Agent Security Requires Contextual Framework, Not Content Checks
A new paper argues that current approaches to agent security, which focus on the content of actions, are fundamentally flawed. The authors contend that security is a contextual problem: the same command, such as 'delete user data,' could be either a routine administrative request or a malicious prompt injection, and content alone cannot distinguish them. They propose a framework based on four properties—Source Authorization, among others—that must be evaluated continuously across an agent's trajectory. Tests on AgentDojo and WASP show that every injection task involves an action an authenticated user could plausibly request, making the content-based conflation a structural issue.
Key facts
- Agent security is currently treated as a content-based problem.
- The paper argues security is fundamentally contextual.
- A command like 'delete user data' can be benign or malicious depending on context.
- Authorization context is key to distinguishing legitimate requests from attacks.
- The proposed framework includes four properties evaluated continuously.
- AgentDojo and WASP benchmarks were used to test the approach.
- Every injection task in those benchmarks matches a plausible routine action.
- The conflation is a structural property of content-based security evaluation.
Entities
—