Paper deep dive
Rethinking Agent Security as a Networking Problem
Van Tran, Taveesh Sharma, Tajveer Singh Dhesi, Nick Feamster
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%
Last extracted: 8/13/2026, 3:39:38 AM
Summary
The paper argues that existing agent-centric security defenses for AI agents are insufficient due to the nondeterministic nature of LLMs and vulnerability to attacks like prompt injection. It proposes rethinking agent security as a networking problem, advocating for a reference architecture that combines deterministic enforcement mechanisms (e.g., sidecars) with semantic, context-aware policies. This approach borrows principles from networking such as centralized control, distributed enforcement, capability-based access, and zero-trust to provide stronger security guarantees than current endpoint-focused solutions.
Entities (8)
Relation Signals (6)
AI Agents → vulnerableto → Prompt Injection
confidence 92% · vulnerable to manipulation through attacks such as prompt injection
Existing Defenses → islimitedby → LLM
confidence 90% · This approach is fundamentally limited because it entrusts policy enforcement to AI agents whose LLM-driven behavior is inherently nondeterministic
Control Plane → manages → Security Policies
confidence 90% · The control plane defines and distributes security policies
Sidecar → enforces → Deterministic Enforcement
confidence 88% · We propose a network-based security architecture built on two complementary abstractions: deterministic enforcement... We instantiate these as a reference architecture that pairs each agent with a sidecar
Networking Principles → inspire → Agent Security Architecture
confidence 85% · The networking community has long grappled with similar challenges and offers insightful principles we can borrow to design a more secure AI agent system.
Contextual Integrity → providesvocabularyfor → Semantic Policies
confidence 85% · Nissenbaum’s contextual integrity (CI) provides one such vocabulary... We take a different approach: using CI for enforcement
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:AI agents are rapidly becoming more capable and widely deployed, promising substantial gains in productivity and enabling new classes of applications. However, their growing autonomy also introduces significant privacy and security risks. Existing defenses are predominantly agent-centric, relying on the agent itself to detect threats and enforce privacy and security policies. This approach is fundamentally limited because it entrusts policy enforcement to AI agents whose LLM-driven behavior is inherently nondeterministic and vulnerable to manipulation through attacks such as prompt injection. As a result, current defenses cannot reliably prevent privacy and security threats, highlighting a critical need for a new solution to securing AI agent systems. The networking community has long grappled with similar challenges and offers insightful principles we can borrow to design a more secure AI agent system. These include centralized control with distributed enforcement, capability-based access for mediating requests to sensitive resources, and least privilege through zero-trust enforcement. Historically, these principles have provided strong deterministic guarantees for networked systems. However, these principles alone are insufficient for AI agents because the safety and appropriateness of an agent's actions often depend on semantic context beyond the expressiveness of static rules. Building on these principles, we advocate for a systematic approach to AI agent security that combines deterministic enforcement mechanisms, which provide strong security guarantees, with semantic, context-aware policies that enable nuanced decision-making. We then present a reference architecture and identify key research questions and future directions to guide the design of secure and privacy-preserving AI agent systems.
Tags
Links
- Source: https://arxiv.org/abs/2608.12172v1
- Canonical: https://arxiv.org/abs/2608.12172v1
Trouble viewing inline? Open PDF directly →
Full Text
48,793 characters extracted from source content.
Expand or collapse full text
Rethinking Agent Security as a Networking Problem Van Tran ∗ University of Chicago Chicago, United States Taveesh Sharma ∗ University of Chicago Chicago, United States Tajveer Singh Dhesi ∗ University of Chicago Chicago, United States Nick Feamster University of Chicago Chicago, United States Abstract AI agents are rapidly becoming more capable and widely deployed, promising substantial gains in productivity and enabling new classes of applications. However, their growing autonomy also introduces significant privacy and security risks. Existing defenses are predominantly agent-centric, re- lying on the agent itself to detect threats and enforce privacy and security policies. This approach is fundamentally limited because it entrusts policy enforcement to AI agents whose LLM-driven behavior is inherently nondeterministic and vul- nerable to manipulation through attacks such as prompt injection. As a result, current defenses cannot reliably pre- vent privacy and security threats, highlighting a critical need for a new solution to securing AI agent systems. The networking community has long grappled with simi- lar challenges and offers insightful principles we can borrow to design a more secure AI agent system. These include centralized control with distributed enforcement, capability- based access for mediating requests to sensitive resources, and least privilege through zero-trust enforcement. Histor- ically, these principles have provided strong deterministic guarantees for networked systems. However, these princi- ples alone are insufficient for AI agents because the safety and appropriateness of an agent’s actions often depend on semantic context beyond the expressiveness of static rules. Building on these principles, we advocate for a systematic approach to AI agent security that combines determinis- tic enforcement mechanisms, which provide strong secu- rity guarantees, with semantic, context-aware policies that enable nuanced decision-making. We then present a refer- ence architecture and identify key research questions and future directions to guide the design of secure and privacy- preserving AI agent systems. 