Agent Security Needs Redefinition through a Holistic Framework

TL;DR - This paper reframes agent security as a contextual authorization problem rather than one of detecting malicious-looking actions. It proposes four continuously evaluated properties to better define attacks, defenses, and benchmarks.

• Source Authorization verifies who issued each command.
• Task and Action Alignment ensure actions serve the agent’s authorized objective.
• Data Isolation controls information flow across privilege boundaries.
• The framework casts indirect prompt injection as an authorization violation and argues snapshot benchmarks cannot adequately assess data isolation.