CoChat
Sign Up
Cited by 9Access Control and TrustSecurity and Verification in ComputingAdversarial Robustness in Machine Learning

The DOI matches its Crossref record; 2 of the 2 references it cites were found in a registry or an index.

AgentBound: Securing Execution Boundaries of AI Agents

Open access
Bühler, Christoph, Biagiola, Matteo, Di Grazia, Luca, Salvaneschi, Guido·2026·Proceedings of the ACM on Software Engineering
DOI 10.1145/3808103
Open this paper in CoChat — free account

Abstract

Large Language Models (LLMs) have evolved into AI agents that interact with external tools and environments to perform complex tasks. The Model Context Protocol (MCP) has become the de facto standard for connecting agents with such resources, but security has lagged behind: thousands of MCP servers execute with unrestricted access to host systems, creating a broad attack surface. In this paper, we introduce AgentBound, the first access control framework for MCP servers. AgentBound combines a declarative policy mechanism, inspired by the Android permission model, with a policy enforcement engine that contains malicious behavior without requiring MCP server modifications. We build a dataset containing the 296 most popular MCP servers, and show that access control policies can be generated automatically from source code with 80.9% accuracy. We also show that AgentBound blocks the majority of security threats in several malicious MCP servers, and that the policy enforcement engine introduces negligible overhead. Our contributions provide developers and project managers with a foundation for securing MCP servers while maintaining productivity, enabling researchers and tool builders to explore new directions for declarative access control and MCP security.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1145/3808103

Cites

2 of 2 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Research works printed but not linked: 48

