Tool-augmented LLM agents face a security risk: untrusted tool outputs can specify actions that go beyond user intent, effectively becoming commands. The paper argues this arises from conflating action induction (suggesting a candidate action) with execution authorization (allowing the action to run). They propose SARA, a runtime layer that separates these roles. On the observation side, an Action Probe extracts action-inducing semantics from tool outputs without affecting the agent's reasoning. On the execution side, tool calls are authorized only against the original user objective and audited evidence from past successful executions, with checks at goal, execution-chain, and argument levels. Across benchmarks AgentDojo and AgentDyn, SARA reduces attack success rate to at most 0.63% while keeping task utility competitive.
Separating tool suggestions from authorization sharply reduces agent attacks
SARA tracks where proposed actions originate and permits tool calls only when supported by the user’s objective and previously authorized evidence.
Research Lab
Xiaokun Guo · Zhen Xu · Dongdong Huo · Yanqiu Zhang · Wei Wang · Qinfu Yang · +2 more
Institute of Information Engineering, Chinese Academy of Sciences · School of Cyber Security, University of Chinese Academy of Sciences
Research Digest··2 min read
Thread:Agent Security & Attacks
In one line
SARA separates action induction from runtime authorization in tool-augmented LLM agents, limiting attack success rate to under 0.63%.
Before you read this
Three ideas this paper builds onagent safetyRisks from AI agents including timing errors, shutdown avoidance, collusion, overclaiming, and unsafe execution, mitigated by constrained decoding, safety harnesses, and swarm governance.144 papers →prompt injectionA security attack where malicious instructions are embedded into inputs to override an LLM's intended behavior.63 papers →runtime monitoringAudits an AI agent's live actions, internal states, or effects against constraints or policies to catch errors and attacks.107 papers →
Read it as
Guo et al. address a failure mode in which untrusted tool outputs induce an LLM agent to take actions beyond the user’s intent.
The authors developed SARA, a runtime framework that separates action induction—content suggesting what an agent should do—from authorization to execute that action.
The Daily Edition
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.