{
  "id": 19619432,
  "title": "I built a 50-year-old security model for LLM agents. It caught things I didn't expect.",
  "url": "https://urgent.news/2026/11/12/i-built-a-50-year-old-security-model-for-llm-agents-it-caught-things",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-12T07:51:54.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/nice_dev_226/i-built-a-50-year-old-security-model-for-llm-agents-it-caught-things-i-didnt-expect-84m"
  },
  "original_language": "en",
  "account": "Security researcher Kelvra has developed a system to safeguard large language model (LLM) agents against prompt injection attacks. The model reads data, which includes instructions that can redirect its behavior, but it cannot distinguish between normal tokens and hidden instructions. Traditional information flow control, a concept developed 50 years ago, is the solution. Kelvra allows developers to write a policy file that designates sources, sinks, and the few permitted crossings between them. This summary can now be seen by the support team, a human has reviewed it, and it carries a vouch for its authenticity. In Python, values carry these labels. Kelvra checks the flow before data leaves, ensuring that no under-labeling occurs, which could lead to data leaks. The system analyzes the policy before any execution, identifying potential injection attacks before they happen, without actually running the model or transmitting any traffic. Every run produces an audit record, documenting what was read, what crossed, who consented, and what was refused. This system is not foolproof; it cannot see inside the model itself and relies on developers to ensure accurate labeling. However, it provides a portable label vocabulary, a policy file that a non-programmer can understand, and an audit artifact for regulators. Kelvra's core is finished, with over 1200 tests and no dependencies, but it requires a framework adapter to be deployable. The researcher invites contributions, critiques, and collaborations to enhance the model.",
  "summary": "Prompt injection is the problem nobody's actually solved. An agent reads an email or a web page, and hidden inside that data is an instruction that redirects it. The model can't tell the difference — to it, everything is just tokens. The structural answer has existed for fifty years: information flow control. Data carries labels saying who may read it and who vouches for it, and the system checks…",
  "key_points": [
    "Kelvra developed a 50-year-old security model for LLM agents to prevent prompt injection attacks.",
    "The model uses a policy file to designate sources, sinks, and permitted crossings between them.",
    "Kelvra checks data flow before execution, identifying potential attacks without running the model."
  ],
  "editors_take": "Applying decades-old information flow control to modern AI agents shifts the defensive focus from reactive monitoring to proactive policy enforcement that provides regulators with verifiable audit trails.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}