SPILLWAY tests recipient provenance enforcement against agent tool redirection

Prompt-injected or tool-derived text can try to redirect an agent action to a different recipient while preserving a plausible task narrative. SPILLWAY binds recipient selection to verified provenance instead of model prose.

The paper reports eliminating attacker-targeted redirects in its selected benchmark tests, not a universal claim that every tool exfiltration path is closed.

SPILLWAY separates two failures that prompt sanitization alone does not solve. Untrusted tool or page text may instruct the assistant to send a permitted tool action to a different recipient, while a plausible task explanation makes the redirection look harmless. The proposed defense first verifies the destination against typed provenance and admission rules, then removes injected instructions from inbound text. Its reported benchmark reductions apply to tools with identifiable destinations; they do not establish safety for actions in which the recipient remains legitimate but the amount, message content or other parameters are poisoned. An allowed endpoint is therefore a necessary condition for this class of action, not proof that the complete operation matches the user's authorization.

A prompt-cleaning filter may remove suspicious instructions while leaving the agent free to substitute a destination in an otherwise legitimate tool call. SPILLWAY instead checks typed recipient provenance at the effect boundary. Its reported successes therefore cover tested destination substitutions, not all possible data leaks: a permitted recipient can still receive poisoned content or excessive confidential data. Germline's per-call data isolation studies that second class of problem, demonstrating why destination identity and payload authorization are separate controls.