Evaluating Provenance-Based Defenses Against Prompt Injection in LLM Agents: What Taint Tracking Can and Cannot See

Large language model agents read email, browse the web, run shell commands, and send messages on a user’s behalf, so content an agent merely reads can become an action it performs. Guardrails against this rely on one assumption: an action becomes dangerous because untrusted content preceded it. We test that assumption directly. Using the JED red-team environment, its sandboxed tool suite, 19,679-page web corpus, and breach-scoring function, we evaluate a provenance tainttracking guardrail against four attack classes with full source access to both the defense and the scorer. Three classes are structurally closed. An exact-substring block denies the reads that exfiltration and destructive-write attacks require, and the guardrail’s five-event taint window fully contains the scorer’s two-event breach window, so every scored breach is already denied. Only 221 of the 19,679 corpus pages, 1.1 percent, trigger the injection parser at all, and 194 of those, 88 percent, collapse to one outcome the guardrail already blocks. The fourth class succeeds: a confused-deputy chain built entirely from direct user requests produces no web- or email-sourced tool event, so the taint mechanism has nothing to observe and issues no denial. Taint tracking answers one question, did untrusted input precede this action, and an attack built entirely from trusted input falls outside what it was built to detect.