Progent: Securing AI Agents with Privilege Control

Progent: Securing AI Agents with Privilege Control

• ID: 0f2efa23
• 原文链接: https://arxiv.org/abs/2504.11703
• PDF: https://arxiv.org/pdf/2504.11703v3
• 作者: Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, Dawn Song
• 日期: 2025-04-16
• 更新: 2026-05-14
• 分类: agents
• 来源类型: paper
• 标签: agent-security, privilege-control, tool-calling, prompt-injection, cs.cr
• 质量评分: 4/5
• 抓取时间: 2026-07-25T04:19:45+00:00

中文导读

Progent 论文把工具调用 Agent 的安全问题建模为权限控制：用围绕工具名和参数的符号策略定义哪些调用允许用于完成任务哪些属于不必要或危险动作摘要明确指出它针对间接提示注入和未授权动作，并把策略生成放在用户任务与执行状态变化的上下文中，适合作为 Agent 工具权限从提示约束走向可执行策略层的参考

为什么值得关注

Agent 安全不能只靠模型自觉；工具名和参数级的权限策略正在成为最小权限落地层

这篇论文属于 AAIF 的 Agent 安全/评估线索：它不是泛泛讨论“让模型更安全”，而是把风险落到工具调用、权限继承、授权边界或集合级效用等可被工程系统观测与约束的对象上。对于正在构建工具型 Agent、连接器、沙箱评测或推荐型 Agent 的团队，它提供了一个更具体的检查维度：模型输出之外，系统还需要回答“Agent 被允许做什么、实际做了什么、这些动作对用户账户/环境/推荐集合造成什么后果”。

关键信息

• 论文标题：Progent: Securing AI Agents with Privilege Control
• 作者：Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, Dawn Song
• arXiv：https://arxiv.org/abs/2504.11703
• 发布时间：2025-04-16
• arXiv 分类：cs.CR, cs.AI
• 关联标签：agent-security, privilege-control, tool-calling, prompt-injection, cs.cr

English Abstract

AI agents interact with external environments through tool calls, exposing them to attacks like indirect prompt injection that can trigger unauthorized actions. Securing these agents is challenging: they behave autonomously and probabilistically, security requirements evolve depending on the user's task and execution state, and there is an inherent tradeofff between security and utility. In this work, we introduce Progent, a novel framework that secures AI agents via privilege control. Progent represents privilege as a security policy consisting of symbolic rules over tool names and arguments. These rules specify which tool calls are allowed for task completion and which unnecessary ones are blocked for security. Every tool call is checked against such a policy through a deterministic procedure, enforcing the principle of least privilege. To handle diverse user tasks and evolving execution contexts, an LLM automatically generates the initial policy from the user's task and updates it during execution as new information arrives. Each proposed update is determined by an SMT solver to be either a narrowing (applied automatically) or an expansion (requiring explicit approval), ensuring that the agent's effective action space can only shrink without approval (monotonic confinement). This deterministic update mechanism preserves utility and prevents silent privilege escalation, even when adversarial inputs are present. Our evaluation on popular benchmarks (i.e., AgentDojo and ASB) shows that Progent significantly reduces attack success rates while maintaining high utility. We further validate Progent's practicality by showcasing its effectiveness in real-world agent frameworks such as LangChain and OpenAI Agents SDK.

English Summary

AI agents interact with external environments through tool calls, exposing them to attacks like indirect prompt injection that can trigger unauthorized actions. Securing these agents is challenging: they behave autonomously and probabilistically, security requirements evolve depending on the user's task and execution state, and there is an inherent tradeofff between security and utility. In this work, we introduce Progent, a novel framework that secures AI agents via privilege control. Progent represents privilege as a security policy consisting of symbolic rules over tool names and arguments. These rules specify which tool calls are allowed for task completion and which unnecessary ones are blocked for security. Every tool call is checked against such a policy through a deterministic procedure, enforcing the principle of least privilege. To handle diverse user tasks and evolving execution contexts, an LLM automatically generates the initial policy from the user's task and updates it during execution as new information arrives. Each proposed update is determined by an SMT solver to be either a narrowing (applied automatically) or an expansion (requiring explicit approval), ensuring that the agent's effective action space can only shrink without approval (monotonic confinement). This deterministic update mechanism preserves utility and prevents silent privilege escalation, even when adversarial inputs are present. Our evaluation on popular benchmarks (i.e., AgentDojo and ASB) shows that Progent significantly reduces attack success rates while maintaining high utility. We further validate Progent's practicality by showcasing its effectiveness in real-world agent frameworks such as LangChain and OpenAI Agents SDK.

Obsidian Notes

• 内容由 opencli arxiv paper 拉取 arXiv 元数据与摘要生成。
• 中文导读与价值判断均锚定在条目已有摘要、论文摘要、作者、日期与分类信息上；未补充论文摘要之外的实验细节。