The paper introduces PACE, a system for enforcing capability enforcement in tool-using LLM agents. It mediates every tool call before execution, verifying schema-defined effects against authority and preventing malicious influence. PACE shows significant security gains in agent-security benchmarks, with full-benchmark native utility losing at most three points relative to the undefended agent.

Researchers introduce the concept of memetic trojans, a type of attack that exploits agents' tendency to retransmit and amplify content, potentially leading to network-wide exposure. The study finds that these attacks can be highly effective, with some simulations showing a 3.19x amplification of exposure.

Researchers developed DART, a runtime framework that detects and attributes representation shifts in multi-turn LLM agents, reducing attack success rates and outperforming existing defenses. The framework uses denoising to identify and intervene in potentially harmful behavior.

This paper introduces a framework called FlowReview for authorization-paired evaluation in multi-agent systems, which aims to ensure safe collaboration by blocking prohibited uses while enabling authorized ones. The authors conducted experiments that showed a significant reduction in denied-commit rates without sacrificing authorized supply.

Proof-Gated Signing (PGS) is a method to prevent AI agents from proposing harmful transactions by simulating the transaction's effects and using an SMT solver to check a declarative value-and-permission policy. PGS has been tested on 260 scenarios and prevented 93.6% of harmful scenarios while passing 97.5% of benign ones.

This paper presents a method for conserving authority in self-modifying AI agent populations, addressing issues like quota duplication, permission combination, and overlap during promotion. It defines a protocol that binds each generation to a manifest, root, unique parent, complete lineage, and fresh population sequence, ensuring secure succession and fork conservation.

The paper proposes a claim-anchored execution contract to address the issue of unverified claims in tool-agent auditing. The contract binds claims, evidence, and execution to ensure the integrity of tool usage. It exposes seven testable properties and achieves high attack-detection rates.

Researchers report a vulnerability in closed-loop agent debugging, where a verifier can leak the answer, rendering solver comparison vacuous. They propose a new verification contract that requires a clean reference map, runtime evidence, and signal rule detection to prevent this issue.

Sapien is a stateful policy engine for autonomous AI agents that enforces contextual policies by specifying permitted tool-call sequences using regular expressions, stateful predicates, and deferred policy generation. It can rule out up to 95% of attacks on AgentDojo and 85% on Toolathlon, even if the agent is fully hijacked.

Incident-Arena is a benchmark for agentic site-reliability-engineering (SRE) that evaluates AI coding agents' ability to execute on production incident response. It includes 20 carefully selected tasks and a novel verification method that goes beyond static checks to functional verifiers.

Cloudflare has updated Quick Tunnels to allow agents to add email authentication and access control, making it easier to share local services securely.

Rogo's Vercel setup automates AI agent deployments in 5 minutes, enabling 73,000+ monthly deployments and zero manual triage during production incidents.

The paper introduces query-conditioned agent action attribution, a task that recovers the source and ordered intermediate evidence for a query-specified aspect of an action taken by an LLM agent. The proposed method uses small open-weight models as attribution proposers and achieves better source and evidence rankings with lower inference cost.

Researchers developed a new framework called Pretext that can evade existing skill detection systems for AI agents. Pretext uses a white-box LLM attacker to craft skills that evade detection while still delivering a payload. This highlights major gaps in current skill scanners and raises concerns about the security of AI agent skills.

A new framework, Speculative Safety Honeypot (SSH), is proposed to proactively defend against multi-turn agent attacks. SSH uses multi-agent simulation and speculation to predict potential risks and verify them using real actions, reducing reliance on individual detection components and improving defense resilience.

ActionGuard is a tool that authorizes tool calls in LLM-based agents by inspecting skill-influenced tool calls before execution, separating the agent's action-generation context from the authorization context, and using a balanced skill profile, recent tool calls, and local script contents to make decisions.

Researchers present TrustProbe, a framework for detecting vulnerabilities in skill-based LLM agents. They analyze 11 open-source agents and find 104 taint-style vulnerabilities, 25.1% of which are exercised in real-world skill-agent trials, demonstrating a systematic trust failure in skill-based LLM agents.

This paper describes a vulnerability in causal action verification for language agents, where corrupting the committed graph can lead to false executions. The authors demonstrate that omitting or reversing edges in the graph can cause the verifier to issue incorrect certificates, allowing for harmful actions. A proposed attestation step can detect these attacks, but it has limitations and scalability issues.

Researchers propose MiniRep, a reputation-based aggregation system for multi-agent debate to prevent malicious agents from influencing the final output. MiniRep evaluates agents based on their behavior and reputation, and it outperforms other approaches in experiments.

MADBench is a benchmark for evaluating the security of multi-agent debate (MAD) in large language models (LLMs). It assesses the effectiveness of MAD in mitigating or amplifying adversarial attacks. The benchmark evaluates six attack families across 356 source tasks and 3,958 test cases, showing that MAD may not improve LLM reasoning under attacks and can even amplify unauthorized actions.