Realm resource scoping cut injection while also blocking many legitimate tasks

Realm enforces explicit resource scope around tool-using agents rather than relying only on a language-model refusal. In the reported AgentDyn setup, an unconstrained agent experienced ninety-three successful attacks across 560 injection tests; the scoped design yielded one. The corresponding legitimate-task completion, however, dropped from forty-seven of sixty to twenty-four of sixty. Both denominators belong in the finding. A safeguard that sharply lowers attacks while also denying ordinary authorized work is not a complete production solution.

The paper reports at least one attack still operating through an allowed calendar tool, demonstrating that resource scoping cannot detect every malicious purpose inside an otherwise permitted capability. Real implementations must identify legitimate assets and design task-specific approvals so that the model is not simply deprived of most useful tools. This study is an authorization tradeoff experiment, not evidence of live incidents eliminated.