Abstract

Tool-using language agents now reach into file repositories, internal APIs, databases, source trees, and external messaging systems, often through the Model Context Protocol (MCP). The same connectivity that makes these agents useful also widens their attack surface: a single line of attacker-controlled text inside a retrieved document can redirect an agent toward exfiltrating a secret or executing a destructive action. This paper proposes AgentShield-G, a graph-based guardrail model that detects prompt injection and tool misuse by treating an agent session as a dynamic, typed interaction graph over users, prompts, retrieved context, plans, tool calls, and permission scopes. Rather than classifying prompt text in isolation, AgentShield-G scores each candidate tool call from structural signals—privilege-escalation path length, proximity to sensitive tools, the transition likelihood from prompt to tool, an anomalous context-injection score, and a count of repeated unsafe attempts—and gates calls whose composite risk exceeds a threshold. The graph is defined formally, an online scoring and gating algorithm is given, and a simulation harness of benign and adversarial workflows spanning file access, API calls, database queries, code modification, and external communication is described. Illustrative results from that harness are reported, including detection rate, false-positive rate, blocked-unsafe-action rate, an explainability measure, and per-update overhead, together with an ablation that isolates the contribution of the escalation-path and context-injection features. All reported numbers are simulated and are intended to characterize the design, not to certify a deployed system. The work is framed as defensive research: it models attack categories at the taxonomy level and proposes a protective layer that complements, rather than replaces, permission and sandbox controls.

References

• Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., and Fritz, M. 2023. Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. In Proc. 16th ACM Workshop on Artificial Intelligence and Security (AISec), 79–90.
• Anthropic. 2024. Model Context Protocol Specification. Open specification. https://modelcontextprotocol.io/
• Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K., and Cao, Y. 2023. ReAct: Synergizing Reasoning and Acting in Language Models. In Proc. 11th Int. Conf. on Learning Representations (ICLR).
• Schick, T., Dwivedi-Yu, J., Dessì, R., Raileanu, R., Lomeli, M., Hambro, E., Zettlemoyer, L., Cancedda, N., and Scialom, T. 2023. Toolformer: Language Models Can Teach Themselves to Use Tools. In Advances in Neural Information Processing Systems (NeurIPS), vol. 36.
• OWASP Foundation. 2023. OWASP Top 10 for Large Language Model Applications, Version 1.1. https://owasp.org/www-project-top-10-for-large-language-model-applications/
• National Institute of Standards and Technology. 2023. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. https://doi.org/10.6028/NIST.AI.100-1
• MITRE Corporation. 2023. MITRE ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems. https://atlas.mitre.org/
• Akoglu, L., Tong, H., and Koutra, D. 2015. Graph Based Anomaly Detection and Description: A Survey. Data Mining and Knowledge Discovery 29, 3, 626–688.
• Ma, X., Wu, J., Xue, S., Yang, J., Zhou, C., Sheng, Q. Z., Xiong, H., and Akoglu, L. 2023. A Comprehensive Survey on Graph Anomaly Detection with Deep Learning. IEEE Transactions on Knowledge and Data Engineering 35, 12, 12012–12038.
• Denning, D. E. 1987. An Intrusion-Detection Model. IEEE Transactions on Software Engineering SE-13, 2, 222–232.
• Perez, F., and Ribeiro, I. 2022. Ignore Previous Prompt: Attack Techniques for Language Models. NeurIPS 2022 ML Safety Workshop. arXiv:2211.09527.
• Willison, S. 2023. Prompt Injection and the Question of Trust Boundaries in LLM Applications. USENIX Security Symposium Invited Talks.
• Saltzer, J. H., and Schroeder, M. D. 1975. The Protection of Information in Computer Systems. Proceedings of the IEEE 63, 9, 1278–1308.
• Hardt, D. 2012. The OAuth 2.0 Authorization Framework. RFC 6749, Internet Engineering Task Force.
• Kang, D., Li, X., Stoica, I., Guestrin, C., Zaharia, M., and Hashimoto, T. 2024. Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks. In IEEE Security and Privacy Workshops (SPW).
• Divi, V. R. 2026. Multi-Agent Debate for Software Architecture Governance: A Framework for ADR Generation, Risk Review, and Deployment Readiness. International Journal of Engineering Development and Research (IJEDR) 14, 2, 862–. DOI: 10.56975/ijedr.v14i2.308420.