Who Grants the Agent Power? Defending Against Instruction Injection via Task-Centric Access Control

TL;DR

This paper introduces AgentSentry, a dynamic access control framework that enforces task-specific permissions to prevent instruction injection attacks in autonomous AI agents, enhancing security without hindering legitimate tasks.

Contribution

AgentSentry is the first lightweight runtime system that dynamically enforces task-centric permissions to defend against instruction injection in AI agents.

Findings

AgentSentry prevents instruction injection attacks effectively.

Dynamic, task-specific permissions improve security without impeding legitimate tasks.

The framework is lightweight and adaptable for real-world deployment.

Abstract

AI agents capable of GUI understanding and Model Context Protocol are increasingly deployed to automate mobile tasks. However, their reliance on over-privileged, static permissions creates a critical vulnerability: instruction injection. Malicious instructions, embedded in otherwise benign content like emails, can hijack the agent to perform unauthorized actions. We present AgentSentry, a lightweight runtime task-centric access control framework that enforces dynamic, task-scoped permissions. Instead of granting broad, persistent permissions, AgentSentry dynamically generates and enforces minimal, temporary policies aligned with the user's specific task (e.g., register for an app), revoking them upon completion. We demonstrate that AgentSentry successfully prevents an instruction injection attack, where an agent is tricked into forwarding private emails, while allowing the legitimate task to complete. Our approach highlights the urgent need for intent-aligned security models to safely govern the next generation of autonomous agents.