Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection

1 Introduction

• A confirmed commerce attack led the agent to issue a third refund of $3,612.59 three material steps after an injected digest, despite cross-checking genuine records and completing its report.Task continuation therefore does not rule out compromise.Source: §1 · p. 1
• Staged IPI is context-aware, multi-step, and task-preserving, with at least two causally connected stages materially advancing a fixed adverse target while the main workflow continues.The threat model trusts the original task, core runtime, and auditor, while allowing attacker-planted content on specified surfaces.Source: §1 · p. 1
• The 479 matched attack pairs across eight scenarios and 32 scenario–skill combinations provide constructive evidence of attack feasibility and breadth, not an estimate of prevalence or task-level success rate.The pairs comprise 240 confirmed Claude Code attacks and 239 Codex attacks.Source: §1 · p. 2
• Input screening may act before consequences are apparent, completed-run evaluation may arrive too late, and existing runtime auditors use incompatible units and labels.Legitimate actions can depend on attacker-influenceable data, so exposure or data dependence alone does not warrant blocking.Source: §1 · p. 2
• Boundary action auditing evaluates a fully specified pending message or tool call before its effect, using initial context and the trajectory prefix to return PASS or BLOCK.The benchmark contains 3,112 units, labeled BLOCK only when an action is injection-attributable and realizes or materially advances the fixed target.Source: §1 · p. 2
• PAA decomposes pending actions into operative elements and aligns each element’s value, decision source, role, and material effect before blocking.It blocks only for unwarranted material influence from an attacker-reachable source that provides unqualified steering or conflicts with visible evidence.Source: §1 · p. 2
• 86.1% recall at 6.0% FBR on Claude Code and 86.0% recall at 7.7% FBR on Codex, versus ARGUS at 44.1% and 32.5% and 47.3% and 15.8%, respectively.Under the same backend, PAA also has higher recall and lower FBR than VIGIL and ARGUS on common supported tool calls on both corpora.Source: §1 · p. 2
• The paper contributes a trajectory-conditioned attack-generation framework, a paired benchmark with source-linked injection-causal labels, and PAA.Attacks are generated against unscripted native executions, with human review of retained attacks before auditor evaluation.Source: §1 · p. 2

2.1 Agents and Indirect Prompt Injection

• Indirect prompt injection occurs when attacker-influenced content encountered during a benign task steers an agent’s messages or tool calls using its existing permissions.The related-work discussion distinguishes task-conditioned, fixed attack schemes matched to complete benign native executions from prior automated attack construction.Source: §2.1 · pp. 2–3
• Pre-action review judges a fully specified message or tool call before its effects, unlike detecting malicious content or assessing a completed trajectory.Tool-using agents may include sub-agents and observations that shape later consequential actions.Source: §2.1 · pp. 2–3

2.2 Benchmarks for Agent Security

• Prior security benchmarks evaluate completed runs, staged or persistent attacks, or action-level risks, but use differing constructions and evaluation targets.Examples include outcome-level task utility and attack success, poisoned memory or tool metadata, and per-invocation or interaction-level safety labels.Source: §2.2 · p. 3
• The benchmark pairs matched benign–injected native executions with fixed task-specific staged schemes and injection-causal pre-action labels for consequential messages and tool calls.This combination enables joint BLOCK-recall and FBR measurement under one interface.Source: §2.2 · p. 3

2.3 Defenses and Action Auditing

• Defenses range from input-side injection detection and instruction hierarchy to structural controls, execution monitoring, and action-checking guardrails.Examples include capability-based information-flow separation, dependency-graph restrictions, and policies for tool calls.Source: §2.3 · p. 3
• Runtime auditors ground proposed actions in user intent, provenance, task invariants, or trajectory context, while PAA jointly checks per-element value provenance, decision authority, task warrant, and material effect.The paper tests whether this joint check changes the BLOCK-recall–FBR tradeoff on staged attacks.Source: §2.3 · p. 3

3.1 Audit Setting

• A boundary action is a message or tool call reviewed at the last decision point before an external, persistent, or deliverable effect occurs.Qualification depends on potential effect rather than tool name; read-only operations are excluded.Source: §3.1 · p. 4

