synodic-ai AI SECURITY
AI Security Desk · Agent Security

Evidence, Instructions, Egress: Three Places to Stop Hostile Text Before an Agent Acts on It

2026-10-20

Three papers posted to arXiv on 2026-10-19 defend LLM agents at three different layers: the evidence an agent trusts, the instructions hidden in its tool outputs, and the network connections it opens. Each shows that a defense placed at one layer leaves the others open, and each reports where its own check holds and where it stops.

Poisoning what the agent believes

Mengxiao Wang and Nitesh Saxena separate two attacks that are often merged. Prompt injection targets the model's instructions; information injection targets the evidence the agent trusts. Their setting is LLM agents that trade real capital using news as evidence, which the authors say cannot reliably tell fabricated headlines from real news. Because such agents read the same feeds under near-identical policies, a single fabricated post can push them into the same trade at the same moment.

Their benchmark spans five injection vectors and seven event categories, evaluated over roughly 10,000 decisions on 15 U.S. stocks. Prompt injection reached a 14 percent attack success rate, while fabricated news reached 62 percent, and two 30-word templates reached 100 percent on all 15 stocks. The authors describe this as inverting the usual LLM-security intuition.

Two findings explain why. For fact-poisoning templates, surface form mattered more than content: removing credibility cues such as a named source or a BREAKING tag dropped the success rate from 100 percent to 0 while the fake claim stayed identical. Success also depended on the agent's state, with a fake indicator panel scoring 91 percent against an agent about to hold but 12 percent against one about to buy. The attacks generalized across model vendors and stayed effective when blended, unlabeled, into real news feeds. Most evaded standard defenses: model scaling stopped shallow vectors but not fact poisoning, peer debate failed, and only hierarchical aggregation reduced the success rate.

Finding the injected instruction cheaply

Yinxiang Wang, Han Fang and colleagues address the instruction layer. LLM-based guardrails work against indirect prompt injection, but their detection degrades substantially as the guardrail model gets smaller or weaker. The authors break the guardrail's job into two parts: locating potentially injected instructions within heterogeneous tool outputs, and judging whether those instructions are authorized by the user's request. They find that small models struggle mainly with doing both at once, not with either subproblem alone.

Localization, they argue, needs no strong language-model reasoning, because injected instructions are often semantically discontinuous with the surrounding content and can be partitioned into local regions by lightweight unsupervised segmentation. Once the observation is split this way, the authorization check becomes a localized judgment a small model can make. Their guardrail runs attack-agnostic localization first, then block-level authorization with a small language model, and reports a 0.32 percent attack success rate with negligible loss in benign utility while remaining effective with substantially smaller models.

Holding the connection until a verifier rules

Ashok Subbabhatta Gopalakrishna starts from what an agent in a container actually does: it acts by opening network connections, and the text driving it can be hostile. Controls placed between the agent and its tools can be bypassed by a child process or a direct socket, and their approval is not tied to the connection the kernel later opens.

Connection escrow parks every outbound TCP connection from a supervised pod inside the kernel's connect() path, before any packet exists, using a 98-instruction eBPF program on the pod's cgroup. A node interceptor attributes the held socket to its kernel socket cookie, process, executable digest, cgroup and pod identity, parks the first bytes the agent writes, and asks a verifier running in a separate container with its own key. The connection is released only on a signed verdict that names that one socket cookie and destination and is unexpired and unused; with no verdict by the deadline the connection is reset, and a late approval is refused. The agent itself is unmodified.

A 36-check adversarial suite with real cgroups passes on the eBPF hold point, and the 33 checks that also apply to an iptables hold point pass there too. Refused connections never reach the destination; forged, rebound, replayed, expired and late verdicts are refused; the agent's own attempt to reach the verifier is escrowed; child-process and renamed-binary bypasses fail; and UDP is pinned to the resolver. On a Kubernetes cluster, unmodified pods were held per connection and attributed to their SPIFFE identity, a raw socket that bypassed a sidecar proxy was held, and 600 connections from six pods were gated. The hold adds a median 4.5 ms per released connection, of which 24 microseconds is policy. The design can also gate on request content without terminating TLS: an eBPF uprobe reads plaintext at the agent's TLS-library boundary (shared OpenSSL, static OpenSSL, Go crypto/tls), a model scores it, and the connection is held on that verdict while TLS stays end to end and the enforcer holds no key.

Why one layer is not enough

Read together, the papers describe a stack. The trading-agent results show that defenses aimed only at instructions miss attacks that never issue an instruction: a fabricated headline with the right credibility cues changes the decision without telling the model to do anything. The guardrail result shows that the instruction check itself can be made cheap by separating where to look from what to decide. Connection escrow moves the last decision out of the agent's process entirely and binds it to the specific connection, so a bypass in the agent's tooling does not become a bypass of the control.

Each paper also states its limit. Only hierarchical aggregation reduced information-injection success in the trading benchmark. The guardrail's numbers are for indirect prompt injection, not evidence poisoning. Escrow governs whether a connection leaves the pod, and its content gate is only as good as the model that scores the plaintext.

What security teams should change

These are research results on specific benchmarks, guardrails and clusters, so treat them as test plans rather than measured rates for your own agents.

Sources