Least-Privilege Auditing of Agent Tool Calls with Intent Graphs and Reasoning-Guided Escalation

Summary

This research presents a runtime audit for LLM agents that calls tools, aimed at indirect prompt injection in tool outputs. The audit derives an intent graph from the user's objective and tool catalog with one LLM call per task, then checks each tool call against it with a deterministic loop, median 5.7 microseconds per call. Flagged calls are escalated to a reasoning guardian that sees only the objective, plan, call history without tool outputs, and the flagged call, and the authors note end-to-end validation remains open.

Topics

• Prompt injection and jailbreaks

Related items

• LowHelp defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validationSimilar attack · AWS Security Blog
• InfoCan the Confidence and Decisions of System 1 Models Be Trusted? An Explainability and Perturbation Audit of Jev-Style Decision ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoHarness Matters: Measuring and Dissecting Security Resilience in Web AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumTop MCP security resources — November 2026Similar attack · Adversa AI Blog
• InfoScaling Adaptive Prompt Injection Attacks with Agent SwarmsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)