{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/boundary-auditing-staged-agent-injection-2026/",
 "asOf": "2026-10-30",
 "id": "boundary-auditing-staged-agent-injection-2026",
 "date": "2026-10-04",
 "datePrecision": "day",
 "title": "Boundary auditing tests interventions before staged agent injections take effect",
 "lane": "defense",
 "kind": "paper",
 "summary": "Researchers construct matched benign and attacked Claude Code and Codex executions to study injections that advance through a workflow before causing a consequential action. In the common-tool-call comparison with Claude Sonnet 5 as auditor backend, their Path-Aligned Attribution auditor reports higher recall and lower false-block rates than VIGIL and ARGUS; with GPT-5.5, results involve a recall–false-block tradeoff. The retained successful attacks and offline action-level evaluation demonstrate feasibility and auditing performance in controlled tasks, not deployment prevalence or live prevention rates.",
 "whyItMatters": "It measures a defense at the point where an action can still be stopped, while distinguishing benign task continuation from unauthorized effects.",
 "actors": [
  "beijing-jiaotong-university",
  "mbzuai",
  "inria",
  "xian-jiaotong-university"
 ],
 "topics": [
  "prompt-injection",
  "monitoring-and-control",
  "access-controls",
  "eval-validity"
 ],
 "atlas": [
  "untrusted-content",
  "tools",
  "monitor"
 ],
 "artifacts": [
  "claude-sonnet",
  "gpt-5-family"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2610.05163v1",
   "publisher": "arXiv",
   "title": "Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection",
   "date": "2026-10-04",
   "type": "primary",
   "accessed": "2026-10-13"
  }
 ],
 "keyFacts": [
  {
   "fact": "The benchmark contains 479 matched attack–benign trajectory pairs and 3,112 pending-action units across eight workflow scenarios, seven attack goals and six injection surfaces. Retention selects confirmed successful staged attacks, not a uniform sample of attempted attacks.",
   "locator": "Abstract; Introduction"
  },
  {
   "fact": "With Claude Sonnet 5 and full-benchmark fail-open scoring, the proposed auditor reports 86% BLOCK recall and a 6–8% false-block rate, versus ARGUS at 44–47% recall and 16–33% false-block rate. These classify action units; they are not the fraction of whole attacks prevented in deployment. Unsupported action boundaries and auditor failures count as PASS under this fail-open comparison. In the common-tool-call view with the same backend, the authors report higher recall and lower false-block rates than both VIGIL and ARGUS on each corpus.",
   "locator": "Abstract; Introduction; Evaluation"
  },
  {
   "fact": "Attack schemes are fixed before the target execution and do not adapt during it. Native agent runtimes operate in isolated workspaces with controlled scenario tools; the study does not target real customer accounts or production services.",
   "locator": "Introduction; Ethical Considerations"
  },
  {
   "fact": "The authors describe boundary auditing as complementary to isolation and permission enforcement. Successful retained cases do not establish prevalence, repeated success of a fixed scheme, unseen-task performance or a security ranking of the two agent products.",
   "locator": "Discussion and Limitations"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-074",
  "FID-075"
 ],
 "methods": [
  "indirect-prompt-injection",
  "ai-monitoring",
  "provenance-controls"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-13",
 "revisions": []
}