arXiv: Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gaps

This paper, published on arXiv, identifies a novel vulnerability in large language model agents that use external tools, such as code interpreters or file systems. The attack, called Context-Fractured Decomposition, exploits gaps in how these agents track the provenance of artifacts like generated files or data outputs. By deliberately fragmenting the context across multiple tool calls, an attacker can cause the agent to misattribute or trust a malicious artifact, leading to unauthorized data access or code execution.

This finding directly impacts any organization deploying LLM agents in regulated environments, particularly in finance, healthcare, and legal sectors where data integrity and audit trails are critical. Companies using agentic AI for automated document processing, compliance monitoring, or customer-facing decision tools should assess their exposure. The vulnerability is especially relevant for systems that rely on tool-generated outputs without robust provenance tracking.

Compliance teams should immediately review their AI risk assessments to include this attack vector. They must ensure that any LLM agent implementation includes strict provenance logging for all tool outputs, with cryptographic verification where possible. Additionally, update incident response plans to account for context-fracturing attacks, and require vendors to demonstrate mitigation controls in their model architectures. This is not a regulatory change itself, but a technical finding that should inform your organization’s AI governance and third-party risk management frameworks.