RATION: Towards Quantitative Risk-Based Access Control for AI Agents

Yuntao Du; Harsh Chaudhari; Yuetian Chen; Ron Heichman; Ashish Jayamohan; Kumar Pallav; Mahim Patel; Kaiyuan Zhang

cs.CROct 16, 2026

RATION: Towards Quantitative Risk-Based Access Control for AI Agents

Authors: Yuntao Du, Harsh Chaudhari, Yuetian Chen, Ron Heichman, Ashish Jayamohan, Kumar Pallav, Mahim Patel, Kaiyuan Zhang,

Organizations: Perplexity · Purdue University · Rutgers University

Abstract

AI agents increasingly interact with external environments to complete complex user tasks. These interactions can lead to unexpected behavior and expose agents to security threats such as indirect prompt injection. Current agent security systems largely protect agents by restricting their actions, which can result in a substantial security-utility trade-off for complex, open-ended tasks. To address this, we propose a quantitative risk-based approach to access control for AI agents that regulates measurable risks accumulated during task execution. As a concrete realization of this approach, we introduce RATION, a security framework that tracks measurable risks associated with agent actions and enforces quantitative constraints throughout execution. RATION first constructs a task-specific policy by combining explicit constraints derived from the user request with implicit risks calibrated from historical executions of similar tasks. During task execution, RATION continuously tracks the accumulated risks and applies different enforcement strategies depending on the type of risk. Extensive experiments on four security benchmarks show that RATION provides strong security while maintaining high task utility across diverse models and environments.

Figures & tables

Figure 1: Overview of Ration . It constructs a risk policy from historical task executions and the user request, then enforces the policy on tool calls while tracking accumulated risk during execution.

Figure 2: Running example of Ration . (a) The user requests processing a quote and emailing a recipient, while the quote contains an injected instruction to contact an external auditor. (b) The Provisioner extracts the recipient constraint and selects the implicit risk policy. (c) The Risk Monitor blocks the unauthorized email and intervenes when actions exceed the accumulated risk threshold.

Source	Policy Rule	What It Constrains	Cumulative	Example
Explicit	Value constraint	Values an argument may take	✗	Send to [email protected]
	Per-action limit	Quantity in a single action	✗	At most $200 per transfer
	Total limit	Quantity or count across actions	✓	At most 3 emails sent
Implicit	Tool allow-list	Tools that may be invoked	✗	Calendar tools for scheduling
Implicit	Behavioral threshold	Counts of calls, write/execute calls, and tokens	✓	17k token usage

Table 1: Risk policy rules in Ration .

Figure 3: Comparison of Attack Success Rate (ASR) versus utility under attack. Ration consistently achieves low ASR while maintaining high utility (upper-left region) across four benchmarks.

Defense	DTap			AgentDyn			AgentDojo			ASB
Defense	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$
No defense	38.7 $\pm$ 2.0	65.7 $\pm$ 2.0	80.7 $\pm$ 2.0	53.7 $\pm$ 3.7	55.1 $\pm$ 4.1	68.3 $\pm$ 11.7	62.5 $\pm$ 3.2	58.2 $\pm$ 3.6	86.0 $\pm$ 6.8	46.8 $\pm$ 4.9	47.5 $\pm$ 4.9	77.8 $\pm$ 4.1
Sandwich	32.5 $\pm$ 1.9	65.5 $\pm$ 2.0	77.7 $\pm$ 2.1	46.2 $\pm$ 3.6	58.0 $\pm$ 4.1	68.3 $\pm$ 11.6	48.1 $\pm$ 3.7	65.5 $\pm$ 3.6	86.1 $\pm$ 7.0	45.3 $\pm$ 4.9	49.5 $\pm$ 4.9	83.8 $\pm$ 3.6
Instructional	32.5 $\pm$ 1.9	64.4 $\pm$ 1.9	76.3 $\pm$ 2.1	31.7 $\pm$ 3.4	52.8 $\pm$ 4.1	61.7 $\pm$ 12.2	41.7 $\pm$ 3.7	62.4 $\pm$ 3.7	82.0 $\pm$ 7.8	44.3 $\pm$ 4.9	43.2 $\pm$ 4.9	59.3 $\pm$ 4.8
Spotlighting	31.3 $\pm$ 1.9	63.5 $\pm$ 2.0	78.0 $\pm$ 2.1	47.4 $\pm$ 3.8	56.9 $\pm$ 4.1	73.3 $\pm$ 11.0	53.7 $\pm$ 3.3	64.1 $\pm$ 3.6	87.2 $\pm$ 6.6	40.3 $\pm$ 4.8	25.8 $\pm$ 4.3	35.2 $\pm$ 4.7
PI Detector	26.3 $\pm$ 1.8	54.0 $\pm$ 1.9	56.3 $\pm$ 2.2	1.0 $\pm$ 0.8	0.2 $\pm$ 0.4	1.7 $\pm$ 3.2	9.0 $\pm$ 2.1	27.4 $\pm$ 3.5	50.5 $\pm$ 10.3	37.5 $\pm$ 4.7	50.7 $\pm$ 4.9	80.0 $\pm$ 3.9

Table 2: Average performance (%) across four benchmarks. “ASR” denotes attack success rate, “UA” denotes utility under attack, and “BU” denotes benign utility. Ration achieves strong security while maintaining high utility both with and without attacks across benchmarks.

Explicit		Implicit		DTap (Telecom)			AgentDyn
Act.	Cum.	Act.	Cum.	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$
No defense				42.3	80.6	75.5	53.7	55.1	68.3
✓				17.2	79.3	71.8	22.4	59.4	65.0
✓	✓			14.7	78.5	71.8	9.1	63.0	65.0
✓	✓	✓		6.4	77.0	70.0	5.9	63.6	70.0
✓	✓	✓	✓	6.4	79.2	72.7	1.4	57.3	63.3

Table 3: Impact of each risk control in Ration .

