{"id":"https://openalex.org/W7160053090","doi":"https://doi.org/10.3390/computation14050098","title":"Securing Tool-Using AI Agents Against Injection and Authority Misuse","display_name":"Securing Tool-Using AI Agents Against Injection and Authority Misuse","publication_year":2026,"publication_date":"2026-04-25","ids":{"openalex":"https://openalex.org/W7160053090","doi":"https://doi.org/10.3390/computation14050098"},"language":"en","primary_location":{"id":"doi:10.3390/computation14050098","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computation14050098","pdf_url":"https://www.mdpi.com/2079-3197/14/5/98/pdf?version=1779695899","source":{"id":"https://openalex.org/S2738402919","display_name":"Computation","issn_l":"2079-3197","issn":["2079-3197"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computation","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2079-3197/14/5/98/pdf?version=1779695899","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5095307867","display_name":"Hasan Kanaker","orcid":null},"institutions":[{"id":"https://openalex.org/I36622005","display_name":"Petra University","ror":"https://ror.org/039d9es10","country_code":"JO","type":"education","lineage":["https://openalex.org/I36622005"]}],"countries":["JO"],"is_corresponding":false,"raw_author_name":"Hasan Kanaker","raw_affiliation_strings":["Department of Information Security, Faculty of Information Technology, University of Petra, Amman 11196, Jordan"],"raw_orcid":"https://orcid.org/0009-0000-9504-3844","affiliations":[{"raw_affiliation_string":"Department of Information Security, Faculty of Information Technology, University of Petra, Amman 11196, Jordan","institution_ids":["https://openalex.org/I36622005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135079475","display_name":"Hussam Fakhouri","orcid":null},"institutions":[{"id":"https://openalex.org/I33926330","display_name":"Al-Balqa Applied University","ror":"https://ror.org/00qedmt22","country_code":"JO","type":"education","lineage":["https://openalex.org/I33926330"]}],"countries":["JO"],"is_corresponding":true,"raw_author_name":"Hussam Fakhouri","raw_affiliation_strings":["Department of Intelligent Systems, Faculty of Artificial Intelligence, Al-Balqa Applied University, Al-Salt 19117, Jordan"],"raw_orcid":"https://orcid.org/0000-0002-9170-3291","affiliations":[{"raw_affiliation_string":"Department of Intelligent Systems, Faculty of Artificial Intelligence, Al-Balqa Applied University, Al-Salt 19117, Jordan","institution_ids":["https://openalex.org/I33926330"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5042749439","display_name":"Nader Abdel Karim","orcid":null},"institutions":[{"id":"https://openalex.org/I33926330","display_name":"Al-Balqa Applied University","ror":"https://ror.org/00qedmt22","country_code":"JO","type":"education","lineage":["https://openalex.org/I33926330"]}],"countries":["JO"],"is_corresponding":false,"raw_author_name":"Nader Abdel Karim","raw_affiliation_strings":["Department of Intelligent Systems, Faculty of Artificial Intelligence, Al-Balqa Applied University, Al-Salt 19117, Jordan"],"raw_orcid":"https://orcid.org/0000-0001-8431-5218","affiliations":[{"raw_affiliation_string":"Department of Intelligent Systems, Faculty of Artificial Intelligence, Al-Balqa Applied University, Al-Salt 19117, Jordan","institution_ids":["https://openalex.org/I33926330"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007709629","display_name":"Maher Abuhamdeh","orcid":null},"institutions":[{"id":"https://openalex.org/I91633459","display_name":"Middle East University","ror":"https://ror.org/059bgad73","country_code":"JO","type":"education","lineage":["https://openalex.org/I91633459"]}],"countries":["JO"],"is_corresponding":false,"raw_author_name":"Maher Abuhamdeh","raw_affiliation_strings":["Department of Data Science and Artificial Intelligence, Middle East University, Amman 11831, Jordan"],"raw_orcid":"https://orcid.org/0009-0009-1541-5050","affiliations":[{"raw_affiliation_string":"Department of Data Science and Artificial Intelligence, Middle East University, Amman 11831, Jordan","institution_ids":["https://openalex.org/I91633459"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135189158","display_name":"Nurul Halimatul Asmak Ismail","orcid":"https://orcid.org/0000-0002-2222-5644"},"institutions":[{"id":"https://openalex.org/I106778892","display_name":"Princess Nourah bint Abdulrahman University","ror":"https://ror.org/05b0cyh02","country_code":"SA","type":"education","lineage":["https://openalex.org/I106778892"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Nurul