The paper (arXiv 2608.27146) argues that injection risk in tool-augmented agents comes from conflating two runtime roles: inducing actions from observations and authorizing executions. SARA separates them. A context-isolated Action Probe exposes action-inducing semantics in tool outputs and persistently records action-origin provenance across steps, while actual tool calls are authorized only against the user objective and audited evidence from authorized successful executions, under goal, execution-chain and argument-level support constraints. No-History-Promotion prevents historical recurrence from laundering action origins into execution authority. Across AgentDojo and AgentDyn, attack success stays at or below 0.63% in four primary settings with competitive task utility, consistently across agent backbones.
SARA splits action induction from execution authorization in tool-using agents
The paper (arXiv 2608.27146) argues that injection risk in tool-augmented agents comes from conflating two runtime roles: inducing actions from observations and authorizing executions. SARA separates them. A context-isolated Action Probe exposes action-inducing semantics in tool outputs and persistently records action-origin provenance across steps, while actual tool calls are authorized only against the user objective and audited evidence from authorized successful executions, under goal, execution-chain and argument-level support constraints. No-History-Promotion prevents historical recurrence from laundering action origins into execution authority. Across AgentDojo and AgentDyn, attack success stays at or below 0.63% in four primary settings with competitive task utility, consistently across agent backbones.
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
For teams running MCP-heavy agents this is a directly borrowable architecture split: treat tool outputs as untrusted action suggestions, tie authorization to the user's goal plus previously authorized evidence, and never let an action's origin be promoted by repetition. The untrusted-observation problem is exactly what enterprise MCP gateways are being asked to solve today.
Public artifacts and validated results are different.
The recorded fact is the public work and its artifacts. Author-reported outcomes do not establish independent reproduction. Next checks include usable code, task conditions and third-party validation.
Evidence & related material
Technical details & scores
| Architecture | context-isolated Action Probe over Observations (exposes action-inducing semantics, records provenance); authorization against user objective + audited evidence with goal / execution-chain / argument-level support; No-History-Promotion across steps |
|---|---|
| Results | ASR <= 0.63% across 4 primary settings on AgentDojo + AgentDyn; task utility competitive; consistent across agent backbones |
| Relation | untrusted tool outputs as commands — same problem class as enterprise MCP gateway enforcement (trend #2) |
| Code | not stated on paper page |
| Arxiv | 2608.27146, submitted 2026-08-27 |