Pith. sign in

REVIEW 13 cited by

IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems

Not yet reviewed by Pith; the record is open.

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2403.04960 v2 pith:XITTF4EO submitted 2024-03-08 cs.CR cs.AIcs.CLcs.CYcs.LG

classification cs.CRcs.AIcs.CLcs.CYcs.LG
keywords appsisolationsystemsexecutionisolategptllm-basednaturallanguage
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

Large language models (LLMs) extended as systems, such as ChatGPT, have begun supporting third-party applications. These LLM apps leverage the de facto natural language-based automated execution paradigm of LLMs: that is, apps and their interactions are defined in natural language, provided access to user data, and allowed to freely interact with each other and the system. These LLM app ecosystems resemble the settings of earlier computing platforms, where there was insufficient isolation between apps and the system. Because third-party apps may not be trustworthy, and exacerbated by the imprecision of natural language interfaces, the current designs pose security and privacy risks for users. In this paper, we evaluate whether these issues can be addressed through execution isolation and what that isolation might look like in the context of LLM-based systems, where there are arbitrary natural language-based interactions between system components, between LLM and apps, and between apps. To that end, we propose IsolateGPT, a design architecture that demonstrates the feasibility of execution isolation and provides a blueprint for implementing isolation, in LLM-based systems. We evaluate IsolateGPT against a number of attacks and demonstrate that it protects against many security, privacy, and safety issues that exist in non-isolated LLM-based systems, without any loss of functionality. The performance overhead incurred by IsolateGPT to improve security is under 30% for three-quarters of tested queries.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 13 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?

    cs.CR 2026-07 conditional novelty 7.0 of 10

    OS-level defenses against self-hosted AI agents that corrupt their own memory/config files can close most attack cells but cannot detect small in-distribution memory edits, leaving a residual surface.

  2. Stop Means Stop: Measuring and Repairing the Enforcement Gap in Agent-Framework Control Primitives

    cs.SE 2026-07 accept novelty 7.0 of 10

    Approval-pause, cancellation, and timeout primitives fail to stop side effects in all six evaluated agent frameworks (sibling leak), and an externally placed, formally verified admission gate closes the gap.

  3. DualView: Preventing Indirect Prompt Injection in Personal AI Agents

    cs.CR 2026-07 conditional novelty 7.0 of 10

    DualView extends Dual-LLM symbol isolation into the shared user environment via dual Agent/Human views, blocking both immediate and stored IPI at 0% ASR while preserving near-baseline utility.

  4. The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities

    cs.CR 2026-07 accept novelty 6.5 of 10

    Execution-security research for AI coding agents is fragmented across 17 mechanism categories with five unaddressed cross-cutting gaps, including missing head-to-head isolation-vs-capability evaluation and untested re...

  5. Data Leakage Prevention in Agentic Applications via Preemptive Hardening

    cs.CR 2026-07 conditional novelty 6.0 of 10

    A build-time pipeline that scans, patches, and validates agentic LLM apps reduced prompt-injection leakage to 0% on most tested apps and by 91% on the hardest stress case.

  6. AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents

    cs.CR 2025-09 conditional novelty 6.0 of 10

    AgentSentinel combines system-level tracing with LLM-based auditing to block 79.6% of attacks in the authors' 60-scenario computer-use agent benchmark.

  7. Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms

    cs.CR 2025-07 conditional novelty 6.0 of 10

    Function Calling and MCP architectures show distinct vulnerability patterns, with chained attacks succeeding 91-96% of the time in both.

  8. Maris: A Formally Verifiable Privacy Policy Enforcement Paradigm for Multi-Agent Collaboration Systems

    cs.CR 2025-05 conditional novelty 6.0 of 10

    Maris embeds a formally checkable privacy monitor into multi-agent LLM frameworks, cutting policy violations to 0% in tested healthcare, supply chain, and travel agent scenarios while keeping task success at 100%.

  9. Position: Adversarial ML for LLMs Is Not Making Any Progress

    cs.LG 2025-02 conditional novelty 6.0 of 10

    The authors argue that LLM-era adversarial machine learning is less well-defined, harder to solve, and harder to evaluate, so meaningful progress may not be achievable or trackable in the current paradigm.

  10. LLM Agents Should Employ Security Principles

    cs.CR 2025-05 conditional novelty 5.0 of 10

    A position paper proposing AgentSandbox, a framework that applies Saltzer-Schroeder security principles to LLM agents and reports large attack-success-rate reductions on AgentDojo.

  11. Rethinking Agent Security as a Networking Problem

    cs.MA 2026-08 accept novelty 4.0 of 10

    The authors propose treating AI agent security as a networking problem, with centralized policy control and per-agent sidecars that enforce both deterministic and context-aware rules.

  12. From Agent Failure Paths to Quantified Residual Risk: A Compositional Framework for Resilient Agentic AI

    cs.AI 2026-04 conditional novelty 4.0 of 10

    CPSAINT/FRIESA-K couples failure-path structure to a multiplicative residual-risk score with a Markov-derived resistance term, demonstrated only on parameter-assigned synthetic scenarios.

  13. Vibe Coding vs. Agentic Coding: Fundamentals and Practical Implications of Agentic AI

    cs.SE 2025-05 conditional novelty 3.0 of 10

    A qualitative taxonomy positions vibe coding and agentic coding as complementary paradigms rather than rivals in AI-assisted software development.

Pith tools