Progent: Securing AI Agents with Privilege Control

May combine two claims.

Progent reduces the attack success rate (ASR) from 39.9% to 1.0% on AgentDojo, and from 70.3% to 3.9% on ASB, while maintaining the agent's utility in both cases.

“Progent reduces the attack success rate (ASR) from 39.9% to 1.0% on Agent-Dojo, and from 70.3% to 3.9% on ASB, while maintaining the agent's utility in both cases.”

• Also stated in: § Abstract · plain

  “Our evaluation on popular benchmarks (i.e., AgentDojo and ASB) shows that Progent significantly reduces attack success rates while maintaining high utility.”

• cites [11]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [57]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Manual Approval mode reduces ASR to 0% with human review, demonstrating that human oversight can capture complex security requirements that the automatic pipeline may miss.

“Finally, the Manual Approval mode reduces the ASR to 0% with human review, demonstrating that human oversight can capture complex security requirements that the automatic pipeline may miss.”

May combine two claims.

The LLM-generated policies can successfully identify the necessary tools for the user task and allow their use.

“Specifically, the LLM-generated policies can successfully identify the necessary tools for the user task and allow their use.”

May combine two claims.

Auto-Approve mode has slightly higher ASR than Auto-Deny mode because widened policies may inadvertently permit malicious actions.

“However, the ASR is slightly higher than in the Auto-Deny mode because widened policies may inadvertently permit malicious actions, which is why explicit approval is required in practice for such updates.”

May combine two claims.

Auto-Deny mode achieves the highest level of security among fully automated configurations, as all updates are strictly bounded by invariant checks.

“When the policy update mechanism is enabled, the Auto-Deny mode achieves the highest level of security among fully automated configurations, as all updates are strictly bounded by invariant checks.”

May combine two claims.

The initial LLM-generated policy reduces the attack success rate from 39.9% to 2.5% while maintaining utility.

“Specifically, it reduces the attack success rate from 39.9% to 2.5% while maintaining utility.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In the running example (Figure 1), when send_email is blocked at step 4, the fallback message allows the agent to continue and successfully complete the benign task at step 5.

“For instance, in the running example (Figure 1), when send_email is blocked at step 4, the fallback message allows the agent to continue and successfully complete the benign task at step 5.”

May combine two claims.

Progent reduces ASR from 39.9% with no defense to 1.0% on AgentDojo while maintaining utility scores in both no-attack and under-attack scenarios.

“Progent significantly reduces ASR from 39.9% with the no defense baseline to 1.0%, while maintaining utility scores in both no-attack and under-attack scenarios.”

• AssumptionThe authors state this as an assumption: The user configures the approver to always accept policy-expansion requests.

May combine two claims.

Prior defenses are ineffective in reducing ASR on ASB, consistent with the original paper of ASB.

“The prior defenses are ineffective in reducing ASR, a result consistent with the original paper of ASB [57].”

• cites [57]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Auto-Approve mode allows policies to expand beyond their initial invariants, which improves both utility and security compared to Disable Update mode.

“In contrast, the Auto-Approve mode allows policies to expand beyond their initial invariants, which improves both utility and security compared to the Disable Update mode.”

The quote only partly states this claim.

Manually defined policies enhanced with human insights can provably reduce the ASR to 0%.

“These manually defined policies can provably reduce the ASR to 0%.”

May combine two claims.

With Progent applied, ASR is reduced to 0.5% and 0.3% for claude-sonnet-4 and Meta-SecAlign-70B, defending about 90% of attacks.

“With Progent applied, the ASR is even reduced further to 0.5% and 0.3%, defending about 90% of attacks.”

May combine two claims.

In the multi-agent setting, both utility and ASR are slightly lower than in single-agent systems.

“Figure 8 shows that in the multi-agent setting, both utility and ASR are slightly lower than in single-agent systems.”

May combine two claims.

After the SMT-based expansion check, only 6% of policy updates are expansions that require approval; the rest are narrowings handled automatically.

“We also observe that, after the SMT-based expansion check, only 6% of policy updates are expansions that require approval; the rest are narrowings handled automatically.”

May combine two claims.

Progent either maintains utility under no attack or introduces marginal reduction.