1 Introduction AI agents are LLM-based systems that can autonomously plan, reason, and execute multi-step workflows [68]. These agents can call APIs, invoke external tools, access enterprise resources, coordinate with other agents, and act with limited ∗ These authors contributed equally to this work. human oversight, making them a new layer of networked systems that mediate interactions among users, services, and external APIs [2,21]. A supervisor agent handling a scheduling request, for example, may share calendar details with a third party booking service, all without human review. This autonomy introduces potential privacy and security risks. Agents can inadvertently expose sensitive data such as passwords and personal information through their out- puts [18,73], tool calls [1,18], or communication with other agents [18,33,42]. Additionally, adversarial techniques such as (indirect) prompt injection [13,19,22,71], memory poison- ing [9,16,69], and goal hijacking [14,26,27,72] can further manipulate an agent’s reasoning, causing it to bypass secu- rity policies and perform harmful actions such as launching attacks [59,76], escalating privileges [10,60], tampering with databases [20], or performing unauthorized financial transactions [46]. Unfortunately, existing security architectures are built around static, predefined rules [24,53] and are not designed to address the dynamic, context-dependent behavior of AI agents [45,68]. For example, traditional access control mech- anisms authenticate a principal once and authorize subse- quent actions based on predefined permissions, without con- sidering the context in which an agent performs those actions [24,53]. In contrast, agent-level defenses such as using struc- tured querying [7], fine-tuning [8,32,61], and privacy-aware prompting [32,73], attempt to reason about context, intent, and privacy risks. Because this enforcement depends on LLM reasoning, it inherits the limitations of LLMs: their behavior is inherently nondeterministic, susceptible to attacks such as prompt injection [22, 37, 68], and can be bypassed by ad- versarial inputs [23,28,63]. As a result, they cannot provide strong security guarantees. Proposal: In this paper, we argue that the network is the natural place to enforce privacy and security controls for AI agents. We propose a network-based security architec- ture built on two complementary abstractions: deterministic enforcement, which constrains the actions an agent is per- mitted to perform regardless of whether its reasoning has been compromised, and context-aware filtering, which deter- mines whether an action or disclosure is appropriate given 1 arXiv:2608.12172v1 [cs.MA] 12 Aug 2026 Van Tran, Taveesh Sharma, Tajveer Singh Dhesi, and Nick Feamster its broader context. We instantiate these as a reference ar- chitecture that pairs each agent with a sidecar mediating every request, inter-agent message and external call as al- low, redact, or deny, governed by a control plane outside the agent’s reach. 2 Existing Defenses & Limitations In this section, we examine traditional security architectures and existing AI agent privacy and security defenses, high- lighting why they are insufficient for securing autonomous AI agents. We then identify the architectural capabilities needed to address these gaps. 2.1 Traditional Security Architectures Traditional cybersecurity defenses are built on the assump- tion that system behavior can be modeled, constrained, and verified through predefined policies [45,52]. Accordingly, existing security architectures rely on deterministic enti- ties, static permissions, and predictable interactions, where deviations from expected behavior are treated as potential se- curity violations [15,45]. However, these assumptions break down for AI agents, whose actions are generated through dy- namic reasoning processes and shaped by interactions with external tools, APIs, and other agents [34,43]. As a result, agent behavior is inherently context-dependent and difficult to anticipate [43,68], making security architectures based on static policies and fixed trust boundaries insufficient for protecting AI agents [45, 50]. Access control provides a concrete example of this archi- tectural mismatch. Traditional access control mechanisms, including role-based access control (RBAC) [53] and token- based authorization such as API keys [24], are fundamentally identity-centric. A principal is authenticated, granted a fixed set of permissions, and subsequent actions performed under that identity are authorized based on these predefined priv- ileges. While effective for conventional applications, these mechanisms provide limited visibility into the context sur- rounding an action: the sensitivity of the data being accessed, the purpose of the request, the history of prior interactions, or the downstream recipients of the information. This limi- tation becomes particularly problematic for AI agents. An agent may legitimately have access to sensitive resources, yet still violate privacy or security expectations by retrieving unnecessary information, sharing data with inappropriate external tools, or taking actions inconsistent with user intent [18, 54, 73]. 2.2AI Agent Privacy and Security Defenses The attack surface of AI agents is significantly broader than that of traditional software systems. AI agents continuously interact with external tools, memory systems, internal re- sources, and other agents, incorporating information from these sources into their reasoning process. Each interac- tion point can therefore introduce new opportunities for attacks. For example, prompt injection [13,19,22,71] em- beds malicious instructions in retrieved documents or tool outputs to manipulate an agent’s behavior; memory poison- ing [9,16,69] corrupts an agent’s persistent memory with false information or malicious instructions; and goal hijack- ing [14,26,27,72] diverts an agent from the user’s intended objective by altering its planning process. Beyond adversarial manipulation, AI agents can introduce privacy and security risks even when operating as intended. Agents may disclose sensitive information in inappropriate contexts [17,18,35] or perform actions that exceed the intended scope of a user’s request [29,48], creating risks of unintended data exposure or unauthorized operations. Prior work defends against privacy and security threats in AI agents through a variety of broad strategies. Reasoning- based defenses [13,32,73] aim to guide agents toward privacy- and security-aware decisions by embedding policies into the agent’s reasoning process. This can be achieved either through prompting [73], which provides security