Authors: Reshabh K Sharma, Linxi Jiang, Shuo Chen, Zhiqiang Lin
Organizations: University of Washington Seattle, Washington, USA · The Ohio State University Columbus, Ohio, USA · Microsoft Research Redmond, Washington, USA
A language model agent acts through the tools it is given. The data it reads while working on a task can redirect what it does with those tools. A growing set of techniques for safe and secure agent execution therefore sits between the agent and its tools, aiming to enforce access control, information flow or isolation at that boundary. Today these techniques are evaluated on agent-security benchmarks built around indirect prompt injection. Those benchmarks judge a defense by how far it brings the number of successful attacks down while preserving the agent's utility. A defense is judged only on the agent's execution. It can score well on both metrics while holding open a transfer, a deletion or a broad read that no task needed. Ajar measures that open privilege directly using the existing benchmarks. It attaches to an agent-security benchmark that already exists and reuses the tasks, tool schemas, reference solutions and goal states that benchmark uses to grade its own runs. For each benign task it builds candidate tool calls the task does not need, so allowing one is privilege left open. These calls are presented to the defense at every point where the agent could act. We evaluate Ajar by attaching it to AgentDojo, where open privilege becomes a third axis beside the existing attack success and benign utility. We run it on five defenses: Progent, CaMeL, AC4A, Permission Assistant, and Claude Code's Auto mode. We observed that they leave widely different amounts of privilege open. Two defenses leak by almost the same amount yet differ widely in the benign tasks they finish, and one defense buys part of its tightness by refusing calls its tasks were entitled to make. This open privilege cannot be derived from the measured attack success or benign utility. The source code of Ajar is available at https://github.com/reSHARMA/Ajar.
Table 1: For each of the seven fault classes we give one of the tests Ajar generates for banking user_task_2 . The label says whether the task needs the call, and it is fixed by the construction. The harm tier runs from H0, the calls the task needs, to H4. Section 3 gives the rubric that fixes a tier and the weight it carries.
Tier
Description
Weight w
H0
Required call (the allow set)
0
H1
Reversible, self-scoped read or draft
1
H2
Reversible action touching a third party
3
H3
Irreversible action, self-scoped
9
H4
Irreversible action touching a third party or funds
27
Table 2: For each of the five harm tiers we describe the calls it covers and the weight a test in it carries. A tier follows from whether a call’s side effect can be undone and how far that effect reaches.
Figure 1: Ajar attaches to a host benchmark through an adapter and to a defense through a wrapper. The adapter exports what the benchmark already carries in order to grade itself, the task, the tools it may call, the reference plan and the attack sinks its injections aim at. The generator turns those into tests, the oracle gives each test its label and its harm tier, and the wrapper hands a test to a defense’s own enforcement path and returns the verdict through decide . Scoring compares the verdicts with the labels to give leakage and sufficiency.
Suite
Tasks
Candidates
Tests
deny
Required
Permitted
Validated
banking
16
573
1156
1035
33
88
474 (41.0%)
slack
21
973
2618
2226
98
294
774 (29.6%)
travel
20
464
2785
2151
124
510
862 (31.0%)
workspace
40
1541
3912
3627
84
201
712 (18.2%)
all
97
3551
10471
9039
339
1093
2822 (27.0%)
Table 3: For each of AgentDojo’s four task suites we give the tasks it holds, the unique (task, tool, arguments) candidates Ajar generated from them, and the tests those candidates make when each is offered at every decision point it applies to. The tests split by label into deny tests, required calls and permitted calls. Validated counts the tests whose label AgentDojo’s own predicates confirm, and Ajar asserts the rest.
amount
Defense
Deciding model
1200
"12000.0"
0.0
0.01
Ground truth
allow
deny
deny
deny
Progent
Sonnet-5
allow
allow
allow
allow
Progent
Haiku-4.5
allow
allow
allow
allow
perm-assistant
Sonnet-5
allow
deny
deny
deny
perm-assistant
Haiku-4.5
allow
deny
deny
deny
Table 4: For each defense under each deciding model we give its verdict on the rent update of banking user_task_2 and on the update’s three nearest wrong variants. Every column is the same tool on the same transaction, update_scheduled_transaction on id=7 , and the columns differ only in the amount argument. Claude Code’s Auto mode is scored only on calls its model issued, and it never issued the string-typed variant, marked —.
