Agents Can Combine Permitted Actions Into a Prohibited Outcome

1A Prompt Injection Only Lands If the Agent Already Holds the Authority

Reading a confidential document is permitted. So is sending an external message. Doing both in one session produces the result a policy forbids. Xabier Muruaga posted a preprint to arXiv on August 16, 2026. Its authorization model judges each request against everything the session has already done. The paper's central claim is about prompt injectionGlossaryPrompt InjectionPrompt injection is an attack in which adversarial input manipulates an AI agent into performing unintended actions. The attacker embeds instructions…: an injected instruction only causes harm when the agent already holds the authority to act on it. Permissions fixed at session start cannot see a combination coming.

These are authorization failures, not model-alignment failures: they remain possible no matter how robust the model is to a given injection, because the underlying authority structure permits them.

Xabier Muruaga, Bounded Agents

The paper sorts the gap three ways. An agent takes permitted actions unrelated to its task. A sub-agent claims authority beyond what was passed to it, or hands it on without narrowing it. Or it arrives at a forbidden result by combinationGlossaryCompositional RiskCompositional risk is the security exposure that emerges from an agent's accumulated access path, evaluated in aggregate rather than as individual…, where no single permission is the one that failed. The model follows authority along the delegation chain, the run of principals from the person who starts a task down to each sub-agent and tool. No hop may grow the blast radiusGlossaryBlast RadiusBlast radius is the total extent of damage that can result from a security incident, measured by the systems, data, and operations that could be….

2The Results Are Strong and the Benchmarks Are Synthetic

Across 3,154 instances from public benchmark suites, AgentDojo exfiltrationGlossaryData ExfiltrationData exfiltration is the unauthorized transfer of data from an organization's systems to an external location. In AI agent contexts, exfiltration… fell from a range of 75 to 100 percent to zero in all four domains. All 544 InjecAgent data-stealing cases were blocked. Enforcement is not free. Across 949 task-injection pairs, task utility landed 8.6 and 13.9 percentage points lower in the two settings tested.

External: all benchmarks are synthetic, and no production-deployment data is presented; this is a deliberate scope choice, as the primary claims are structural.

Xabier Muruaga, Bounded Agents

The author draws the rest of the boundary. Adaptive attacks were self-designed rather than externally red-teamed. The compromised-model test inserts its attack at a fixed point after the first legitimate call. It complements role-based and attribute-based access controlGlossaryABAC (Attribute-Based Access Control)Attribute-based access control (ABAC) is an authorization model that evaluates access requests against attributes of the user, the resource, the… rather than replacing them. This is a single-author preprint without peer review, whose author discloses standards-body involvement and language-model help in the writing. What it bounds is which authority gets exercised and in what combinations, never whether one authorized action was the right call. Nothing in the model records which person asked for itKnowledgeMCP v2 Improves Agent Access Control and Still Cannot Say Who DecidedMCP revision 2026-07-28 improves two of the three identities behind every agent action: the agent making the call and the account whose permissions….

Source: Xabier Muruaga, "Bounded Agents: Delegation Security for Multi-Agent AI SystemsExternal Link Tohttps://arxiv.org/abs/2608.15888", August 16, 2026.