Trust Laundering: The Failure Primitive Hiding Under Five Names in Agentic AI

Here is a failure you have almost certainly seen. An AI system produces a confident, specific, citation-shaped claim: a paper title, an author list, a percentage, an RFC number. It looks like evidence. It is passed along, quoted, built on. Only later does someone check, and the paper does not exist, the RFC is about something else, and the percentage was never measured. The fabrication did not announce itself as untrusted. It arrived wearing the uniform of a citation, and everything downstream saluted.

We watched this happen repeatedly, and in a place that makes the point sharp: inside structured analyses whose entire subject was this exact failure, the models doing the analysis kept manufacturing citation-shaped and percentage-shaped claims that were then treated, briefly, as established. The content was untrusted. The form was authoritative. The boundary between "a model said this" and "this is true" was never labeled, so the claim crossed it for free.

Call the phenomenon trust laundering: untrusted content, or unearned authority, crossing a boundary and coming out the other side with a trust status it did not have going in. Once you have the name, you start seeing it across agentic systems, under five different names the field usually treats as five different problems. They are not identical problems. But they share this one primitive, and a common control family addresses a large part of that shared surface, much of it already built and published. This piece maps the primitive and points you at the tools.

The primitive, stated precisely

Strip the five problems down and the same shape is underneath each:

An agentic system fails when untrusted content or unearned authority is laundered into trusted, authority-bearing status as it crosses a boundary the system failed to label. The response is a control family centered on information-flow control: attach provenance at ingestion, make it survive transformation, distinguish data from authority-bearing instructions, mint authority only through an explicit authorization step, and mediate consequential actions at deterministic sinks outside the model.

Say the scope out loud, because overclaiming it is the fastest way to lose a technical reader. The five categories are not operationally identical, and provenance is not the whole answer to any of them; some also require artifact integrity, sandboxing, delegation lifecycle, or workload identity that are not information-flow control by another name. The claim is narrower and more useful than "one bug, one fix": these problems repeatedly instantiate the same authority-transfer failure, and one related control family addresses much of the shared surface.

Two honesty notes belong right here, because leading with them is what makes the rest credible. This primitive is not a new observation; it is the design principle behind a named and growing body of work, and this article translates and maps that work rather than claiming it. The idea that an agent's static permissions are structurally decoupled from the fluctuating trustworthiness of what it is currently reading has been surveyed across more than two hundred papers and named a "trust-authorization mismatch" (SoK, arXiv:2512.06914), and the design response of pulling control and data flow out of the untrusted context and enforcing policy deterministically outside the model is the explicit design of CaMeL (Debenedetti et al., 2025). If that is new to you, this guide is worth your time; if it is not, treat it as a consolidated map.

And provenance is the right frame precisely because the one channel you cannot instrument is the model's own reasoning. Untrusted text becomes an action through a stochastic process you cannot fully audit, so you do not try to verify the agent reasoned correctly. You bound what it is permitted to do, indexed to the trust of its inputs, attest the constraints, and account for the result. Bound, attest, account, not prove.

Five faces of one primitive

The reason trust laundering hides is that it crosses a different boundary in each subsystem, and each boundary has its own literature. This table is the field guide in miniature; the case studies that follow put one concrete attack on each row.

The tool-call argument. An agent reading an untrusted email extracts a well-formed bank account number and passes it to a payment tool. No instruction was followed and no prompt injection was needed; a schema-valid value pulled from untrusted text simply influenced an authority-bearing operand. This is a provenance-blind confused-deputy failure: the system checked that the value was well-formed, never that it was trusted, and the argument boundary went unlabeled. It is the sharpest and most under-appreciated face of the bug, and it has a name in the literature now, argument-level provenance, with published implementations (PACT and PAuth, below). Its lesson is that agent security cannot be reduced to detecting malicious instructions.

The metadata channel. In the Model Context Protocol and similar tool ecosystems, a tool advertises itself with a free-text description that an instruction-following model then reads. When an attacker, a compromised server, or an untrusted registry entry can influence a tool's description or output, text intended as metadata can become an authority-bearing input to the model's planning process. The boundary that went unlabeled is the one between declared metadata and the instruction stream. There is now a dedicated SoK on this ecosystem's security (arXiv:2512.08290).

