{"data":{"id":"7955f2bc-0bd1-4442-8803-7117bd74c28d","title":"On the Relative Security of Prompt Injection: Mechanised Definitions, Defences and Verdicts for LLM Agents","summary":"This paper proposes relative security for LLM agents that read untrusted content: an agent counts as secure if every leak it has is also a leak of a reference agent that never obeys injected instructions. The authors present PlanTERS, a framework built on a small agent language with runtime monitors and attacker models, and prove in Isabelle/HOL that revoking injectable tools after the first untrusted read makes every plan relatively secure at the event level on finite runs, extending to possibly infinite runs under a fairness condition.","solution":"The source describes a fence theorem: revoking injectable tools at the first untrusted read, and never granting them back, makes every plan relatively secure at the event level on finite runs, for model behaviours where each injection is a single call and the model obeys on a schedule fixed in advance; with a fairness condition, this extends to possibly infinite runs.","labels":["security","research"],"sourceUrl":"https://arxiv.org/abs/2611.11506v1","publishedAt":"2026-11-08T17:20:48.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["prompt_injection"],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":[],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-08T17:20:48.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":"preprint","atlasIds":["AML.T0051"]}}