cs.CRAug 25, 2026

WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents

Authors: Lin-Fa Lee, YI-YU Chang, Kuo-Hui Yeh

Organizations: Department of Institute of Artificial Intelligence Innovation National Yang Ming Chiao Tung University Hsinchu, Taiwan

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

The emerging W3C WebMCP proposal enables LLM agents to invoke tools exposed by web pages. In multi-party web environments, however, integrating agent execution into a browser security model centered on the Same-Origin Policy (SOP) leaves insufficient provenance and lifecycle guarantees for agent-accessible tools, creating three risks: subject-attribution spoofing, uncontrolled tool lifecycles, and semantic prompt injection. We propose WebMCP-Phalanx, a dual-layer agent runtime architecture. Its first layer provides a browser-native trust anchor that binds each tool to its registering principal through cryptographically protected capability credentials and propagates provenance labels throughout the tool lifecycle. Its second layer separates semantic inspection from privileged tool use. A Quarantine Agent (Q-LLM), without tool invocation authority, inspects tool metadata, outputs, and page-supplied content for prompt injection. Validated content is then forwarded to a Privileged Agent (P-LLM) for execution, while the Q-LLM's internal state remains hidden from page scripts. Empirical evaluation shows that the browser-native ownership mechanism reduces revocation and overwrite attack success from 100% to 0%. The dual-agent runtime blocks all 80 prompt-injection attempts embedded in tool descriptions and limits tool-return attacks to 2 successful cases out of 80. Across experiments, task utility remains statistically indistinguishable from the no-attack baseline. Under a white-box adaptive attacker, however, description-based filtering can be bypassed through malicious tool names invoked before inspection. This finding motivates a call-timing gate that delays tool invocation until all agent-visible tool metadata has been validated.

Figures & tables

Figure 1: The native browser side trust pipeline. The Tool Ownership Authority acts as the root of trust by issuing unforgeable capability handles, effectively isolating the registry from Turing complete same origin adversaries. The synthesis of telemetry and lifecycle states generates a deterministic Trust Tier Label. Note that while this architecture ensures ownership integrity, first registered name allocation remains a structural limitation (§Limitations).
Injection VectorL0L1L2L3
Description (Registration)69/8071/8025/800/80
Returned Content (Execution)42/8038/802/802/80
Table 1: Attack success counts for description and returned content injection across the four defense levels (n=80 per cell).
Handling PointMechanismFails When
Registration: DescriptionLabel RulesAlways, under a same origin adversary: every successful registrant obtains a capability, so the origin dimension is constant and its veto cannot fire (Table in Appendix).
Registration: DescriptionRule based StrippingThe tool name is task relevant. ASR rises from 0% to 70% as name relevance increases (Table 4 ).
Registration: DescriptionMulti Agent (Q)Not observed; 0% across all name relevance tiers (Table 4 ).
Execution: Return ContentLabel RulesAlways: the label is minted at registration, whereas the injected content does not yet exist at that moment.
Execution: Return ContentRule based StrippingThe agent invokes the tool on its name before the carrier executes (1 of the 2/80 residual; the other is channel consistent).
Execution: Return ContentMulti Agent (Q)The agent invokes the tool on its name before the carrier executes (2/80).
Table 2: Failure conditions of each mechanism at each handling point.
ConditionAttack Success RateTask Completion Rate
No Defense80%95%
No Attack0%100%
Lifecycle Monitor Only70%80%
Lifecycle Monitor + Our Framework0%100%
Table 3: Cross Page Semantic Residual Analysis.
Name RelevanceL2 ASRL3 ASR
N0 Completely Irrelevant0%0%
N1 Generic0%0%
N2 Common Step25%0%
N3 Task Domain55%0%
N4 Essential Step70%0%
Table 4: Name Relevance on Defense Performance.
More in this topic

