FORTIS: Benchmarking Over-Privilege in Agent Skills

• URL: http://arxiv.org/abs/2605.09163v2
• Date: Wed, 13 May 2026 06:09:23 GMT
• Title: FORTIS: Benchmarking Over-Privilege in Agent Skills
• Abstract summary: We present a benchmark that evaluates over-privilege in agent skills across two stages.<n>We find that over-privileged behavior is the norm rather than the exception.<n>The results indicate that the skill layer, far from containing agent behavior, is itself a primary source of privilege escalation in current systems.
• Score: 68.34663362794069
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large language model agents increasingly operate through an intermediate skill layer that mediates between user intent and concrete task execution. This layer is widely treated as an organizational abstraction, but we argue it is also a privilege boundary that current models routinely exceed. We present \textbf{FORTIS}, a benchmark that evaluates over-privilege in agent skills across two stages: whether a model selects the minimally sufficient skill from a large overlapping library, and whether it executes that skill without expanding into broader tools or actions than the skill permits. Across ten frontier models and three domains, we find that over-privileged behavior is the norm rather than the exception. Models consistently reach for higher-privilege skills and tools than the task requires, failing at both stages at rates that remain high even for the strongest available models. Failure is especially severe under the ordinary conditions of real user interaction: incomplete specification, convenience framing, and proximity to skill boundaries. None of these requires adversarial construction. The results indicate that the skill layer, far from containing agent behavior, is itself a primary source of privilege escalation in current systems.

Related papers

• Running the Gauntlet: Re-evaluating the Capabilities of Agents Beyond Familiar Environments [67.2234316079859]
  GauntletBench is a web-based benchmark for evaluating agent generalisation in challenging scenarios.<n>It focuses on three underexplored capabilities (temporal perception, graphical understanding, and 3D reasoning) across five less-covered professional applications.<n>Our empirical results reveal that frontier agentic systems remain far from achieving human-level performance.
  arXiv  Detail & Related papers  (2026-06-12T12:32:24Z)
• Skill is Not One-Size-Fits-All: Model-Aware Skill Alignment for LLM Agents [9.144810798419975]
  LLM agents increasingly retrieve externally curated skills-procedural instructions retrieved at decision time to improve performance on long-horizon interactive tasks.<n>We propose MASA Model-Aware Skill Alignment, a framework that adapts skills to each target backbone without modifying agent weights.<n> MASA consistently achieves the best overall performance, with gains of up to 25.8 points over the strongest baseline.
  arXiv  Detail & Related papers  (2026-05-29T01:34:42Z)
• SkillScope: Toward Fine-Grained Least-Privilege Enforcement for Agent Skills [39.85716310474543]
  We present SkillScope, a framework for fine-grained least-privilege enforcement in Agent Skills.<n> SkillScope extracts potential over-privilege candidates, validates them under graph-instantiated user tasks, and constrains validated over-privileged actions.<n>We evaluate SkillScope through effectiveness experiments and large-scale real-world measurement.
  arXiv  Detail & Related papers  (2026-05-07T08:34:14Z)
• DRIVE: Modeling Skills at the Reasoning and Interaction Levels for Web Agents under Continual Learning [17.92660876001036]
  Web agents require both high-level reasoning and low-level interactions to conduct different tasks.<n>We propose DRIVE, a dual-level skill modeling framework separating historical experience into natural language reasoning skills.<n>Experiments show DRIVE attains an average task success rate of 52.8%, exceeding the skill-free baseline by 7.3 percentage points.
  arXiv  Detail & Related papers  (2026-04-28T11:39:20Z)
• Breaking User-Centric Agency: A Tri-Party Framework for Agent-Based Recommendation [59.362016745945375]
  We propose the first Tri-party LLM-agent Recommendation framework (TriRec)<n>TriRec explicitly coordinates user utility, item exposure, and platform-level fairness.<n>We show consistent gains in accuracy, fairness, and item-level utility.
  arXiv  Detail & Related papers  (2026-03-11T11:40:13Z)
• SoK: Agentic Skills -- Beyond Tool Use in LLM Agents [6.356997609995175]
  Agentic systems increasingly rely on reusable procedural capabilities, textita.k.a., agentic skills, to execute long-horizon reliably.<n>This paper maps the skill layer across the full lifecycle (discovery, practice, distillation, storage, composition, evaluation, and update)<n>We analyze the security and governance implications of skill-based agents, covering supply-chain risks, prompt injection via skill payloads, and trust-tiered execution.
  arXiv  Detail & Related papers  (2026-02-24T13:11:38Z)
• Agent Skill Framework: Perspectives on the Potential of Small Language Models in Industrial Environments [14.079091139464175]
  This work introduces a formal mathematical definition of the Agent Skill process, followed by a systematic evaluation of language models of varying sizes.<n>Results show that tiny models struggle with reliable skill selection, while moderately sized SLMs (approximately 12B - 30B) benefit substantially from the Agent Skill approach.
  arXiv  Detail & Related papers  (2026-02-18T17:52:17Z)
• The Why Behind the Action: Unveiling Internal Drivers via Agentic Attribution [63.61358761489141]
  Large Language Model (LLM)-based agents are widely used in real-world applications such as customer service, web navigation, and software engineering.<n>We propose a novel framework for textbfgeneral agentic attribution, designed to identify the internal factors driving agent actions regardless of the task outcome.<n>We validate our framework across a diverse suite of agentic scenarios, including standard tool use and subtle reliability risks like memory-induced bias.
  arXiv  Detail & Related papers  (2026-01-21T15:22:21Z)
• Youtu-LLM: Unlocking the Native Agentic Potential for Lightweight Large Language Models [78.73992315826035]
  We introduce Youtu-LLM, a lightweight language model that harmonizes high computational efficiency with native agentic intelligence.<n>Youtu-LLM is pre-trained from scratch to systematically cultivate reasoning and planning capabilities.
  arXiv  Detail & Related papers  (2025-12-31T04:25:11Z)
• UltraHorizon: Benchmarking Agent Capabilities in Ultra Long-Horizon Scenarios [63.67884284105684]
  We introduce textbfUltraHorizon, a novel benchmark that measures the foundational capabilities essential for complex real-world challenges.<n>Agents are designed in long-horizon discovery tasks where they must iteratively uncover hidden rules.<n>Our experiments reveal that LLM-agents consistently underperform in these settings, whereas human participants achieve higher scores.
  arXiv  Detail & Related papers  (2025-09-26T02:04:00Z)
• SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints [59.645885492637845]
  SOPBench is an evaluation pipeline that transforms each service-specific SOP code program into a directed graph of executable functions.<n>Our approach transforms each service-specific SOP code program into a directed graph of executable functions and requires agents to call these functions based on natural language SOP descriptions.<n>We evaluate 18 leading models, and results show the task is challenging even for top-tier models.
  arXiv  Detail & Related papers  (2025-03-11T17:53:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.