Defense
Model
OPL ↓
95% CI
Suff. ↑
Provisioned
Attacks ↓
perm-assistant
Sonnet-5
0.0810
[0.0616, 0.1037]
0.961
82/92
25/609
perm-assistant
Haiku-4.5
0.1289
[0.0943, 0.1647]
0.822
68/92
39/609
CaMeL
Sonnet-5
0.0895
[0.0480, 0.1378]
0.700
37/92
16/609
CaMeL
Haiku-4.5
0.1041
[0.0575, 0.1556]
0.665
34/92
16/609
Progent †
Sonnet-5
0.1026
[0.0690, 0.1402]
0.902
70/92
34/609
Progent †
Haiku-4.5
0.1312
[0.0909, 0.1713]
0.859
64/92
36/609
Table 5: For each defense we report over-privilege leakage, sufficiency, the fully provisioned count, and the attack sinks it leaves open. The model column names the deciding model. Intervals are 95% bootstrap intervals resampling tasks. Claude Code’s Auto mode is scored on the calls its own agent issued, so it has no sufficiency and no fully provisioned count. Progent † is scored once per unique candidate at the earliest decision point it is offered at. perm-assistant ‡ is Permission Assistant given a personalized history.
Baseline
OPL ↓
Suff. ↑
Provisioned
Attacks ↓
allow-all
1.0000
1.00
92/92
609/609
tool-name allowlist
0.3551
1.00
92/92
99/609
argument-exact oracle
0.0020
0.91
71/92
1/609
deny-all
0.0000
0.00
0/92
0/609
Table 6: For each reference baseline we report over-privilege leakage, sufficiency, the fully provisioned count and the attack sinks it leaves open, scored on the same tests as the measured defenses.
Defense
Deciding model
Agent
Undefended
Defended
Cost (pp)
perm-assistant
Sonnet-5
Sonnet-4.5
85.6%
74.2%
−11.3
perm-assistant
Haiku-4.5
Sonnet-4.5
85.6%
70.1%
−15.5
Progent
Sonnet-5
Sonnet-4.5
87.6%
87.6%
0.0
Progent
Haiku-4.5
Sonnet-4.5
87.6%
82.5%
−5.2
CaMeL
Sonnet-5
Sonnet-5
86.6%
64.9%
−21.6
CaMeL
Haiku-4.5
Haiku-4.5
77.3%
73.2%
−4.1
Table 7: For each defense we report benign-task completion with and without the defense. The agent column gives the model that ran the tasks in both runs of a row.
Full set
Auto’s subset
Defense
Model
Denied
Over-Res. ↓
Flips
Denied
Over-Res. ↓
perm-assistant
Sonnet-5
126
0.088
0
17
0.054
perm-assistant
Haiku-4.5
300
0.209
0
48
0.152
Progent
Sonnet-5
325
0.227
16
42
0.133
Progent
Haiku-4.5
356
0.249
3
52
0.165
AC4A
Sonnet-5
442
0.309
0
93
0.294
Table 8: For each defense we report how many of the 1432 entitled calls it refuses. Claude Code’s Auto mode is scored on a subset of 316 of those calls in each of its three runs, which gives the range shown, and the right-hand columns score every defense on that subset. Over-Res. is the fraction of entitled calls the defense denies. Flips counts candidates the defense answered differently at two states the benchmark executes.