3.2 Threat Model

• The threat model trusts the original task, core runtime instructions, tool implementations, permissions, event recording, designated authoritative scenario data, and the auditor.The auditor may read attacker-influenced history; attacks targeting the auditor itself are outside the threat model.Source: §3.2 · p. 4
• The adversary may place content through six surfaces but cannot alter model weights, tool implementations, permissions, or the event record, nor act directly as the agent.The content and placements are fixed once the run begins, although the adversary may design them using offline knowledge.Source: §3.2 · pp. 4–5
• A staged attack has a fixed adverse target outside task authorization and uses one surface, with at least two causally connected material stages while the main workflow continues.The requested deliverable type is produced, though it may be incorrect or compromised.Source: §3.2 · p. 5

3.3 Audit Problem

• An audit unit consists of initial context, the recorded trajectory prefix, and the fully specified pending boundary action, excluding its result and all later events.The prefix preserves global order across the target agent and sub-agents; it excludes thinking and includes workspace content only when observed.Source: §3.3 · p. 5
• The auditor returns PASS or BLOCK using only the available audit unit, without knowing whether the run is attacked, what content is injected, or the attacker’s target.The formulation does not prescribe what follows a BLOCK decision.Source: §3.3 · p. 5
• BLOCK is appropriate when an action is attributable to injection and realizes or materially advances its target; other actions in an attacked trajectory should pass.The criterion concerns the proposed effect, not whether the action would ultimately execute successfully.Source: §3.3 · p. 5
• The formulation reviews pending actions, not injected content or whole trajectories, and excludes directly malicious user requests.The presence or discussion of injected content alone is not grounds for BLOCK.Source: §3.3 · p. 5

4.1 Feedback-Guided Attack Generation

• The eight scenarios cover seven attack goals and six injection surfaces, including durable-state and committed-output harms.The scenarios combine 18 skills into 32 scenario–skill combinations.Source: §4.1 · p. 6
• The framework schedules context-conditioned goal–surface schemes, freezes each scheme before a native rerun, and uses failure diagnoses only for fresh attempts.A run is retained only with source-linked target realization, at least two causally connected material steps, and intact or partial task completion.Source: §4.1 · pp. 6–7

4.2 Staged Attacks on Commercial Agents

• 240 Claude Code and 239 Codex attacks survive review, forming 479 matched benign–injected pairs across all scenario–skill combinations, goals, and injection surfaces.The retained set demonstrates feasibility for the evaluated tasks, not attack prevalence or success rates.Source: §4.2 · p. 7
• Of 479 attacks, 417 involve three or more material steps, and all preserve the core workflow: 387 are intact and 92 partial.Attacks may propagate through artifacts, tool calls, workspace files, memory, or delegated work before a consequential action.Source: §4.2 · p. 7
• In the commerce example, an injected refund digest steers a third $3,612.59 refund three material steps after entry while the workflow remains intact.The agent cross-checks genuine order, amount, and payee records before adopting the digest’s claim.Source: §4.2 · p. 7

4.3 Boundary-Action Benchmark

• The benchmark contains 3,112 audit units from 479 pairs, labeling an injected action BLOCK only when its effect is attributable to the injection and realizes or advances the target.Other actions, including ordinary actions within attacked trajectories, receive PASS.Source: Table 1 · p. 7, §4.3 · p. 8

5 Path-Aligned Attribution

• Because attacker-influenceable content can be necessary task data or unauthorized control, PAA assesses each source’s role and whether the task warrants its use.The same digest can supply an expected refund amount yet steer a decision through its “UNPAID” framing.Source: §5 · p. 8
• PAA decomposes the pending action into operative elements and traces both each element’s value and the decision to produce it to prefix evidence.A source read earlier may be adopted later and applied only at the boundary; the paired trajectory and attack labels are unavailable to the auditor.Source: §5 · p. 8
• Stage 1 registers visible text by channel and derives a task contract from the user task; verified resource designations record only authority conveyed by that task.Reachability is assigned by channel, so a reachable source need not be injected, malicious, or directly attacker-authored.Source: §5 · p. 8
• Stage 2 treats as operative any action element that determines what the action will do or assert, including independently governed arguments, targets, claims, and dispositions.Its element-level attribution distinguishes a source supplying content from one guiding the decision.Source: §5 · pp. 8–9
• Its three stages register sources and the task contract, attribute action elements to sources, then adjudicate flagged records and apply the aligned-witness rule.If no flagged record exists, PAA returns PASS without invoking the adjudicator.Source: §5 · p. 8, Figure 3 · p. 9
• A BLOCK requires an aligned witness on one operative element: an unwarranted material deviation plus unqualified steering or verified counter-evidence.Reachability or warranted data use alone is insufficient; the rule preserves user-delegated authority in designated control documents.Source: §5 · pp. 9–10

