TraceGrant: Contract-Governed Lifecycle Defense Against Indirect Prompt Injection in Networked LLM Agents
First seen Aug 24, 2026 · Updated Aug 24, 2026
This is a defensive research paper, not an active threat or exploit disclosure. It proposes TraceGrant, a governance framework that mitigates indirect prompt injection in networked LLM agents by binding tool execution to a pre-established 'Contract' derived from trusted user intent and verifying task completion against actual results. The underlying risk it addresses (indirect prompt injection redirecting tool calls) is well-known and already covered by existing threat models; no new vulnerability or attack technique is introduced here.
Technical Analysis
The paper targets the general problem class of indirect prompt injection, where untrusted content retrieved by an agent (email, cloud storage, calendars, web pages) contains embedded instructions that hijack tool invocation, alter arguments, or derail task completion. TraceGrant's mechanism establishes a task-effect boundary before execution, restricts what runtime evidence can authorize during execution, and verifies outcomes against the original Contract after execution, effectively adding intent-binding and post-hoc verification layers around tool calls. This closes gaps in prior defenses that only filtered untrusted content or gated individual tool calls without connecting intent, evidence, and final effects. The paper reports zero attack successes against AgentDojo and Agent Security Bench benchmarks (77-83% baseline attack success rates), indicating the defense addresses a class of vulnerability that remains highly exploitable in unprotected agents.
Affected Systems
AgentDojo, Agent Security Bench
Detection Signatures
- Tool call arguments diverging from original user-specified task parameters
- Sensitive tool invocations (payment, file deletion, external send) not traceable to an explicit user-authorized contract/scope
- Runtime evidence (retrieved documents/emails/web content) containing embedded imperative instructions redirecting agent behavior
- Task completion claims that do not match verifiable tool execution results
- High divergence between planned task boundary and actual sequence of tool calls executed
Remediation Steps
- 1
Adopt intent-binding contracts
Establish an explicit, auditable boundary of authorized tasks/effects derived from trusted user input before agent execution begins, and require all tool calls to map back to this contract.
- 2
Constrain authority derived from untrusted evidence
Ensure that content retrieved during execution (emails, documents, web pages) can only exercise authority already granted by the pre-established contract, not expand it.
- 3
Verify task completion post-execution
Cross-check final tool results against the original contract and user intent rather than trusting the agent's self-reported task completion.
- 4
Benchmark against known attack suites
Evaluate agent deployments using AgentDojo and Agent Security Bench (or similar) to measure susceptibility to indirect prompt injection before production rollout.
- 5
Monitor for white-box/defense-aware attacks
Since the paper notes evaluation against defense-aware adversaries, continuously red-team any adopted contract-governance layer for adaptive bypass techniques.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.