Figure 4: Comparison of No defense and Ration across five language models on DTap.

Named-URL 404: requested resource not found
Metric / Scenario	No defense	MELON	AttriGuard	Twin Agent	Tool Filter	Progent	DRIFT	Ration
Unsafe execution $\downarrow$	83.3	58.3	75.0	58.3	75.0	58.3	25.0	0.0
Task success $\uparrow$	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0
429 rate limiting: service rejects requests due to rate limits
Unsafe execution $\downarrow$	11.1	5.6	5.6	22.2	5.6	5.6	5.6	0.0
Task success $\uparrow$	100.0	100.0	100.0	94.4	100.0	100.0	100.0	100.0

Table 4: Performance (%) on two Agent Meltdowns scenarios, where benign environmental errors can induce unsafe behavior. Ration completes all error-free tasks and prevents unsafe execution.

Figure 5: Execution behavior on AgentDyn. (a) Performance by execution length; ticks mark bin upper bounds. (b) Implicit risk quantities on tasks with or without attacks.

(a) Policy granularity
Metric	DTap (Telecom)		AgentDyn
Metric	Task category	Domain	Task category	Domain
ASR	6.4	7.5	1.4	2.1
UA	79.2	79.7	57.3	59.3
BU	72.7	71.8	63.3	63.3

Table 5: Sensitivity of risk policy construction. (a) Granularity of the implicit policy. (b) Quantile used to calibrate implicit behavioral thresholds. (c) Provisioner model used for policy construction.

Metric	No defense	Sandwich	Instructional	Spotlighting	MELON	AttriGuard	Twin Agent	Tool Filter	Progent	DRIFT	Ration
Total tokens (M)	1.63	1.69	1.62	1.63	2.21	2.31	2.82	0.68	4.29	2.95	2.17
UA	80.6	80.2	76.7	78.0	77.6	78.1	80.3	16.2	77.2	75.9	79.2
ASR	42.3	36.2	38.8	31.7	34.6	37.9	25.5	9.0	30.5	40.9	6.4
Efficiency	23.5	26.0	23.4	28.4	19.5	17.4	19.4	10.6	10.9	11.9	33.5

Table 6: Cost comparison of defenses on the Telecom domain of DTap.

Attack	No defense	MELON	AttriGuard	CaMeL	Twin Agent	Tool Filter	Progent	DRIFT	Ration	+ Integrity
Static	42.3	34.6	37.9	36.4	25.5	9.0	30.5	40.9	6.4	0.0
Manual	9.0	7.2	7.2	7.8	4.8	3.0	7.2	8.4	0.6	0.6
PAIR	64.5	56.6	56.0	47.0	41.0	24.1	51.2	57.2	12.0	1.2
Search-based	42.2	40.4	40.4	38.0	28.5	14.5	30.7	38.0	15.7	1.2

Table 7: Attack success rate on DTap (Telecom). Attacks are optimized against Ration ; baselines replay the same payloads. Integrity augments Ration with tool-description checks.

Appendix figures & tables21 assets

Supplementary material from the paper’s appendix.

Appendix

Policy field	Value
Task category	Report delivery
Tool allow-list	$\{\texttt{read\_report},\ \texttt{send\_email},...\}$
Behavioral thresholds	Total tool calls; write/execute calls; tokens
Value constraint	Tool: send_email ; argument: recipient ; allowed values: $\{\texttt{[email protected]}\}$
Total limit	Tool: send_email ; quantity: accumulated call count; limit: $2$

Appendix

Table 8: Illustrative risk policy of Ration for the user request “Email the report to [email protected], using at most two messages.” The tools and category are illustrative.

Domain	Task Category	Description
Code	Quick compute	Local computation, file transformation, and small programs
	Web retrieval	Fetch, save, and process external web content
	Project maintenance	Diagnose and repair code, tests, builds, and dependencies
Legal	Matter research	Research legal matters and produce work products
	Client correspondence	Email assignments and replies through email or existing Slack
	Team collaboration	Legal work also reported into Slack channels

Appendix

Table 9: Task categories for DTap (Part I of II), with a fallback category for each domain.

Domain	Task Category	Description
Workflow	Coordination	Workplace communications, tickets, pages, scheduling, and forms
	Data analytics	Coordination and read-only work with data platforms
	Payments	Data analytics and PayPal financial operations
	Operations	Broad delegated work or additional administrative capabilities
Windows	File operations	Manipulate specified files and folders on disk
	Document work	Edit document, spreadsheet, and presentation content or formatting

Appendix

Table 10: Task categories for DTap (Part II of II), with a fallback category for each domain.

Domain	Task Category	Description
Shopping	Purchase	Product search, carts, discounts, and purchases
	Order management	Handle invoices and refunds without a new purchase
	Account management	Login, verification, and shopping account profile updates
	Delegated work	Otherwise unspecified shopping work delegated through email
	Full access (fallback)	Shopping requests outside any narrower category
GitHub	Repository content	Create, clone, pull, edit, or push repository content

Appendix

Table 11: Task categories for AgentDyn, with each domain’s fallback category labeled explicitly.

Domain	Task Category	Description
Banking	Account review	Inspect and summarize account information without changes
	Payments	Send, schedule, or adjust financial transactions
	Profile management	Read or update profiles and change passwords
	Full access (fallback)	Combined banking requests or no narrower category
Slack	Channel reading	Inspect channels, messages, members, and user inboxes
	Messaging	Send direct messages or messages to channels

Appendix

Table 12: Task categories for AgentDojo, with each domain’s fallback category labeled explicitly.