The model-packaging artifact. Before a single token of user input is processed, a model loads a chat template, a tokenizer config, a generation config. These pre-semantic artifacts are auto-loaded from a package and operate before any input-layer guardrail runs. They can alter how the system constructs prompts, tokenizes content, or initializes inference, and in unsafe packaging and loading paths they can expose conventional supply-chain and code-execution risk: hidden instructions embedded in chat templates are a demonstrated backdoor (arXiv:2602.04653), and Jinja template injection in a model's packaged chat template has produced remote code execution in the wild (CVE-2024-34359, "Llama Drama"). This face lives in the supply-chain literature rather than the agent-IFC literature, and spanning both under one primitive is part of what this map adds. Note the corollary: input filtering cannot see it, because it runs upstream of input.

The inter-agent message. In a multi-agent system, one agent summarizes untrusted content and passes the summary to a peer. After a hop or two, the external, untrusted origin has been forgotten, and the content now carries the authority of "a trusted agent said so." Provenance degraded silently along the chain. The boundary that went unlabeled is every inter-agent message that treated a payload as an instruction instead of as data with a source. The field-level framing of this problem, including collusion and coordinated attacks that go beyond provenance loss, is now established (Open Challenges in Multi-Agent Security, arXiv:2505.02077).

The IAM principal. An agent holds valid credentials and full authorization for its task, and is redirected mid-session by untrusted context. Its identity never changed; its behavior did. Worse, its own outputs re-enter the system as inputs, so an artifact it produced under influence becomes a future instruction. Call that an artifact-mediated principal, a conceptual extension rather than an established identity category: conventional identity systems have a slot for "who is acting" but none for "the thing this agent produced is now an input that can carry an attack." The boundary that went unlabeled is the gap between identity and behavior, which for a fixed-binary service is small and for an agent is the whole problem. This face also carries baggage that is not provenance at all, credential lifecycle, non-human identity, delegation, and session state, so provenance is necessary here but far from sufficient.

Five boundaries, five literatures, one recurring primitive: untrusted content acquiring authority because a boundary was crossed without a label.

One control family, in layers

Because the faces share a primitive, the controls share a family. It is cleanest to read them as architectural layers rather than a flat list, and for each layer there is published work you can build on rather than a principle you must invent. No single layer is sufficient alone, and the supply-chain and IAM faces in particular need controls (artifact integrity, workload identity, delegation lifecycle) that sit outside information-flow control entirely.

Representation: separate asserted instructions from referenced data. The moment a message's content can be interpreted as a command by whatever reads it next, you have a laundering channel. The invariant is not that data may never influence a plan (natural-language data legitimately shapes actions all the time); it is that untrusted data must not acquire control authority or bind a privileged operand merely because a model read it imperatively. Structurally separating the two channels is CaMeL's control/data split (arXiv:2503.18813).

Provenance: labels that survive transformation. A taint label is worthless if summarizing, translating, or extracting strips it. Labels carry both an integrity axis (where did this come from) and a confidentiality axis (where may it go) and propagate through transformation. FIDES (Microsoft Research, arXiv:2505.23643) does exactly this, with a formal model of what dynamic taint-tracking can and cannot enforce. The honest caveat that conservative propagation can become too restrictive to use is itself a named, studied problem with proposed fixes (permissive IFC for LLMs, arXiv:2410.03055).

Authorization: task-, object-, and argument-scoped capability, minted explicitly. Coarse scopes ("this agent may send email") are not enough when the exploit lives in one argument. Authority may originate in a natural-language instruction, but it should be minted only through an explicit authorization step that converts intent into a bounded, independently enforceable policy, never silently expanded by later model interpretation. Progent (arXiv:2504.11703) makes this a programmable privilege layer over tool names and arguments; PAuth (arXiv:2603.17170) binds operand values to their computational origins for server-side verification; PACT (arXiv:2605.11039) formalizes argument-level provenance.

Enforcement: a deterministic reference monitor at the sinks. The enforcement point is the consequential sink (the payment, the write, the egress), and the check is deterministic and outside the model. RTBAS (arXiv:2502.08966) auto-executes only the tool calls it can prove preserve integrity and confidentiality, and asks a human only about the residue. That residue-to-a-human pattern is the correct shape: mechanize what is mechanizable, escalate the rest.

