基于大语言模型的AI智能体在会话开始时权限就固定下来,而且每次请求都是单独审查,这就导致智能体可以把各自被允许的动作组合起来做坏事,比如先读取机密文件再把它发到外部邮箱。作者提出了APC(Agentic Principal Chain,智能体主体链)这一权限管理框架,它会随着权限逐层委派而不断收窄,并结合此前所有动作的历史记录来审查每一个新请求,同时给出了数学证明。即便在模型完全被攻陷的最坏情况下测试,APC也把AgentDojo的数据泄露成功率从最高100%降到了0%,并挡住了InjecAgent全部544起数据窃取案例。
Table 7. Utility preservation on four AgentDojo suites (Claude Sonnet 4.6). UPR = fraction of task–injection pairs where the user task is completed successfully. Values are means over 3 runs; ± denotes sample standard deviation. Δ columns report percentage-point differences computed from unrounded means.
Suite
Baseline
Strict
Inter.
Δ strict (pp)
Δ inter. (pp)
Workspace (560)
96.2±0.2%
81.5±0.1%
86.7±0.4%
−14.7
−9.6
Banking (144)
68.8±1.2%
50.0±0.7%
58.8±1.7%
−18.8
−10.0
Travel (140)
59.8±1.1%
55.7±0.7%
60.0±1.4%
−4.0
+0.2
Slack (105)
73.0±1.5%
56.5±5.2%
60.0±4.4%
−16.5
−13.0
Table 8. Compromised-model evaluation on four AgentDojo suites (Claude Haiku 4.5). Ground-truth attack injection simulates a fully compromised model. Total: 609 unique task–injection pairs, 1,218 executions.
Suite / Category
Attack Tools
No Def.
APC
Blocking
Workspace (240 pairs)
Exfiltration
send_email
90.0%
0.0%
C2b + C4 + C6
Destruction
delete_file/email
48.8%
5.0%
C6 (intent)
Manipulation
create_calendar
97.5%
30.0%
C6 (partial)
Banking (144 pairs)
Financial exfil.
send_money
75.0%
0.0%
C2b (formal)
Manipulation
update_sched_txn
87.5%
12.5%
C6 (partial)
Account takeover
update_password
87.5%
0.0%
C2b (formal)
Travel (120 pairs)
Exfiltration
send_email
90.0%
0.0%
C2b (formal)
Manipulation
reserve/calendar
86.7%
0.0%
C6 (no overlap)
Slack (105 pairs)
Ext. exfiltration
post_webpage
100.0%
0.0%
C2b (formal)
Int. exfiltration
send_direct_msg
100.0%
0.0%
k-tuple
Destruction
remove_user
0.0%
0.0%
— (attack fails undefended)
Reconnaissance
get_webpage
100.0%
0.0%
C6 (intent)
Table 9. Taxonomy of residual attack successes (18 of 609 runs, 3.0% aggregated observed ASR).
Category
Attack Tool
Cases
Root Cause
Intent overlap
create_calendar_event
12
write class matches task intent
update_sched_transaction
2
write class matches task intent
Missing pair in X
delete_file
4
(read, delete) ∉X
Total
18
Table 10. Evaluation coverage across all benchmarks (3,154 evaluation instances). The compromised-model and utility cohorts are drawn from the same AgentDojo task–injection space and are therefore not disjoint.
Benchmark
Cases
Type
Main outcome
Delegation chains
99
Multi-hop (2–8 hops)
99/99, all 6 conditions
InjecAgent
1,054
Public
Data stealing 0%
ASB
400
Public
Disruptive 0%
AgentDojo (utility)
949
Live LLM, 4 suites
Δ interactive −8.6 pp (mean, 3 runs)
AgentDojo (compromised)
609†
Compromised-model
Exfil 0% all suites
Adaptive
43
Self-designed
23/23 matched
†609 unique pairs, 1,218 total executions under two conditions.
Table 11. Attack-class coverage summary. Residual values are observed ASR.
