safety security
Scoped Authority Contained Every Tested Harmful Tool Call
Across 128 paired scenarios, broad credentials executed some attacked actions while three scoped conditions executed none.
Summary
Across 128 paired scenarios, broad credentials executed some attacked actions while three scoped conditions executed none.
The frozen-model replay separates compromise from consequence: broad-bearer harmful execution ranged from 8.9% to 37.8% across models, while scoped JWT, sender-constrained and policy-engine conditions recorded zero among valid attacked decisions. The paper claims containment for the tested cross-action and cross-resource cases, not prevention of prompt injection or universal safety.
Why it matters
Across 128 paired scenarios, broad credentials executed some attacked actions while three scoped conditions executed none.
Limits and context
- The paper claims containment for the tested cross-action and cross-resource cases, not prevention of prompt injection or universal safety.
Key claims
Across 128 paired scenarios, broad credentials executed some attacked actions while three scoped conditions executed none.
Qualification: The paper claims containment for the tested cross-action and cross-resource cases, not prevention of prompt injection or universal safety.
Evidence: source-2026-10-06-017
Sources
- arXiv preprint 2610.05840arXiv · primary research
Corrections
No corrections have been recorded for this story.