Containment and accountability: the layers IFC does not cover. Blast-radius limits (rate caps, reversibility tiers, sandboxing), artifact integrity for the supply-chain face (signing, reproducible builds, constrained loaders), and workload identity plus delegation scoping for the IAM face are not information-flow control, and a piece that pretended provenance subsumed them would be wrong. Accountability, the execution-provenance and audit trail that lets you reconstruct what influenced an action after the fact, is surveyed as its own problem ("From Agent Traces to Trust", arXiv:2606.04990).

Notice what this list is: a map to real, published, buildable tools. CaMeL supplies the one utility measurement the field actually has, solving 77% of the AgentDojo benchmark with provable security against 84% for the undefended baseline, roughly a seven-point utility cost. The open question is not whether the approach works but whether that cost generalizes beyond that benchmark's task distribution, and adaptive-attack evaluations warn that static benchmark numbers overstate robustness (arXiv:2606.26479). Build on these; do not reinvent them.

The engineering distillations

The academic systems above are correct but not packaged as decisions. Here is the practitioner residue, the part worth taping to the wall.

Prefer confinement to detection, and know why. A detector does not fail loudly; it fails on arithmetic. At a 0.1% false-positive rate, one million benign tool calls a day generate roughly a thousand alerts before a single real attack is counted, and when attacks are rare the alert stream is dominated by false positives. This is the base-rate fallacy applied to intrusion detection (Axelsson, 1999), and it is why anomaly monitors and injection classifiers cannot be your boundary. Confinement does not need to correctly classify an input as an attack; it can still deny legitimate activity or reduce utility, but its security guarantee does not depend on distinguishing malicious text from benign text. Detection is triage; confinement is the wall.

Start at the sinks, not the sources. You will never enumerate every way untrusted content enters. You can enumerate the consequential actions it might drive. Gate those. Working backward from a small set of sinks is tractable in a way that policing an unbounded set of sources is not.

Use a two-question deploy gate. Before shipping an agentic action, ask: can it cause consequential, hard-to-reverse effects, and does it operate over untrusted context? If both are yes and you have no out-of-model enforcement at the sink, you do not have a safety story; you have a hope.

Index authority by reversibility, and treat rate as blast radius. Grade actions from advisory and trivially reversible up to irreversible, and remember that reversibility is rate-dependent: one small refund is low tier, ten thousand in an hour is not. That makes rate limits and spend caps authorization controls, and it gives you a maturity ladder to climb one rung at a time.

Count expected loss, not attack-success rate. A multi-agent design that lowers per-step attack-success rate but widens what a single compromise can reach has not necessarily made you safer. The quantity that matters is capability-adjusted expected loss, blast radius times probability, not the raw success rate of any one step.

Bound, do not prove. The unifying discipline: the model's reasoning is an untracked channel, so you cannot certify correct behavior. Confine what a compromised agent can do, attest the constraints it ran under, and keep an account you can audit.

The honest limits

A map that hides the cliffs is worse than no map. This control family has a real residual it does not close.

• A compromised but legitimate source has no cryptographic fix. If a trusted origin is itself malicious, provenance faithfully labels it "trusted." Provenance authenticates the channel, not the honesty of what came through it.
• Covert channels survive allowlisted sinks. An agent can exfiltrate information by paraphrasing it into an otherwise-permitted output, or by leaking bits through whether an action was denied. The denial-feedback version is a documented attack (Causality Laundering, arXiv:2604.04035); the mitigation is to make denials uninformative, and it does not close every channel.
• Argument-level gates miss joint-content payloads. A check on each argument in isolation can be defeated by a payload split across several individually-innocuous fields.
• Signing proves identity, not interpretation. Signing establishes an artifact's origin and integrity, not that two components read it the same way. If a guardrail's tokenizer and the model's tokenizer parse the same signed artifact differently, authenticity alone does not prevent a parser-differential attack; that is an orthogonal problem, not a deficiency in signing.
• Taint through the model's reasoning may be a fundamental limit, not an engineering gap. If untrusted content can influence an agent's reasoning in ways no label can track, then the only sound posture for agents on genuinely untrusted context is to confine them to low-reversibility actions, no matter how good the surrounding machinery looks.
• The safe-but-useless trap is real. Push confinement far enough (block every novel entity, confirm every unusual action) and you either destroy utility or train the human to click through, which is its own failure.