Attack class
Coverage
Main mechanism
Residual
Multi-step exfiltration
Full
C2b composition closure
0%
Delegation priv. escalation
Full
Thm. 4.6
0%
Destruction (out-of-intent)
High
C6 intent binding
4%
Manipulation (in-intent)
Partial
C6 (action-type granularity)
12.1%
Single-action within scope
None
Outside APC boundary
60.4%
Parameter-level misuse
None
Requires param. validation
—
Table 12. Formal results: assumptions, guarantees, and supporting evidence.
No admissible sequence produces prohibited outcome
InjecAgent 0% DS; ASB 0% disruptive; adaptive all matched
Table 13. Adaptive attack results (representative subset). Twenty-three named attacks with 43 variants target all six conditions.
Attack
Strategy
Result
Decomposed Exfil
read → write → send_internal (evades pairwise)
blocked (k-tuple)
Intent Drift
in-scope, out-of-intent resource
blocked (C6)
Budget Exhaustion
3 transfers, budget max 2
blocked (C2c)
Approval Replay
reuse token with different parameters
blocked (C4 hash)
Expired Token
use approval token after TTL expires
blocked (C4 temporal)
Consumed Token
reuse single-use token after consumption
blocked (C4 single-use)
Evidence Evasion
act when evidence sink is down
blocked (C5 fail-closed)
Scope Probing (A3)
probe resources, actions, classifications
boundaries enforced
Gradual Buildup (A4)
8-step sequence with interleaved noise
blocked (pair + k-tuple)
Session Splitting
split read/send across sessions
admitted (per-session)
Cross-Session Token (T3)
replay session-A token in session-B
blocked (C4 session)
Envelope Forgery (T2)
sign envelope with wrong key
blocked (signature)
Envelope Tampering (T2)
modify sealed envelope scope
blocked (immutability)
Depth Overflow
act beyond delegation depth ceiling
blocked (C2c)
Intent Warn Mode
out-of-intent in warn vs strict mode
graduated enforcement
Table 14. Enforcement mechanism comparison on InjecAgent (1,054 cases) and ASB (400 cases).
InjecAgent
ASB
Mechanism
DS
DH
Total
Stlth.
Disr.
Class
Comp. closure (APC)
0.0%
60.4%
29.2%
30.0%
0.0%
Action-class pairs
Info flow (SEAgent sim.)
1.7%
59.2%
29.5%
60.0%
60.0%
Sensitivity labels
Table 15. Enforcement latency on the environment above. Median of five repetitions; bracketed values are the range across repetitions. Reproduced from the committed measurement artifact evals/latency/results/latency_appendix_d.json.
Component
p50 (ms)
p99 (ms)
Full admissibility, C4 below threshold
0.049 [0.048–0.050]
0.240 [0.173–0.261]
Full admissibility, C4 token verified
0.057 [0.056–0.058]
0.236 [0.215–0.345]
Composition closure (isolated)
0.0016 [0.0012–0.0021]
0.0031 [0.0016–0.0033]
Envelope narrowing (meet + re-sign)
0.015 [0.015–0.016]
0.059 [0.049–0.081]
Table 16. Standalone coverage of APC properties by existing authorization mechanisms.
Property
OAuth+OPA
Prompts
Static Manifest
APC
Scope enforcement (G1)
✓
—
—
✓
Scope attenuation
Partial
—
Tool-level
✓
Composition closure (G2)
—
—
—
✓
Blast-radius mono. (G3)
—
—
—
✓
Approval binding (G4)
—
—
—
✓
Evidence commit. (G5)
Partial
—
—
✓
Intent binding (G6)
—
—
—
✓
Table 17. APC versus modern agentic security systems.
Property
SEAgent
CaMeL
Progent
APC
Data stealing ASR
0%a
—
—
0%
Composition closure
Policy-dep.
Dataflow-dep.
Policy-dep.
Formalb
Blast-radius mono.
—
—
Temporalc
Structural
Multi-hop delegation
Partial
—
Partialc
✓
Intent binding
—
—
—
✓
Table 18. Illustrative blast scores under default weights.
LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.