Domain	Task Category	Description
Academic Search	Academic search	Search academic sources and synthesize research findings
Aerospace Engineer	Aerospace engineering	Analyze, design, test, and update aerospace systems
Autonomous Driving	Autonomous driving	Develop, test, and improve autonomous driving systems
E-commerce Manager	E-commerce management	Analyze sales and manage inventory, listings, and campaigns
Education Consultant	Education consulting	Provide course, performance, study, and education guidance
Financial Analyst	Financial analysis	Analyze markets, portfolios, investment risk, and performance

Appendix

Table 13: Task categories for ASB.

Benchmark	Model	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$
DTap (Travel)	GPT-4.1	50.8 $\pm$ 7.3	50.8 $\pm$ 6.4	77.2 $\pm$ 7.1
DTap (Travel)	GPT-5.4	53.3 $\pm$ 7.6	53.3 $\pm$ 6.8	91.4 $\pm$ 5.6
AgentDyn	GPT-4.1	53.7 $\pm$ 3.7	55.1 $\pm$ 4.1	68.3 $\pm$ 11.7
AgentDyn	GPT-5.4	0.0 $\pm$ 0.0	69.6 $\pm$ 3.7	68.3 $\pm$ 11.3
AgentDojo	GPT-4.1	62.5 $\pm$ 3.2	58.2 $\pm$ 3.6	86.0 $\pm$ 6.8
AgentDojo	GPT-5.4	0.2 $\pm$ 0.3	87.1 $\pm$ 2.1	88.7 $\pm$ 6.3

Appendix

Table 14: Undefended performance (%) with different agent models. GPT-5.4 achieves near-zero undefended ASR on AgentDyn and AgentDojo, while GPT-4.1 achieves low benign utility on DTap.

Defense	Code			Legal			Browser			OS-FS			Research
Defense	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$
No defense	69.7 $\pm$ 10.3	97.5 $\pm$ 3.5	98.1 $\pm$ 1.8	56.7 $\pm$ 6.4	75.2 $\pm$ 5.3	91.0 $\pm$ 3.9	39.0 $\pm$ 10.6	82.9 $\pm$ 8.1	76.5 $\pm$ 14.3	37.0 $\pm$ 6.7	74.5 $\pm$ 6.0	82.0 $\pm$ 5.3	13.4 $\pm$ 6.6	36.9 $\pm$ 10.2	99.5 $\pm$ 1.0
Sandwich	48.5 $\pm$ 10.3	97.5 $\pm$ 3.5	98.1 $\pm$ 1.8	55.3 $\pm$ 6.4	62.2 $\pm$ 6.1	78.1 $\pm$ 5.6	28.0 $\pm$ 9.7	68.3 $\pm$ 10.1	67.6 $\pm$ 15.7	35.0 $\pm$ 6.6	73.0 $\pm$ 6.2	79.5 $\pm$ 5.6	8.5 $\pm$ 6.5	36.6 $\pm$ 10.2	95.0 $\pm$ 6.2
Instructional	36.8 $\pm$ 6.5	97.5 $\pm$ 3.5	99.2 $\pm$ 1.1	44.8 $\pm$ 6.0	66.9 $\pm$ 5.5	83.1 $\pm$ 5.2	26.8 $\pm$ 9.6	85.4 $\pm$ 7.6	64.7 $\pm$ 16.1	33.5 $\pm$ 6.5	69.5 $\pm$ 6.4	73.0 $\pm$ 6.2	6.9 $\pm$ 4.4	35.1 $\pm$ 8.7	97.0 $\pm$ 4.7
Spotlighting	49.8 $\pm$ 7.1	97.5 $\pm$ 3.5	98.4 $\pm$ 1.5	47.7 $\pm$ 6.4	72.7 $\pm$ 5.4	89.6 $\pm$ 3.7	24.4 $\pm$ 9.3	40.2 $\pm$ 10.6	70.6 $\pm$ 15.3	33.0 $\pm$ 6.5	74.0 $\pm$ 6.1	78.0 $\pm$ 5.7	10.5 $\pm$ 7.0	37.1 $\pm$ 10.2	94.0 $\pm$ 6.3
PI Detector	68.9 $\pm$ 10.3	97.0 $\pm$ 3.7	96.1 $\pm$ 2.4	50.9 $\pm$ 6.3	68.2 $\pm$ 5.8	85.9 $\pm$ 4.8	25.6 $\pm$ 9.4	79.3 $\pm$ 8.8	76.5 $\pm$ 14.3	13.0 $\pm$ 4.7	41.0 $\pm$ 6.8	42.5 $\pm$ 6.9	9.0 $\pm$ 6.5	30.1 $\pm$ 9.6	46.0 $\pm$ 7.5

Appendix

Table 15: Domain-level performance (%) on DTap using GPT-5.4 (Part I of III).