  1. 10.1145/3605764.3623985 · DOI · Paper page
  2. Arash Ahmadi, Sarah Sharif, and Yaser M. Banad. MCP Bridge: A Lightweight, LLM-agnostic Restful Proxy for Model Context Protocol Servers. 2026. arXiv: 2504 . 08999 [cs.CR]. url: https://arxiv.org/abs/2504.08999 (visited on 02/24/2026). Pre-published. · arXiv
  3. 10.1007/s10462-025-11458-6 · DOI · Paper page
  4. 10.1002/9781119644682 · DOI · Paper page
  5. Anthropic. Introducing the Model Context Protocol. Anthropic. Nov. 25, 2024. url: https : //www.anthropic.com/news/model-context-protocol (visited on 07/29/2025).
  6. Kathy Wain Yee Au et al. "Pscout: analyzing the android permission specification". In: Proceedings of the 2012 ACM conference on Computer and communications security. 2012, pp. 217-228.
  7. 10.3390/fi17090404 · DOI · Paper page
  8. Parnika Bhat and Kamlesh Dutta. "A survey on various threats and current state of security in android platform". In: ACM Computing Surveys (CSUR) 52.1 (2019), pp. 1-35. · DOI
  9. 10.1145/3338498.3358654 · DOI
  10. 10.3390/a18080499 · DOI · Paper page
  11. Tom Brown et al. "Language models are few-shot learners". In: Advances in neural information processing systems 33 (2020), pp. 1877-1901.
  12. Mark Chen et al. "Evaluating Large Language Models Trained on Code". In: CoRR abs/2107. 03374 (2021). arXiv: 2107.03374. url: https://arxiv.org/abs/2107.03374. · arXiv
  13. 10.48550/arXiv.2401.03428 · DOI
  14. 10.48550/ARXIV.2601.08012 · DOI
  15. 10.48550/ARXIV.2506.13666 · DOI
  16. 10.1109/ISPASS.2015.7095802 · DOI
  17. 10.48550/ARXIV.2411.04468 · DOI · Paper page
  18. 10.48550/ARXIV.2410.14923 · DOI
  19. 10.48550/arXiv.2509.25292 · DOI · Paper page
  20. 10.48550/ARXIV.2506.13538 · DOI
  21. /ARXIV.2506.13538. arXiv: 2506.13538. url: https://doi.org/10.48550/arXiv.2506.13538. 10.48550/arXiv.2506.13538 · DOI
  22. 10.48550/ARXIV.2505.24201 · DOI
  23. 10.1016/j · DOI
  24. 10.48550/ARXIV.2503.23278 · DOI · Paper page
  25. 10.48550/ARXIV.2505.14590 · DOI
  26. 10.48550/arXiv.2506.19676 · DOI · Paper page
  27. 10.48550/ARXIV.2504.12757 · DOI
  28. Zhihao Li et al. We Urgently Need Privilege Management in MCP: A Measurement of API Usage in MCP Ecosystems. 2025. arXiv: 2507.06250 [cs.CR]. url: https://arxiv.org/abs/2507.06250. · arXiv
  29. Jiahuei Lin et al. "Engineering AI Judge Systems". In: arXiv preprint arXiv:2411.17793 (2024). · arXiv
  30. 10.48550/ARXIV.2305.13860 · DOI
  31. 10.48550/arXiv.2503.21460 · DOI · Paper page
  32. 10.4230/LIPIcs.ECOOP.2024.27 · DOI
  33. 10.48550/ARXIV.2503.04479 · DOI
  34. modelcontextprotocol.io contributors. Specification. Model Context Protocol. June 18, 2025. url: https://modelcontextprotocol.io/specification/2025-06-18 (visited on 07/29/2025).
  35. 10.1109/IC2E.2015.74 · DOI
  36. 10.48550/ARXIV.2504.08623 · DOI · Paper page
  37. OpenAI. Function Calling and Other API Updates. Mar. 13, 2024. url: https://openai.com/ index/function-calling-and-other-api-updates/ (visited on 08/21/2025).
  38. 10.1145/3697010 · DOI · Paper page
  39. 10.1109/ACCESS.2025.3585609 · DOI · Paper page
  40. 10.48550/arXiv.2504.03767 · DOI
  41. 10.1007/978-3-319-11599-3_5 · DOI
  42. Mark Russinovich, Ahmed Salem, and Ronen Eldan. "Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack". In: 34th USENIX Security Symposium (USENIX Security 25). 2025, pp. 2421-2440. isbn: 978-1-939133-52-6. url: https://www. usenix.org/conference/usenixsecurity25/presentation/russinovich (visited on 09/09/2025).
  43. 10.1016/j.inffus.2025.103599 · DOI · Paper page
  44. Hao Song et al. Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem. 2025. arXiv: 2506.02040 [cs.CR]. url: https://arxiv.org/abs/2506.02040. · arXiv
  45. 10.1109/OJCS.2025.3589638 · DOI
  46. 10.48550/arXiv.2310.10634 · DOI
  47. 10.48550/ARXIV.2306.02224 · DOI · Paper page
  48. 10.1145/3650212.3680384 · DOI · Paper page

Metadata

Authors
Bühler, C., Biagiola, M., Di Grazia, L., & Salvaneschi, G.
Affiliations
  • University of St.Gallen (CH)
  • University of St. Gallen, St. Gallen, Switzerland
ORCID
Venue
Proceedings of the ACM on Software Engineering
Publisher
Association for Computing Machinery (ACM)
Published
2026-06-30
Volume
3
Issue
FSE
Pages
2141-2164
ISSN
2994-970X (ISSN-L)
DOI
10.1145/3808103
OpenAlex
W4417325963
Cited by
9
References
2
Citations by year
2026: 9
FWCI
63.35
Type
journal article
Language
en
Open access
Licence
Locations
  • Proceedings of the ACM on software engineering. (publishedVersion, cc-by)
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Funders
  • Swiss National Science Foundation (10001777)
  • European Union’s Horizon research and innovation programme (101189899)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Access Control and Trust
  • Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
AI agent security, Model Context Protocol, access control, large language models, AI agents, malicious activity detection, execution boundary

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review