“It either maintains utility under no attack or introduces marginal reduction.”

May combine two claims.

Progent significantly reduces attack success rates while preserving high utility.

“Our evaluation on AgentDojo and ASB demonstrates that Progent significantly reduces attack success rates while preserving high utility”

May combine two claims.

Progent is effective with LLMs for policy generation and update, reducing ASR below 5% across all models and to 1% with the best performing LLM.

“As shown in Figure 6, Progent is effective with LLMs for policy generation and update, reducing ASR below 5% across all models and to 1% with the best performing LLM.”

May combine two claims.

After applying Progent, it maintains similar utility while significantly improving security, defending against more than 95% of successful attacks in the multi-agent setting.

“After applying Progent, it maintains similar utility while significantly improving security, defending against more than 95% of successful attacks.”

May combine two claims.

Under attacks, Progent improves utility and significantly reduces ASR across different models.

“Under attacks, it improves the utility and significantly reduces the ASR across different models.”

May combine two claims.

Progent substantially reduces ASR and retains meaningful protection against user-introduced mistakes using an adaptive attack.

“In Appendix E, we empirically evaluate Progent against user-introduced mistakes using an adaptive attack, showing that Progent substantially reduces ASR and retains meaningful protection despite possible human misjudgment.”

May combine two claims.

Progent consistently reduces ASR to around 1% while maintaining strong utility on real-world agents.

“As shown in Figure 8, Progent consistently reduces the ASR to around 1% while maintaining strong utility.”

May combine two claims.

claude-sonnet-4 and Meta-SecAlign-70B achieve ASR of only 6.8% and 4.8% without any defense applied.

“We also find that claude-sonnet-4 and Meta-SecAlign-70B, themselves already have strong safety mechanisms, achieving a remarkable ASR of only 6.8% and 4.8% without any defense applied.”

Classified as probably not a substantial claim.

Progent represents privilege as a security policy consisting of symbolic rules over tool names and arguments, which specify which tool calls are allowed and which should be blocked.

“Progent represents privilege as a security policy consisting of symbolic rules over tool names and arguments.”

• Also stated in: § Challenges for Securing AI Agents. · plain

  “Progent leverages a privilege control policy consisting of symbolic rules over tool names and arguments.These rules specify which tool calls are allowed and which should be blocked.”

Probably not a substantial claim: may not pass S2 (checkable).

Distinguishing legitimate from adversarial expansions, without sacrificing security or utility, is a fundamental challenge.

“Distinguishing legitimate from adversarial expansions, without sacrificing security or utility, is a fundamental challenge.”

Probably not a substantial claim: may not pass S4 (based).

Agents must sometimes expand their privileges to complete benign tasks.

“Finally, agents must sometimes expand their privileges to complete benign tasks.”

Classified as probably not a substantial claim.

There are two kinds of context for an agent: task context and execution context.

“We identify two kinds of context for the agent.The first is task context: the same agent can process different tasks, such as summarizing emails, booking a flight, or reconciling a budget, each authorizing a different set of tools with different tool arguments.”

May combine two claims.

Progent uses an LLM to automatically generate the initial policy from the user's task and updates it during execution as new information arrives.

“To handle diverse user tasks and evolving execution contexts, an LLM automatically generates the initial policy from the user's task and updates it during execution as new information arrives.”

• Also stated in: § Challenges for Securing AI Agents. · plain

  “To handle context-dependent security requirements, Progent utilizes an LLM to automatically generate the initial policy from the user's task and updates it as new information arrives during execution.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

All external effects of an agent occur through tool calls, and they expose a structured interface (tool names and typed arguments), unlike the agent's unstructured reasoning.

“We focus on tool calls because all external effects of an agent occur through them, and they expose a structured interface (tool names and typed arguments), unlike the agent's unstructured reasoning.”

May combine two claims.

The attack is subtle: the user's original task is completed while the malicious action is carried out, potentially leaving the user unaware.

“The attack is subtle: the user's original task is completed while the malicious action is carried out, potentially leaving the user unaware.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

Involving the user in every security decision is impractical and negates the benefit of an autonomous agent.