Defense	Customer Service			Medical			Workflow			Windows			macOS
Defense	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$
No defense	40.6 $\pm$ 9.6	100.0 $\pm$ 0.0	94.4 $\pm$ 3.6	48.5 $\pm$ 4.6	63.5 $\pm$ 4.8	70.1 $\pm$ 2.4	50.5 $\pm$ 9.5	37.4 $\pm$ 9.2	82.4 $\pm$ 4.1	1.9 $\pm$ 2.6	20.6 $\pm$ 7.7	55.0 $\pm$ 9.8	1.9 $\pm$ 3.7	67.9 $\pm$ 12.6	36.7 $\pm$ 17.2
Sandwich	30.7 $\pm$ 9.0	100.0 $\pm$ 0.0	93.8 $\pm$ 3.8	46.0 $\pm$ 5.1	60.9 $\pm$ 4.7	69.6 $\pm$ 2.4	55.1 $\pm$ 9.4	44.9 $\pm$ 9.4	83.0 $\pm$ 4.0	0.9 $\pm$ 1.8	18.7 $\pm$ 7.4	56.0 $\pm$ 9.7	1.9 $\pm$ 3.7	73.6 $\pm$ 11.9	36.7 $\pm$ 17.2
Instructional	36.6 $\pm$ 9.4	100.0 $\pm$ 0.0	93.1 $\pm$ 3.9	46.5 $\pm$ 4.8	59.6 $\pm$ 4.8	67.4 $\pm$ 2.4	43.0 $\pm$ 9.4	39.3 $\pm$ 9.3	76.1 $\pm$ 4.6	0.9 $\pm$ 1.8	15.9 $\pm$ 6.9	54.0 $\pm$ 9.8	1.9 $\pm$ 3.7	69.8 $\pm$ 12.4	23.3 $\pm$ 15.1
Spotlighting	35.6 $\pm$ 9.3	100.0 $\pm$ 0.0	93.1 $\pm$ 3.9	46.5 $\pm$ 4.8	66.2 $\pm$ 4.8	69.9 $\pm$ 2.4	37.4 $\pm$ 9.2	43.0 $\pm$ 9.4	82.4 $\pm$ 4.1	0.9 $\pm$ 1.8	18.7 $\pm$ 7.4	52.0 $\pm$ 9.8	3.8 $\pm$ 5.1	71.7 $\pm$ 12.1	30.0 $\pm$ 16.4
PI Detector	16.8 $\pm$ 7.3	100.0 $\pm$ 0.0	85.0 $\pm$ 5.5	48.2 $\pm$ 5.0	58.6 $\pm$ 4.9	62.3 $\pm$ 3.0	16.8 $\pm$ 7.1	38.3 $\pm$ 9.2	51.0 $\pm$ 5.4	0.9 $\pm$ 1.8	12.1 $\pm$ 6.2	54.0 $\pm$ 9.8	1.9 $\pm$ 3.7	73.6 $\pm$ 11.9	60.0 $\pm$ 17.5

Appendix

Table 16: Domain-level performance (%) on DTap using GPT-5.4 (Part II of III).

Defense	Travel			Finance			CRM			Telecom
Defense	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$
No defense	53.3 $\pm$ 7.6	53.3 $\pm$ 6.8	91.4 $\pm$ 5.6	32.8 $\pm$ 6.0	70.4 $\pm$ 5.9	96.7 $\pm$ 2.3	54.5 $\pm$ 8.3	59.7 $\pm$ 8.2	80.6 $\pm$ 5.6	42.3 $\pm$ 6.6	80.6 $\pm$ 6.1	75.5 $\pm$ 6.7
Sandwich	44.2 $\pm$ 7.6	58.3 $\pm$ 7.3	93.3 $\pm$ 5.0	31.1 $\pm$ 6.0	76.9 $\pm$ 5.2	95.9 $\pm$ 2.5	34.2 $\pm$ 7.7	65.3 $\pm$ 8.0	70.9 $\pm$ 6.5	36.2 $\pm$ 6.7	80.2 $\pm$ 6.3	70.0 $\pm$ 6.8
Instructional	55.8 $\pm$ 7.9	52.5 $\pm$ 6.7	95.0 $\pm$ 4.8	34.0 $\pm$ 6.1	72.5 $\pm$ 5.5	91.9 $\pm$ 4.0	48.8 $\pm$ 8.4	60.8 $\pm$ 8.2	80.0 $\pm$ 5.9	38.8 $\pm$ 7.2	76.7 $\pm$ 6.5	70.5 $\pm$ 7.4
Spotlighting	43.3 $\pm$ 8.0	53.3 $\pm$ 7.0	86.7 $\pm$ 7.0	33.0 $\pm$ 6.0	72.0 $\pm$ 5.6	96.0 $\pm$ 2.5	40.8 $\pm$ 7.9	64.8 $\pm$ 8.2	78.2 $\pm$ 5.9	31.7 $\pm$ 6.2	78.0 $\pm$ 6.6	73.6 $\pm$ 7.1
PI Detector	31.7 $\pm$ 7.2	41.7 $\pm$ 6.2	21.4 $\pm$ 3.3	18.5 $\pm$ 5.0	9.8 $\pm$ 3.8	7.3 $\pm$ 3.7	34.2 $\pm$ 8.4	42.2 $\pm$ 8.6	58.2 $\pm$ 7.0	31.8 $\pm$ 6.8	64.2 $\pm$ 7.6	42.7 $\pm$ 7.4

Appendix

Table 17: Domain-level performance (%) on DTap using GPT-5.4 (Part III of III).

