Indirect prompt injection (IPI) hides adversarial instructions in the content that large language model (LLM) agents read at runtime. As agents compose heterogeneous capability units—tools, MCP servers, and skills—the number of injection carriers multiplies, and pattern‑based defenses fall behind. We shift the defense focus to a single stable point: regardless of carrier or propagation path, harm materializes only at the execution boundary, where the agent turns internal state into an external action or output. Safety at this point is governed by two conditions set by the trusted task rather than the run: whether the proposed effect is authorized, and whether the runtime information reaching it is endorsed by that task.
APEX is an active defense that enforces both conditions from a single authorization contract compiled before untrusted execution. Evidence‑gated prevention admits an effect only when the contract justifies it, while deception‑based exposure forces unendorsed usage to reveal itself before the effect commits. Protection therefore follows what the task permits rather than how an attack is built, applying uniformly across capability units without attack‑specific policies or taint tracking.
Against 13 baselines, APEX achieves 0% attack success on five of six benchmarks (the sixth at 0.56%) and maintains 0% success under adaptive attacks on all three capability‑unit types, remaining effective across different defender backbones. The implementation is open‑source: https://github.com/ZhengXR930/APEX_official/tree/official.
Review: APEX demonstrates a principled approach to IPI mitigation by anchoring security at the execution boundary with an authorization contract, offering a task‑driven, uniform safeguard that advances the safe deployment of LLM agents.