Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions¶

🕒 Published (v1): 2026-07-14 06:25 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

This survey argues that isolation—explicit boundary enforcement between user inputs, tool access, execution channels, inter-agent communication, and environment-originated context—should be treated as a first-class safety principle for LLM-agent systems, not a secondary concern. The authors propose a five-boundary taxonomy (user-agent, agent-tool, agent-execution, agent-agent, system-environment) that unifies fragmented attack/defense literature around where isolation first breaks and how compromise then propagates. The result is both a structured map of the current literature and a research agenda for isolation-by-construction.

Problem¶

The LLM-agent safety literature is fragmented by attack type, application domain, or capability. This organization obscures a common root cause: most failures—prompt injection, tool misuse, memory poisoning, communication-borne attacks—share the same structural origin, which is loss of isolation at a specific boundary. Existing surveys do not clearly explain cross-boundary propagation, making it hard to reason about systemic failure paths or design principled defenses.

Method¶

The paper organizes existing literature around five isolation boundaries, classifying each work by the primary boundary where isolation first fails:

User-Agent: Whether user content remains data or becomes control (prompt injection, role confusion, persistent compromise via memory injection).
Agent-Tool: Whether tool outputs/descriptions/metadata remain bounded observations rather than hidden control channels (indirect injection, MCP/protocol manipulation, trajectory-level unsafe tool orchestration).
Agent-Execution: Whether model output is mediated before becoming real-world action (code execution, browser/GUI actions, embodied/VLA systems, unsafe action realization).
Agent-Agent: Whether inter-agent messages remain bounded contributions rather than unverified control signals (prompt infection, topology-dependent cascade, shared-memory weaponization).
System-Environment: Whether external content (web pages, RAG retrievals, documents) remains observational rather than instructional (indirect prompt injection, RAG poisoning, environment-mediated disclosure).

Papers touching multiple boundaries are classified by the first point of isolation loss to keep the taxonomy tractable.

Key Contributions¶

Boundary-centric taxonomy of five isolation boundaries with explicit mappings from each boundary to its representative attack subtypes, propagation patterns, and defenses.
Unification of superficially disparate failure modes (prompt injection, tool misuse, memory poisoning) under a single structural explanation: loss of isolation at a boundary.
Cross-boundary failure path analysis showing how compromise initiated at one boundary (e.g., user-agent) propagates downstream (agent-tool → agent-execution → agent-agent).
Research agenda for isolation-by-construction emphasizing trust separation, scoped capabilities, traceability, and recovery mechanisms.

Results¶

This is a survey; no new empirical results are reported. The paper maps approximately 100+ cited works across the five boundaries. Representative benchmarks catalogued include:

User-agent: HarmBench, JailbreakBench, JailbreakEval, SG-Bench, Sorry-Bench
Agent-tool: MCP Security Bench, ToolSafe, CIBER, MOSAIC-Bench
Agent-execution: ST-WebAgentBench, SafeArena, HW-EBench, Embodied Agent Interface, HASARD, HEAL
Agent-agent: NetSafe, G-Safeguard
System-environment: (indirect injection, RAG poisoning works)

Limitations¶

No new experiments or quantitative validation of the taxonomy's explanatory power.
Classification by "first boundary of isolation failure" is a simplifying heuristic; many attacks are inherently multi-boundary and the assignment may be ambiguous.
The paper is cut off at Section 6 (System-Environment) in the provided text, so the full taxonomy detail for that boundary is not available.
The agenda for isolation-by-construction is descriptive rather than prescriptive: specific mechanisms (type systems, capability calculi, formal models) are mentioned but not developed.
Coverage is inherently incomplete and shaped by which threat types have received community attention; structurally under-studied boundaries may appear safer than they are.

Relevance to Harnesses / Meta-Harnesses¶

The paper directly names agent harnesses (Meng et al., 2026) as a motivating artifact alongside managed agents and orchestrators, framing harnesses as systems where the five boundaries are instantiated concretely. The agent-tool boundary analysis—covering trajectory-level orchestration, protocol metadata risks, and MCP-style ecosystems—maps almost exactly onto what a harness controls: tool dispatch, capability scoping, and workflow sequencing. The agent-agent boundary analysis of topology, privilege separation, and attribution is equally central to multi-agent meta-harnesses that coordinate fleets of subagents. The isolation-by-construction agenda (scoped capabilities, typed interfaces, traceability) provides a principled design checklist for harness authors, and the cross-boundary propagation model explains why harness-level sandboxing is a necessary but not sufficient safety layer.