instruc- tions, policy guidance, or reasoning steps at inference time, or through model fine-tuning [32], which aligns the model with privacy and security norms during training. For exam- ple, AgentDAM [73] uses chain-of-thought prompting to encourage reasoning about data minimization before tak- ing actions, while CI-RL [32] uses reinforcement learning to align agents with contextual integrity norms. Filtering-based defenses [3,27,31,49,75] inspect informa- tion flows to prevent sensitive data or malicious instructions from propagating through an agent system. Depending on the threat model, filtering can be applied at different stages, including agent inputs and outputs [49] and communication channels between agents or components [3,27]. These de- fenses typically rely on rules or classifiers [31,49] to detect, block, redact, sanitize, or validate information before it is processed, shared, or stored, thereby reducing the risk of prompt injection, data leakage, and memory poisoning. Other defenses, such as information flow and tool control [11,58,74], sandboxing [12,38,47,64], and action verifica- tion [39,65], aim to constrain agent behavior through prede- fined interfaces, restricted execution environments, and ap- proval mechanisms. For example, sandboxing [12,38,47,64] isolates agents from sensitive resources and external systems, limiting their ability to perform harmful actions or access protected assets. While agent-level defenses can mitigate specific threats, they are fundamentally limited by their reliance on the agent itself for security decisions. Because LLM-based reasoning is inherently nondeterministic, approaches that depend on 2 Rethinking Agent Security as a Networking Problem Agent Sidecar (Deterministic + Semantic policies) Agent Supervisor Agent Sub-agent Sidecar (Deterministic + Semantic policies) Untrusted Zone Control plane (compiles and pushes rules) External World Calendar API Booking API Allow / Deny / Human Approval / Redact Third party Agent Enterprise Files Databases ServicesClusters Internal Resources Figure 1: Proposed sidecar architecture for securing multi-agent systems. Each agent is paired with a side- car that enforces deterministic and semantic policies on all inter-agent messages and external API calls, me- diating every action as allow, redact, deny or escalate for the user’s approval. Agents reside in an untrusted zone, while a control plane in a trusted zone within the enterprise compiles and pushes policy rules to the sidecars, keeping policy authority out of reach of the untrusted agents. agents to interpret and enforce privacy and security policies cannot provide strong enforcement guarantees. Moreover, agents remain vulnerable to attacks such as prompt injection, which can manipulate their behavior and bypass these de- fenses. Therefore, securing AI agents requires mechanisms that (1) provide deterministic enforcement for critical, high- stakes actions and (2) operate independently from the agent executing those actions. Why Borrow from Networking? The networking com- munity has spent decades addressing the problem of securing communication among autonomous, diverse, and untrusted endpoints [4,5,55–57,66,67]. Instead of assuming that ev- ery endpoint is trustworthy, networks enforce trust at the boundaries between components using principles such as least privilege, mediated communication, and continuous traffic monitoring. These capabilities are largely absent from endpoint focused agent defenses, which lose visibility once data leaves an individual agent and is sent to other agents, tools, or services. Moreover, endpoint-focused defenses such as prompt-level guardrails, model finetuning and model-side filters have repeatedly been shown to be evadable [23,28,63] in prior work. Because multi-agent AI systems are funda- mentally distributed systems of communicating entities, net- working provides a natural foundation for securing their interactions. 3 Design Principles for Secure AI Agents AI agents are becoming an important component of net- worked systems, yet they face privacy and security risks that existing network security architectures were never de- signed to address. Today’s defenses for privacy in multi- agent LLM systems reside almost entirely at the application and endpoint layer, in the form of prompt-level guardrails [49], output filters [36], system-prompt instructions [61], and per-agent content classifiers [25]. This work argues that the natural place to enforce data minimization and egress control is instead the network, and that the networking community is well positioned to conduct research on agent-aware mid- dleboxes, policy-driven egress filtering, and capability-based network access for agents. Each of these ideas has a long and well-tested history for hosts, flows, and services. The novelty lies in recognizing that an agent is a new kind of network entity, that inter-agent and agent-to-service traffic is a new kind of flow, and that the privacy failures specific to multi-agent systems (such as benign oversharing, context propagation across agent hops, and contextual integrity violations) are a new kind of failure source. The remainder of this section identifies the components they lack for AI agents, and proposes a set of design principles for building effective agent security architectures. We show that the field has already built the necessary mechanisms, only for a different entity. 3.1 Combine Deterministic Enforcement with Context-Aware Control Our core claim is that agent security requires two abstrac- tions that are useful only in combination: deterministic exe- cution enforcement and context-aware policy semantics. De- terministic enforcement without context-aware semantics reduces to coarse connectivity control, i.e, it can stop an agent from reaching an unapproved endpoint, but not from oversharing with an approved one. Context-aware semantics without deterministic enforcement reduces to present-day guardrails: norms specified in a prompt and enforced by the very entity being protected. Our contribution is to combine them: compiling semantics into a deterministic mechanism placed where the protected endpoint cannot bypass it. The enforcement abstraction is a systems-layer primitive that constrains what an agent execution may do. It includes: which tools it may call, which destinations it may reach, which data-flow paths its outputs may traverse. These are ag- nostic to the agent’s cooperation, prompt, or model weights. It resembles