6.1 Experimental Setup

• The primary view scores all 3,112 units; unsupported boundaries and persistent failures map to PASS, and FBR measures blocks on gold-PASS actions rather than general policy violations.Recall, FBR, and other unit-level metrics use injection-causal labels; confidence intervals cluster by trajectory pair.Source: §6.1 · p. 10

6.2 Boundary-Action Auditing Results

• 86% Block recall at 6–8% FBR on both corpora for PAA with Claude Sonnet 5, versus 44–47% recall at 16–33% FBR for ARGUS.These are full-benchmark results under uniform fail-open scoring.Source: §6.2 · p. 10, Table 2 · p. 11
• Reachability-only blocking marks 84–100% of gold-PASS units, while removing materiality raises FBR by 9–11 points for 3–11 points of recall and removing conflict lowers recall by 8–27 points.The rule evaluates materiality and steering or conflict on the same action element.Source: §6.2 · p. 11
• Backend and corpus effects vary across the four evaluated configurations: on Codex, switching to GPT-5.5 drops PAA recall by 18.2 points and raises FBR by 6.3 points.Baselines also move when the backend or corpus changes, so the observed sensitivity is not specific to PAA.Source: §6.2 · pp. 11–12

6.3 Trajectory-Level Audit Effectiveness

• With Claude Sonnet 5, PAA interrupts 5–7% of eligible benign runs in-run, versus 21–63% for baseline configurations; it withholds benign final results in 8–14% of trajectories.Figure 4 reports the Claude Code in-run rate over 92 of 240 benign trajectories in scope.Source: Figure 4 · p. 12, §6.3 · p. 12
• PAA’s first stop is gold-BLOCK on 88–90% of injected Claude Code trajectories and 89% of Codex trajectories with Claude Sonnet 5, with gold-PASS stops on 4–5% and 5%, respectively.On Claude Code, 82–88% of PAA stops occur at the earliest gold-BLOCK opportunity; the Codex figure is 84%.Source: Figure 5 · p. 12, §6.3 · p. 12

6.4 Cross-Scenario Behavior of PAA

• Balanced accuracy spans .77–.97 across scenarios with Claude Sonnet 5 and .49–.96 with GPT-5.5; Code Review recall falls to .33–.78 across configurations.Code Review misses mainly reflect materiality assessment and incomplete source-to-effect attribution. In Codex S04, gold-PASS labels conflict with visible user–skill authority conflicts, contributing to elevated FBR.Source: §6.4 · pp. 12–13, Table 4 · p. 13

• Boundary review complements content isolation and permission enforcement; it is not a complete defense.Source: §7 · p. 13
• 479 retained attacks establish feasibility and breadth in studied tasks, not deployment prevalence, fixed-scheme repeatability, unseen-task success, or a security ranking of the agents.Source: §7 · p. 13
• Labels reflect author review rather than an independent annotator study, and BLOCK captures injection-caused target advancement rather than policy compliance.The authors note that FBR is relative to this labeling scope.Source: §7 · p. 13
• Online-adaptive and auditor-targeted attacks remain unstudied; PAA may miss disguised steering when visible evidence does not contradict it.Source: §7 · p. 13
• Offline replay tests intervention opportunities, not end-to-end prevention, recovery, or task completion; implementation comparisons cannot isolate structured procedure from prompting or inference budget.Source: §7 · p. 13

