{"id":"https://openalex.org/W7225567480","doi":"https://doi.org/10.5281/zenodo.24049560","title":"Secure Intent-Driven Internet Execution: A Threat Model and Defense Architecture for Autonomous Capability Invocation","display_name":"Secure Intent-Driven Internet Execution: A Threat Model and Defense Architecture for Autonomous Capability Invocation","publication_year":2026,"publication_date":"2026-11-08","ids":{"openalex":"https://openalex.org/W7225567480","doi":"https://doi.org/10.5281/zenodo.24049560"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.24049560","doi":"https://doi.org/10.5281/zenodo.24049560","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24049560","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.24049560","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100638045","display_name":"Jincheng Zhang","orcid":"https://orcid.org/0000-0001-7332-6704","observed_orcids":["https://orcid.org/0000-0001-7332-6704","https://orcid.org/0009-0005-1860-0009"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Zhang, Jincheng","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0009-0005-1860-0009","affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5100638045"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.8109999895095825,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.8109999895095825,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.11959999799728394,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.02590000070631504,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/autonomous-agents","display_name":"autonomous agents","score":0.6060000061988831},{"id":"https://openalex.org/keywords/generative-ai-security","display_name":"generative AI security","score":0.7210000157356262},{"id":"https://openalex.org/keywords/threat-model","display_name":"threat model","score":0.703000009059906},{"id":"https://openalex.org/keywords/sandboxed-execution","display_name":"sandboxed execution","score":0.7730000019073486},{"id":"https://openalex.org/keywords/prompt-injection","display_name":"prompt injection","score":0.6380000114440918},{"id":"https://openalex.org/keywords/defensive-architecture","display_name":"defensive architecture","score":0.5770000219345093},{"id":"https://openalex.org/keywords/api-security","display_name":"API security","score":0.34599998593330383},{"id":"https://openalex.org/keywords/security-invariants","display_name":"security invariants","score":0.5370000004768372}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7753000259399414},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7085999846458435},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.6110000014305115},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.4147000014781952},{"id":"https://openalex.org/C2779089604","wikidata":"https://www.wikidata.org/wiki/Q7169333","display_name":"Permission","level":2,"score":0.39809998869895935},{"id":"https://openalex.org/C22111027","wikidata":"https://www.wikidata.org/wiki/Q1070427","display_name":"Internet security","level":4,"score":0.3953000009059906},{"id":"https://openalex.org/C9628104","wikidata":"https://www.wikidata.org/wiki/Q788009","display_name":"Autonomous system (mathematics)","level":2,"score":0.3896999955177307},{"id":"https://openalex.org/C2778012447","wikidata":"https://www.wikidata.org/wiki/Q1034415","display_name":"Scope (computer science)","level":2,"score":0.37720000743865967},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.3732999861240387},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.3662000000476837},{"id":"https://openalex.org/C31139447","wikidata":"https://www.wikidata.org/wiki/Q5380386","display_name":"Enterprise information security architecture","level":2,"score":0.3653999865055084},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.35920000076293945},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.34360000491142273},{"id":"https://openalex.org/C114869243","wikidata":"https://www.wikidata.org/wiki/Q133735","display_name":"Security through obscurity","level":5,"score":0.3352000117301941},{"id":"https://openalex.org/C2776527387","wikidata":"https://www.wikidata.org/wiki/Q1671839","display_name":"Invocation","level":2,"score":0.2971000075340271},{"id":"https://openalex.org/C2778717966","wikidata":"https://www.wikidata.org/wiki/Q4189076","display_name":"Protection mechanism","level":3,"score":0.29330000281333923},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.28349998593330383},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.2822999954223633},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.27549999952316284},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.2736999988555908},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.27160000801086426},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.2637999951839447},{"id":"https://openalex.org/C22927095","wikidata":"https://www.wikidata.org/wiki/Q1784206","display_name":"Stateful firewall","level":3,"score":0.25529998540878296},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.25429999828338623},{"id":"https://openalex.org/C9354725","wikidata":"https://www.wikidata.org/wiki/Q286017","display_name":"Operationalization","level":2,"score":0.25200000405311584}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.24049560","doi":"https://doi.org/10.5281/zenodo.24049560","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24049560","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.24049561","doi":"https://doi.org/10.5281/zenodo.24049561","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24049561","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.5281/zenodo.24049560","doi":"https://doi.org/10.5281/zenodo.24049560","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24049560","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, justice, and strong