a firewall whose unit of protection is the agent execution graph rather than the packet 5-tuple, and it must 3 Van Tran, Taveesh Sharma, Tajveer Singh Dhesi, and Nick Feamster sit at a network choke point off-path from the agent’s rea- soning. We develop the mechanism that supplies these con- straints in §3.3. The semantic abstraction supplies the vocab- ulary of appropriateness that principals, resources, and ports cannot. Nissenbaum’s contextual integrity (CI) provides one such vocabulary [44]: flows are governed by norms of the form (sender role, recipient role, subject, information type, transmission principle), and a flow violates privacy when it breaches its context’s norms. This is why medical context ap- propriate for a health application becomes a violation when it reaches a restaurant-booking service. CI has been opera- tionalized primarily as an evaluation tool in existing defenses, with benchmarks showing high leakage rates [3,40,54]. Recent defenses do apply CI at runtime [32,62] but they delegate norm application to a model, leaving enforcement probabilistic. We take a different approach: using CI for en- forcement by turning its norms into checks a choke point can execute. For example, acheck_flow(sender, recipient, task, labels)function evaluated on every hop which, in essence, is information flow control [30,41,70] with CI norms as the label policy and the network as the reference monitor. 3.2 Centralized Control Connectivity should be governed by a declarative, centrally specified policy that the network enforces, rather than by endpoint mechanisms. This is the thesis of SANE [6] and Ethane [5]. SANE replaces a mix of access control lists (ACLs), firewalls, and NATs with a single protection layer in which a logically centralized server makes all access-control de- cisions and implements declarative policies such as “host 퐴can reach service퐵”; switches are minimally trusted and simply enforce the capabilities they are given. Ethane, which laid the foundation for software-defined networking (SDN), extends this to network-wide policy enforcement using a cen- tralized controller that manages simple flow-based switches. Its central argument is that network policies are effective only if all traffic passes through the enforcement point. The same principle applies to AI agents: if an agent can bypass or ignore a guardrail, the guardrail cannot reliably enforce policy. We adopt Ethane’s approach of compiling high-level declarative policies into enforceable rules, extending it from networks to agent egress control. These parallels raise a question the end-to-end argument was written to answer [51]: when is it appropriate to place a function in the network rather than at the endpoints? The argument is often summarized as “keep the network dumb,” but its actual claim is more nuanced: place a function at the endpoints when the endpoints are the only place it can be implemented correctly and completely. Our proposal fol- lows this principle rather than challenging it. The test the argument prescribes is whether the endpoint can do the job completely, and for agent egress control the relevant end- point is the agent itself. An untrusted and manipulable agent cannot reliably block its own leaks, because the enforcer and the constrained party are the same. Centralized control instead sits outside the agent’s boundary, observes every outbound flow, and leaves no part of the job to be completed elsewhere. 3.3 Capability-based Access An agent’s reach should be off by default: it must obtain an explicit capability granted by policy before it can send data or contact a destination. This idea builds on capability-based networking, developed to control unwanted network traffic. SIFF [66] separates traffic into privileged and unprivileged classes and requires a capability exchange before privileged communication can begin, allowing receivers to block un- wanted traffic before it consumes network resources. The traffic validation architecture (TVA) [67] extends this by re- quiring senders to first obtain permission from the receiver in the form of capabilities, which network devices verify before discarding unauthorized traffic. The Off-by-Default [4] pro- posal applies the same principle: communication is denied by default and allowed only through explicit policy. We carry this idea over to AI agents, where each task grants a narrow, revocable set of capabilities. By default, an agent should not be able to send a user’s data to another agent, tool, or external service. Instead, it should receive a capability that explicitly specifies the allowed destination, the type of data that may be shared, and the purpose of the transfer. As in the networking proposals, these capabilities should be forgery-proof, verifiable by enforcement points, and issued by a trusted policy authority rather than claimed by the agent itself. An open research question is what the right granularity and semantics of such capabilities should be when the protected resource is contextually private infor- mation rather than network bandwidth. 4 Designing the Building Blocks for Secure AI Agents Building on the design principles presented in Section 3, we present a reference security architecture that combines deter- ministic enforcement with context-aware semantic control. We first describe the key architectural components and how they interact to enforce security and privacy policies during agent execution. We then discuss how such an architecture can be integrated into existing enterprise environments. We emphasize that this architecture is intended as a reference design rather than a definitive solution. Its purpose is to 4 Rethinking Agent Security as a Networking Problem illustrate the architectural capabilities needed to secure au- tonomous AI agents, motivate further research, and provide a foundation for developing practical, deployable systems. 4.1 Core Architectural Components At a high level, the architecture separates security policy management from runtime enforcement through two compo- nents: a control plane and sidecars. The control plane defines and distributes security policies, while sidecars, deployed alongside AI agents, enforce these policies by mediating agent interactions with external resources. This separation provides centralized policy control while allowing security mechanisms to evolve independently of agent implementa- tions. 