stop oversharing with an approved endpoint, the architecture's privacy guarantee for such flows rests on an evadable component unless mitigations are specified. Please add an explicit threat model for the semantic engine and describe defenses (e.g., input sanitization, adversarial training, or restricting semantic analysis to structured fields).
  2. [3.1, 4.1.2] The relationship between "compiling semantics into a deterministic mechanism" (§3.1) and the "context-aware semantic engine" (§4.1.2) is unclear. §3.1 describes check_flow(sender, recipient, task, labels) as executable at a choke point, which suggests deterministic enforcement of contextual-integrity norms. §4.1.2 describes a semantic engine that "gathers information" and "evaluates semantic policies," which sounds like a learned or LLM-based reasoner. These are different mechanisms with different security properties. The paper should state explicitly whether the semantic layer is (a) a compiler from normative policies to deterministic label checks, (b) a learned classifier or LLM, or (c) a hybrid. The central claim about strong guarantees depends on this distinction.
  3. [4.2] The request classifier/policy router determines whether an action goes through deterministic enforcement or semantic evaluation. If the router misclassifies a context-dependent action as low-risk and sends it only to the deterministic engine, a leak that depends on semantic context (e.g., oversharing with an approved endpoint) would go undetected. The paper does not analyze the security impact of router errors or discuss the failure modes and required accuracy of the classifier. Since the architecture's combined guarantee relies on correct routing, this is a load-bearing point that should be addressed at least as an explicit open problem with a concrete risk statement.
minor comments (4)
  1. [Figure 1, §4.1.2] Figure 1's caption uses "redact" while §4.1.2 uses "modify" for the set of possible sidecar actions; align the terminology.
  2. [Abstract, §3.1] The abstract and §3.1 use "context-aware filtering" and "context-aware policy semantics" interchangeably; choose one term for consistency.
  3. [5] In §5, the phrase "the policy router (Figure 2)" would be clearer as "the Request Classifier/Policy Router (Figure 2)" to match the component names used in the architecture.
  4. [4.3] The paper mentions BlindBox [57] in the references but does not discuss how the sidecar handles encrypted traffic; a sentence on TLS termination or on where interception occurs in the network stack would help clarify the enforcement point.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper is a position piece with a reference architecture and makes no empirical predictions, fitted parameters, or derivation chains that could reduce to their inputs.

full rationale

This is a position paper proposing a network-based reference architecture for AI agent security. It contains no equations, no fitted parameters, no datasets, and no predictions that are then compared with measurements. The argument is architectural: deterministic enforcement is placed in a sidecar, while semantic, context-aware evaluation is delegated to a separate engine; both are motivated by analogies to networking principles (SANE, Ethane, SIFF, TVA, Off-by-Default) and by cited external work on prompt injection and contextual integrity. The paper explicitly disclaims a definitive solution and lists open research questions and limitations, including the acknowledgment that an attacker may manipulate the context supplied by the agent. The authors do not cite their own prior work as load-bearing evidence, and no claim reduces by construction to its own input. The closest concern, that the semantic engine may inherit LLM evadability, is a substantive correctness and threat-model issue, not a circularity issue: the paper does not claim the semantic engine is invulnerable, and it explicitly concedes a limitation. Under the specified rules, an honest non-finding is the appropriate result.

Assumptions & free parameters 0 free parameters · 4 assumptions · 1 invented entities

Position paper with no fitted parameters or formal derivation. The central claim rests on the transferability of networking principles to agents and the feasibility of a semantic engine that interprets contextual integrity norms; both are assumed without empirical demonstration, though the paper candidly lists remaining challenges.