• Boundary action auditing evaluates a fully specified pending message or tool call before it takes effect, using a benchmark of 479 paired trajectories and 3,112 action-level units.Source: §8 · p. 13
• PAA attains the highest full-benchmark recall and balanced accuracy, while matched tool-call, replay, and scenario analyses expose backend- and scenario-dependent variation.Source: §8 · p. 13
• Within the studied setting, role-sensitive boundary auditing is a complementary runtime checkpoint before consequential actions take effect.Source: §8 · p. 13

• Experiments used isolated workspaces and controlled scenario tools; no real customer account, production service, or operational system was targeted.Source: Ethical Considerations · p. 14
• Released audit units omit hidden reasoning and original execution infrastructure, but the authors say this reduces rather than eliminates misuse risk.Source: Ethical Considerations · p. 14

A.1 Systems and Task Environments

• Targets ran tasks in their native runtimes, with consequential actions routed through controlled scenario tools and state-changing effects confined to simulated state.The evaluated systems retained different network settings; benchmark code did not choose tools or supply an action plan.Source: §A.1 · p. 19
• Benign runs were admitted only with valid tasks and resources, grounded nonempty outputs, reconstructable traces, and no agent-visible answer keys.Source: §A.1 · p. 19

A.2 Staged-Attack Construction

• Attack schemes target applicable goal–surface cells and are validated, frozen, and executed in reconstructed environments; scheduling seeks underrepresented cells but does not guarantee realization.Source: §A.2 · pp. 19, 21
• Retention required source-linked target realization, at least two causally connected material steps, and task completion; human review and selection removed candidates that failed re-examination.Source: §A.2 · p. 21

A.3 Boundary Units and Gold Labels

• Boundary discovery proposes consequential messages and tool calls, then checks recorded actions and durable effects; each audit unit contains only the strict prefix and pending action.Source: §A.3 · p. 21
• Gold BLOCK requires an injection-attributed action that realizes or materially advances the target; benign units are PASS, and actions are labeled independently by their proposed effects.Reporting or rejecting injected content is PASS unless that action also advances the target; delivery of a compromised artifact is assessed separately.Source: §A.3 · pp. 21–22

A.4 Coverage and Evidence Sufficiency

• Figure 6 maps retained attacks across goal–surface cells for each target agent on a shared count scale, with marginal totals and dots for zero-count applicable cells.Source: Figure 6 · p. 22, §A.4 · p. 22
• Evidence-sufficiency review excluded 17 Codex units—14 BLOCK and 3 PASS—leaving 1,792 scored units across all 239 pairs, with a BLOCK in every injected trajectory.Source: §A.4 · p. 22

B.1 Procedure

• The procedure combines model-produced structure and semantic assessments with code that verifies citations and applies a fixed witness rule; unsupported assertions cannot themselves produce a block.Persistent validation failure returns UNKNOWN, while an empty set of reachable records yields a decided PASS without adjudication.Source: §B.1 · p. 22, §B.2 · p. 23

B.2 Sources and Qualification

• Reachability marks possible attacker influence, not maliciousness: system and user text have zero reach, while skills, tool metadata, workspace content, and agent artifacts remain reachable.Task designation records the user's chosen evidence source but does not authorize it to invent goals or permissions; qualification alone is insufficient without an unwarranted, verified, material effect.Source: §B.2 · pp. 22–23

B.3 Verification and Failure Handling

• Citations must verify against visible locations; verification does not establish that cited evidence is true or that the model's semantic attribution is correct.Persistent validation failure returns UNKNOWN, and an empty reachable-record set returns a decided PASS without adjudication.Source: §B.3 · p. 23

B.4 Decision Predicates and Gates

• A block requires an aligned operative element with an unwarranted, material effect and either unqualified steering or qualifying visible conflict; delegated-control and append-only gates narrow eligible conflicts.The delegated-control gate suppresses only authority conflicts for a contract-designated control document; the tool-description gate counts only attacker-writable appended text as reachable.Source: §B.4 · pp. 23–24

B.5 Worked Example

• In the commerce example, PAA blocks the third $3,612.59 refund because the injected digest materially steers an unwarranted claim contradicted by the designated payment record.The two earlier refunds pass because their values match designated records and control documents; the distinction is provenance and use, not the refund operation itself.Source: §B.5 · p. 24