4.1.1 Centralized Control Plane. The control plane specifies and manages security policies but does not participate in runtime decision making. Located within the enterprise trust boundary and isolated from AI agents, it prevents agents from modifying or bypassing security requirements. It dis- tributes policies to sidecars, including deterministic rules (e.g., ACLs, and RBAC policies), semantic policies (e.g., con- straints on how customer PII may be used), request routing policies, data sensitivity labels, risk thresholds, and approved models for semantic evaluation. 4.1.2 Sidecars. Sidecars serve as runtime security enforce- ment points between AI agents and external resources. They intercept agent actions, evaluate requests using policies re- ceived from the control plane, and enforce the resulting de- cisions before allowing execution. Each sidecar consists of several components responsible for request classification, deterministic enforcement, and context-aware semantic eval- uation. Agent Policy Gateway. The agent policy gateway serves as the runtime enforcement point between AI agents and external resources. Rather than allowing agents to directly in- voke tools or access data, all external actions, including tool invocations, memory operations, API requests, network com- munications, file access, and data sharing, are intercepted by the gateway before execution. This centralized enforce- ment point ensures that every action is evaluated against enterprise security policies before it is executed. Request Classifier/ Policy Router. A key challenge in securing AI agents is that not all actions require semantic reasoning. The request classifier addresses this challenge by determining the appropriate evaluation path for each agent action. Using policy-defined criteria such as action type, resource sensitivity, and risk level, it routes requests either to the deterministic enforcement engine or to the context-aware semantic engine. This risk-adaptive routing enables the architecture to preserve the efficiency and strong Figure 2: Reference architecture for secure AI agents. The control plane centrally manages security policies, while sidecars deployed at agent interaction points in- tercept agent actions, route requests to deterministic or semantic enforcement, and mediate access to enter- prise resources. guarantees of deterministic enforcement while reserving more expensive semantic analysis for actions whose security implications depend on context, intent, or purpose. Deterministic Enforcement. The deterministic enforce- ment engine evaluates requests against predefined, unam- biguous security policies that can be enforced without se- mantic reasoning. These policies include mechanisms such as access control (e.g., ACLs and RBAC), tool permissions, network policies, and rate limits. By relying on explicit rules, the engine enables fast, predictable enforcement without the overhead of semantic reasoning. Context-aware control. The context-aware semantic engine evaluates requests whose security depends on the surrounding context rather than predefined rules alone. Be- fore making a decision, it gathers the information needed to understand the request, including the sensitivity of the data, the risk of the requested action, the agent’s role and per- missions, the user’s intent, the current task, and the agent’s recent interactions with tools and resources. Using this struc- tured view of the agent’s execution, the engine evaluates semantic policies to determine whether the request is con- sistent with its intended purpose and enterprise security requirements. It can then allow, deny, modify, or escalate the request for human approval. 5 Van Tran, Taveesh Sharma, Tajveer Singh Dhesi, and Nick Feamster 4.2 End-to-End Execution Flow Figure 2 illustrates the end-to-end execution flow of the pro- posed architecture. The enterprise control plane first defines security policies and distributes them to the runtime enforce- ment layer. These policies specify deterministic rules (e.g., access control, and tool permissions), semantic policies for context-dependent decisions, routing policies, and relevant metadata such as data sensitivity labels and risk thresholds. When an AI agent attempts to perform an external action, such as invoking a tool, accessing memory, issuing an API re- quest, or sharing data, the request is intercepted by the Agent Policy Gateway. The gateway evaluates the request using the policies received from the control plane and forwards it to the Request Classifier, which determines the appropriate en- forcement path. Requests with clear, rule-based decisions are routed to the Deterministic Enforcement Engine, while re- quests requiring reasoning about intent or execution context are routed to the Context-Aware Semantic Engine. For semantic evaluation, the engine collects relevant ex- ecution context, including the requested data, action risk, agent permissions, user intent, task state, and prior interac- tions. It then evaluates the semantic policies defined by the control plane to determine the appropriate decision. The re- sulting decision—allow, deny, modify, or escalate for human approval—is returned to the Agent Policy Gateway, which enforces the decision before the action is executed. All deci- sions and relevant execution information are recorded for auditing and policy refinement. 4.3Integration with Existing Architectures The proposed architecture enables existing policy enforce- ment mechanisms to be extended to autonomous AI agents. Similar to API gateways, service meshes, and policy enforce- ment points, the sidecar mediates agent interactions with protected resources by intercepting and evaluating actions before they are executed. The control plane integrates with existing enterprise security infrastructure, such as identity management, access control, and data governance systems, allowing organizations to reuse existing policies and security practices while adding controls designed for autonomous agent behavior. The separation between policy management and runtime enforcement further enables flexible deployment across di- verse AI agent environments. Since sidecars operate outside agent implementations, the same security layer can be ap- plied across different models, frameworks, and application architectures without requiring modifications to individual agents. Sidecars can be deployed at agent interaction points or data boundaries between agents and protected resources, enabling organizations to enforce policies even when agents have heterogeneous internal designs or expose only black- box interfaces. 