SPA: Securing Persistent LLM Agents Across Queries with Plan-First Information-Flow Control

Dylan Girrens, Guangjing Wang

Large language model (LLM) agents increasingly operate over untrusted webpages, documents, tools, and persistent states while exercising authority over security-sensitive resources…