assumptions (4)
  • domain assumption LLM-driven agent behavior is nondeterministic and cannot be trusted to enforce its own security policies.
    Stated in Section 2 as the fundamental limitation of agent-centric defenses; motivates placing enforcement outside the agent.
  • domain assumption Network security principles (centralized control, capability-based access, least privilege) are transferable to AI agents.
    Sections 3.2 and 3.3 assert that agents are network entities and that SANE/Ethane/SIFF-style mechanisms apply directly; the analogy is assumed rather than demonstrated.
  • domain assumption Contextual integrity norms can be compiled into checks that a choke point can execute.
    Section 3.1 proposes check_flow(sender, recipient, task, labels) as 'information flow control with CI norms as the label policy,' but no mechanism or implementation is given.
  • domain assumption The sidecar can observe all relevant agent actions (egress).
    Section 4.1 asserts the gateway intercepts 'all external actions,' which requires agents to route every interaction through the sidecar; the paper later limits scope to egress.
invented entities (1)
  • Context-aware semantic engine in the sidecar
    purpose: Evaluates whether an agent action or disclosure is appropriate given execution context, and allows, denies, redacts, or escalates.
    The paper proposes this component without implementation or empirical validation; its feasibility is the main open question and the paper admits it can be manipulated via agent-supplied context.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Rethinking Agent Security as a Networking Problem." pith.science (2026). https://pith.science/paper/CPVO4LCX

@misc{pith2026260812172,
  author       = {Pith},
  title        = {Pith review of: Rethinking Agent Security as a Networking Problem},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CPVO4LCX}},
  note         = {Machine review of arXiv:2608.12172}
}
read the original abstract

AI agents are rapidly becoming more capable and widely deployed, promising substantial gains in productivity and enabling new classes of applications. However, their growing autonomy also introduces significant privacy and security risks. Existing defenses are predominantly agent-centric, relying on the agent itself to detect threats and enforce privacy and security policies. This approach is fundamentally limited because it entrusts policy enforcement to AI agents whose LLM-driven behavior is inherently nondeterministic and vulnerable to manipulation through attacks such as prompt injection. As a result, current defenses cannot reliably prevent privacy and security threats, highlighting a critical need for a new solution to securing AI agent systems. The networking community has long grappled with similar challenges and offers insightful principles we can borrow to design a more secure AI agent system. These include centralized control with distributed enforcement, capability-based access for mediating requests to sensitive resources, and least privilege through zero-trust enforcement. Historically, these principles have provided strong deterministic guarantees for networked systems. However, these principles alone are insufficient for AI agents because the safety and appropriateness of an agent's actions often depend on semantic context beyond the expressiveness of static rules. Building on these principles, we advocate for a systematic approach to AI agent security that combines deterministic enforcement mechanisms, which provide strong security guarantees, with semantic, context-aware policies that enable nuanced decision-making. We then present a reference architecture and identify key research questions and future directions to guide the design of secure and privacy-preserving AI agent systems.

Figures

Figures reproduced from arXiv: 2608.12172 by the authors.

Figure 1
Figure 1. Proposed sidecar architecture for securing [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Reference architecture for secure AI agents. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

77 extracted references · 47 canonical work pages

  1. [1]

    Simple prompt injection attacks can leak personal data observed by llm agents during task execution.arXiv preprint arXiv:2506.01055, 2025

    Meysam Alizadeh, Zeynab Samei, Daria Stetsenko, and Fabrizio Gilardi. Simple prompt injection attacks can leak personal data observed by llm agents during task execution.arXiv preprint arXiv:2506.01055, 2025

    arXiv 2025

  2. [2]

    Model context protocol

    Anthropic. Model context protocol. https://modelcontextprotocol.io, 2024

    work page 2024

  3. [3]

    Air- GapAgent: Protecting privacy-conscious conversational agents

    Eugene Bagdasarian, Ren Yi, Sahra Ghalebikesabi, Peter Kairouz, Marco Gruteser, Sewoong Oh, Borja Balle, and Daniel Ramage. Air- GapAgent: Protecting privacy-conscious conversational agents. In Proceedings of the 2024 ACM SIGSAC Conference on Computer and Com- munications Security, CCS ’24, pages 3868–3882, New York, NY, USA,

    work page 2024

  4. [4]

    Off by default! InProceedings of the 4th ACM Workshop on Hot Topics in Networks (HotNets-IV), College Park, MD, 2005

    Hitesh Ballani, Yatin Chawathe, Sylvia Ratnasamy, Timothy Roscoe, and Scott Shenker. Off by default! InProceedings of the 4th ACM Workshop on Hot Topics in Networks (HotNets-IV), College Park, MD, 2005

    work page 2005

  5. [5]