5 Discussion & Future Directions Our reference architecture is intended to motivate further exploration of the design space rather than serve as a final solution. It represents a step toward more secure AI agent systems while leaving several important challenges and lim- itations open for future research. Limitations. Unlike existing agent-level defenses that rely on the agent itself to reason about and enforce privacy and security policies, our architecture delegates these deci- sions to an independent semantic engine running in a sidecar. This separation reduces the likelihood that policy enforce- ment is compromised by attacks on the agent. However, it does not eliminate the risk entirely. For example, an at- tacker may manipulate the context supplied by the agent, causing the semantic engine to authorize an otherwise unau- thorized information flow or action. Second, our architecture is designed to enforce policies at the enterprise boundary. It does not provide visibility or control over computation performed by external services once data leaves the enter- prise. Therefore, it should be complemented with trusted external services or additional safeguards for outbound data and requests. From egress to ingress. The natural next step is to extend our egress-only mechanism to ingress, so that we filter not just what an agent sends but also what it receives. This cleanly separates the two directions. However, ingress is much harder. To inspect incoming traffic, the sidecar needs cooperation it cannot rely on: a malicious sender can simply avoid any channel that lets the sidecar look inside. And the information needed to enforce policy must now come from the sender, who may hide, drop, or fake it. Solving this likely means changing strategy—instead of inspecting traffic after it arrives, we would rely on senders to attach verifiable labels agreed upon ahead of time. Semantic policies and context. A third set of questions concerns policy and context. How should semantic security policies be defined, and what context should they evalu- ate? Policies should clearly specify how information may be used while remaining precise, auditable, and adaptable to organization-specific requirements. Similarly, context repre- sentations should preserve the information and execution history needed for policy decisions without becoming too complex to enforce efficiently and consistently. Generalizability. Deterministic enforcement works well when the set of agents is known in advance and workflow paths can be specified by predefined policies. In practice, however, AI agents often spawn sub-agents, invoke new 6 Rethinking Agent Security as a Networking Problem tools, and establish previously unseen interactions at run- time. Supporting these dynamic behaviors requires more than static rules and remains an important area for future re- search. Dynamic enforcement mechanisms that complement predefined policies could help close this gap. Similarly, supporting a dynamic role-based system intro- duces a second challenge. At startup, each agent registers with the control plane by declaring its role and trust level, from which the control plane derives its capabilities accord- ing to role-based policies. However, roles, trust levels, and capabilities may evolve as agents execute tasks and inter- act with new tools. Continuously reevaluating these assign- ments improves security but incurs additional overhead. Bal- ancing timely policy updates with efficient enforcement re- mains an open research challenge. Finally, the policy router (Figure 2) raises an important research question: how can enforcement resources be allo- cated based on risk? A risk-aware router could direct low-risk flows through efficient deterministic checks while reserving more expensive context-aware analysis for higher-risk flows. Designing accurate and adaptive risk classification mecha- nisms to support this tradeoff remains an open direction for future work. References [1]Meysam Alizadeh, Zeynab Samei, Daria Stetsenko, and Fabrizio Gilardi. Simple prompt injection attacks can leak personal data observed by llm agents during task execution. arXiv preprint arXiv:2506.01055, 2025. [2] Anthropic. Model context protocol. https://modelcontextprotocol.io, 2024. [3] Eugene Bagdasarian, Ren Yi, Sahra Ghalebikesabi, Peter Kairouz, Marco Gruteser, Sewoong Oh, Borja Balle, and Daniel Ramage. Air- GapAgent: Protecting privacy-conscious conversational agents. In Proceedings of the 2024 ACM SIGSAC Conference on Computer and Com- munications Security, CCS ’24, pages 3868–3882, New York, NY, USA, 2024. Association for Computing Machinery. [4] Hitesh Ballani, Yatin Chawathe, Sylvia Ratnasamy, Timothy Roscoe, and Scott Shenker. Off by default! In Proceedings of the 4th ACM Workshop on Hot Topics in Networks (HotNets-IV), College Park, MD, 2005. [5] Martin Casado, Michael J. Freedman, Justin Pettit, Jianying Luo, Nick McKeown, and Scott Shenker. Ethane: Taking control of the enterprise. In Proceedings of the ACM SIGCOMM 2007 Conference, pages 1–12, 2007. [6]Martin Casado, Tal Garfinkel, Aditya Akella, Michael J. Freedman, Dan Boneh, Nick McKeown, and Scott Shenker. SANE: A protection archi- tecture for enterprise networks. In 15th USENIX Security Symposium (USENIX Security 06), Vancouver, B.C., Canada, 2006. [7] Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. StruQ: Defending against prompt injection with structured queries. In 34th USENIX Security Symposium (USENIX Security 25), pages 2383– 2400, 2025. [8] Sizhe Chen, Arman Zharmagambetov, Saeed Mahloujifar, Kamalika Chaudhuri, David Wagner, and Chuan Guo. Secalign: Defending against prompt injection with preference optimization. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pages 2833–2847, 2025. [9]Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. Agentpoison: Red-teaming llm agents via poisoning memory or knowl- edge bases. Advances in Neural Information Processing Systems, 37:130185–130213, 2024. [10]Cloud Security Alliance AI Safety Initiative. Overprivileged by design: AI agents as cloud escalation vectors. Lab Space, Cloud Security Alliance, April 2026. CSA Research Note. [11]Manuel Costa, Boris Köpf, Aashish Kolluri, Andrew Paverd, Mark Russinovich, Ahmed Salem, Shruti Tople, Lukas Wutschitz, and San- tiago Zanella-Béguelin. Securing ai agents with information-flow control. arXiv preprint arXiv:2505.23643, 2025. [12] Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, An- dreas Terzis, and Florian Tramèr. Defeating prompt injections by design. arXiv preprint arXiv:2503.18813, 2025. [13]Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer- Kellner, Marc Fischer, and Florian Tramèr. