Evidence · DiggingBeagle record
SPILLWAY: Recipient provenance checks for agent tool calls
Prompt-injected or tool-derived text can try to redirect an agent action to a different recipient while preserving a plausible task narrative. SPILLWAY binds recipient selection to verified provenance instead of model prose. The paper reports eliminating attacker-targeted redirects in its selected benchmark tests, not a universal claim that every tool exfiltration path is closed. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
Prompt-injected or tool-derived text can try to redirect an agent action to a different recipient while preserving a plausible task narrative. SPILLWAY binds recipient selection to verified provenance instead of model prose. The paper reports eliminating attacker-targeted redirects in its selected benchmark tests, not a universal claim that every tool exfiltration path is closed. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (3)
- supportsSPILLWAY tests recipient provenance enforcement against agent tool redirection: The paper reports eliminating attacker-targeted redirects in its selected benchmark tests, not a universal claim that every tool exfiltration path is closed.
Paper method and experimental recipient redirection benchmark
- supportsSPILLWAY tests recipient provenance enforcement against agent tool redirection: Prompt-injected or tool-derived text can try to redirect an agent action to a different recipient while preserving a plausible task narrative. SPILLWAY binds recipient selection to verified provenance instead of model prose.
Paper method and experimental recipient redirection benchmark
- supportsSPILLWAY tests recipient provenance enforcement against agent tool redirection: SPILLWAY blocks unauthorized destination substitutions in the tested agent-tool workflows through recipient provenance checks, but its successful benchmark results do not establish protection against content poisoning sent to an otherwise authorized recipient.
SPILLWAY typed destination provenance and benchmark limitations