What they found
The authors define privilege escalation for SI agents: an action may go ahead only if every principal (a user, tool or data source) that influenced it would allow it. They present Conflux, a defence that sits outside the model. Its core, called ITES, tracks where information came from and uses the organisation's existing access-control system. It keeps only the permissions that all influencing principals share. They prove that, under five stated conditions, the core admits no action that escalates privilege for any recorded influencing principal. The proof covers value influence only. Influence from choosing a tool, branch, recipient or plan step is left as future work. They also describe two testing tools, SLED (black-box, explores a declared finite model up to a bound) and SLED-V (white-box, checks an intermediate representation).
Why it matters
SI agents often mix instructions and data from several sources while acting in the real world. Defences that rely on the model's own judgement are only probabilistic, so a rule-based layer outside the model is a useful idea. The paper also offers ways to test whole systems, not only single models. The authors are clear that the evidence is bounded and partial and is not a guarantee for real deployments.
How it changes the race
If it holds up, it gives teams building agents a way to limit what agents can do using existing access controls, instead of trusting the model. It does not change what SI models can do. It is mainly relevant to deploying agents safely.
Safety and control
This is a security paper about stopping SI agents from being steered into actions that exceed someone's permissions. The theorem depends on conditions such as complete mediation and trustworthy provenance, and it does not cover control influence. The abstract says no result is an unbounded deployment guarantee.
The abstract, by the authors
LLM agents combine information from multiple principals while acting externally. We formalise privilege escalation (PE) as the system-level security objective: an action may proceed only if every principal that influenced it would allow it. Model-level defences remain probabilistic, so enforcement must sit outside model judgement. We present Conflux, a principal-context defence. Its kernel, ITES, derives authority from provenance and the organisation's existing access-control system and intersects the permissions of every influencing principal. We prove a conditional authority-confinement theorem: under complete mediation, no-laundering provenance, a known non-empty decision context, fresh permission checks, and action binding, the kernel admits no action that escalates privilege with respect to any recorded influencing principal. The theorem covers the represented value-influence fragment; control influence from tool, branch, recipient, or plan-step selection remains a refinement obligation. Conflux extends the kernel with independent policy ports, argument-aware authorisation, disclosure, consent, delegation, restriction, and exposure planning. We describe two system- level evaluators. SLED is a black-box evaluator: it exhaustively explores a declared finite model of a defence up to a bound. SLED-V is a white-box evaluator: it checks a serialisable intermediate representation against security and provenance properties. The evidence is bounded and partial. The appendix reports retained AgentDojo, SLED, and SLED-V results, including the limits of those runs. No result in this paper is an unbounded deployment guarantee.
Quoted from arXiv:2611.08768. The research and its words belong to its authors.