AgentSecBench: Measuring Prompt Injection, Privacy Leakage, and Tool-Use Integrity in LLM Agents

Computer Science > Cryptography and Security [Submitted on 25 May 2026] AgentSecBench: Measuring Prompt Injection, Privacy Leakage, and Tool-Use Integrity in LLM Agents Faruk Alpay, Taylan Alpay LLM agents process trusted instructions, retrieved records, and tool observations through a common generative channel. This conflates data flow with authority: an untrusted string can affect a secret-bearing response or an action proposal even when no application policy authorizes that influence. We introduce AgentSecBench as an empirical instantiation of a formal security framework for this problem. The framework defines three games-instruction-integrity, retrieval-confidentiality, and capability-integrity-under a common notion of intent-to-execution noninterference with permitted leakage. It represents an application policy as a projection onto authorized observations and capabilities, distinguishes prompt annotations from enforcing projections, and measures both adversarial advantage and whether a defense closes the relevant model-visible channel before generation. The exact-marker experiments are intentionally one observable instantiation of the games rather than a complete semantic security claim: they test disclosure and forbidden-action distinguishers with unambiguous ground truth. We evaluate six defense classes with Qwen3-0.6B and Qwen3-1.7B on paired adversarial and benign-control executions. The measurements show when risk reduction follows channel closure and when a model-visible adversarial capability remains exploitable. The result is a security-oriented evaluation method: prompt text can describe a boundary, whereas provenance projection, capability restriction, and output validation can enforce one. Comments: 24 pages, 3 figures. Ancillary files provided Subjects: Cryptography and Security (cs.CR) MSC classes: 68M25, 68P27, 68T42, 68P20 Cite as: arXiv:2605.26269 [cs.CR]   (or arXiv:2605.26269v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2605.26269 Focus to learn more Submission history From: Taylan Alpay [view email] [v1] Mon, 25 May 2026 18:53:22 UTC (82 KB) Access Paper: HTML (experimental) view license Ancillary files (details): agentsecbench/README.md agentsecbench/agentsecbench/__init__.py agentsecbench/agentsecbench/data.py agentsecbench/agentsecbench/defenses.py agentsecbench/agentsecbench/metrics.py (18 additional files not shown) Current browse context: cs.CR < prev   |   next > new | recent | 2026-05 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)