    Freedman, Justin Pettit, Jianying Luo, Nick McKeown, and Scott Shenker

    Martin Casado, Michael J. Freedman, Justin Pettit, Jianying Luo, Nick McKeown, and Scott Shenker. Ethane: Taking control of the enterprise. InProceedings of the ACM SIGCOMM 2007 Conference, pages 1–12, 2007

    work page 2007

  6. [6]

    Freedman, Dan Boneh, Nick McKeown, and Scott Shenker

    Martin Casado, Tal Garfinkel, Aditya Akella, Michael J. Freedman, Dan Boneh, Nick McKeown, and Scott Shenker. SANE: A protection archi- tecture for enterprise networks. In15th USENIX Security Symposium (USENIX Security 06), Vancouver, B.C., Canada, 2006

    work page 2006

  7. [7]

    {StruQ}: Defending against prompt injection with structured queries

    Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. {StruQ}: Defending against prompt injection with structured queries. In34th USENIX Security Symposium (USENIX Security 25), pages 2383– 2400, 2025

    work page 2025

  8. [8]

    Secalign: Defending against prompt injection with preference optimization

    Sizhe Chen, Arman Zharmagambetov, Saeed Mahloujifar, Kamalika Chaudhuri, David Wagner, and Chuan Guo. Secalign: Defending against prompt injection with preference optimization. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pages 2833–2847, 2025

    2025

Show all 77 references
  1. [9]

    Agentpoison: Red-teaming llm agents via poisoning memory or knowl- edge bases.Advances in Neural Information Processing Systems, 37:130185–130213, 2024

    Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. Agentpoison: Red-teaming llm agents via poisoning memory or knowl- edge bases.Advances in Neural Information Processing Systems, 37:130185–130213, 2024

    2024

  2. [10]

    Overprivileged by design: AI agents as cloud escalation vectors

    Cloud Security Alliance AI Safety Initiative. Overprivileged by design: AI agents as cloud escalation vectors. Lab Space, Cloud Security Alliance, April 2026. CSA Research Note

    2026

  3. [11]

    Securing ai agents with information-flow control.arXiv preprint arXiv:2505.23643, 2025

    Manuel Costa, Boris Köpf, Aashish Kolluri, Andrew Paverd, Mark Russinovich, Ahmed Salem, Shruti Tople, Lukas Wutschitz, and San- tiago Zanella-Béguelin. Securing ai agents with information-flow control.arXiv preprint arXiv:2505.23643, 2025

    2025 arXiv

  4. [12]

    Defeating prompt injections by design.arXiv preprint arXiv:2503.18813, 2025

    Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, An- dreas Terzis, and Florian Tramèr. Defeating prompt injections by design.arXiv preprint arXiv:2503.18813, 2025

    2025 arXiv

  5. [13]

    AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents

    Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer- Kellner, Marc Fischer, and Florian Tramèr. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. InNeurIPS Datasets and Benchmarks, 2024

    2024

  6. [14]

    Ai agents under threat: A survey of key security challenges and future pathways.ACM Computing Surveys, 57(7):1–36, 2025

    Zehang Deng, Yongjian Guo, Changzhou Han, Wanlun Ma, Junwu Xiong, Sheng Wen, and Yang Xiang. Ai agents under threat: A survey of key security challenges and future pathways.ACM Computing Surveys, 57(7):1–36, 2025

    2025

  7. [15]

    Dorothy E. Denning. An intrusion-detection model.IEEE Transactions on Software Engineering, SE-13(2):222–232, February 1987

    1987

  8. [16]

    Memory injection attacks on llm agents via query-only interaction.Advances in Neural Information Processing Systems, 38:46697–46731, 2026

    Shen Dong, Shaochen Xu, Pengfei He, Yige Li, Jiliang Tang, Tianming Liu, Hui Liu, and Zhen Xiang. Memory injection attacks on llm agents via query-only interaction.Advances in Neural Information Processing Systems, 38:46697–46731, 2026

    2026

  9. [17]

    Towards verifiably safe tool use for llm agents

    Aarya Doshi, Yining Hong, Congying Xu, Eunsuk Kang, Alexandros Kapravelos, and Christian Kästner. Towards verifiably safe tool use for llm agents. InProceedings of the IEEE/ACM 48th International Conference on Software Engineering, ICSE-NIER ’26, page 201–205, New York, NY, US...