“A defense must track these changes automatically, since involving the user in every security decision is impractical and negates the benefit of an autonomous agent.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Introducing an LLM for policy construction introduces non-determinism, creating a fundamental tension between automation and deterministic enforcement.

“However, introducing an LLM for policy construction introduces non-determinism, creating a fundamental tension between automation and deterministic enforcement.”

Classified as probably not a substantial claim. May combine two claims.

Different tasks require different tools and arguments, and the relevant context evolves at runtime as the agent interacts with the environment.

“Different tasks require different tools and arguments, and the relevant context evolves at runtime as the agent interacts with the environment.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Adversaries also seek to exploit the same mechanism to induce harmful actions, and both legitimate and adversarial expansion requests arrive through the same channel.

“Yet, adversaries also seek to exploit the same mechanism to induce harmful actions, and both legitimate and adversarial expansion requests arrive through the same channel.”

Classified as probably not a substantial claim. May combine two claims.

A policy permissive enough for every task is too broad to block attacks, while one designed for a single task is too narrow for any other.

“A policy permissive enough for every task is too broad to block attacks, while one designed for a single task is too narrow for any other.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Security requires deterministic enforcement that holds regardless of how the LLM reasons, even under adversarial influence.

“In contrast, security requires deterministic enforcement that holds regardless of how the LLM reasons, even under adversarial influence.”

May combine two claims.

Progent can be integrated by inserting a separate module between the agent and its tools, requiring no changes to the agent's internal architecture, making integration non-intrusive and generalizable across diverse agent frameworks.

“Since Progent operates at the tool-call level, it can be integrated by inserting a separate module between the agent and its tools.This requires no changes to the agent's internal architecture, making integration non-intrusive and generalizable across diverse agent frameworks.”

Probably not a substantial claim: may not pass S4 (based).

Under the benign user query threat model, the initialized policy P is expected to accurately identify and restrict tool usage and arguments in accordance with the principle of least privilege.

“Under our threat model, where the user query is benign, the initialized 𝑃 is expected to accurately identify and restrict tool usage and arguments in accordance with the principle of least privilege.”

• AssumptionThe authors state this as an assumption: The user query is benign.

Classified as probably not a substantial claim. May combine two claims.

The same channel can carry adversarial content, making it challenging to balance security and utility.

“However, the same channel can carry adversarial content, making it challenging to balance security and utility.”

May combine two claims.

The three prompt injection detectors fail to generalize to AgentDojo, exhibiting high rates of false positives and negatives.

“While they may perform well on datasets similar to their training distributions, they fail to generalize to AgentDojo, exhibiting high rates of false positives and negatives.”

May combine two claims.

Progent successfully enforces the principle of least privilege, allowing tool calls necessary for completing the user task while blocking malicious tool calls.

“This means Progent successfully enforces the principle of least privilege, allowing tool calls necessary for completing the user task while blocking malicious tool calls.”

Probably not a substantial claim: may not pass S4 (based).

The only requirement for Progent's formulation is that the agent can call tools within T.

“The only requirement is that the agent can call tools within T .”

May combine two claims.

Higher-priority generic policies cannot be overridden by lower-priority ones, and no lower-priority or task-specific policy can weaken stronger generic guarantees.

“Higher-priority policies are enforced first and cannot be overridden by lower-priority ones, while lower-priority policies may further restrict the remaining action space, ensuring that no lower-priority or task-specific policy can weaken stronger generic guarantees.”

Classified as probably not a substantial claim. May combine two claims.

Both requests arrive through the same channel, a tool return that shifts the agent's plan, and the adversarial case is especially hard to detect because the injected instruction arrives inside the same tool return as the legitimate email content the agent needs to summarize.

“Both requests arrive through the same channel, a tool return that shifts the agent's plan, and the adversarial case is especially hard to detect because the injected instruction arrives inside the same tool return as the legitimate email content the agent needs to summarize.”

May combine two claims.

The deterministic SMT check ensures that policy updates can only narrow privileges without approval, whereas any expansion requires explicit approval.

“This deterministic check ensures that policy updates can only narrow privileges without approval, whereas any expansion requires explicit approval.”

May combine two claims.

No attack can silently escalate the agent's privileges; only expansion requests require approval, and all other security decisions are handled deterministically.

