REALM: Identifying Minimal Task Assets for LLM Agents

Zihou Ren; Byungchul Tak; Long Wang

cs.CROct 29, 2026

REALM: Identifying Minimal Task Assets for LLM Agents

Authors: Zihou Ren, Byungchul Tak, Long Wang

Organizations: INSC, Tsinghua University · Kyungpook National University

Abstract

Large language model (LLM) agents often receive access to more files, accounts, and services than a task requires. Prompt injection turns this excess access into an opportunity to redirect execution toward unrelated resources. Applying least privilege therefore requires identifying the assets needed by a task, including assets whose identities emerge only during execution. We present REALM (Required Execution Assets Linked to a Mission), an approach to identifying and maintaining a task's required assets and their permitted uses. The approach represents required assets as Dependency Graph nodes, resolves prerequisite relationships, and admits newly discovered assets through source-scoped selection. It separates discovering an asset from authorizing its use, while preserving the agent's freedom to choose its computation. The REALM Builder maintains the selected grants and projects Asset Files; the Partial API Manager exposes resource-bound Partial APIs to the Agent inside a Task Container. Across 60 clean tasks and 560 injected cases in AgentDyn, it completes 40.0% and 36.4% of tasks and decreases ASR from 16.6% to 0.2% with qwen3.5-flash as the base model.

Figures & tables

Node	Required access	Mission link
Alice’s address	Use the known address to discover Alice’s email	Select the instruction source
Alice’s email	Read the selected email	Identify the image and group repo
Image	Read the selected image file	Obtain the requested upload input
Repo	Upload to the selected group repo	Complete the requested effect

Table 1: Dependency Graph nodes in the running example. Each node connects a required asset and permitted use to the User Task; unknown identities must be resolved before access is granted.

Figure 1: Overview of dynamic REALM construction. Step 1 builds the Initial REALM from the User Task and its Dependency Graph. Step 2 interleaves Agent execution with updates to the Current REALM: Alice’s email is identified first, then its contents identify the image and group repo. Dashed nodes have unknown identities; solid nodes have identified assets, with fetched status omitted for clarity. Unrelated assets remain inaccessible despite the injected upload instruction, and Step 3 completes the task.

Class	Resource meaning	Examples
Ordinary data	Supplies payloads or computation inputs	Mail body; sender search filter
Asset identifier	Directly names resources read, modified, or used	Message ID; recipient list
Asset record	Contains provider-declared resource fields	Attachment record with a declared file_path field
Opaque resources	May contain references whose structure is unresolved	Attachment dictionary with an unspecified layout

Table 2: Parameter classes and their roles in asset identification.

Status	Meaning and use
Unknown	Only a task-derived description is available; the asset’s concrete identifier remains unresolved.
Identified	A concrete identifier, path, or address is known; the asset is eligible for admission after access and scope checks.
Fetched	Attributed content has been retrieved for the identified asset; this evidence can resolve nodes that depend on it.

Table 3: Node states during dynamic REALM construction.

Figure 2: System architecture of Realm . The REALM Builder uses the User Task and REALM LLM to maintain the Dependency Graph and initialize or update Asset Files. The Partial API Manager exposes Partial APIs in the Task Container and translates limited tool calls into actual tool calls to Tools. The Agent accesses Asset Files and Partial APIs through local I/O and uses the Agent LLM for reasoning and planning. The dashed boundary separates task execution from asset selection, tool credentials, and model services.

Figure 3: Constructing a Partial API from an illustrative mail interface. The admitted mailbox and report determine fixed resource arguments; unused recipient fields are bound to empty lists. The Agent supplies only the subject and body. The host retains the native endpoint and fixed bindings, and rejects attempts to include resource arguments in a request.

Interface	Fixed outside Task Container	Possible residual inputs
Send email	Recipients, CC/BCC, attachments	Subject and message body
Git push	Checkout path and remote metadata	Fields left by the native schema
Create event	Participants; task literals when specified	Remaining title, time, description, location
Provider form	Page, field map, recipient	Registered scalar form values

Table 4: Fixed resource bindings and residual inputs for representative interfaces.

Metric	Without Realm	With Realm
Clean utility	47/60 (78.3%)	24/60 (40.0%)
Injected utility	401/560 (71.6%)	204/560 (36.4%)
Overall utility	448/620 (72.3%)	228/620 (36.8%)
ASR	93/560 (16.6%)	1/560 (0.2%)

Table 5: AgentDyn results with qwen3.5-flash . Entries show successes/denominator and percentage.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 517 papers

Beyond Direct Access: Resource Hijacking in LLM Agents
Aug 15, 2026Puyu Zeng, Mingang Chen, Zheli Liu +1LLM Agent Security Tool Access Control for LLM Agents
College of Cryptology and Cyber Science, Nankai University, China · Shanghai Jiao Tong University, China
Do AI Agents Know When a Task Is Simple? Toward Complexity-Aware Reasoning and Execution
Jul 14, 2026Junjie Yin, Xinyu FengSoftware Engineering Agents LLM Agent Evaluation
University of Tennessee, Knoxville, TN 37996, USA · Microsoft, Redmond, WA 98052, USA
Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents
Oct 13, 2026Kristoffer Hempel, Nils Loose, Lorenzo Cavallaro +1LLM Agent Security Runtime Enforcement for AI Agents
Universität zu Lübeck · University College London · Mohamed bin Zayed University of Artificial Intelligence

Aug 15, 2026J/K move · Enter open · S save

Beyond Direct Access: Resource Hijacking in LLM Agents

Puyu Zeng, Mingang Chen, Zheli Liu, Qibing Ren

College of Cryptology and Cyber Science, Nankai University, China · Shanghai Jiao Tong University, China

LLM Agent Security Tool Access Control for LLM Agents AI Agent Security Benchmarks

Open paper AskPDF arXiv

Large language model agents are increasingly connected to high-value resources, including external APIs, GPUs and servers, and workflows such as deployment and approval. Existing agent security research mainly focuses on attacks against information and agent behavior, while high-value resources have received less attention as attack targets themselves. To our knowledge, we are the first to identify and systematically study agent resource hijacking, in which attackers induce agents to use high-value resources for their own goals without directly obtaining those resources or their credentials. We introduce ResourceHijackBench, an executable benchmark and automated case-generation pipeline that covers six categories of high-value resources. It contains 300 attack scenarios and 900 attack prompts, and each case runs in an isolated local environment that records actual resource use. Resource hijacking remains effective across four model backends, with average attack success rates of 70.0% to 89.6%, and it also appears across two agent harnesses, with average ASRs of 84.1% on OpenClaw and 72.3% on Codex. In paired comparisons, resource hijacking achieves ASRs 62.4 to 84.0 percentage points higher than direct resource acquisition across the four model backends. Real-world experiments also demonstrate the practical effectiveness of resource hijacking. Among the three existing defenses we evaluate, the lowest average ASR is still 55.1%. We further propose ResGate, a pre-execution resource authorization defense that combines model-based resource-use extraction with deterministic policy enforcement based on trusted requester identity metadata, reducing the average ASR on OpenClaw to 23.6%. These results show that preventing direct access alone is not enough to protect resources that agents can still use on an attacker's behalf, and that explicit resource authorization can help reduce this risk.

Abstract

AI Agent Security

Explore similar work

Beyond Direct Access: Resource Hijacking in LLM Agents

Do AI Agents Know When a Task Is Simple? Toward Complexity-Aware Reasoning and Execution

Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents