Architectural Defenses for Agentic Systems: Prompt Injection and Beyond

Abstract

Large Language Model (LLM) agents are now incrementally being deployed in real-world systems solving general purpose tasks as well as coding tasks. These agents often interact with external untrusted environments and among many other problems, two problems emerge and stand out from this interaction: prompt injection and supply chain attacks. We propose architectural and deterministic defenses for these two problems. Firstly, we present a taxonomy of tasks based on the minimum data knowledge required for task completion by agents. Motivated by the fact that many tasks can be completed without the LLM observing any untrusted data, we present Execute-Only Agent (XOA), a defense paradigm that provides architectural protection rather than probabilistic protection against prompt injection by ensuring the LLM never observes untrusted data. XOA leverages the LLM's capabilities to generate scripts that execute in an isolated sandbox, which returns output to the user. We evaluate XOA on AgentDojo and InjecAgent benchmarks using three models of increasing capability, demonstrating an effective 0.0% Attack Success Rate with a utility gap of ~16 percentage points(for the best performing model) compared to ReAct agents under attack, narrowed from ~27 points on clean tasks as ReAct degrades while XOA remains stable. Secondly, we discuss the need for deterministic checks as coding agents scale in the context of eBPF. We discuss how seemingly benign code can encode malicious control or data flows and introduce BPFflow, a framework for the system administrator to define policies that are deterministically enforced by an Information FlowControl (IFC) system within the eBPF verifier to track the propagation of sensitive data to prevent unauthorized leakage to userspace or any other untrusted sinks without any runtime overhead. We evaluate BPFflow against real-world rootkits and find that it is effective at blocking supply chain attacks