When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents

TL;DR - SARA is a runtime security framework that separates action suggestions derived from untrusted tool outputs from authorization to execute those actions. It sharply reduces agent attack success rates while preserving competitive task utility.

• An isolated Action Probe detects action-inducing content in observations and tracks its provenance across multiple steps.
• Tool calls are authorized only when supported by the user’s objective and evidence from previously authorized, successful executions.
• “No-History-Promotion” prevents repeated malicious instructions from gaining authority merely by recurring in an agent’s history.
• On AgentDojo and AgentDyn, SARA held attack success rates to at most 0.63% across four primary settings and reduced them across additional agent backbones.