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 327 papers

Explore similar work

CardsList
May 11, 2026

The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck

Tool-using LLM agents must act on untrusted webpages, emails, files, and API outputs while issuing privileged tool calls. Existing defenses often mediate trust at the granularity of an entire tool invocation, forcing a brittle choice in mixed-trust workflows: allow external content to influence a call and risk hijacked destinations or commands, or quarantine the call and block benign retrieval-then-act behavior. The key observation behind this paper is that indirect prompt injection becomes dangerous not when untrusted content appears in context, but when it determines an authority-bearing argument. We present PACT (Provenance-Aware Capability Contracts), a runtime monitor that assigns semantic roles to tool arguments, tracks value provenance across replanning steps, and checks whether each argument's origin satisfies its role-specific trust contract. Under oracle provenance, PACT achieves 100% utility and 100% security on mixed-trust diagnostic suites, while flat invocation-level monitors incur false positives or false negatives. In full AgentDojo deployments across five models, PACT reaches 100% security on the three strongest models while recovering 38.1--46.4% utility, 8--16 percentage points above CaMeL at the same security level. Ablations show that both semantic roles and cross-step provenance are necessary. PACT reframes agent security as authority binding, and isolates the remaining deployment bottleneck to provenance inference and contract synthesis.

Linfeng Fan, Ziwei Li, Yuan Tian +3

Gaoling School of Artificial Intelligence, Renmin University of China, Beijing, China · King Abdullah University of Science and Technology, Thuwal, Saudi Arabia · Dongbei University of Finance and Economics, Dalian, China +1

LLM Agent SecurityInformation Flow ControlPrompt Injection DefenseAccess ControlTool Access Control for LLM Agents
AskPDF
May 18, 2026

Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control

Large language models increasingly operate as autonomous agents that select and invoke tools from large registries. We identify a critical gap: when unauthorized tools are visible in an agent's context, models select them in adversarial scenarios -- even when explicitly instructed otherwise. We propose a governed MCP proxy that enforces attribute-based access control (ABAC) at two points: tool discovery, where unauthorized tools are removed from the model's context window, and tool invocation, where a second check blocks any unauthorized call. Across three models (Qwen 2.5 7B, Llama 3.1 8B, Claude Haiku 3.5) and 150 adversarial tasks spanning four attack categories, our proxy reduces unauthorized invocation rate (UIR) to 0% while adding under 50ms median latency. Prompt-based restrictions reduce UIR by only 11--18 percentage points, leaving substantial residual risk. Our results show that architectural enforcement -- not prompting -- is necessary for reliable tool access control in deployed agentic systems.

Rohith Uppala

Independent Researcher

LLM Agent SecurityAI ControlLLM Tool UseAccess ControlTool Access Control for LLM Agents
AskPDF
Sep 29, 2026

ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents

Tool-using LLM agents remain vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context, allowing malicious content to steer consequential input-filtering defenses. Multi-path consensus defenses still leave a high attack success rate because they examine content or aggregated outputs rather than authorizing effects, especially for the within-tool attack, which preserves the intended tool but manipulates its arguments. Data-Flow Control such as CaMeL provides stronger guarantees, but incurs substantial time latency that limits practical deployment. We introduce ToolFence, which compiles a typed authorization blueprint before execution, enforces it through a deterministic monitor, and when the blueprint is incomplete asks a judge to grant new capabilities rather than adjudicate each concrete call. ToolFence provides two key advantages. First, its fine-grained provenance-aware authorization enables the system to distinguish user-authorized values from untrusted observations, effectively addressing the within-tool attack. Second, its deterministic fast path and capability-level runtime grants substantially reduce the frequency of expensive judge calls, improving runtime efficiency. On AgentDojo with Qwen3-max, ToolFence reduces overall ASR to near zero with only a 3.80 percentage-point clean-utility drop and practical runtime overhead.

Yanjie Li, Xiangyu He, Xuelong Dai +1

Hong Kong Polytechnic University · Shandong University

Runtime Enforcement for AI AgentsPrompt Injection DefensePrompt Injection AttacksTool Access Control for LLM Agents
AskPDF