Research · curated 16 Sep 2026
ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
ROPE offers defenders a deterministic, origin-based enforcement mechanism to blunt indirect prompt injection against autonomous tool-calling agents where runtime-determined tool sequences evade prior screening defenses.
ROPE (Routed Origin Policy Enforcement) is a research defense against indirect prompt injection in tool-using LLM agents, enforcing that a value may reach a state-changing tool only if it traces unforgeably to the user, a user-named source, or the user's own records. Evaluated across four agent models, ROPE holds attack success rate to 1.6-2.6% while retaining 82-100% of clean utility, with provable origin guarantees and published code and logs on GitHub.