Capability-Mediated Perimeters for Secure AI Agent Tool Execution: Conditional Non-Escalation Invariants and Empirical Evaluation Against Indirect Prompt Injection
Year: 2026
Type: preprint
Abstract: Autonomous artificial intelligence agents executing over extensible tool interfaces (such as Anthropic's Model Context Protocol) operate with ambient authority over connected tools. Because autoregressive Transformers ingest instructions and untrusted third-party data within a single homogeneous context window, adversarial observations can manipulate the model into executing unintended privileged actions—the classic Confused Deputy problem. In this paper, we argue that LLM agents should be treated as potentially compromised, untrusted principals . We present Mastyf Guard as a deterministic-first security architecture in which the neural model functions as a semantic fallback rather than the final security authority . Tool dispatch is governed by an external reference monitor enforcing complete mediation, least privilege, and four typed relational argument invariants (destination containment, scope boundedness, privilege monotonicity, and aggregate monetary clamping). Under stated reference-monitor complete mediation axioms (A1–A6) over the trusted computing base, out-of-scope tool execution has zero probability (formalized as Theorem 1: Conditional Non-Escalation Invariant over the Trusted Computing Base ). We report two distinct experimental benchmarks to avoid architectural conflation: (1) In historical v1 macro evaluation across 50,000 balanced instances (25,000 academic attacks from InjecAgent, BIPIA, and Garak vs. 25,000 authentic developer traces), the baseline capability perimeter filtered 82.40% of attacks at the transport boundary in 0.003 ms, reaching 99.33% recall at 0.005 ms amortized fast-path overhead when paired with the initial classifier; and (2) In Mastyf Guard 2.0 evaluation across 3,000 balanced enterprise instances , deterministic relational leaf-walking alone catches 75.00% of attacks with 0.00% FPR at 17.3 μs latency, while an evidence-conditioned 1.5B neural fallback recovers 475 of 500 structural misses ( V neural = 95.0%), yielding 97.50% net hybrid coverage and 0.00% observed FPR across 2,000 benign enterprise operations (Wilson 95% CI: [0.00%, 0.19%]) with P (fallback) = 0.00% on routine traffic. For cross-tool exfiltration where target sinks are authorized, an explicit-flow dynamic taint monitor inspired by DIFC (Theorem 2) intercepted 100% of 1,152 evaluated cases without leaks. Mastyf Guard 2.0 is scoped as an empirically evaluated pre-production security architecture; broader independent live-agent, production-environment, and third-party adversarial validation remain outstanding.
Source: Research Square
Author: Rudraneel Das
Institution: Jadavpur University
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7204807916