Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection
arXiv:2608.30041v1 Announce Type: cross Abstract: Large language model agents place outputs from external skills into their execution context, allowing attacker-controlled data to influence later priv