None of these is a reason to skip the control family. All of them are reasons to state your threat model honestly and to keep the riskiest agents on the shortest leash.

Where this sits

This is a practitioner map, and it stands on a real, fast-moving literature; the single most useful action you can take is to read the primary sources and build on them. The design-time anchor is CaMeL; the provenance-enforcing runtime family is FIDES, Progent, RTBAS, and PAuth; the sharpest single technical move, argument-level provenance, is PACT. Several recent systematizations already map this whole territory, most pointedly a 200-plus-paper SoK that independently names the same "trust-authorization mismatch" (arXiv:2512.06914). The lens this article uses (information-flow control, Biba integrity, reference monitoring, least privilege) is long-established rather than new here, a point the adaptive-evaluation literature makes explicitly even as it warns that static benchmark numbers overstate robustness (arXiv:2606.26479); the full reading map is in the references. perfecXion's contribution here is not new science. It is the editorial act of putting five usually-separate problems under one primitive, packaging the academic systems into deployment decisions a CISO can act on, and naming the trust-laundering phenomenon that opened this piece.

Bottom line

Stop treating argument injection, MCP metadata trust, poisoned model artifacts, inter-agent deception, and agent IAM as five unrelated projects. They are five faces of one recurring primitive: untrusted content crossing an unlabeled boundary and acquiring authority. Label the boundaries. Carry provenance on both axes and make it survive transformation. Separate data from authority-bearing instructions, and mint authority only through an explicit authorization step. Scope capability down to the argument. Gate every consequential sink deterministically, outside the model, and add the artifact-integrity, identity, and containment controls the data-flow layer does not provide. Prefer confinement to detection because detection loses on base rates, start at the sinks, index authority by reversibility, and keep agents on untrusted context confined to reversible actions until you can measure that the leash can safely lengthen.

The tools exist and are published. The failure is not that we lack controls. It is that we keep meeting the same primitive under five names and defending each name separately.

References

Reference maturity is signaled explicitly: [SoK], [survey], and [preprint] tags mark evidence type, since not every arXiv entry has been peer-reviewed.

The design and the runtime family

1. Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, Florian Tramer. Defeating Prompt Injections by Design (CaMeL). arXiv:2503.18813, 2025. arxiv.org/abs/2503.18813. The control/data separation this map builds on, and the 77% vs 84% AgentDojo utility result.
2. Mark Russinovich, et al. (Microsoft Research). FIDES: Securing AI Agents with Information-Flow Control. arXiv:2505.23643, 2025 [preprint]. arxiv.org/abs/2505.23643. Integrity and confidentiality labels with a formal enforceability model.
3. Progent: Programmable Privilege Control for LLM Agents. arXiv:2504.11703, 2025 [preprint]. arxiv.org/abs/2504.11703. Argument-level capability scoping as a policy DSL.
4. RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage. arXiv:2502.08966, 2025 [preprint]. arxiv.org/abs/2502.08966. Auto-execute only IFC-preserving calls; confirm the residue.
5. Reshabh K. Sharma, Linxi Jiang, Zhiqiang Lin, Shuo Chen. PAuth: Precise Task-Scoped Authorization for Agents. arXiv:2603.17170, 2026 [preprint]. arxiv.org/abs/2603.17170. Operand-to-origin binding for server-side verification.
6. Linfeng Fan, et al. The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck (PACT, Provenance-Aware Capability Contracts). arXiv:2605.11039, 2026 [preprint]. arxiv.org/abs/2605.11039. Injection is dangerous when untrusted content determines an authority-bearing argument.
7. Permissive Information-Flow Analysis for LLMs. arXiv:2410.03055, 2024 [preprint]. arxiv.org/abs/2410.03055. The over-restrictive-label problem and a proposed fix.

