Three of Four Major Agent Frameworks Provide No Built-In Confinement for Delegated Authority

arXiv 2609.00267·high signalXBlueskyLinkedInCopy link

Evaluating agent security under an untrusted-model assumption, where a fully prompt-injected agent must still not exceed its delegated authority, the authors test LangGraph, CrewAI, AutoGen, and the MCP authorization model against four adversaries: confused deputy, token theft and replay, prompt-injection privilege escalation, and compromised sub-agents. Three provide no built-in confinement and one only partial; no existing standard alone covers the eight derived requirements. Their authorization broker accepts 0 of 200,000 forged tokens and confines a compromised sub-agent to a mean of 1.5 reachable actions versus all 8,100 under bearer delegation across 2,000 randomized scenarios, at about 2.6 microseconds per decision.