Research
ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection
Publication date not yet evaluated · Added arxiv.org
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
ROPE offers defenders a deterministic, origin-based enforcement mechanism to blunt indirect prompt injection against autonomous tool-calling agents where runtime-determined tool sequences evade prior screening defenses.
ROPE (Routed Origin Policy Enforcement) is a research defense against indirect prompt injection in tool-using LLM agents, enforcing that a value may reach a state-changing tool only if it traces unforgeably to the user, a user-named source, or the user's own records. Evaluated across four agent models, ROPE holds attack success rate to 1.6-2.6% while retaining 82-100% of clean utility, with provable origin guarantees and published code and logs on GitHub.