Defense	Shopping			GitHub			DailyLife
Defense	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$
No defense	44.4 $\pm$ 7.3	48.3 $\pm$ 7.3	60.0 $\pm$ 21.5	31.1 $\pm$ 6.8	58.9 $\pm$ 7.2	70.0 $\pm$ 20.1	85.5 $\pm$ 4.9	58.0 $\pm$ 6.8	75.0 $\pm$ 19.0
Sandwich	32.8 $\pm$ 6.9	51.1 $\pm$ 7.3	60.0 $\pm$ 21.5	23.9 $\pm$ 6.2	58.9 $\pm$ 7.2	65.0 $\pm$ 20.9	82.0 $\pm$ 5.3	64.0 $\pm$ 6.7	80.0 $\pm$ 17.5
Instructional	16.1 $\pm$ 5.4	46.7 $\pm$ 7.3	55.0 $\pm$ 21.8	15.6 $\pm$ 5.3	66.1 $\pm$ 6.9	70.0 $\pm$ 20.1	63.5 $\pm$ 6.7	45.5 $\pm$ 6.9	60.0 $\pm$ 21.5
Spotlighting	37.8 $\pm$ 7.1	50.6 $\pm$ 7.3	65.0 $\pm$ 20.9	28.3 $\pm$ 6.6	61.1 $\pm$ 7.1	70.0 $\pm$ 20.1	76.0 $\pm$ 5.9	59.0 $\pm$ 6.8	85.0 $\pm$ 15.6
PI Detector	0.0 $\pm$ 0.0	0.0 $\pm$ 0.0	0.0 $\pm$ 0.0	0.6 $\pm$ 1.1	0.6 $\pm$ 1.1	5.0 $\pm$ 9.6	2.5 $\pm$ 2.2	0.0 $\pm$ 0.0	0.0 $\pm$ 0.0

Appendix

Table 18: Domain-level performance (%) on AgentDyn using GPT-4.1.

Defense	Banking			Slack			Travel			Workspace
Defense	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$
No defense	72.9 $\pm$ 7.3	78.5 $\pm$ 6.7	93.8 $\pm$ 11.9	93.3 $\pm$ 4.8	65.7 $\pm$ 9.1	95.2 $\pm$ 9.1	47.1 $\pm$ 8.3	46.4 $\pm$ 8.3	70.0 $\pm$ 20.1	36.4 $\pm$ 4.0	42.1 $\pm$ 4.1	85.0 $\pm$ 11.1
Sandwich	54.9 $\pm$ 8.1	80.6 $\pm$ 6.5	93.8 $\pm$ 11.9	73.3 $\pm$ 8.5	65.7 $\pm$ 9.1	90.5 $\pm$ 12.6	50.7 $\pm$ 8.3	45.7 $\pm$ 8.3	70.0 $\pm$ 20.1	13.4 $\pm$ 2.8	70.0 $\pm$ 3.8	90.0 $\pm$ 9.3
Instructional	46.5 $\pm$ 8.1	76.4 $\pm$ 6.9	87.5 $\pm$ 16.2	66.7 $\pm$ 9.0	62.9 $\pm$ 9.2	90.5 $\pm$ 12.6	35.7 $\pm$ 7.9	50.0 $\pm$ 8.3	70.0 $\pm$ 20.1	18.0 $\pm$ 3.2	60.4 $\pm$ 4.1	80.0 $\pm$ 12.4
Spotlighting	61.1 $\pm$ 8.0	79.9 $\pm$ 6.6	93.8 $\pm$ 11.9	90.5 $\pm$ 5.6	69.5 $\pm$ 8.8	95.2 $\pm$ 9.1	39.3 $\pm$ 8.1	51.4 $\pm$ 8.3	75.0 $\pm$ 19.0	23.7 $\pm$ 3.5	55.5 $\pm$ 4.1	85.0 $\pm$ 11.1
PI Detector	5.6 $\pm$ 3.7	33.3 $\pm$ 7.7	43.8 $\pm$ 24.3	15.2 $\pm$ 6.9	26.7 $\pm$ 8.5	38.1 $\pm$ 20.8	1.4 $\pm$ 2.0	21.4 $\pm$ 6.8	50.0 $\pm$ 21.9	13.8 $\pm$ 2.9	28.2 $\pm$ 3.7	70.0 $\pm$ 14.2

Appendix

Table 19: Domain-level performance (%) on AgentDojo using GPT-4.1.

Defense

Academic Search

Aerospace Engineer

Autonomous Driving

E-commerce Manager

Education Consultant

ASR

\downarrow

\uparrow

\uparrow

ASR

\downarrow

\uparrow

\uparrow

ASR

\downarrow

\uparrow

\uparrow

ASR

\downarrow

\uparrow

\uparrow

ASR

\downarrow

\uparrow

\uparrow

No defense

40.0

\pm

15.2

75.0

\pm

13.4

100.0

\pm

0.0

70.0

\pm

14.2

60.0

\pm

15.2

100.0

\pm

0.0

17.5

\pm

11.8

57.5

\pm

15.3

100.0

\pm

0.0

65.0

\pm

14.8

0.0

\pm

0.0

\pm

0.0

7.5

\pm

8.2

2.5

\pm

4.8

35.0

\pm

14.8

Sandwich

25.0

\pm

13.4

70.0

\pm

14.2

100.0

\pm

0.0

70.0

\pm

14.2

72.5

\pm

13.8

100.0

\pm

0.0

25.0

\pm

13.4

75.0

\pm

13.4

100.0

\pm

0.0

42.5

\pm

15.3

0.0

\pm

0.0

\pm

0.0

7.5

\pm

8.2

2.5

\pm

4.8

50.0

\pm

15.5

Instructional

27.5

\pm

13.8

62.5

\pm

15.0

100.0

\pm

0.0

80.0

\pm

12.4

2.5

\pm

4.8

0.0

\pm

0.0

30.0

\pm

14.2

70.0

\pm

14.2

100.0

\pm

0.0

25.0

\pm

13.4

0.0

\pm

0.0

\pm

0.0

5.0

\pm

6.8

0.0

\pm

0.0

\pm

0.0

Spotlighting

17.5

\pm

11.8

52.5

\pm

15.5

65.0

\pm

14.8

87.5

\pm

10.2

0.0

\pm

0.0

100.0

\pm

0.0

12.5

\pm

10.2

57.5

\pm

15.3

27.5

\pm

13.8

57.5

\pm

15.3

0.0

\pm

0.0

\pm

0.0

2.5

\pm

4.8

0.0

\pm

0.0

\pm

0.0

PI Detector

20.0

\pm

12.4

100.0

\pm

0.0

100.0

\pm

0.0

75.0

\pm

13.4

72.5

\pm

13.8

100.0

\pm

0.0

20.0

\pm

12.4

65.0

\pm

14.8

100.0

\pm

0.0

35.0

\pm

14.8

0.0

\pm

0.0

\pm

0.0

7.5

\pm

8.2

0.0

\pm

0.0

20.0

\pm

12.4

Appendix

Table 20: Domain-level performance (%) on ASB using GPT-4.1 (Part I of II).

