AgentVisor: Defending Against Prompt Injection in LLM Agents Through Semantic Virtualization

AgentVisor is a defense framework that draws on operating system virtualization and defends against direct and indirect prompt injection in LLM agents through semantic privilege separation; in experiments, the attack success rate drops to 0.65%. The framework treats the target agent as an untrusted guest, has a trusted semantic visor intercept tool calls, and uses a one-time self-correction mechanism to turn safety violations into constructive feedback. Compared with the no-defense setting, average utility decreases by only 1.45%.