Agent Security Needs Redefinition through a Holistic Framework

2026-07-24

AI Summary

This study addresses a critical limitation in existing agent safety evaluations, which predominantly focus on instruction or action content while neglecting contextual factors, thereby failing to distinguish legitimate operations from malicious attacks. The work reframes agent safety as a contextual problem and introduces a continuous safety assessment framework grounded in four dimensions: source authorization, task alignment, action alignment, and data isolation. By integrating authorization verification, goal consistency analysis, action intent inference, and cross-privilege data flow control, the framework exposes fundamental shortcomings of current snapshot-based benchmarks—particularly their inability to detect data isolation violations. It further redefines the logic underpinning defense strategy effectiveness and substantially enhances detection capabilities for context-sensitive threats such as indirect prompt injection attacks.

Abstract

Agent security is widely treated as a question about action content. Defenses ask whether an instruction looks malicious. Benchmarks ask whether an agent performs a harmful sounding action. \textbf{We argue that agent security is fundamentally a contextual problem, and that the current content based framing systematically misdefines it.} A command to ``delete user data'' might be a routine administrative request or a prompt injection attacking production systems, and the content alone cannot distinguish the two. Authorization context can. Across every injection task in AgentDojo and WASP, the same action is one an authenticated user would plausibly request in a routine workflow, which makes the conflation a structural property of evaluating security through content. We operationalize contextual security through four properties that must hold jointly and be evaluated continuously across the agent's trajectory. Source Authorization asks who issued the command. Task Alignment specifies the agent's authorized objective. Action Alignment evaluates whether each action serves that objective. Data Isolation governs information flows across privilege boundaries. Under this reframing, indirect prompt injection becomes a Source Authorization violation. Snapshot benchmarks are structurally incapable of evaluating Data Isolation. Existing defenses are reorganized around the property they actually approximate. The contextual reframing changes which defenses are coherent, which evaluations measure something useful, and which attack patterns evaluation can see at all.

Problem

• agent security
• contextual security
• authorization
• prompt injection
• data isolation

Innovation

• contextual security
• agent security
• source authorization
• data isolation
• prompt injection