Caging the Agents: A Zero Trust Security Architecture for Autonomous AI in Healthcare

ID: 4e2adb57
原文链接: https://arxiv.org/abs/2603.17419
PDF: https://arxiv.org/pdf/2603.17419v1
作者: Saikat Maiti
日期: 2026-03-18
更新: 2026-03-18
分类: agents
标签: zero-trust, healthcare-ai, agent-security, prompt-injection, production-agents
质量评分: 4/5
抓取时间: 2026-07-26T12:28:08+08:00

一句话

生产级 Agent 安全不能只靠提示词，需要覆盖凭证执行网络数据库和配置漂移的零信任架构

中文导读

这篇论文把自主 Agent 放在医疗生产环境中讨论：当 Agent 拥有 shell文件系统数据库查询和多方通信能力时，未授权服从敏感信息泄露身份伪造跨 Agent 传播和间接提示注入都会变成 PHI/HIPAA 风险其六域威胁模型适合用作生产 Agent 安全评审清单

关键要点

把 Agent / 工具调用系统的攻击面从“模型回答是否安全”推进到规划、权限、数据流与执行边界。
论文备注：Keywords: agentic AI security, autonomous agents, healthcare cybersecurity, zero trust, prompt injection, HIPAA, Kubernetes security, OpenClaw
arXiv 分类：cs.CR, cs.AI，适合放入 AAIF 的 agents 频道继续追踪。
内容页由 arXiv 元数据与摘要回填，后续若需要精读可再补充实验细节、威胁模型图和 benchmark 表格。

English Summary

The paper studies autonomous LLM agents in production settings with shell execution, file-system access, database queries, and multi-party communication. In healthcare environments processing protected health information, vulnerabilities such as unauthorized compliance, sensitive disclosure, identity spoofing, unsafe cross-agent propagation, and indirect prompt injection become compliance risks. It presents a six-domain threat model covering credentials, execution abuse, network egress, prompt integrity, database access, and fleet configuration drift, plus a layered zero-trust defense architecture.

Abstract

Autonomous AI agents powered by large language models are being deployed in production with capabilities including shell execution, file system access, database queries, and multi-party communication. Recent red teaming research demonstrates that these agents exhibit critical vulnerabilities in realistic settings: unauthorized compliance with non-owner instructions, sensitive information disclosure, identity spoofing, cross-agent propagation of unsafe practices, and indirect prompt injection through external resources [7]. In healthcare environments processing Protected Health Information, every such vulnerability becomes a potential HIPAA violation. This paper presents a security architecture deployed for nine autonomous AI agents in production at a healthcare technology company. We develop a six-domain threat model for agentic AI in healthcare covering credential exposure, execution capability abuse, network egress exfiltration, prompt integrity failures, database access risks, and fleet configuration drift. We implement four-layer defense in depth: (1) kernel level workload isolation using gVisor on Kubernetes, (2) credential proxy sidecars preventing agent containers from accessing raw secrets, (3) network egress policies restricting each agent to allowlisted destinations, and (4) a prompt integrity framework with structured metadata envelopes and untrusted content labeling. We report results from 90 days of deployment including four HIGH severity findings discovered and remediated by an automated security audit agent, progressive fleet hardening across three VM image generations, and defense coverage mapped to all eleven attack patterns from recent literature. All configurations, audit tooling, and the prompt integrity framework are released as open source.

Source Metadata

arXiv ID: 2603.17419
Primary category: cs.CR
Categories: cs.CR, cs.AI
Comment: Keywords: agentic AI security, autonomous agents, healthcare cybersecurity, zero trust, prompt injection, HIPAA, Kubernetes security, OpenClaw

_Content backfilled by AAIF content-fetcher from OpenCLI arXiv metadata._