New research shows that today's AI agent frameworks would let a hijacked agent do almost anything a user could do.
Researchers built a threat model for multi-agent LLM systems around four attack types: confused deputies, stolen and replayed tokens, prompt-injection privilege escalation, and compromised sub-agents. They first tested a default setup that hands out broad bearer credentials and lets the model itself gate authorization, and it failed all four threats. They then checked four widely used frameworks - LangGraph, CrewAI, AutoGen, and the Model Context Protocol's authorization model - and found three offered no built-in confinement at all, with the fourth only partial. To close the gap, they built and adversarially tested an authorization broker: it blocked all four threats, survived 11 direct attacks on its own design, rejected all 200,000 forged tokens thrown at it, and cut a compromised sub-agent's reach from all 8,100 possible actions down to an average of 1.5, while adding roughly 2.6 microseconds per decision.
The useful part of this paper is the framing, not just the fix. It assumes the model driving the agent is already compromised, rather than treating prompt injection as an edge case to patch around. That reframes agent security as an authorization problem first, which is a different posture than most frameworks currently ship with.
The researchers note the same approach now runs in production inside VotalAI's LLM Shield - worth keeping in mind, since the line between academic threat model and vendor pitch is thin here.