SOURCE-LINKED INTELLIGENCE

The Stochastic Deputy: Structural Tenant Isolation for Tool-Using LLM Agents

arXiv · AI, language, vision and robotics · article · Sep 13, 2026 · UTC

Multi-tenant tools commonly accept a tenant identifier and validate it against the caller's entitlement. For a large language model (LLM) agent, that pattern delegates resource selection to a process whose context may contain attacker controlled instructions. We formalize this stochastic deputy problem and present a structural defense: remove tenant identity from the Model Context Protocol (MCP) tool schema, bind scope to a verified credential, and enforce it below the agent. In a 373-trial ablation across eight model configurations and two transports, a correctly validated tenant parameter se

Read original source ↗ Open in workspace

recordType

paper

region

Global