“This guarantees that no attack can silently escalate the agent's privileges: only expansion requests require approval, and all other security decisions are handled deterministically.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Rules can specify concrete values, wildcards, and regular-expression patterns, making the policy expressive enough to capture fine-grained constraints.

“Rules can specify concrete values (such as 20), wildcards (*), and regular-expression patterns, making the policy expressive enough to capture fine-grained constraints.”

May combine two claims.

Expansion is sensitive: it may be necessary for utility but can also be caused by an attack.

“Expansion, however, is sensitive: it may be necessary for utility (as in 𝑃 1 → 𝑃 2 , where the task requires more tools) but can also be caused by an attack (as in step 3's injection).”

Classified as probably not a substantial claim.

Progent's runtime enforcement is a deterministic procedure that checks every tool call against the current policy.

“Progent's runtime enforcement is a deterministic procedure that checks every tool call against the current policy, as illustrated in Algorithm 2.”

Classified as probably not a substantial claim. May combine two claims.

The function P(c) creates a policy-governed tool call that behaves like the original tool call when allowed and switches to the fallback function when not.

“The function 𝑃 (𝑐) creates a policy-governed tool call.It behaves just like the original tool call 𝑐 when the policy 𝑃 allows it, and it automatically switches to the fallback function when it does not.”

May combine two claims.

Manual Approval mode delivers the strongest security, as all policies are explicitly reviewed by the user, but it demands manual effort and is most suitable for security-critical environments.

“Finally, the Manual Approval mode delivers the strongest security, as all policies are explicitly reviewed by the user, but it demands manual effort and is most suitable for security-critical environments.”

May combine two claims.

Even when the LLM is manipulated or hallucinates, the deterministic judgment ensures that no new permission is granted without explicit approval, so utility-driven expansions are permitted while adversarial ones are caught.

“Even when the LLM is manipulated or hallucinates, the deterministic judgment ensures that no new permission is granted without explicit approval, so utility-driven expansions are permitted while adversarial ones are caught.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Disable Update mode provides deterministic stability by fixing policies after initialization, though it may reduce adaptability to dynamic contexts.

“The Disable Update mode provides deterministic stability by fixing policies after initialization, though it may reduce adaptability to dynamic contexts.”

Probably not a substantial claim: may not pass S2 (checkable).

Given the vast range of possible outcomes from tool calls, the attacker could cause a variety of downstream damages.

“Given the vast range of possible outcomes from tool calls, the attacker could cause a variety of downstream damages.”

Classified as probably not a substantial claim.

If no rule in P targets the tool or the tool call's arguments do not trigger any rule, Progent blocks the tool call by default for security purposes.

“Finally, at Line 8, if no rule in P targets the tool or the tool call's arguments do not trigger any rule, we block the tool call by default for security purposes.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

The development of AI agents is complex, involving various modules, strategic architectural decisions, and sophisticated implementation.

“The development of AI agents is complex, involving various modules, strategic architectural decisions, and sophisticated implementation [46].”

• cites [46]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

When the agent issues a tool call, Progent matches it against the current policy's rules and deterministically allows or blocks it; calls that match no rule are blocked by default.

“When the agent issues a tool call, Progent matches it against the current policy's rules and deterministically allows or blocks it; calls that match no rule are blocked by default.”

May combine two claims.

Because Progent's policies are symbolic, both relations are decidable by an SMT solver, giving a fully deterministic judgment.

“Because Progent's policies are symbolic, both relations are decidable by an SMT solver, giving a fully deterministic judgment (details in Section 4.3).”

May combine two claims.

State-of-the-art LLM service providers use JSON to format tool calls, making JSON Schema a natural choice for validating tool calls against policy rules.

“State-of-the-art LLM service providers (e.g., OpenAI API [35]) use JSON to format tool calls, making JSON Schema a natural choice for validating tool calls against policy rules.”

• cites [35]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

tool_filter suffers from higher utility reduction and ASR because its coarse-grained approach of ignoring tool arguments either blocks an entire tool, harming utility, or allows it completely, causing attack success.

“tool_filter suffers from higher utility reduction and ASR because its coarse-grained approach of ignoring tool arguments either blocks an entire tool, harming utility, or allows it completely, causing attack success.”

