SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection

Summary

SPILLWAY is a defense for tool-using agents against prompt injection that checks where an action's target comes from. It admits a call when each target value absent from the user's task was returned by a read-only tool in a typed field, or is covered by a fixed delegation rule, instead of relying on a language model's judgment. Across three backbones and seven task suites on one of them, no standard templated injection redirected an action to an attacker's target under SPILLWAY.

Topics

• Prompt injection and jailbreaks

Related items

• InfoDecision Models as Retrieval Gates Against Injection and PollutionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMultimodal-SEA: Benchmarking AI Agent Security under Multimodal Social Engineering AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumResearchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User InteractionSimilar attack · The Hacker News
• InfoTrueFoundry & Straiker | AI Gateway Security for AgentsSimilar attack · Straiker Blog
• InfoThe Agent Smith Dilemma: Governing Agentic IdentitiesSimilar attack · SecurityWeek