'Rethinking Agent Security as a Networking Problem': stop asking the LLM to enforce its own policy

arXiv·high signalXBlueskyLinkedInCopy link

A position paper submitted 2026-08-12 argues that agent defenses are fundamentally broken because they are agent-centric — they entrust policy enforcement to an LLM whose behavior is nondeterministic and manipulable via prompt injection. The authors import three networking principles with decades of deterministic guarantees: centralized control with distributed enforcement, capability-based access mediating requests to sensitive resources, and least privilege through zero-trust enforcement, while conceding these alone don't cover the appropriateness judgments agents need. The practical read for builders: the enforcement point belongs outside the model, in the harness or a gateway, not in the system prompt.