Probably not a substantial claim: may not pass S4 (based).

When the agent retrieves attacker-manipulated data via tool calls, the injected command can alter the agent's behavior.

“When the agent retrieves such data via tool calls, the injected command can alter the agent's behavior.”

• AssumptionThe authors state this as an assumption: The attacker can manipulate the agent's external data source in the environment E, such as an email, to embed malicious commands.

Classified as probably not a substantial claim.

Progent places forbid rules before allow rules such that the forbid ones take effect first.

“Then, at Line 3, we take a conservative approach to place forbid rules before allow rules such that the forbid ones take effect first.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Auto-Deny offers a conservative balance between security and automation, ensuring that all expansions are rejected.

“In contrast, Auto-Deny offers a conservative balance between security and automation, ensuring that all expansions are rejected.”

Probably not a substantial claim: may not pass S4 (based).

Because agents execute autonomously, they must adapt to new information that may legitimately require additional privileges.

“Because agents execute autonomously, they must adapt to new information that may legitimately require additional privileges.”

• AssumptionRests on an assumption: AI agents execute autonomously, and the context changes as the agent gathers new information at runtime.

May combine two claims.

The attacker could induce dangerous data erasure operations and unauthorized financial transactions.

“For instance, as shown in [11,57], the attacker could induce dangerous data erasure operations and unauthorized financial transactions.”

• cites [11]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [57]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

Since the agent interacts with the external environment via tool calls, dangerous behaviors exhibit as malicious tool calls at Line 3 of Algorithm 1.

“Since the agent interacts with the external environment via tool calls, such dangerous behaviors exhibit as malicious tool calls at Line 3 of Algorithm 1.”

May combine two claims.

Because this check is purely symbolic over structured policy rules, every security decision is deterministic, directly addressing Challenge I.

“Because this check is purely symbolic over structured policy rules, every security decision is deterministic, directly addressing Challenge I.”

May combine two claims.

Progent introduces a privilege control policy consisting of symbolic rules over tool names and arguments, enforced deterministically with no LLM in the decision loop.

“Progent introduces a privilege control policy consisting of symbolic rules over tool names and arguments, enforced deterministically with no LLM in the decision loop.”

May combine two claims.

Progent serves as an effective defense-in-depth layer that complements other defenses while requiring minimal code changes.

“For agents, Progent serves as an effective defense-in-depth layer that complements other defenses while requiring minimal code changes.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Multi-agent systems naturally introduce isolation between sub-agents, which can reduce coordination efficiency but also limit attack propagation, improving security.

“This is likely because multi-agent systems naturally introduce isolation between sub-agents, which can reduce coordination efficiency but also limit attack propagation, improving security.”

Probably not a substantial claim: may not pass S4 (based).

Many other system-level defenses require substantial architectural modifications.

“whereas many other system-level defenses require substantial architectural modifications.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

There are no policies or licensing restrictions preventing the authors from making the artifacts publicly available.

“There are no policies or licensing restrictions preventing us from making the artifacts publicly available.”

May combine two claims.

The proxy mode offers out-of-the-box deployability and requires no modification to the underlying agent, but it cannot protect agent functionalities implemented as built-in tools that bypass external MCP interfaces.

“Besides, the proxy mode offers out-of-the-box deployability and requires no modification to the underlying agent, but it cannot protect agent functionalities implemented as built-in tools that bypass external MCP interfaces.”

May combine two claims.

Progent complements existing defense mechanisms and serves as an effective defense-in-depth layer in practice.

“These results demonstrate that Progent complements existing defense mechanisms and serves as an effective defense-in-depth layer in practice.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The marginal variations in utility and security across different agents are likely due to differences in system prompts and retry mechanisms among these agents.

“The marginal variations in utility and security across different agents are likely due to differences in system prompts and retry mechanisms among these agents.”

May combine two claims.

Progent is effective and robust when deployed with real-world agents under realistic attack scenarios.

“These results demonstrate Progent's effectiveness and robustness when deployed with real-world agents under realistic attack scenarios.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Progent can be applied separately for each sub-agent, allowing customized policies tailored to the role and functionality of each agent.