    2026

  10. [18]

    AgentLeak: A full-stack benchmark for privacy leakage in multi-agent LLM systems.arXiv preprint arXiv:2602.11510, February 2026

    Faouzi El Yagoubi, Godwin Badu-Marfo, and Ranwa Al Mallah. AgentLeak: A full-stack benchmark for privacy leakage in multi-agent LLM systems.arXiv preprint arXiv:2602.11510, February 2026. Preprint

    2026

  11. [19]

    Wasp: Benchmarking web agent security against prompt injection attacks.Advances in Neural Information Processing Systems, 38, 2026

    Ivan Evtimov, Arman Zharmagambetov, Aaron Grattafiori, Chuan Guo, and Kamalika Chaudhuri. Wasp: Benchmarking web agent security against prompt injection attacks.Advances in Neural Information Processing Systems, 38, 2026

    2026

  12. [20]

    AI agents are the biggest data security threat you’re not governing

    Tim Freestone. AI agents are the biggest data security threat you’re not governing. Kiteworks, Cybersecurity Risk Management Blog, February 2026. Updated February 26, 2026

    2026

  13. [21]

    Agent2agent (A2A) protocol

    Google. Agent2agent (A2A) protocol. https://a2a-protocol.org, 2025

    2025

  14. [22]

    Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. InACM Workshop on Artificial Intelligence and Security (AISec), 2023

    2023

  15. [23]

    Bypassing LLM guardrails: An empirical analysis of eva- sion attacks against prompt injection and jailbreak detection systems, 2025

    William Hackett, Lewis Birch, Stefan Trawicki, Neeraj Suri, and Peter Garraghan. Bypassing LLM guardrails: An empirical analysis of eva- sion attacks against prompt injection and jailbreak detection systems, 2025

    2025

  16. [24]

    The OAuth 2.0 authorization framework

    Dick Hardt. The OAuth 2.0 authorization framework. Technical Report RFC 6749, Internet Engineering Task Force (IETF), October 2012

    2012

  17. [25]

    Llama guard: Llm-based input-output safeguard for human-ai conversations.arXiv preprint arXiv:2312.06674, 2023

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: Llm-based input-output safeguard for human-ai conversations.arXiv preprint arXiv:2312.06674, 2023. ...

    2023 arXiv

  18. [26]

    Break- ing and fixing defenses against control-flow hijacking in multi-agent systems.arXiv preprint arXiv:2510.17276, 2025

    Rishi Jha, Harold Triedman, Justin Wagle, and Vitaly Shmatikov. Break- ing and fixing defenses against control-flow hijacking in multi-agent systems.arXiv preprint arXiv:2510.17276, 2025

    2025

  19. [27]

    The task shield: Enforcing task alignment to defend against indirect prompt injection in LLM agents

    Feiran Jia, Tong Wu, Xin Qin, and Anna Squicciarini. The task shield: Enforcing task alignment to defend against indirect prompt injection in LLM agents. InProceedings of the 63rd Annual Meeting of the Asso- ciation for Computational Linguistics (Volume 1: Long Papers), pages ...

    2025

  20. [28]

    A critical evaluation of defenses against prompt injection attacks.arXiv preprint arXiv:2505.18333, 2025

    Yuqi Jia, Zedian Shao, Yupei Liu, Jinyuan Jia, Dawn Song, and Neil Zhenqiang Gong. A critical evaluation of defenses against prompt injection attacks.arXiv preprint arXiv:2505.18333, 2025

    2025 arXiv

  21. [29]

    When benign inputs lead to severe harms: Eliciting unsafe unintended behaviors of computer-use agents.arXiv preprint arXiv:2602.08235, 2026

    Jaylen Jones, Zhehao Zhang, Yuting Ning, Eric Fosler-Lussier, Pierre- Luc St-Charles, Yoshua Bengio, Dawn Song, Yu Su, and Huan Sun. When benign inputs lead to severe harms: Eliciting unsafe unintended behaviors of computer-use agents.arXiv preprint arXiv:2602.08235, 2026