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In NeurIPS Datasets and Benchmarks, 2024. [14]Zehang Deng, Yongjian Guo, Changzhou Han, Wanlun Ma, Junwu Xiong, Sheng Wen, and Yang Xiang. Ai agents under threat: A survey of key security challenges and future pathways. ACM Computing Surveys, 57(7):1–36, 2025. [15]Dorothy E. Denning. An intrusion-detection model. IEEE Transactions on Software Engineering, SE-13(2):222–232, February 1987. [16] Shen Dong, Shaochen Xu, Pengfei He, Yige Li, Jiliang Tang, Tianming Liu, Hui Liu, and Zhen Xiang. Memory injection attacks on llm agents via query-only interaction. Advances in Neural Information Processing Systems, 38:46697–46731, 2026. [17]Aarya Doshi, Yining Hong, Congying Xu, Eunsuk Kang, Alexandros Kapravelos, and Christian Kästner. Towards verifiably safe tool use for llm agents. In Proceedings of the IEEE/ACM 48th International Conference on Software Engineering, ICSE-NIER ’26, page 201–205, New York, NY, USA, 2026. Association for Computing Machinery. [18]Faouzi El Yagoubi, Godwin Badu-Marfo, and Ranwa Al Mallah. AgentLeak: A full-stack benchmark for privacy leakage in multi-agent LLM systems. arXiv preprint arXiv:2602.11510, February 2026. Preprint. [19]Ivan Evtimov, Arman Zharmagambetov, Aaron Grattafiori, Chuan Guo, and Kamalika Chaudhuri. Wasp: Benchmarking web agent security against prompt injection attacks. Advances in Neural Information Processing Systems, 38, 2026. [20]Tim Freestone. AI agents are the biggest data security threat you’re not governing. Kiteworks, Cybersecurity Risk Management Blog, February 2026. Updated February 26, 2026. [21] Google. Agent2agent (A2A) protocol. https://a2a-protocol.org, 2025. [22]Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. In ACM Workshop on Artificial Intelligence and Security (AISec), 2023. [23]William Hackett, Lewis Birch, Stefan Trawicki, Neeraj Suri, and Peter Garraghan. Bypassing LLM guardrails: An empirical analysis of eva- sion attacks against prompt injection and jailbreak detection systems, 2025. [24]Dick Hardt. The OAuth 2.0 authorization framework. Technical Report RFC 6749, Internet Engineering Task Force (IETF), October 2012. [25]Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674, 2023. 7 Van Tran, Taveesh Sharma, Tajveer Singh Dhesi, and Nick Feamster [26]Rishi Jha, Harold Triedman, Justin Wagle, and Vitaly Shmatikov. Break- ing and fixing defenses against control-flow hijacking in multi-agent systems. arXiv preprint arXiv:2510.17276, 2025. [27] Feiran Jia, Tong Wu, Xin Qin, and Anna Squicciarini. The task shield: Enforcing task alignment to defend against indirect prompt injection in LLM agents. In Proceedings of the 63rd Annual Meeting of the Asso- ciation for Computational Linguistics (Volume 1: Long Papers), pages 29680–29697, Vienna, Austria, July 2025. Association for Computa- tional Linguistics. [28]Yuqi Jia, Zedian Shao, Yupei Liu, Jinyuan Jia, Dawn Song, and Neil Zhenqiang Gong. A critical evaluation of defenses against prompt injection attacks. arXiv preprint arXiv:2505.18333, 2025. [29]Jaylen Jones, Zhehao Zhang, Yuting Ning, Eric Fosler-Lussier, Pierre- Luc St-Charles, Yoshua Bengio, Dawn Song, Yu Su, and Huan Sun. When benign inputs lead to severe harms: Eliciting unsafe unintended behaviors of computer-use agents. arXiv preprint arXiv:2602.08235, 2026. [30]Maxwell Krohn, Alexander Yip, Micah Brodsky, Natan Cliffer, M. Frans Kaashoek, Eddie Kohler, and Robert Morris. Information flow control for standard OS abstractions. In ACM SOSP, 2007. [31] Lakera AI. Lakera guard. https://w.lakera.ai/lakera-guard, 2023. Accessed 2026-07-08. [32]Guangchen Lan, Huseyin A. Inan, Sahar Abdelnabi, Janardhan Kulka- rni, Lukas Wutschitz, Reza Shokri, Christopher G. Brinton, and Robert Sim. Contextual integrity in LLMs via reasoning and reinforcement learning. In Advances in Neural Information Processing Systems, vol- ume 39, 2025. [33] Yedidel Louck, Ariel Stulman, and Amit Dvir. Improving google a2a protocol: Protecting sensitive data and mitigating unintended harms in multi-agent systems. ACM Transactions on Software Engineering and Methodology, 2025. [34] Hongyi Lu, Nian Liu, Shuai Wang, and Fengwei Zhang. Clawless: A security model of ai agents. arXiv preprint arXiv:2604.06284, 2026. [35]Hanjun Luo, Shenyu Dai, Chiming Ni, Xinfeng Li, Guibin Zhang, Kun Wang, Tongliang Liu, and Hanan Salam. Agentauditor: Human-level safety and security evaluation for llm agents. Advances in Neural Information Processing Systems, 38:43241–43298, 2026. [36]Todor Markov, Chong Zhang, Sandhini Agarwal, Florentine Eloun- dou Nekoul, Theodore Lee, Steven Adler, Angela Jiang, and Lilian Weng. A holistic approach to undesired content detection in the real world. Proceedings of the AAAI Conference on Artificial Intelligence, 37(12):15009–15018, 2023. [37] Conor McCauley and Kasimir Schulz. Same model, different hat. HiddenLayer Research, October 2025. [38]Luoxi Meng, Henry Feng, Ilia Shumailov, and Earlence Fernandes. cell- mate: Sandboxing browser ai agents. arXiv preprint arXiv:2512.12594, 2025. [39]Lesly Miculicich, Mihir Parmar, Hamid Palangi, Krishnamurthy Dj Dvijotham, Mirko Montanari, Tomas Pfister, and Long T Le. Veriguard: Enhancing llm agent safety via verified code generation. arXiv preprint arXiv:2510.05156, 2025. [40]Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, and Yejin Choi. Can LLMs keep a secret? Testing privacy implications of language models via contextual in- tegrity theory. In ICLR, 2024. [41]Andrew C. Myers and Barbara Liskov. A decentralized model for information flow control. In ACM SOSP, 1997. [42] Akshat Naik, Jay Culligan, Yarin Gal, Philip Torr, Rahaf Aljundi, Alas- dair Paren, and Adel Bibi. Omni-leak: Orchestrator multi-agent net- work induced data leakage. arXiv preprint arXiv:2602.13477, 2026. [43]Vineeth Sai Narajala and Om Narayan. Securing agentic ai: A com- prehensive threat model and mitigation framework for generative ai agents. arXiv preprint arXiv:2504.19956, 2025. [44]Helen Nissenbaum. Privacy as contextual integrity. Washington Law Review, 79(1):119–157, 2004. [45] Anand Oswal. Why traditional security fails in the age of non- deterministic AI. Perspectives, Palo Alto Networks, February 2026. [46]Atharv Singh Patlan, Peiyao Sheng, S Ashwin Hebbar, Prateek Mit- tal, and Pramod Viswanath. Real ai agents with fake memories: Fatal context manipulation attacks on web3 agents. arXiv preprint arXiv:2503.16248, 2025. [47]Yun Piao, Hongbo Min, Hang Su, Leilei Zhang, Lei Wang, Yue Yin, Xiao Wu, Zhejing Xu, Liwei Qu, Hang Li, et al. Agentbay: A hybrid interaction sandbox for seamless human-ai intervention in agentic systems. arXiv preprint arXiv:2512.04367, 2025. [48]Yubin Qu, Ying Zhang, Yanjun Zhang, Gelei Deng, Yuekang Li, Leo Yu Zhang, and Yi Liu. Overeager coding agents: Measuring out-of-scope actions on benign tasks. arXiv preprint arXiv:2605.18583, 2026. [49] Traian Rebedea, Razvan Dinu, Makesh Narsimhan Sreedhar, Christo- pher Parisien, and Jonathan Cohen. NeMo guardrails: A toolkit for controllable and safe LLM applications with programmable rails. