Researchers argue agent security requires context over content checks

Researchers have published a framework arguing that current AI agent security evaluations are structurally flawed because they prioritize action content over authorization context. The paper, released on arXiv, contends that distinguishing legitimate administrative commands from prompt injection attacks requires evaluating source authorization, task alignment, action alignment, and data isolation jointly. Analysis of AgentDojo and WASP benchmarks demonstrates that identical actions function as either routine workflows or security violations depending entirely on user privileges and system state. The authors assert that snapshot-based testing cannot measure data isolation failures, rendering many existing defenses ineffective against indirect prompt injections. This reframing categorizes prompt injection fundamentally as an authorization violation rather than a content moderation problem. The proposed model requires continuous evaluation across agent trajectories instead of static input screening. Industry adoption would necessitate replacing keyword-based guardrails with dynamic permission systems integrated into agentic architectures.