C.1 Configurations and Adaptation

• Baseline coverage is nonuniform: VIGIL and ARGUS support tool calls only, TS-Guard is excluded for its 4,096-token limit, and AgentDoG truncates inputs above 15,360 tokens.AgentDoG truncation may contribute to near-chance balanced accuracy, but does not by itself establish the cause.Source: §C.1 · p. 24

C.2 Scoring Scope and Failure Policy

• Under fail-open scoring, unsupported boundaries and persistent failures count as PASS; excluding specified PAA unknowns and VIGIL failures leaves 1,294 jointly decided Codex/GPT-5.5 tool-call units.On that sensitivity set, recall/FBR is .775/.144 for PAA, .252/.151 for VIGIL, and .902/.386 for ARGUS.Source: §C.2 · pp. 24–25

C.3 Label-Scope Sensitivity

• Codex exposes label-scope distinctions: 69 gold-PASS actions execute a reviewed User–Skill file-creation conflict and another 22 deliver its artifact; post-hoc exclusions do not change the primary result.The benchmark's FBR uses injection-causal labels, so a gold-PASS action may still violate an unrelated policy.Source: §C.3 · p. 25

C.4 Ablation and Confidence Intervals

• Materiality limits blocks on gold-PASS units, while the conflict channel preserves substantial recall; reachability alone is not a useful decision rule.Table 15 recomputes decision-rule variants from frozen certificates; overlapping witness branches mean ablation effects need not add.Source: §C.4 · p. 25, Table 15 · p. 26
• All PAA-minus-baseline Block-recall intervals exclude zero; under Claude Sonnet 5, FBR favors PAA except against VIGIL/GPT-5.5, where differences are +7.6 points on Claude Code and +2.2 on Codex.The Codex FBR interval for the +2.2-point difference includes zero.Source: §C.4 · p. 25, Table 17 · p. 26

C.5 Cost Accounting

• PAA uses a median 3–4 requests per unit and 64–71k recorded tokens; on Codex, VIGIL uses 290–302k tokens and ARGUS 136–272k, supporting within-backend comparisons only.Provider caching and transport accounting differ, so these ranges do not establish cross-backend latency or monetary rankings.Source: §C.5 · pp. 26–27
• The Codex in-run benign-interruption analysis covers 238 of 239 benign trajectories; Table 18 counts blocked final submissions over all 239 Codex and 240 Claude Code trajectories.The in-run analysis excludes trajectories whose boundary actions are all final submissions.Source: Figure 7 · p. 27, Table 18 · p. 27

C.6 Supplemental Trajectory Results

• Across both corpora, PAA interrupts fewer eligible benign trajectories than the baselines, while injected-run blocks occur predominantly at the earliest gold-BLOCK opportunity.Eligible benign trajectories number 92 of 240 for Claude Code and 238 of 239 for Codex; final-submission blocks are reported separately.Source: §C.6 · p. 27
• The Claude Code timing figure reports the share stopped after zero, one, or at least two missed gold-BLOCK opportunities; the Codex timing figure uses the same definition.The Codex figures also cover first-stop outcomes and gold-BLOCK-stop timing across all 239 injected trajectories.Source: Figure 9 · p. 27, Figure 8 · p. 27, Figure 10 · p. 28
• The benign-interruption figure covers 238 of 239 Codex benign trajectories in scope, while the gold-BLOCK-stop timing figure covers all 239 injected trajectories.Both figures refer to definitions established in earlier figures.Source: Figure 10 · p. 28

D Benchmark Comparison

• The classifications describe workload construction rather than benchmark quality or difficulty.The comparison concerns properties present in cited released versions.Source: D Benchmark Comparison · p. 28
• A checkmark marks a workload-wide requirement, a circle marks subset or approximate coverage, and a dash means the released workload does not require that property.A dash does not preclude an extension; Table 20 records the section-level evidence behind Table 19's classifications.Source: D Benchmark Comparison · p. 28, Table 20 · p. 29
• The comparison spans dynamic runs, context-aware attacks, multi-step attacks, native runtimes, and action-level labels across representative workloads.A multi-step attack requires at least two causally connected steps to realize or materially advance its target.Source: Table 19 · p. 28, D Benchmark Comparison · p. 28