“Progent can also be applied separately for each sub-agent, allowing customized policies tailored to the role and functionality of each agent.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The datasets and benchmarks used in the evaluation have been made publicly available by their authors.

“The datasets and benchmarks used in the evaluation have been made publicly available by their authors.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The MCP-based benchmark is fully reusable and can be applied to future agent frameworks or products as long as they support MCP.

“It is fully reusable and can be applied to future agent frameworks or products as long as they support MCP, making it a practical and extensible testbed for real-world agent security research.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Progent naturally supports multi-agent systems through its modular design.

“Progent naturally supports multi-agent systems through its modular design.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Two injection tasks in the travel suite are preference attacks, which mislead the agent into choosing another legitimate hotel rather than the target one.

“Two injection tasks in the travel suite are preference attacks, which mislead the agent into choosing another legitimate hotel rather than the target one.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

All datasets used in the experiments are publicly available and do not contain any private or sensitive data.

“All datasets used in the experiments are publicly available and do not contain any private or sensitive data.”

Probably not a substantial claim: may not pass S4 (based).

Existing policy languages are not suited to the dynamic behavior of AI agents.

“yet existing policy languages are not suited to the dynamic behavior of AI agents.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Progent's modular design enables integration into existing agent implementations with minimal changes, potentially lowering adoption barriers.

“Its modular design enables integration into existing agent implementations with minimal changes, potentially lowering adoption barriers”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

An attacker who is aware of the LLM-based policy update mechanism and the user with limited security awareness could construct adaptive attacks to circumvent Progent's defense effect.

“Considering that the LLM-based policy update mechanism utilizes external information and the user with limited security awareness who may make risky decisions in practice, an attacker who is aware of this could construct adaptive attacks to circumvent Progent's defense effect.”

• AssumptionRests on an assumption: The LLM-based policy update mechanism utilizes external information and the user may have limited security awareness and make risky decisions in practice.
• AssumptionRests on an assumption: An attacker can be aware of the LLM-based policy update mechanism and the user's limited security awareness.

May combine two claims.

In Progent, even if the tool is blocked, it still exists in the trace with a blocking message and it would be wrongly classified by the AgentDojo success check.

“In our method, even if the tool is blocked, it still exists in the trace with a blocking message and it would be wrongly classified.”

Classified as probably not a substantial claim. May combine two claims.

The library mode requires only a few lines of code changes yet can secure built-in tools as well.

“In contrast, the library mode requires only a few lines of code changes yet can secure built-in tools as well.”

Probably not a substantial claim: may not pass S3 (load-bearing).

For another injection task in the slack suite, the AgentDojo implementation directly looks for the attack tool call in the execution trace to determine whether the attack is successful regardless of whether the tool call succeeds or not.

“For another injection task in the slack suite, the AgentDojo implementation directly looks for the attack tool call in the execution trace to determine whether the attack is successful regardless of whether the tool call succeeds or not.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

All experiments are done in a local and sandboxed environment which will not leak any attack prompt to real-world applications.

“All experiments are done in a local and sandboxed environment which will not leak any attack prompt to the real-world applications.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Treating the entire multi-agent system as a unified entity and enforcing a single layer of privilege control ensures consistent security and prevents cross-agent privilege escalation.

“This global context and policy management ensures consistent security and prevents cross-agent privilege escalation.”

Probably not a substantial claim: may not pass S4 (based).

Progent provides deterministic security enforcement, which guardrail models cannot.

“Another key distinction is that Progent provides deterministic security enforcement, which guardrail models cannot.”

May combine two claims.

An LLM automatically generates and updates the policy, while a deterministic SMT-based check determines whether each update is a narrowing (applied automatically) or an expansion (requiring approval), guaranteeing monotonic confinement.

“To handle diverse tasks and evolving execution contexts, an LLM automatically generates and updates the policy, while a deterministic SMT-based check determines whether each update is a narrowing (applied automatically) or an expansion (requiring approval), guaranteeing monotonic confinement.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Text-to-text attacks are more aligned with model-level risks that have been extensively studied by existing model security works.

“Such text-to-text attacks are more aligned with model-level risks that have been extensively studied by existing model security works.”