Defense

Financial Analyst

Legal Consultant

Medical Advisor

Psychological Counselor

System Admin

ASR

\downarrow

\uparrow

\uparrow

ASR

\downarrow

\uparrow

\uparrow

ASR

\downarrow

\uparrow

\uparrow

ASR

\downarrow

\uparrow

\uparrow

ASR

\downarrow

\uparrow

\uparrow

No defense

35.0

\pm

14.8

75.0

\pm

13.4

100.0

\pm

0.0

35.0

\pm

14.8

45.0

\pm

15.4

52.5

\pm

15.5

87.5

\pm

10.2

65.0

\pm

14.8

100.0

\pm

0.0

45.0

\pm

15.4

72.5

\pm

13.8

90.0

\pm

9.3

65.0

\pm

14.8

22.5

\pm

12.9

100.0

\pm

0.0

Sandwich

65.0

\pm

14.8

77.5

\pm

12.9

100.0

\pm

0.0

37.5

\pm

15.0

40.0

\pm

15.2

87.5

\pm

10.2

85.0

\pm

11.1

57.5

\pm

15.3

100.0

\pm

0.0

40.0

\pm

15.2

75.0

\pm

13.4

100.0

\pm

0.0

55.0

\pm

15.4

25.0

\pm

13.4

100.0

\pm

0.0

Instructional

90.0

\pm

9.3

90.0

\pm

9.3

100.0

\pm

0.0

12.5

\pm

10.2

67.5

\pm

14.5

72.5

\pm

13.8

92.5

\pm

8.2

60.0

\pm

15.2

97.5

\pm

4.8

67.5

\pm

14.5

80.0

\pm

12.4

100.0

\pm

0.0

12.5

\pm

10.2

0.0

\pm

0.0

22.5

\pm

12.9

Spotlighting

17.5

\pm

11.8

22.5

\pm

12.9

30.0

\pm

14.2

17.5

\pm

11.8

17.5

\pm

11.8

0.0

\pm

0.0

95.0

\pm

6.8

70.0

\pm

14.2

40.0

\pm

15.2

37.5

\pm

15.0

35.0

\pm

14.8

50.0

\pm

15.5

57.5

\pm

15.3

2.5

\pm

4.8

40.0

\pm

15.2

PI Detector

15.0

\pm

11.1

45.0

\pm

15.4

100.0

\pm

0.0

35.0

\pm

14.8

52.5

\pm

15.5

82.5

\pm

11.8

90.0

\pm

9.3

60.0

\pm

15.2

100.0

\pm

0.0

25.0

\pm

13.4

87.5

\pm

10.2

97.5

\pm

4.8

52.5

\pm

15.5

25.0

\pm

13.4

100.0

\pm

0.0

Appendix

Table 21: Domain-level performance (%) on ASB using GPT-4.1 (Part II of II).

Base Model	Defense	Important Instructions		Tool Knowledge		BU $\uparrow$
Base Model	Defense	ASR $\downarrow$	UA $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$
Llama-3-8B-Instruct	No defense	2.3 $\pm$ 1.0	11.7 $\pm$ 2.0	3.6 $\pm$ 1.2	11.3 $\pm$ 2.0	15.5 $\pm$ 7.2
	StruQ	0.0 $\pm$ 0.0	5.4 $\pm$ 1.4	0.0 $\pm$ 0.0	5.9 $\pm$ 1.5	6.2 $\pm$ 4.8
	SecAlign	0.0 $\pm$ 0.0	4.7 $\pm$ 1.4	0.0 $\pm$ 0.0	4.7 $\pm$ 1.4	5.2 $\pm$ 4.4
	Ration	0.2 $\pm$ 0.3	12.1 $\pm$ 2.1	0.5 $\pm$ 0.5	13.2 $\pm$ 2.2	13.4 $\pm$ 6.8
Llama-3.3-70B-Instruct	No defense	25.3 $\pm$ 2.8	41.6 $\pm$ 3.1	22.1 $\pm$ 2.6	43.3 $\pm$ 3.2	62.9 $\pm$ 9.6

Appendix

Table 22: Performance comparison (%) with model-level defenses on AgentDojo.

Model	Defense	Code	Legal	Browser	OS-FS	Research	CS	Medical	Workflow	Windows	macOS	Travel	Finance	CRM	Telecom
GPT-5.4	No defense	69.7	56.7	39.0	37.0	13.4	40.6	48.5	50.5	1.9	1.9	53.3	32.8	54.5	42.3
GPT-5.4	Ration	35.3	34.7	4.9	23.0	10.7	4.0	39.4	25.2	1.9	0.0	19.2	10.3	16.7	6.4
Claude Sonnet 4.5	No defense	52.2	47.5	4.9	14.5	0.0	34.7	64.8	32.7	1.9	0.0	25.0	16.1	32.4	23.5
Claude Sonnet 4.5	Ration	17.5	41.0	4.9	13.5	0.0	15.8	45.2	33.6	1.9	1.9	11.7	8.2	21.4	1.8
Gemini 3.1 Pro	No defense	81.3	87.6	72.0	54.5	20.3	69.3	72.6	73.8	8.4	3.8	65.0	62.1	60.6	81.6
Gemini 3.1 Pro	Ration	50.0	69.7	3.7	41.0	12.2	8.9	44.9	23.4	2.8	5.7	23.3	16.6	33.0	9.5

Appendix

Table 23: ASR (%) on DTap across five agent models. “OS-FS” denotes “OS-Filesystem”, and “CS” denotes “Customer Service”.