Variant
Deciding model
OPL ↓
Ratio
Sufficiency ↑
Provisioned
Progent, dynamic
Sonnet-5
0.1026
1.00 ×
0.902
70/92
Progent, frozen S0
Sonnet-5
0.1605
1.56 ×
0.888
72/92
Progent, dynamic
Haiku-4.5
0.1312
1.00 ×
0.859
64/92
Progent, frozen S0
Haiku-4.5
0.1622
1.24 ×
0.848
66/92
Table 9: Progent-static, the frozen S0 row of each pair, keeps Progent’s own generator, prompt and enforcement code, and freezes the initial policy S0 . We score both variants once per unique candidate over the 3551-candidate set. OPL is pooled over the deny tests, sufficiency is the per-task mean, and the provisioned column counts tasks on which the defense admits every required call.
Figure 2: For each defense we plot sufficiency against over-privilege leakage on a log vertical axis. A filled marker is the Sonnet-5 run, a hollow marker is the Haiku-4.5 run, and the two are joined. The reference baselines are also plotted for scale. The shaded corner is the region at least as usable as the argument-exact oracle and no leakier, where a procedure is tight and usable at once. Claude Code’s Auto mode has no sufficiency value, and the deny-all baseline cannot be placed on a log axis.
Defense
Model
default
unweighted
linear
base-2
base-4
steep H4
(1,3,9,27)
(1,1,1,1)
(1,2,3,4)
(1,2,4,8)
(1,4,16,64)
(1,3,9,81)
perm-assistant
Sonnet-5
0.0810
0.2070
0.1373
0.1070
0.0717
0.0669
Haiku-4.5
0.1289
0.1937
0.1613
0.1436
0.1234
0.1200
CaMeL
Sonnet-5
0.0895
0.1095
0.0902
0.0905
0.0900
0.0916
Haiku-4.5
0.1041
0.1130
0.1008
0.1032
0.1053
0.1073
AC4A
Sonnet-5
0.1113
0.1734
0.1430
0.1255
0.1059
0.1028
Table 10: For each defense–model configuration we give OPL under six harm weightings. The model column names the deciding model. The default weighting is the one used throughout the paper. Kendall’s τ in the last row is computed against the default ranking.
Figure 3: For each defense–model configuration we plot OPL recomputed from 10, 25, 50, 75 and 100 percent of each task’s tests, one panel per defense, with Sonnet-5 as filled and Haiku-4.5 as open markers. Every plot shares one logarithmic axis.
Defense
OPL base
Δ rep.
Δ para.
Agr. rep.
Agr. para.
Op/Cl rep.
Op/Cl para.
perm-assistant
0.0810
−0.0193
−0.0145
92.9%
93.1%
94/16
84/13
CaMeL
0.0895
−0.0069
−0.0297
98.1%
96.2%
10/14
15/24
Progent
0.1026
+0.0012
+0.0021
92.5%
92.4%
106/38
108/31
AC4A
0.1113
+0.0251
+0.0472
91.2%
91.6%
152/22
172/10
Claude Code Auto
0.3009
+0.0073
−0.0121
95.4%
93.1%
80/0
101/2
Table 11: For each defense we report both runs of the task-prompt re-generation, over the same 3551 deduplicated candidates, with Sonnet-5 as the deciding model. Repeat sends the identical prompts again and isolates the defense’s own run-to-run variance, and paraphrase rewrites the user’s request. The wording effect is the difference between the two Δ columns. Opens counts candidates the baseline run correctly denied and the new run admits, and closes counts allow -labelled candidates the baseline admitted and the new run denies. Each row is scored on the candidates its two runs share, and Claude Code’s Auto mode on the 3150 calls its agent issued.
Defense
Runs
OPL per run
Mean
SD
Verdict agreement
AC4A
3
0.1113 / 0.1364 / 0.0962
0.1146
0.0203
91.2–93.0%
perm-assistant
3
0.0810 / 0.0617 / 0.0717
0.0715
0.0096
92.1–92.9%
CaMeL
3
0.0895 / 0.0826 / 0.0755
0.0825
0.0070
96.8–98.1%
Progent
3
0.1026 / 0.1038 / 0.1045
0.1036
0.0010
92.5–95.3%
Claude Code Auto
3
0.3009 / 0.3091 / 0.3025
0.3042
0.0044
95.4–95.9%
Table 12: For each defense we report OPL on each of three runs on identical input, the mean and standard deviation across the runs, and the fraction of verdicts the runs agree on. Agreement is the fraction of the candidates on which two runs return the same verdict, given as a range over the three pairs of runs. Auto mode is scored on the calls its agent issued in each run, and its agreement over the 3150 out of 3551 of them both runs reached.