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 431–445, 2023. [50]Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero trust architecture. Technical Report NIST Special Publication (SP) 800-207, National Institute of Standards and Technology (NIST), Gaithersburg, MD, August 2020. [51] Jerome H. Saltzer, David P. Reed, and David D. Clark. End-to-end arguments in system design. ACM Transactions on Computer Systems, 2(4):277–288, 1984. [52] Jerome H. Saltzer and Michael D. Schroeder. The protection of infor- mation in computer systems. Proceedings of the IEEE, 63(9):1278–1308, September 1975. [53] Ravi S. Sandhu, Edward J. Coyne, Hal L. Feinstein, and Charles E. Youman. Role-based access control models. Computer, 29(2):38–47, 1996. [54]Yijia Shao, Tianshi Li, Weiyan Shi, Yanchen Liu, and Diyi Yang. Pri- vacyLens: Evaluating privacy norm awareness of language models in action. In Advances in Neural Information Processing Systems, vol- ume 37 of NeurIPS Datasets and Benchmarks Track, 2024. [55]Justine Sherry, Peter Xiang Gao, Soumya Basu, Aurojit Panda, Arvind Krishnamurthy, Christian Maciocco, Maziar Manesh, João Martins, Sylvia Ratnasamy, Luigi Rizzo, and Scott Shenker. Rollback-recovery for middleboxes. In ACM SIGCOMM, 2015. [56] Justine Sherry, Shaddi Hasan, Colin Scott, Arvind Krishnamurthy, Sylvia Ratnasamy, and Vyas Sekar. Making middleboxes someone else’s problem: Network processing as a cloud service. In ACM SIG- COMM, 2012. [57] Justine Sherry, Chang Lan, Raluca Ada Popa, and Sylvia Ratnasamy. BlindBox: Deep packet inspection over encrypted traffic. In ACM SIGCOMM, 2015. [58] Tianneng Shi, Jingxuan He, Zhun Wang, Linyu Wu, Hongwei Li, Wenbo Guo, and Dawn Song. Progent: Programmable privilege control for llm agents. arXiv e-prints, pages arXiv–2504, 2025. [59]Jiejun Tan, Zhicheng Dou, Xinyu Yang, Yuyang Hu, Yiruo Cheng, Xiaoxi Li, and Ji-Rong Wen. From prompt injection to persistent control: Defending agentic harness against trojan backdoors. arXiv preprint arXiv:2605.31042, 2026. [60]The Hacker News. AI agents are becoming authorization bypass paths. The Hacker News, January 2026. [61]Eric Wallace, Kai Xiao, Reimar Leike, Lilian Weng, Johannes Heidecke, and Alex Beutel. The instruction hierarchy: Training llms to prioritize privileged instructions. arXiv preprint arXiv:2404.13208, 2024. 8 Rethinking Agent Security as a Networking Problem [62]Shouju Wang, Fenglin Yu, Xirui Liu, Xiaoting Qin, Jue Zhang, Qing- wei Lin, Dongmei Zhang, and Saravan Rajmohan. Privacy in action: Towards realistic privacy mitigation and evaluation for LLM-powered agents. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 17055–17074, Suzhou, China, November 2025. As- sociation for Computational Linguistics. [63]Xunguang Wang, Zhenlan Ji, Wenxuan Wang, Zongjie Li, Daoyuan Wu, and Shuai Wang. Sok: Evaluating jailbreak guardrails for large language models. In 2026 IEEE Symposium on Security and Privacy (SP), pages 39–58. IEEE, 2026. [64]Yuhao Wu, Franziska Roesner, Tadayoshi Kohno, Ning Zhang, and Umar Iqbal. Isolategpt: An execution isolation architecture for llm- based agentic systems. arXiv preprint arXiv:2403.04960, 2024. [65]Zhen Xiang, Linzhi Zheng, Yanjie Li, Junyuan Hong, Qinbin Li, Han Xie, Jiawei Zhang, Zidi Xiong, Chulin Xie, Carl Yang, et al. Guarda- gent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning. arXiv preprint arXiv:2406.09187, 2024. [66]Abraham Yaar, Adrian Perrig, and Dawn Song. SIFF: A stateless internet flow filter to mitigate DDoS flooding attacks. In 2004 IEEE Symposium on Security and Privacy, pages 130–143, 2004. [67] Xiaowei Yang, David Wetherall, and Thomas Anderson. A DoS- limiting network architecture. In Proceedings of the ACM SIGCOMM 2005 Conference, pages 241–252, 2005. [68]Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. ReAct: Synergizing reasoning and acting in language models. In ICLR, 2023. [69] Abbas Yazdinejad and Hadis Karimipour. Temporal dynamics of mem- ory poisoning in web3-style llm agents. IEEE Access, 2026. [70]Nickolai Zeldovich, Silas Boyd-Wickizer, Eddie Kohler, and David Mazières. Making information flow explicit in HiStar. In USENIX OSDI, 2006. [71] Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. Injecagent: Benchmarking indirect prompt injections in tool-integrated large lan- guage model agents. In Findings of the Association for Computational Linguistics: ACL 2024, pages 10471–10506, 2024. [72]Yuyang Zhang, Kangjie Chen, Jiaxin Gao, Ronghao Cui, Run Wang, Lina Wang, and Tianwei Zhang. Towards action hijacking of large language model-based agent. arXiv preprint arXiv:2412.10807, 2024. [73]Arman Zharmagambetov, Chuan Guo, Ivan Evtimov, Maya Pavlova, Ruslan Salakhutdinov, and Kamalika Chaudhuri. AgentDAM: Privacy leakage evaluation for autonomous web agents. In Advances in Neural Information Processing Systems, volume 39, 2025. [74]Peter Yong Zhong, Siyuan Chen, Ruiqi Wang, McKenna McCall, Ben L Titzer, Heather Miller, and Phillip B Gibbons. Rtbas: Defending llm agents against prompt injection and privacy leakage. arXiv preprint arXiv:2502.08966, 2025. [75]Jijie Zhou, Eryue Xu, Yaoyao Wu, and Tianshi Li. Rescriber: Smaller- LLM-powered user-led data minimization for LLM-based chatbots. In Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems, CHI ’25, pages 1–28, Yokohama, Japan, April 2025. Association for Computing Machinery. [76]Yuxuan Zhu, Antony Kellermann, Dylan Bowman, Philip Li, Akul Gupta, Adarsh Danda, Richard Fang, Conner Jensen, Eric Ihli, Ja- son Benn, et al. Cve-bench: a benchmark for ai agents’ ability to exploit real-world web application vulnerabilities. arXiv preprint arXiv:2503.17332, 2025. 9