Halimatul Asmak Ismail","raw_affiliation_strings":["Department of Computer Science and Information Technology, Applied College, Princess Nourah bint Abdulrahman University, P.O. Box 84428, Riyadh 11671, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0002-2222-5644","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Information Technology, Applied College, Princess Nourah bint Abdulrahman University, P.O. Box 84428, Riyadh 11671, Saudi Arabia","institution_ids":["https://openalex.org/I106778892"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5135150367","display_name":"Sandi Fakhouri","orcid":"https://orcid.org/0000-0002-8011-9671"},"institutions":[{"id":"https://openalex.org/I114972647","display_name":"University of Jordan","ror":"https://ror.org/05k89ew48","country_code":"JO","type":"education","lineage":["https://openalex.org/I114972647"]}],"countries":["JO"],"is_corresponding":false,"raw_author_name":"Sandi Fakhouri","raw_affiliation_strings":["Department of Computer Science, The University of Jordan, Amman 11942, Jordan"],"raw_orcid":"https://orcid.org/0000-0002-8011-9671","affiliations":[{"raw_affiliation_string":"Department of Computer Science, The University of Jordan, Amman 11942, Jordan","institution_ids":["https://openalex.org/I114972647"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5135079475"],"corresponding_institution_ids":["https://openalex.org/I33926330"],"apc_list":{"value":1600,"currency":"CHF","value_usd":1782},"apc_paid":{"value":1600,"currency":"CHF","value_usd":1782},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.53624829,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"14","issue":"5","first_page":"98","last_page":"98"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.3093999922275543,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.3093999922275543,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.11680000275373459,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.05660000070929527,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/limiting","display_name":"Limiting","score":0.5909000039100647},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.5634999871253967},{"id":"https://openalex.org/keywords/database-transaction","display_name":"Database transaction","score":0.47119998931884766},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.43720000982284546},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.3790999948978424},{"id":"https://openalex.org/keywords/private-information-retrieval","display_name":"Private information retrieval","score":0.36970001459121704},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.3650999963283539}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6937000155448914},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6496999859809875},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.5909000039100647},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.5634999871253967},{"id":"https://openalex.org/C75949130","wikidata":"https://www.wikidata.org/wiki/Q848010","display_name":"Database transaction","level":2,"score":0.47119998931884766},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.43720000982284546},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.3790999948978424},{"id":"https://openalex.org/C99221444","wikidata":"https://www.wikidata.org/wiki/Q1532069","display_name":"Private information retrieval","level":2,"score":0.36970001459121704},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.3650999963283539},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.35429999232292175},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.34529998898506165},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.33230000734329224},{"id":"https://openalex.org/C148220186","wikidata":"https://www.wikidata.org/wiki/Q7111912","display_name":"Outcome (game theory)","level":2,"score":0.3165999948978424},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.27950000762939453},{"id":"https://openalex.org/C198082294","wikidata":"https://www.wikidata.org/wiki/Q3399648","display_name":"Position (finance)","level":2,"score":0.27219998836517334},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.25699999928474426},{"id":"https://openalex.org/C98184364","wikidata":"https://www.wikidata.org/wiki/Q1780131","display_name":"Argument (complex