Safeguarding LLM agents requires intent-to-execution integrity

In a position paper, researchers propose that safeguarding LLM agents requires first defining an end-to-end correctness property, namely intent-to-execution integrity, in which the agent's execution faithfully reflects the user's intent. The authors point out that most existing defenses implicitly assume tools are trustworthy, whereas systems such as OpenClaw that have an open third-party skill ecosystem and direct access to the user's environment break this assumption, exposing new failure modes in the execution pipeline such as malicious or over-privileged components. The paper structurally analogizes LLM agents to compilers, treats security violations as erroneous executions that fail to preserve user intent, summarizes two sources of problems—untrusted data ingestion and untrusted tool execution—and proposes four integrity properties that must hold simultaneously: Tool Integrity, Instruction Integrity, Judgment Integrity, and Data Flow Integrity. The authors use this to analyze existing agent defenses, stating that current systems provide only partial and non-composable coverage, leaving a fundamental gap in the security of modern LLM agents.