    2026 arXiv

  22. [30]

    Frans Kaashoek, Eddie Kohler, and Robert Morris

    Maxwell Krohn, Alexander Yip, Micah Brodsky, Natan Cliffer, M. Frans Kaashoek, Eddie Kohler, and Robert Morris. Information flow control for standard OS abstractions. InACM SOSP, 2007

    2007

  23. [31]

    Lakera guard

    Lakera AI. Lakera guard. https://www.lakera.ai/lakera-guard, 2023. Accessed 2026-07-08

    2023

  24. [32]

    Inan, Sahar Abdelnabi, Janardhan Kulka- rni, Lukas Wutschitz, Reza Shokri, Christopher G

    Guangchen Lan, Huseyin A. Inan, Sahar Abdelnabi, Janardhan Kulka- rni, Lukas Wutschitz, Reza Shokri, Christopher G. Brinton, and Robert Sim. Contextual integrity in LLMs via reasoning and reinforcement learning. InAdvances in Neural Information Processing Systems, vol- ume 39, 2025

    2025

  25. [33]

    Improving google a2a protocol: Protecting sensitive data and mitigating unintended harms in multi-agent systems.ACM Transactions on Software Engineering and Methodology, 2025

    Yedidel Louck, Ariel Stulman, and Amit Dvir. Improving google a2a protocol: Protecting sensitive data and mitigating unintended harms in multi-agent systems.ACM Transactions on Software Engineering and Methodology, 2025

    2025

  26. [34]

    Clawless: A security model of ai agents.arXiv preprint arXiv:2604.06284, 2026

    Hongyi Lu, Nian Liu, Shuai Wang, and Fengwei Zhang. Clawless: A security model of ai agents.arXiv preprint arXiv:2604.06284, 2026

    2026 arXiv

  27. [35]

    Agentauditor: Human-level safety and security evaluation for llm agents.Advances in Neural Information Processing Systems, 38:43241–43298, 2026

    Hanjun Luo, Shenyu Dai, Chiming Ni, Xinfeng Li, Guibin Zhang, Kun Wang, Tongliang Liu, and Hanan Salam. Agentauditor: Human-level safety and security evaluation for llm agents.Advances in Neural Information Processing Systems, 38:43241–43298, 2026

    2026

  28. [36]

    A holistic approach to undesired content detection in the real world.Proceedings of the AAAI Conference on Artificial Intelligence, 37(12):15009–15018, 2023

    Todor Markov, Chong Zhang, Sandhini Agarwal, Florentine Eloun- dou Nekoul, Theodore Lee, Steven Adler, Angela Jiang, and Lilian Weng. A holistic approach to undesired content detection in the real world.Proceedings of the AAAI Conference on Artificial Intelligence, 37(12):1500...

    2023

  29. [37]

    Same model, different hat

    Conor McCauley and Kasimir Schulz. Same model, different hat. HiddenLayer Research, October 2025

    2025

  30. [38]

    cell- mate: Sandboxing browser ai agents.arXiv preprint arXiv:2512.12594, 2025

    Luoxi Meng, Henry Feng, Ilia Shumailov, and Earlence Fernandes. cell- mate: Sandboxing browser ai agents.arXiv preprint arXiv:2512.12594, 2025

    2025

  31. [39]

    Veriguard: Enhancing llm agent safety via verified code generation.arXiv preprint arXiv:2510.05156, 2025

    Lesly Miculicich, Mihir Parmar, Hamid Palangi, Krishnamurthy Dj Dvijotham, Mirko Montanari, Tomas Pfister, and Long T Le. Veriguard: Enhancing llm agent safety via verified code generation.arXiv preprint arXiv:2510.05156, 2025

  32. [40]

    Can LLMs keep a secret? Testing privacy implications of language models via contextual in- tegrity theory

    Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, and Yejin Choi. Can LLMs keep a secret? Testing privacy implications of language models via contextual in- tegrity theory. InICLR, 2024

    2024

  33. [41]

    Myers and Barbara Liskov

    Andrew C. Myers and Barbara Liskov. A decentralized model for information flow control. InACM SOSP, 1997

    1997

  34. [42]

