一句话：提出 GrantBox 沙箱，集成真实工具让 LLM 智能体调用真实权限，评估其在提示注入下的权限使用安全性。
为 LLM 智能体配备真实世界工具能显著提升生产力，但把工具使用自主权交给智能体，也意味着把相应权限转移给了智能体及其底层 LLM；权限使用不当可能造成信息泄露与基础设施破坏。已有安全基准多依赖预先编码的工具和受限的交互模式，这种人工构造的环境与真实世界差异很大，难以评估智能体在关键权限控制与使用上的安全能力。为此，作者提出 GrantBox——一个用于分析智能体权限使用的安全评估沙箱。GrantBox 能自动集成真实世界工具，允许 LLM 智能体调用真实权限，从而在提示注入攻击下评估其权限使用行为。实验结果表明，LLM 虽具备基本安全意识并能拦截部分直接攻击，但仍易受更复杂的攻击影响，在精心设计的场景中平均攻击成功率达 84.80%。
Equipping LLM agents with real-world tools can substantially improve productivity. However, granting agents autonomy over tool use also transfers the associated privileges to both the agent and the underlying LLM. Improper privilege usage may lead to serious consequences, including information leakage and infrastructure damage. While several benchmarks have been built to study agents' security, they often rely on pre-coded tools and restricted interaction patterns. Such crafted environments differ substantially from the real-world, making it hard to assess agents' security capabilities in critical privilege control and usage. Therefore, we propose GrantBox, a security evaluation sandbox for analyzing agent privilege usage. GrantBox automatically integrates real-world tools and allows LLM agents to invoke genuine privileges, enabling the evaluation of privilege usage under prompt injection attacks. Our results indicate that while LLMs exhibit basic security awareness and can block some direct attacks, they remain vulnerable to more sophisticated attacks, resulting in an average attack success rate of 84.80% in carefully crafted scenarios.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{ZhangFLGWZJP26,
title = {Evaluating Privilege Usage of Agents with Real-World Tools},
author = {Quan Zhang and Lianhang Fu and Lvsi Lian and Gwihwan Go and Yujue Wang and Chijin Zhou and Yu Jiang and Geguang Pu},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3805554}
}