Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gaps
arXiv:2606.09084v1 Announce Type: cross Abstract: Tool-using LLM agents interact with the world through actions that persist state in artifacts (e.g., workspace files or logs). Consequently, jailbreak defenses must reason about cross-step composition rather than isolated text. Yet most existing attacks and defenses, including ``multi-turn'' jailbreaks such as Crescendo and Tree of Attacks,still assume a single contiguous conversation visible to the defender. This assumption breaks down in real agent pipelines, where enforcement is fragmented across tools, modules, and time, and where artifact
The rapid advancement and deployment of tool-using LLM agents necessitate a deeper understanding of their vulnerabilities, which are now being actively explored beyond simple prompt injection.
This research reveals critical security gaps in how AI agents interact with external tools and persistent states, highlighting a new attack vector beyond traditional jailbreaking methods.
The focus for AI agent security shifts from single-turn conversational defenses to more complex, cross-step compositional reasoning and provenance tracking across fragmented agent architectures.
- · Cybersecurity researchers
- · AI Red Team consultancies
- · Developers of robust agent security frameworks
- · Developers of insecure LLM agent systems
- · Organizations deploying AI agents without comprehensive security models
- · Attackers relying solely on basic jailbreak techniques
Exploiting these vulnerabilities could lead to data exfiltration, system manipulation, or unintended actions by AI agents.
Increased awareness of these attacks will drive the development of more complex and distributed security architectures for AI agents.
The necessity for robust provenance tracking in AI agent systems could lead to new industry standards and regulatory requirements for AI safety and security.
This signal links to a primary source. Continuum Brief monitors and indexes it as part of the live intelligence stream — we do not republish source content.
Read at arXiv cs.AI