institutions","score":0.47620001435279846}],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7225580437","https://openalex.org/W7225586814","https://openalex.org/W7225571473","https://openalex.org/W7220728269","https://openalex.org/W7202260492","https://openalex.org/W7220744183","https://openalex.org/W7202212520","https://openalex.org/W7213915180","https://openalex.org/W7169791914","https://openalex.org/W7165673943"],"abstract_inverted_index":{"The":[0,256,368,389,456],"evolution":[1],"of":[2,68,112,314],"the":[3,75,110,120,158,165,216,219,315,322,328,356],"Internet":[4,26,29,133,143],"toward":[5],"increasingly":[6,72],"autonomous":[7,49,80,88,142,189,437],"and":[8,22,40,48,62,84,176,252,282,297,338,382,402,430,436,448,470],"interconnected":[9,180,231],"computational":[10],"environments":[11],"creates":[12],"new":[13],"security":[14,30,70,149,181,254,289,387,396,472],"challenges":[15],"for":[16,140],"systems":[17],"that":[18,118,187,206,210,264,319,464],"interpret":[19,57,193,325],"human":[20],"intentions":[21],"independently":[23,380],"invoke":[24,60,103],"heterogeneous":[25],"capabilities.":[27],"Traditional":[28],"mechanisms":[31],"primarily":[32],"focus":[33],"on":[34,66],"protecting":[35,141],"accounts,":[36],"networks,":[37],"applications,":[38],"APIs,":[39,61],"data":[41],"resources.":[42],"However,":[43],"when":[44,305],"generative":[45],"artificial":[46],"intelligence":[47],"agents":[50],"are":[51,442],"able":[52],"to":[53,123,195,202,209,324,330,346,358,415],"discover":[54],"external":[55,373],"services,":[56,107],"web":[58,95],"content,":[59,96],"execute":[63,116,331],"multi-step":[64,296],"operations":[65,117,178],"behalf":[67],"users,":[69],"risks":[71],"emerge":[73],"from":[74,327],"relationship":[76],"between":[77,433],"user":[78,113,360,434],"intentions,":[79,361],"decision-making,":[81],"capability":[82,144,236,244,268,411],"authorization,":[83,114,243],"execution":[85,174,280,299,424],"behavior.":[86,439],"An":[87],"system":[89,190,438],"may":[90,342],"be":[91,292],"manipulated":[92],"by":[93],"malicious":[94],"receive":[97],"adversarial":[98],"instructions":[99],"through":[100,384],"third-party":[101,339],"tools,":[102],"impersonated":[104],"or":[105,115,160,364],"compromised":[106],"unintentionally":[108],"expand":[109,362],"scope":[111],"exceed":[119],"permissions":[121],"necessary":[122],"accomplish":[124,196],"an":[125,151,188,197,260,271,385,403],"intended":[126],"objective.":[127,211],"This":[128],"paper":[129,217,390],"proposes":[130,371],"Secure":[131,220],"Intent-Driven":[132,221],"Execution":[134,222],"(SIDIE)":[135],"as":[136,150,179,199,376,444],"a":[137,225,306,393,460],"security-oriented":[138],"framework":[139,317,369,463],"invocation.":[145],"Rather":[146],"than":[147,301,452],"treating":[148,372],"independent":[152],"access-control":[153],"mechanism":[154],"applied":[155],"only":[156,304],"at":[157],"application":[159],"network":[161],"level,":[162],"SIDIE":[163],"considers":[164],"user's":[166],"original":[167],"intention,":[168],"authorized":[169,383],"operational":[170],"boundaries,":[171],"selected":[172],"capabilities,":[173],"context,":[175,281],"actual":[177],"objects.":[182],"Its":[183],"central":[184],"principle":[185],"is":[186,318,459],"should":[191,352],"not":[192,353],"permission":[194,201,421],"objective":[198],"unrestricted":[200],"perform":[203],"any":[204],"operation":[205,250],"might":[207],"contribute":[208],"To":[212],"operationalize":[213],"this":[214],"principle,":[215],"introduces":[218,259],"Architecture":[223],"(SIDIEA),":[224],"conceptual":[226,461],"defense":[227,398],"architecture":[228,257,458],"comprising":[229],"eight":[230],"components:":[232],"intent":[233],"boundary":[234],"protection,":[235],"invocation":[237,269],"authentication,":[238],"tool-output":[239],"instruction":[240],"isolation,":[241],"least-privilege":[242],"trust":[245],"assessment,":[246],"sandboxed":[247],"execution,":[248],"unauthorized":[249,410],"detection,":[251],"cross-service":[253,298,427],"monitoring.":[255],"further":[258],"intent-bound":[261],"authorization":[262,283,435],"model":[263],"associates":[265],"each":[266],"proposed":[267,316,457],"with":[270],"explicitly":[272],"defined":[273],"task":[274,307,347],"scope,":[275],"permitted":[276],"operation,":[277],"resource":[278],"boundary,":[279],"condition.":[284],"It":[285],"also":[286,391],"examines":[287],"how":[288],"decisions":[290],"can":[291],"continuously":[293],"evaluated":[294],"throughout":[295],"rather":[300,451],"being":[302],"established":[303,454],"initially":[308],"begins.":[309],"A":[310],"particularly":[311],"important":[312],"distinction":[313],"it":[320],"separates":[321],"authority":[323,329,357],"information":[326,344,378],"operations.":[332],"Webpages,":[333],"retrieved":[334],"documents,":[335],"API":[336],"responses,":[337],"tool":[340,374],"outputs":[341,375],"provide":[343],"relevant":[345],"completion,":[348],"but":[349],"their":[350],"contents":[351],"automatically":[354],"acquire":[355],"modify":[359],"permissions,":[363],"authorize":[365],"additional":[366],"actions.":[367],"therefore":[370],"untrusted":[377],"unless":[379],"validated":[381],"appropriate":[386],"mechanism.":[388],"develops":[392],"threat":[394],"model,":[395],"invariants,":[397],"mechanisms,":[399],"research":[400,449,462],"propositions,":[401],"evaluation":[404],"methodology.":[405],"Potential":[406],"advantages":[407,441],"include":[408],"reduced":[409,426],"invocation,":[412],"improved":[413,431],"resistance":[414],"indirect":[416],"prompt":[417],"injection,":[418],"more":[419],"precise":[420],"enforcement,":[422],"stronger":[423],"traceability,":[425],"attack":[428],"propagation,":[429],"alignment":[432],"These":[440],"presented":[443],"theoretically":[445],"motivated":[446],"possibilities":[447],"hypotheses":[450],"experimentally":[453],"outcomes.":[455],"requires":[465],"subsequent":[466],"implementation,":[467],"formal":[468],"analysis,":[469],"empirical":[471],"evaluation.":[473]},"counts_by_year":[],"updated_date":"2026-11-10T11:39:43.021295","created_date":"2026-11-09T00:00:00"}