Analysis · curated 30 Jul 2026
Position: Agent Security Needs Redefinition through a Holistic Framework
First reported arxiv.org
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
The paper reframes how defenders should evaluate and design agent-security defenses, arguing that content-scanning guardrails and snapshot benchmarks systematically misdefine prompt-injection and data-isolation threats.
A position paper by Siu, He, Montgomery, Wang, Wang and Song argues that agent security is fundamentally a contextual rather than content-based problem, showing that across benchmarks like AgentDojo, WASP and SHADE Arena the same surface instruction (e.g. 'delete file 13' or 'add coworker as Owner') is both a legitimate request and an attack depending on authorization context. The authors propose a holistic framework of four jointly-held properties—Source Authorization, Task Alignment, Action Alignment, and Data Isolation—reframing indirect prompt injection as a Source Authorization violation and arguing snapshot benchmarks cannot evaluate Data Isolation.