Preprint reports pre-deployment hardening for tool-using AI agents

What happened

The paper, submitted July 21, 2026, says its system scans prompt templates, tool interfaces, and tool-invocation code for patterns that could enable leakage or misuse.

It then applies controls including tighter data schemas, sanitizing boundaries between instructions and data, allowlist-based tool access, and least-privilege checks, which restrict each agent or tool to the permissions it needs.

The authors report testing hardened versions of five CrewAI and LangGraph application codebases, plus the AgentDojo benchmark. They used direct requests, jailbreaks, instruction overrides, and stress-induced prompts.

Under those tests, reported post-hardening attack-success rates were 0% in four applications and 7.4% in the Network Monitoring Assistant. The authors describe those results as 100% leakage reduction in four applications and a 91% aggregate reduction in the remaining one.

Why it matters

Tool-using AI agents can act on retrieved or externally supplied content. A malicious instruction embedded in that content can seek sensitive data or unauthorized use of connected tools, making controls before deployment relevant to agent security.

What remains unclear

• The findings are self-reported in an arXiv preprint, not an independent replication, peer-reviewed result, or evidence of production deployment.
• The results cover five codebases, the authors’ leakage definitions, four attack categories, and a limited adaptive-testing protocol. They do not establish that prompt injection can be fully prevented.
• The authors report that stress-framed prompts were reduced rather than eliminated. They also identify schema-preserving tampering of inter-agent artifacts and authorization and context-isolation needs in multi-user systems as remaining limitations.
• OWASP guidance says it is unclear whether foolproof prompt-injection prevention methods exist.

Sources

1. Data Leakage Prevention in Agentic Applications via Preemptive HardeningPrimary source - arXiv - preprint - Jul 21, 2026

   Used for: Submission date, pipeline description, evaluation scope, reported results, and limitations.

   Open source

2. LLM01:2025 Prompt InjectionOWASP Gen AI Security Project - community security guidance - Date not listed

   Used for: Caveat that foolproof prevention for prompt injection is not established.

   Open source