Model	Defense	Code	Legal	Browser	OS-FS	Research	CS	Medical	Workflow	Windows	macOS	Travel	Finance	CRM	Telecom
GPT-5.4	No defense	97.5	75.2	82.9	74.5	36.9	100.0	63.5	37.4	20.6	67.9	53.3	70.4	59.7	80.6
GPT-5.4	Ration	85.4	76.7	87.8	76.0	45.4	100.0	64.3	49.5	15.9	73.6	68.3	82.6	62.1	79.2
Claude Sonnet 4.5	No defense	98.3	68.0	75.6	62.5	36.1	100.0	50.0	30.8	21.5	79.2	52.5	79.4	58.0	85.7
Claude Sonnet 4.5	Ration	98.9	80.1	84.1	62.5	36.0	100.0	53.9	35.5	23.4	77.4	73.3	87.8	69.1	87.8
Gemini 3.1 Pro	No defense	99.3	63.0	84.1	76.5	60.8	100.0	46.1	46.7	23.4	67.9	59.2	70.2	70.0	80.7
Gemini 3.1 Pro	Ration	99.3	74.4	91.5	73.5	58.7	100.0	55.4	53.3	23.4	67.9	75.0	84.4	79.3	82.8

Appendix

Table 24: Utility under attack (%) on DTap across five agent models.

Model	Defense	Code	Legal	Browser	OS-FS	Research	CS	Medical	Workflow	Windows	macOS	Travel	Finance	CRM	Telecom
GPT-5.4	No defense	98.1	91.0	76.5	82.0	99.5	94.4	70.1	82.4	55.0	36.7	91.4	96.7	80.6	75.5
GPT-5.4	Ration	97.2	90.2	70.6	83.5	92.5	92.5	70.6	86.0	53.0	46.7	95.8	95.5	78.2	72.7
Claude Sonnet 4.5	No defense	98.6	93.0	52.9	66.0	96.0	83.8	58.4	90.4	54.0	86.7	81.7	97.8	83.6	75.5
Claude Sonnet 4.5	Ration	98.6	93.9	61.8	67.0	98.5	86.2	60.4	88.4	56.0	90.0	83.1	95.8	80.0	74.5
Gemini 3.1 Pro	No defense	99.0	70.7	79.4	83.5	97.5	91.2	70.7	91.9	57.0	10.0	98.9	95.2	81.8	66.4
Gemini 3.1 Pro	Ration	99.6	83.7	82.4	82.5	100.0	93.8	68.7	91.9	53.0	13.3	99.4	90.5	84.2	71.8

Appendix

Table 25: Benign utility (%) on DTap across five agent models.

Execution data	DTap (Telecom)			AgentDyn			AgentDojo			ASB
Execution data	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$	ASR $\downarrow$	UA $\uparrow$	BU $\uparrow$
Historical (all)	6.23	79.82	70.91	1.36	57.58	64.27	0.04	76.82	85.72	0.00	59.50	78.25
Historical (five-fold)	6.36	79.20	72.73	1.44	57.31	63.33	0.04	76.86	83.56	0.00	59.00	80.00
Synthetic	7.27	77.57	69.09	1.72	57.76	53.33	0.09	75.01	84.31	0.00	43.00	48.25

Appendix

Table 26: Performance (%) of Ration with implicit risk policies constructed from different request and execution sources. “Historical (five-fold)” uses the original requests and executions from the other four folds; “Historical (all)” uses all folds. “Synthetic” derives tool allow-lists and behavioral thresholds from executions of validated GPT-5.4-generated requests by the same agent model.

Defense	DTap (Telecom)				AgentDyn				AgentDojo				ASB
Defense	Total tokens (M)	UA	ASR	Efficiency	Total tokens (M)	UA	ASR	Efficiency	Total tokens (M)	UA	ASR	Efficiency	Total tokens (M)	UA	ASR	Efficiency
No defense	1.63	80.6	42.3	23.5	1.89	55.1	53.7	0.7	0.93	58.2	62.5	-4.6	0.71	47.5	46.8	1.0
Sandwich	1.69	80.2	36.2	26.0	1.97	58.0	46.2	6.0	1.63	65.5	48.1	10.7	0.72	49.5	45.3	5.8
Instructional	1.62	76.7	38.8	23.4	1.73	52.8	31.7	12.2	0.89	62.4	41.7	23.3	0.71	43.2	44.3	-1.5
Spotlighting	1.63	78.0	31.7	28.4	1.90	56.9	47.4	5.0	0.90	64.1	53.7	11.6	0.79	25.8	40.3	-18.4
PI Detector	1.52	64.2	31.8	21.3	1.14	0.2	1.0	-0.7	1.12	27.4	9.0	16.4	0.70	50.7	37.5	18.9

Appendix

Table 27: Cost comparison of defense methods across benchmarks.