    Omni-leak: Orchestrator multi-agent net- work induced data leakage.arXiv preprint arXiv:2602.13477, 2026

    Akshat Naik, Jay Culligan, Yarin Gal, Philip Torr, Rahaf Aljundi, Alas- dair Paren, and Adel Bibi. Omni-leak: Orchestrator multi-agent net- work induced data leakage.arXiv preprint arXiv:2602.13477, 2026

    2026

  35. [43]

    Securing agentic ai: A com- prehensive threat model and mitigation framework for generative ai agents.arXiv preprint arXiv:2504.19956, 2025

    Vineeth Sai Narajala and Om Narayan. Securing agentic ai: A com- prehensive threat model and mitigation framework for generative ai agents.arXiv preprint arXiv:2504.19956, 2025

    2025 arXiv

  36. [44]

    Privacy as contextual integrity.Washington Law Review, 79(1):119–157, 2004

    Helen Nissenbaum. Privacy as contextual integrity.Washington Law Review, 79(1):119–157, 2004

    2004

  37. [45]

    Why traditional security fails in the age of non- deterministic AI

    Anand Oswal. Why traditional security fails in the age of non- deterministic AI. Perspectives, Palo Alto Networks, February 2026

    2026

  38. [46]

    Real ai agents with fake memories: Fatal context manipulation attacks on web3 agents.arXiv preprint arXiv:2503.16248, 2025

    Atharv Singh Patlan, Peiyao Sheng, S Ashwin Hebbar, Prateek Mit- tal, and Pramod Viswanath. Real ai agents with fake memories: Fatal context manipulation attacks on web3 agents.arXiv preprint arXiv:2503.16248, 2025

    2025 arXiv

  39. [47]

    Agentbay: A hybrid interaction sandbox for seamless human-ai intervention in agentic systems.arXiv preprint arXiv:2512.04367, 2025

    Yun Piao, Hongbo Min, Hang Su, Leilei Zhang, Lei Wang, Yue Yin, Xiao Wu, Zhejing Xu, Liwei Qu, Hang Li, et al. Agentbay: A hybrid interaction sandbox for seamless human-ai intervention in agentic systems.arXiv preprint arXiv:2512.04367, 2025

    2025

  40. [48]

    Overeager coding agents: Measuring out-of-scope actions on benign tasks.arXiv preprint arXiv:2605.18583, 2026

    Yubin Qu, Ying Zhang, Yanjun Zhang, Gelei Deng, Yuekang Li, Leo Yu Zhang, and Yi Liu. Overeager coding agents: Measuring out-of-scope actions on benign tasks.arXiv preprint arXiv:2605.18583, 2026

    2026 arXiv

  41. [49]

    NeMo guardrails: A toolkit for controllable and safe LLM applications with programmable rails

    Traian Rebedea, Razvan Dinu, Makesh Narsimhan Sreedhar, Christo- pher Parisien, and Jonathan Cohen. NeMo guardrails: A toolkit for controllable and safe LLM applications with programmable rails. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Pro...

    2023

  42. [50]

    Zero trust architecture

    Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero trust architecture. Technical Report NIST Special Publication (SP) 800-207, National Institute of Standards and Technology (NIST), Gaithersburg, MD, August 2020

    2020

  43. [51]

    Saltzer, David P

    Jerome H. Saltzer, David P. Reed, and David D. Clark. End-to-end arguments in system design.ACM Transactions on Computer Systems, 2(4):277–288, 1984

    1984

  44. [52]

    Saltzer and Michael D

    Jerome H. Saltzer and Michael D. Schroeder. The protection of infor- mation in computer systems.Proceedings of the IEEE, 63(9):1278–1308, September 1975

    1975

  45. [53]

    Sandhu, Edward J

    Ravi S. Sandhu, Edward J. Coyne, Hal L. Feinstein, and Charles E. Youman. Role-based access control models.Computer, 29(2):38–47, 1996

    1996

  46. [54]

    Pri- vacyLens: Evaluating privacy norm awareness of language models in action

    Yijia Shao, Tianshi Li, Weiyan Shi, Yanchen Liu, and Diyi Yang. Pri- vacyLens: Evaluating privacy norm awareness of language models in action. InAdvances in Neural Information Processing Systems, vol- ume 37 ofNeurIPS Datasets and Benchmarks Track, 2024