Systematizations and surveys (this map's parents)

8. SoK: Trust-Authorization Mismatch in LLM Agent Interactions. arXiv:2512.06914, 2025 [SoK]. arxiv.org/abs/2512.06914. 200-plus papers; static permissions decoupled from runtime trustworthiness.
9. Narisetty, Kore, Kattamanchi, Kumarapu. Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents. arXiv:2606.26479, 2026 [preprint]. arxiv.org/abs/2606.26479. An adaptive evaluation of out-of-band defenses that warns static benchmarks overstate robustness; it treats the Biba / reference-monitor / least-privilege lens on these defenses as established, not novel.
10. SoK: Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks. arXiv:2511.15203, 2025 [SoK].
11. SoK: The Attack Surface of Agentic AI. arXiv:2603.22928, 2026 [SoK].
12. SoK: Security and Safety in the Model Context Protocol Ecosystem. arXiv:2512.08290, 2025 [SoK].
13. Yiqi Wang, et al. From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents. arXiv:2606.04990, 2026 [survey].
14. Christian Schroeder de Witt, et al. Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents. arXiv:2505.02077, 2025 [preprint].

The model-artifact supply chain

15. Inference-Time Backdoors via Hidden Instructions in LLM Chat Templates. arXiv:2602.04653, 2026; ICLR 2026 [peer-reviewed]. Hidden instructions embedded in packaged chat templates.
16. CVE-2024-34359 ("Llama Drama"). Jinja2 server-side template injection in a packaged model chat template leading to remote code execution (llama-cpp-python). nvd.nist.gov

Foundations, attacks, and empirical anchors

17. K. J. Biba. Integrity Considerations for Secure Computer Systems. MITRE, 1977 (the integrity-lattice model). With Dorothy Denning, A Lattice Model of Secure Information Flow, CACM, 1976; Jerome Saltzer and Michael Schroeder, The Protection of Information in Computer Systems, Proc. IEEE, 1975 (least privilege); Butler Lampson, A Note on the Confinement Problem, CACM, 1973.
18. Stefan Axelsson. The Base-Rate Fallacy and the Difficulty of Intrusion Detection. ACM CCS, 1999 [peer-reviewed].
19. Mohammad Hossein Chinaei. Causality Laundering: Denial-Feedback Leakage in Tool-Calling LLM Agents. arXiv:2604.04035, 2026 [preprint].
20. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, Mario Fritz. Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. arXiv:2302.12173, 2023; AISec at CCS 2023 [peer-reviewed].
21. Yangjun Ruan, et al. Identifying the Risks of LM Agents with an LM-Emulated Sandbox (ToolEmu). arXiv:2309.15817, 2023; ICLR 2024 [peer-reviewed]. 23.9% severe-failure rate under non-adversarial high-stakes use (evaluator-derived, 68.8% human-validated).
22. Edoardo Debenedetti, et al. AgentDojo. arXiv:2406.13352, 2024; NeurIPS 2024 [peer-reviewed]. 97 tasks, 629 injection cases.
23. Qiusi Zhan, Zhixiang Liang, Zifan Ying, Daniel Kang. InjecAgent. arXiv:2403.02691, 2024; ACL Findings 2024 [peer-reviewed]. ~24% base / ~48% enhanced attack success (GPT-4).

Author's note on method and verification

This field guide consolidates five separate multi-model deliberations that were then checked against the primary sources above. The deliberations are how the map was drafted, not evidence for it, and their most useful byproduct is the lede: the models repeatedly produced citation-shaped and percentage-shaped claims that briefly acquired authority, a live instance of the trust laundering the piece is about. Verification was therefore not optional. Every statistic and named citation the deliberations produced was treated as false until independently checked: several were fabricated (an invented paper title, benchmark percentages that do not appear in the cited work, a mis-numbered RFC, a coined "warrant attestation" standard that does not exist) and were removed, and only figures traceable to the papers that measured them (CaMeL's 77%/84%, ToolEmu's 23.9%, the AgentDojo and InjecAgent figures) remain. Where an argument-level or capability idea appears, it is credited to the published systems that introduced it, not to the deliberations.

What this piece claims, and what it does not

• It does not claim the unifying primitive, the IFC/Biba/reference-monitor frame, argument-level provenance, or a systematization of this field as novel. All of those are published, several within the last year, including a 200-paper SoK that names the same core mismatch. It does not claim the five faces are operationally identical or that information-flow control alone resolves any of them.
• It does offer a cross-domain practitioner map that unifies five usually-separated problem framings under one primitive, a set of deployment decisions distilled from the underlying systems, and the trust-laundering framing and reflexive specimen as an honest lede. That is a field guide, and it is labeled as one.