Agentic computing systems, while immensely capable, raise serious security, privacy, and safety concerns. A key issue is that the full set of functionalities offered by these systems, combined with their probabilistic execution flows, is not known beforehand. Given this lack of characterization, it is challenging to validate whether a system has successfully carried out the user's intended task or instead executed irrelevant actions, potentially as a consequence of compromise. We present Agent Sentry, a runtime defense that learns a bound on an agent's benign execution from prior legitimate executions and flags any action that falls outside this bound. Agent Sentry layers three complementary checks: a structural classifier over the sequence of actions and the provenance of each function's arguments; a deterministic allowlist check over sensitive argument values; and an LLM judge, invoked only on the residual of actions where the first two checks cannot safely decide between a legitimate new request and a carefully crafted injection. We demonstrate the effectiveness of Agent Sentry in AgentDojo and AgentDyn by blocking 94.3% of successful injections while allowing 95.1% of benign executions, without modifying the agent, its tools, or the LLM.
Rohan Sequeira, Stavros Damianakis, Umar Iqbal +1
University of Southern California, Los Angeles, California, USA · Washington University in St. Louis, St. Louis, Missouri, USA
Tool-using language agents turn model decisions into external side effects: they read files, run scripts, call APIs, send messages, and invoke Model Context Protocol tools. This makes agent attacks different from jailbreaks. The harmful step is often not an obviously forbidden output, but an ordinary executable action that becomes unsafe because attacker-controlled context steers authorized access against the user's interest. We identify this failure mode as authority confusion: untrusted resources may inform reasoning, but they must not authorize side effects. We present AIRGuard, a runtime guard that operationalizes least privilege as action-time authorization. AIRGuard normalizes heterogeneous tool calls, derives task authority into step-level authority, tracks source and target trust, simulates sensitive side effects, audits cross-step risk, and enforces decisions before actions execute. On AgentTrap, AIRGuard reduces Sonnet 4.6 attack success from 36.3% without defense to 5.5%. On DTAP-150, AIRGuard preserves 76.0% benign utility with Haiku 4.5, compared with 52.0% for ARGUS and 42.0% for MELON. An ablation further shows that prompt-only policy helps only modestly, whereas a dedicated runtime authority-control layer gives the agent system direct control over tool-mediated side effects. Code and data are available at https://github.com/Sophie508/AIRGuard.
Suliu Qin, Haomin Zhuang, Yujun Zhou +2
University of Liverpool · University of Notre Dame · 2Inria, France
This position paper argues that the Authorization-Execution Gap (AEG) is a major safety and security problem in open-world agents. The AEG is the divergence between what a principal intends to authorize and what an open-world agent ultimately executes. Because such agents act autonomously across tools, persistent state, and multi-agent handoffs, even small instances of authorization divergence can cause harm that is difficult or impossible to undo. We argue that many observed agent failures can be traced to three structural sources of AEG: delegation-level incompleteness, channel-level corruption, and composition-level fragmentation. The same observed failure may arise from any of these sources. Without identifying the source, a defense targeting the symptom alone cannot address the underlying cause. Agent safety and security should therefore emphasize source-oriented diagnosis and defense. Because the structural sources of AEG arise dynamically during execution, this approach necessarily requires authorization integrity checks applied during execution, rather than relying solely on one-shot upfront filtering or post-hoc audit. For NeurIPS, the implication is that papers on open-world agents should report not only outcome-level metrics such as task success or attack resistance, but also process-level evidence showing where AEG was detected, constrained, and attributed to a structural source during execution.
Baoyuan Wu, Qingshan Liu, Adel Bibi +2
Chinese University of Hong Kong, Shenzhen, China · Nanjing University of Posts and Telecommunications, China · University of Oxford, UK +2