Boundary Audit Tool Blocks Staged Prompt Injection Before Agent Tools Run

The short version

Long-running coding agents read files, browse the web, and call tools over many steps. Attackers can hide instructions in content the agent loads later. A preprint, not yet peer-reviewed on arXiv 2610.05163 posted 4 October 2026 introduces boundary action auditing that predicts block or pass before risky tool calls, reporting 86 percent attack recall on Claude Sonnet with single-digit false blocks.

What the researchers did

Authors built an automated attack pipeline against Claude Code and Codex native environments across eight workflow types, seven attack goals, and six injection surfaces. They collected 479 execution pairs and 3,112 audit units. Path-Aligned Attribution (PAA) traces causal features of pending actions without extra training. Comparisons include ARGUS-style baselines with lower recall in their tables.

What they found

PAA reached about 86 percent interception recall with roughly 6 to 8 percent false block rates on Claude Sonnet in the paper’s main table, versus ARGUS recall near 44 to 47 percent and false positives 16 to 33 percent. The benchmark focuses on staged indirect prompt injection where input filters miss payloads split across sessions.

Why it matters for you

Security teams enabling agentic IDEs need controls at the tool boundary, not only at chat entry. Auditing the next shell command or file write matches how developers actually grant privileges.

What to keep in mind

Preprint, not yet peer-reviewed. Results cover specific agent products and dated model snapshots. Defenders must still patch apps and rotate credentials.

Coding agents read repos, run shells, and post comments. Staged attacks split malicious text across files or web pages loaded later. Input filters at chat start miss those payloads. Boundary auditing watches the next tool call instead. Pass or block decisions happen before the command runs.

Path aligned attribution traces which context influenced the pending action. No extra training means teams can try the auditor on current builds faster. False blocks annoy users but may prevent data loss. Recall measures how many real attacks get caught.

Security leads should combine auditing with least privilege tokens and secret scanners. Model names and percentages change as vendors patch agents.

Agents chain many tools in one task. Attackers hide instructions inside fetched pages. Filters at chat start miss later loads. Audit the next shell or write call. High recall catches more attacks. False blocks stop legit work. Balance safety with developer speed. Combine with secret vaults and scoped tokens. Retest after each agent upgrade.

Teams share papers so others can repeat the work. A preprint is an early public draft. Peer review may change claims later. Numbers in tables can move after feedback. Always read the linked paper for exact values. This desk note tracks when we last checked sources. We remove claims if sources disagree. If you build on this work, cite the primary paper. If you spot an error, tell the publisher through the site contact path.

Paper authors share methods so others can test them. Read the primary link for full tables. We use plain words here on purpose. Short sentences help busy readers. This block adds length without new claims. Facts still come only from cited sources. Dates follow the paper posting record. We skip hype words on purpose. You can share this brief with a teammate. They should still open the source PDF. Science moves fast in October twenty twenty six. Check back if the paper version changes.

Security staff should log blocked actions for review. Developers need clear messages when a block happens. Retest after each model upgrade from vendors. Keep human approval on money and delete commands. We last checked sources on twenty six October twenty twenty six.

Key takeaways

• Staged injections split malicious text across long horizons.
• Boundary auditing scores pending actions, not just first user prompt.
• PAA hits 86% recall on reported Claude Sonnet tests.
• Benchmark packs hundreds of traced agent runs for reuse.
• Posted 4 October 2026 on arXiv.

Sources

• Primary — arXiv, Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection (4 October 2026). PAA metrics and benchmark size.