    2024

  47. [55]

    Rollback-recovery for middleboxes

    Justine Sherry, Peter Xiang Gao, Soumya Basu, Aurojit Panda, Arvind Krishnamurthy, Christian Maciocco, Maziar Manesh, João Martins, Sylvia Ratnasamy, Luigi Rizzo, and Scott Shenker. Rollback-recovery for middleboxes. InACM SIGCOMM, 2015

    2015

  48. [56]

    Making middleboxes someone else’s problem: Network processing as a cloud service

    Justine Sherry, Shaddi Hasan, Colin Scott, Arvind Krishnamurthy, Sylvia Ratnasamy, and Vyas Sekar. Making middleboxes someone else’s problem: Network processing as a cloud service. InACM SIG- COMM, 2012

    2012

  49. [57]

    BlindBox: Deep packet inspection over encrypted traffic

    Justine Sherry, Chang Lan, Raluca Ada Popa, and Sylvia Ratnasamy. BlindBox: Deep packet inspection over encrypted traffic. InACM SIGCOMM, 2015

    2015

  50. [58]

    Progent: Programmable privilege control for llm agents.arXiv e-prints, pages arXiv–2504, 2025

    Tianneng Shi, Jingxuan He, Zhun Wang, Linyu Wu, Hongwei Li, Wenbo Guo, and Dawn Song. Progent: Programmable privilege control for llm agents.arXiv e-prints, pages arXiv–2504, 2025

    2025

  51. [59]

    From prompt injection to persistent control: Defending agentic harness against trojan backdoors.arXiv preprint arXiv:2605.31042, 2026

    Jiejun Tan, Zhicheng Dou, Xinyu Yang, Yuyang Hu, Yiruo Cheng, Xiaoxi Li, and Ji-Rong Wen. From prompt injection to persistent control: Defending agentic harness against trojan backdoors.arXiv preprint arXiv:2605.31042, 2026

    2026 arXiv

  52. [60]

    AI agents are becoming authorization bypass paths

    The Hacker News. AI agents are becoming authorization bypass paths. The Hacker News, January 2026

    2026

  53. [61]

    The instruction hierarchy: Training llms to prioritize privileged instructions.arXiv preprint arXiv:2404.13208, 2024

    Eric Wallace, Kai Xiao, Reimar Leike, Lilian Weng, Johannes Heidecke, and Alex Beutel. The instruction hierarchy: Training llms to prioritize privileged instructions.arXiv preprint arXiv:2404.13208, 2024. 8 Rethinking Agent Security as a Networking Problem

    2024 arXiv

  54. [62]

    Privacy in action: Towards realistic privacy mitigation and evaluation for LLM-powered agents

    Shouju Wang, Fenglin Yu, Xirui Liu, Xiaoting Qin, Jue Zhang, Qing- wei Lin, Dongmei Zhang, and Saravan Rajmohan. Privacy in action: Towards realistic privacy mitigation and evaluation for LLM-powered agents. InFindings of the Association for Computational Linguistics: EMNLP 20...

    2025

  55. [63]

    Sok: Evaluating jailbreak guardrails for large language models

    Xunguang Wang, Zhenlan Ji, Wenxuan Wang, Zongjie Li, Daoyuan Wu, and Shuai Wang. Sok: Evaluating jailbreak guardrails for large language models. In2026 IEEE Symposium on Security and Privacy (SP), pages 39–58. IEEE, 2026

    2026

  56. [64]

    Isolategpt: An execution isolation architecture for llm- based agentic systems.arXiv preprint arXiv:2403.04960, 2024

    Yuhao Wu, Franziska Roesner, Tadayoshi Kohno, Ning Zhang, and Umar Iqbal. Isolategpt: An execution isolation architecture for llm- based agentic systems.arXiv preprint arXiv:2403.04960, 2024

    2024 arXiv

  57. [65]

    Guarda- gent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning.arXiv preprint arXiv:2406.09187, 2024

