LLM Agent Capabilities Should Follow Task Intent and Context Source

• URL: http://arxiv.org/abs/2609.14631v1
• Date: Sun, 13 Sep 2026 16:04:31 GMT
• Title: LLM Agent Capabilities Should Follow Task Intent and Context Source
• Abstract summary: Unlike traditional systems, where capability is predefined, the least-privilege capability an agent needs is dynamic.<n>This creates a security and safety challenge: all inputs enter one shared planning channel with equal influence, yet a user's explicit request and a document's extracted text carry different trust and should not share authority to choose a destination or widen access.<n>IntentCap composes capabilities from four such sources: user intent, workflow instructions, tool schemas, and runtime environment, with field-level ownership and monotonic narrowing.
• Score: 3.0990248963651355
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: LLM agents take real actions, including executing code, modifying files, calling services, and delegating tasks, driven by context sources: user requests, tool results, documents, shell outputs, Skill and MCP instructions, memory. Unlike traditional systems, where capability is predefined, the least-privilege capability an agent needs is dynamic, depending on its task intent: what it wants to do and how. This creates a security and safety challenge: all inputs enter one shared planning channel with equal influence, by adversarial injection or accidental scope widening, yet a user's explicit request and a document's extracted text carry different trust and should not share authority to choose a destination or widen access. Existing defenses constrain operations and information flow; we study task-scoped, multi-source authority composition. We argue that agent capabilities should be scoped to the current task intent, not a sandbox or session lifetime, and that no single context source defines a complete capability. IntentCap composes capabilities from four such sources: user intent, workflow instructions, tool schemas, and runtime environment, with field-level ownership and monotonic narrowing. Each source contributes specific fields, none can fill another's, and the lease only narrows the user's authorized authority, never widens it. IntentCap uses an LLM to generate short-lived leases from these sources, validated by a deterministic checker before any side effect commits and enforced by tool- and OS-level information flow policies. Evaluation shows IntentCap blocks tested violations without rejecting benign actions, each source boundary is independently necessary, and the checker generalizes across tool, execution, placement, and delegation boundaries.

Related papers

• Authority Is Not a String: A Capability-Scoped Harness for Prompt-Injection-Resistant Coding Agents [1.8587887164315786]
  Coding agents use system-level tools to read files, execute commands, and modify source code.<n>Indirect prompt injection exploits this authority by placing instructions in repository files or tool output that cause the agent to perform actions the user did not request.<n>We propose CapScope, a harness-level authorization mechanism that restricts tool use without requiring the model to identify malicious text.
  arXiv  Detail & Related papers  (2026-09-08T07:37:00Z)
• FRAMEWORKERS: A Dynamic Multi-Agent Framework for AI-Generated Video Production [55.71860113185132]
  We introduce FRAMEWORKERS, a task-centric and workspace-grounded multi-agent framework for open-ended video production.<n>A central Director formulates video creation as dynamic task management, continuously editing a Task Stack to determine which subtask to execute next and which sub-agent to invoke.<n>An Assistant serves as the execution layer, grounding each selected task in a shared Workspace, retrieving the required assets and context, invoking the assigned sub-agent, and persisting the resulting artifacts.<n>Experiments show that FRAMEWORKERS outperforms strong planners in routing accuracy, recovers reliably from runtime failures, generalizes to unseen sub
  arXiv  Detail & Related papers  (2026-08-30T14:28:50Z)
• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• Agent Security Needs Redefinition through a Holistic Framework [46.88917910966891]
  Defenses ask whether an instruction looks malicious. Benchmarks ask whether an agent performs a harmful sounding action.<n>We operationalize contextual security through four properties that must hold jointly and be evaluated continuously across the agent's trajectory.
  arXiv  Detail & Related papers  (2026-07-24T06:43:09Z)
• ToolGuardian: Declarative Security for AI Agent-Tool Interactions [0.0]
  Existing defenses rely on weak metadata, collapse characterization and policy judgment.<n>This paper presents ToolGuardian, a policy-driven framework for securing agent-tool interactions.
  arXiv  Detail & Related papers  (2026-07-23T21:53:34Z)
• Context-to-Execution Integrity for LLM Agents [0.0]
  Context-to-Execution Integrity ( CXI) is an execution-boundary system for this setting.<n>We evaluate CXI on open-weight field-projection runs, AgentDojo live episodes, a code-agent exact-effect benchmark, manifest-bound ledger faults, proposal-pressure controls, and hosted/API compatibility traces.
  arXiv  Detail & Related papers  (2026-07-07T08:38:50Z)
• AgenticOS: An Intent-Oriented Secure Operating System Architecture for Autonomous AI Agents [9.964434409587222]
  AgenticOS is an intent-oriented secure OS architecture.<n>AgenticOS consolidates delegable, auditable software capabilities into OS-native ones.
  arXiv  Detail & Related papers  (2026-06-19T06:14:37Z)
• Securing LLM Agents Need Intent-to-Execution Integrity [49.490963596514185]
  We argue that securing LLM agents requires defining an end-to-end correctness property that specifies when an agent's execution faithfully reflects the user's intent.<n>We observe that LLM agents are structurally analogous to compilers, where security violations correspond to mis-executions that do not preserve user intent.<n>We derive four integrity properties that must hold simultaneously: emphTool Integrity, emphInstruction Integrity, emphJudgment Integrity, and emphData Flow Integrity.
  arXiv  Detail & Related papers  (2026-05-16T12:53:31Z)
• Beyond Static Sandboxing: Learned Capability Governance for Autonomous AI Agents [6.8552591401084015]
  Aethelgard enforces least privilege for AI agents through a learned policy.<n>Aethelgard learns the minimum viable skill set for each task type.
  arXiv  Detail & Related papers  (2026-04-12T13:10:56Z)
• DeepAgent: A General Reasoning Agent with Scalable Toolsets [111.6384541877723]
  DeepAgent is an end-to-end deep reasoning agent that performs autonomous thinking, tool discovery, and action execution.<n>To address the challenges of long-horizon interactions, we introduce an autonomous memory folding mechanism that compresses past interactions into structured episodic, working, and tool memories.<n>We develop an end-to-end reinforcement learning strategy, namely ToolPO, that leverages LLM-simulated APIs and applies tool-call advantage attribution to assign fine-grained credit to the tool invocation tokens.
  arXiv  Detail & Related papers  (2025-10-24T16:24:01Z)
• Get my drift? Catching LLM Task Drift with Activation Deltas [55.75645403965326]
  Task drift allows attackers to exfiltrate data or influence the LLM's output for other users.<n>We show that a simple linear classifier can detect drift with near-perfect ROC AUC on an out-of-distribution test set.<n>We observe that this approach generalizes surprisingly well to unseen task domains, such as prompt injections, jailbreaks, and malicious instructions.
  arXiv  Detail & Related papers  (2024-06-02T16:53:21Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.