AgentTracer: reconstructing Agent attack chains through intent tracing

A research team from Sun Yat-sen University and the Hong Kong University of Science and Technology proposes AgentTracer, which extracts context and decision relationships from Agent reasoning records, builds an intent-driven execution graph, and aligns it with the user authorization space, thereby locating the injection point of indirect prompt injection in historical logs and reconstructing the attack chain. On 300 successful attack logs each from the AgentDyn and InjecAgent datasets, the system achieved an average attack identification rate of 97.34%, injection point localization accuracy of 94.17%, attack chain coverage of 90.25%, and precision of 93.56%. Ablation experiments show that replacing the intent-driven execution graph with a temporal sequence graph reduced injection point localization accuracy by 17 percentage points, and using an LLM to directly judge intent deviation reduced it by 27 percentage points. Among 394 evaluable execution edges in 100 normal execution logs, the authors report that 13 were mislabeled as intent deviation, an edge-level false positive rate of 3.52%; the authors also note that the method relies on relatively complete reasoning records and is better suited to architectures such as ReAct that have explicit decision records.