Containing multiple privilege escalations in LLM agent systems: a mandatory access control framework

The paper proposes SEAgent, a mandatory access control framework based on attribute-based access control (ABAC) to prevent privilege escalation in LLM agent systems. The authors define privilege escalation as an agent performing actions beyond the minimum permissions required by the user's task, and identify new privilege escalation scenarios on a formal model of LLM agent systems, including a variant of the classic confused deputy problem in multi-agent systems. SEAgent monitors agent-tool interactions via an information flow graph and enforces customizable security policies based on entity attributes. Evaluation shows SEAgent effectively blocks various privilege escalations while maintaining low false positive rates and negligible system overhead.