@inproceedings{betser-etal-2026-agentrim,
title = "{A}gen{TRIM}: Tool Risk Mitigation for Agentic {AI}",
author = "Betser, Roy and
Giloni, Amit and
Bose, Shamik and
Padakandla, Sindhu and
Picardi, Chiara and
Erez, Lidor and
Vainshtein, Roman",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.1102/",
doi = "10.18653/2026.findings-emnlp.1102",
pages = "23301--23325",
ISBN = "979-8-89176-462-0",
abstract = "AI agents combine LLMs with external tools to solve complex tasks. While tools extend agents' capabilities, improper permissions introduce risks such as indirect prompt injection and tool misuse. We characterize these failures as unbalanced tool-driven agency, a unified view in which agents either retain unnecessary permissions (excessive agency) or fail to invoke required tools (insufficient agency), increasing risk and reducing performance. We introduce AgenTRIM, a framework that addresses this imbalance without altering agent reasoning, through complementary offline and online stages. Offline, it reconstructs the agent{'}s tool interface from code and validates tool behavior via controlled executions and trace analysis. At runtime, it enforces per-step least-privilege access through adaptive capability filtering and isolated validation of tool calls, implicitly decomposing tasks without explicit planning. On the AgentDojo benchmark, AgenTRIM substantially reduces attack success while improving task performance over the baseline, unlike other leading defenses. To assess robustness beyond prompt injection, we conduct additional experiments covering description-based attacks and policy enforcement. Together, these results establish AgenTRIM as a general, capability-preserving framework for mitigating tool-driven risks in LLM-based agents."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="betser-etal-2026-agentrim">
<titleInfo>
<title>AgenTRIM: Tool Risk Mitigation for Agentic AI</title>
</titleInfo>
<name type="personal">
<namePart type="given">Roy</namePart>
<namePart type="family">Betser</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Amit</namePart>
<namePart type="family">Giloni</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Shamik</namePart>
<namePart type="family">Bose</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sindhu</namePart>
<namePart type="family">Padakandla</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Chiara</namePart>
<namePart type="family">Picardi</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Lidor</namePart>
<namePart type="family">Erez</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Roman</namePart>
<namePart type="family">Vainshtein</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>AI agents combine LLMs with external tools to solve complex tasks. While tools extend agents’ capabilities, improper permissions introduce risks such as indirect prompt injection and tool misuse. We characterize these failures as unbalanced tool-driven agency, a unified view in which agents either retain unnecessary permissions (excessive agency) or fail to invoke required tools (insufficient agency), increasing risk and reducing performance. We introduce AgenTRIM, a framework that addresses this imbalance without altering agent reasoning, through complementary offline and online stages. Offline, it reconstructs the agent’s tool interface from code and validates tool behavior via controlled executions and trace analysis. At runtime, it enforces per-step least-privilege access through adaptive capability filtering and isolated validation of tool calls, implicitly decomposing tasks without explicit planning. On the AgentDojo benchmark, AgenTRIM substantially reduces attack success while improving task performance over the baseline, unlike other leading defenses. To assess robustness beyond prompt injection, we conduct additional experiments covering description-based attacks and policy enforcement. Together, these results establish AgenTRIM as a general, capability-preserving framework for mitigating tool-driven risks in LLM-based agents.</abstract>
<identifier type="citekey">betser-etal-2026-agentrim</identifier>
<identifier type="doi">10.18653/2026.findings-emnlp.1102</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.1102/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>23301</start>
<end>23325</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T AgenTRIM: Tool Risk Mitigation for Agentic AI
%A Betser, Roy
%A Giloni, Amit
%A Bose, Shamik
%A Padakandla, Sindhu
%A Picardi, Chiara
%A Erez, Lidor
%A Vainshtein, Roman
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F betser-etal-2026-agentrim
%X AI agents combine LLMs with external tools to solve complex tasks. While tools extend agents’ capabilities, improper permissions introduce risks such as indirect prompt injection and tool misuse. We characterize these failures as unbalanced tool-driven agency, a unified view in which agents either retain unnecessary permissions (excessive agency) or fail to invoke required tools (insufficient agency), increasing risk and reducing performance. We introduce AgenTRIM, a framework that addresses this imbalance without altering agent reasoning, through complementary offline and online stages. Offline, it reconstructs the agent’s tool interface from code and validates tool behavior via controlled executions and trace analysis. At runtime, it enforces per-step least-privilege access through adaptive capability filtering and isolated validation of tool calls, implicitly decomposing tasks without explicit planning. On the AgentDojo benchmark, AgenTRIM substantially reduces attack success while improving task performance over the baseline, unlike other leading defenses. To assess robustness beyond prompt injection, we conduct additional experiments covering description-based attacks and policy enforcement. Together, these results establish AgenTRIM as a general, capability-preserving framework for mitigating tool-driven risks in LLM-based agents.
%R 10.18653/2026.findings-emnlp.1102
%U https://aclanthology.org/2026.findings-emnlp.1102/
%U https://doi.org/10.18653/2026.findings-emnlp.1102
%P 23301-23325
Markdown (Informal)
[AgenTRIM: Tool Risk Mitigation for Agentic AI](https://aclanthology.org/2026.findings-emnlp.1102/) (Betser et al., Findings 2026)
ACL
- Roy Betser, Amit Giloni, Shamik Bose, Sindhu Padakandla, Chiara Picardi, Lidor Erez, and Roman Vainshtein. 2026. AgenTRIM: Tool Risk Mitigation for Agentic AI. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 23301–23325, Budapest, Hungary. Association for Computational Linguistics.