    Zhen Xiang, Linzhi Zheng, Yanjie Li, Junyuan Hong, Qinbin Li, Han Xie, Jiawei Zhang, Zidi Xiong, Chulin Xie, Carl Yang, et al. Guarda- gent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning.arXiv preprint arXiv:2406.09187, 2024

    2024 arXiv

  58. [66]

    SIFF: A stateless internet flow filter to mitigate DDoS flooding attacks

    Abraham Yaar, Adrian Perrig, and Dawn Song. SIFF: A stateless internet flow filter to mitigate DDoS flooding attacks. In2004 IEEE Symposium on Security and Privacy, pages 130–143, 2004

    2004

  59. [67]

    A DoS- limiting network architecture

    Xiaowei Yang, David Wetherall, and Thomas Anderson. A DoS- limiting network architecture. InProceedings of the ACM SIGCOMM 2005 Conference, pages 241–252, 2005

    2005

  60. [68]

    ReAct: Synergizing reasoning and acting in language models

    Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. ReAct: Synergizing reasoning and acting in language models. InICLR, 2023

    2023

  61. [69]

    Temporal dynamics of mem- ory poisoning in web3-style llm agents.IEEE Access, 2026

    Abbas Yazdinejad and Hadis Karimipour. Temporal dynamics of mem- ory poisoning in web3-style llm agents.IEEE Access, 2026

    2026

  62. [70]

    Making information flow explicit in HiStar

    Nickolai Zeldovich, Silas Boyd-Wickizer, Eddie Kohler, and David Mazières. Making information flow explicit in HiStar. InUSENIX OSDI, 2006

    2006

  63. [71]

    Injecagent: Benchmarking indirect prompt injections in tool-integrated large lan- guage model agents

    Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. Injecagent: Benchmarking indirect prompt injections in tool-integrated large lan- guage model agents. InFindings of the Association for Computational Linguistics: ACL 2024, pages 10471–10506, 2024

    2024

  64. [72]

    Towards action hijacking of large language model-based agent.arXiv preprint arXiv:2412.10807, 2024

    Yuyang Zhang, Kangjie Chen, Jiaxin Gao, Ronghao Cui, Run Wang, Lina Wang, and Tianwei Zhang. Towards action hijacking of large language model-based agent.arXiv preprint arXiv:2412.10807, 2024

    2024 arXiv

  65. [73]

    AgentDAM: Privacy leakage evaluation for autonomous web agents

    Arman Zharmagambetov, Chuan Guo, Ivan Evtimov, Maya Pavlova, Ruslan Salakhutdinov, and Kamalika Chaudhuri. AgentDAM: Privacy leakage evaluation for autonomous web agents. InAdvances in Neural Information Processing Systems, volume 39, 2025

    2025

  66. [74]

    Rtbas: Defending llm agents against prompt injection and privacy leakage.arXiv preprint arXiv:2502.08966, 2025

    Peter Yong Zhong, Siyuan Chen, Ruiqi Wang, McKenna McCall, Ben L Titzer, Heather Miller, and Phillip B Gibbons. Rtbas: Defending llm agents against prompt injection and privacy leakage.arXiv preprint arXiv:2502.08966, 2025

    2025 arXiv

  67. [75]

    Rescriber: Smaller- LLM-powered user-led data minimization for LLM-based chatbots

    Jijie Zhou, Eryue Xu, Yaoyao Wu, and Tianshi Li. Rescriber: Smaller- LLM-powered user-led data minimization for LLM-based chatbots. In Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems, CHI ’25, pages 1–28, Yokohama, Japan, April 2025. Association fo...

    2025

  68. [76]

    Cve-bench: a benchmark for ai agents’ ability to exploit real-world web application vulnerabilities.arXiv preprint arXiv:2503.17332, 2025

    Yuxuan Zhu, Antony Kellermann, Dylan Bowman, Philip Li, Akul Gupta, Adarsh Danda, Richard Fang, Conner Jensen, Eric Ihli, Ja- son Benn, et al. Cve-bench: a benchmark for ai agents’ ability to exploit real-world web application vulnerabilities.arXiv preprint arXiv:2503.17332, 2025. 9

    2025 arXiv

  69. [2024]

    Association for Computing Machinery

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.