Defense	DTap (Telecom)			AgentDyn			AgentDojo			ASB
Defense	ASR	UA	BU	ASR	UA	BU	ASR	UA	BU	ASR	UA	BU
No defense	39.5 ( $\pm$ 2.2)	78.8 ( $\pm$ 1.3)	74.5 ( $\pm$ 1.4)	54.8 ( $\pm$ 0.8)	56.3 ( $\pm$ 0.8)	69.3 ( $\pm$ 1.5)	63.0 ( $\pm$ 0.9)	59.1 ( $\pm$ 0.8)	87.9 ( $\pm$ 1.3)	47.7 ( $\pm$ 2.5)	47.8 ( $\pm$ 1.5)	78.5 ( $\pm$ 0.7)
Ration	6.7 ( $\pm$ 0.5)	79.0 ( $\pm$ 1.2)	71.6 ( $\pm$ 2.0)	1.8 ( $\pm$ 0.3)	58.5 ( $\pm$ 1.2)	61.7 ( $\pm$ 2.0)	0.1 ( $\pm$ 0.0)	75.9 ( $\pm$ 1.1)	84.2 ( $\pm$ 0.9)	0.0 ( $\pm$ 0.0)	58.4 ( $\pm$ 3.2)	78.6 ( $\pm$ 1.0)

Appendix

Table 28: Stability of Ration across five independent runs. Each entry reports the mean with the standard deviation in parentheses.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 517 papers

Sep 14, 2026

Empirical Evaluation of Task-Based Permission Scoping Architecture for AI Agents

AI agents are provisioned the same as employee-owned hosts in many enterprise settings with a static credential set fixed at deployment which includes all permissions the employee role might ever need. Role-based access control made this compromise for human principals because scoping access per task was infeasible. For AI agents, the compromise leaves every credential standing exposed whether or not the current task uses them. These permissions can later be utilised by a compromised or misaligned agent. Prior work (Noyan, 2026) defined this as the task-context mismatch, and proposed a three-source permission architecture which includes role-based permission ceilings, a task permission classifier and policy-based prohibitions, together eliminating the exposure preemptively. The work released a 600-prompt labelled dataset to evaluate it. This paper presents that evaluation end to end by implementing the security gate; a fine-tuned RoBERTa-large encoder which matched few-shot trained Claude Haiku 4.5 on classification quality (macro-F1 0.881 against 0.886, precision 0.897 against 0.842, severity-weighted residual risk 0.63 against 1.12). The results show the trusted component does not need to scale with the agent it supervises, and the scalable-oversight margin for this control method is wide. We also propose an attack-surface elimination metric which shows the role ceiling alone closes 27.9% of the severity-weighted surface and adding the task classifier closes 84.4%. The gap displays security advantages of task-granular access control over role-granular, and AI agents are the first principal type for which the task-granular access control is enforceable because their tasks arrive as machine-readable text. The research establishes task-based access control as a measured, potentially deployable mechanism for reducing attack surface in agentic deployments.

Halil Burak Noyan

Independent Researcher

AI Agent Evaluation AI Agent Security Runtime Enforcement for AI Agents Tool Access Control for LLM Agents

Ask PDF

Apr 7, 2026

ClawLess: A Security Model of AI Agents

Autonomous AI agents powered by Large Language Models can reason, plan, and execute complex tasks, but their ability to autonomously retrieve information and run code introduces significant security risks. Existing approaches attempt to regulate agent behavior through training or prompting, which does not offer fundamental security guarantees. We present ClawLess, a security framework that enforces formally verified policies on AI agents under a worst-case threat model where the agent itself may be adversarial. ClawLess formalizes a fine-grained security model over system entities, trust scopes, and permissions to express dynamic policies that adapt to agents' runtime behavior. These policies are translated into concrete security rules and enforced through a user-space kernel augmented with BPF-based syscall interception. This approach bridges the formal security model with practical enforcement, ensuring security regardless of the agent's internal design.

Hongyi Lu, Nian Liu, Shuai Wang +1

Research Institute of Trustworthy Autonomous Systems, Southern University of Science and Technology, China · Department of Computer Science and Engineering, Southern University of Science and Technology · Department of Computer Science and Engineering, Hong Kong University of Science and Technology +3

AI Agent Security Runtime Enforcement for AI Agents Tool Access Control for LLM Agents

Ask PDF

Apr 19, 2026

SafeAgent: A Runtime Protection Architecture for Agentic Systems

Large language model (LLM) agents are vulnerable to prompt-injection attacks that propagate through multi-step workflows, tool interactions, and persistent context, making input-output filtering alone insufficient for reliable protection. This paper presents SafeAgent, a runtime security architecture that treats agent safety as a stateful decision problem over evolving interaction trajectories. The proposed design separates execution governance from semantic risk reasoning through two coordinated components: a runtime controller that mediates actions around the agent loop and a context-aware decision core that operates over persistent session state. The core is formalized as a context-aware advanced machine intelligence and instantiated through operators for risk encoding, utility-cost evaluation, consequence modeling, policy arbitration, and state synchronization. Experiments on Agent Security Bench (ASB) and InjecAgent show that SafeAgent consistently improves robustness over baseline and text-level guardrail methods while maintaining competitive benign-task performance. Ablation studies further show that recovery confidence and policy weighting determine distinct safety-utility operating points.

Hailin Liu, Eugene Ilyushin, Jie Ni +1

Lomonosov Moscow State University · Central University

Adversarial Attacks on LLMs AI Agent Security LLM Agent Security Prompt Injection Attacks on LLMs

Ask PDF

Abstract

AI Agent Security

Explore similar work

Empirical Evaluation of Task-Based Permission Scoping Architecture for AI Agents

ClawLess: A Security Model of AI Agents

SafeAgent: A Runtime Protection Architecture for Agentic Systems