analysis)","level":2,"score":0.2540999948978424}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/computation14050098","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computation14050098","pdf_url":"https://www.mdpi.com/2079-3197/14/5/98/pdf?version=1779695899","source":{"id":"https://openalex.org/S2738402919","display_name":"Computation","issn_l":"2079-3197","issn":["2079-3197"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computation","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:5e53f158dc644ff2bb810c167c43944a","is_oa":true,"landing_page_url":"https://doaj.org/article/5e53f158dc644ff2bb810c167c43944a","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Computation, Vol 14, Iss 5, p 98 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/computation14050098","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computation14050098","pdf_url":"https://www.mdpi.com/2079-3197/14/5/98/pdf?version=1779695899","source":{"id":"https://openalex.org/S2738402919","display_name":"Computation","issn_l":"2079-3197","issn":["2079-3197"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computation","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7160053090.pdf","grobid_xml":"https://content.openalex.org/works/W7160053090.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Tool-using":[0],"AI":[1],"agents":[2,35],"couple":[3],"a":[4,97,113,124],"language":[5],"model":[6,116],"with":[7],"controller":[8],"logic,":[9],"memory,":[10],"and":[11,21,48,76,92,121,123,137,139,155,169,190,197,211,228,231],"external":[12,50],"tools":[13],"such":[14],"as":[15,225,246],"browsers,":[16],"email,":[17],"calendars,":[18],"file":[19],"systems,":[20],"transaction":[22],"APIs.":[23],"This":[24],"architecture":[25],"expands":[26],"capability,":[27],"but":[28,192],"it":[29],"also":[30],"enlarges":[31],"the":[32,80,148,174,179],"security":[33],"boundary:":[34],"routinely":[36],"ingest":[37],"untrusted":[38],"content":[39],"while":[40,205],"holding":[41],"privileges":[42],"that":[43,117,129],"can":[44],"reveal":[45],"private":[46],"data":[47],"trigger":[49],"side":[51],"effects.":[52],"The":[53,109],"resulting":[54],"failures":[55],"are":[56],"not":[57],"limited":[58],"to":[59,142],"poor":[60],"text":[61],"generation;":[62],"they":[63,233],"include":[64],"prompt":[65],"injection,":[66],"indirect":[67,203],"injection":[68,204],"through":[69],"tool":[70,81,176],"outputs,":[71],"confused-deputy":[72],"behavior,":[73],"unauthorized":[74],"actions,":[75],"misleading":[77],"claims":[78],"about":[79],"state.":[82],"Because":[83],"large-scale":[84],"testing":[85],"on":[86],"deployed":[87,256],"products":[88],"is":[89,112,178],"difficult,":[90],"vendor-specific,":[91],"ethically":[93],"sensitive,":[94],"we":[95],"present":[96],"transparent,":[98],"theoretical":[99],"simulation-based":[100],"framework":[101,149],"for":[102,150,254],"evaluating":[103],"user-facing":[104],"risk":[105],"in":[106],"tool-using":[107],"agents.":[108],"methodological":[110],"contribution":[111],"formal":[114],"threat":[115,153],"separates":[118],"compromise,":[119],"harm,":[120],"severity,":[122],"Monte":[125],"Carlo":[126],"evaluation":[127],"pipeline":[128],"maps":[130],"architectural":[131,227],"choices":[132],"(permissions,":[133],"retrieval,":[134],"memory":[135],"exposure,":[136],"approvals)":[138],"defensive":[140],"controls":[141],"comparable":[143],"outcome":[144],"metrics.":[145],"We":[146],"instantiate":[147],"six":[151],"representative":[152],"scenarios":[154],"nine":[156],"defense":[157],"configurations,":[158],"reporting":[159],"attack":[160],"success":[161],"rate":[162,212],"(ASR),":[163],"benign":[164],"task":[165],"success,":[166],"latency":[167],"overhead,":[168],"severity-weighted":[170],"harm.":[171],"Across":[172],"scenarios,":[173],"least-privilege":[175],"design":[177,248],"strongest":[180],"single":[181],"broad":[182],"control,":[183],"human-in-the-loop":[184],"approvals":[185],"sharply":[186],"reduce":[187],"high-impact":[188],"actions":[189],"exports":[191],"degrade":[193],"under":[194],"user":[195],"error":[196],"habituation,":[198],"retrieval":[199],"allowlisting":[200],"nearly":[201],"eliminates":[202],"leaving":[206],"other":[207],"channels":[208],"largely":[209],"unaffected,":[210],"limiting":[213],"reduces":[214],"tail":[215],"severity":[216],"more":[217],"than":[218,240,251],"ASR.":[219],"These":[220],"results":[221],"position":[222],"agent":[223],"safety":[224],"an":[226,236],"operational":[229],"problem":[230],"because":[232],"arise":[234],"from":[235],"assumption-explicit":[237],"simulator":[238],"rather":[239,250],"field":[241],"measurements,":[242],"should":[243],"be":[244],"read":[245],"comparative":[247],"guidance":[249],"incident-rate":[252],"estimates":[253],"any":[255],"product.":[257]},"counts_by_year":[],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2026-05-05T00:00:00"}