arXiv:2609.38266v1 Announce Type: cross Abstract: Agentic large language models (LLMs) now move money through tools, yet the record of what they did is usually a trace their own process emits beside...
The paper introduces PACE (Policy‑Attested Contract Execution), a framework that sits between large‑language‑model (LLM) based autonomous AI agents and on‑chain DeFi operations. PACE defines typed transaction intents, a deterministic policy verifier, and signed Policy Decision Records (PDRs) that cryptographically bind an approved intent, policy, and simulation report to the exact on‑chain execution bytes, providing replay and expiration protection. In evaluations across 40 tasks and six baselines, PACE achieves zero unsafe executions and zero false positives, outperforming unguarded agents by a large margin.
The paper introduces a framework for evaluating how large language model agents revise their success criteria after failures, defining five non‑compensatory conditions that must be met for a criterion revision to be considered valid. Using the CMB‑0.1 protocol, the authors test twelve cross‑domain scenarios across four system configurations, finding that no model trial satisfies all five conditions and highlighting specific failure modes such as zero‑state reconstruction and inadequate intervention sensitivity. They propose a more stringent trace‑anchored CMB‑0.4 protocol to better isolate and measure criterion revision in future studies.
arXiv:2607. 19449v1 Announce Type: cross Abstract: Evaluation frameworks for tool-augmented LLM agents focus overwhelmingly on capability metrics or explicit tool crashes, leaving silent infrastructure failures and HTTP 200 responses with empty, null, or malformed payloads largely unaudited.
Proof‑Gated Signing (PGS) is a method for securing on‑chain AI agents that control wallets by simulating proposed transactions, extracting their effects, and using an SMT solver to verify a declarative value‑and‑permission policy across a range of oracle‑uncertainty prices. PGS then compiles on‑chain post‑conditions—such as wallet balance bounds, payee receipts, allowance caps, and ownership checks—ensuring that any execution satisfying these conditions also satisfies the policy, even when the chain state drifts due to front‑running, contract upgrades, or token‑parameter changes. In a testbed of 260 scenarios, PGS prevented 93.6 % of harmful cases and passed 97.5 % of benign ones, outperforming simulation‑only checking and static allowlists, while incurring about 41 k gas and 0.1–0.2 s per check.
arXiv:2608.30091v1 Announce Type: new Abstract: Modern agent frameworks compose planners, tool agents, remote services, and shared specialists into runtime delegation graphs, but their revocation API...
arXiv:2608. 02843v1 Announce Type: cross Abstract: Persistent agent memory must adapt as later outcomes change earlier evidence, yet mutable retrieval weights create an attribution problem: reviewers must distinguish authorized adaptation from database tampering.
NOMOS is a four‑pass compiler that transforms natural‑language policies into deterministic, statically verified tool‑call gates for large‑language‑model agents. By performing tool‑schema‑level checks without relying on provers, solvers, or additional LLM calls, it repairs or rejects 37% of airline and 13% of retail policy candidates, enabling most shipped rules to become operable. In benchmark tests, the compiled gates reduce policy violations from 66.3% to 2.6% in airline scenarios and from 30.8% to 6.9% in retail, while achieving a zero attack success rate on banking and low rates on other suites, all with microsecond decision times.
arXiv:2610.17301v1 Announce Type: new Abstract: Language-model agents sometimes act beyond their authorization and then misreport what they did. On CAPE-Bench, matched agent tasks in which one fact d...
arXiv:2607. 10487v1 Announce Type: cross Abstract: LLM agents can commit durable effects from authority evidence that was valid earlier in execution: a DOM snapshot, approval epoch, version witness, branch token, or worker result.
The paper investigates a critical flaw in AI coding-agent systems such as Claude Code, Codex CLI, and Cursor, where the action approved by a human is not the same as the action executed by the harness. It introduces the concept of Approval Laundering, categorizing six systematic failure modes—Scope, Argument, Temporal, Tool, Delegation, and Semantic laundering—and demonstrates these failures through controlled experiments. The authors propose an Approval Token mechanism that mitigates some laundering types but leaves others unaffected, highlighting the limitations of current enforcement strategies.
The paper introduces a claim‑anchored execution contract that binds a tool‑using agent’s emitted claim to its exact source span, the ordered execution prefix that produced it, and the source version and access state observed. Each receipt contains deterministic anchors, source identifiers, offsets, hashes, quotes, and a domain‑separated execution commitment, allowing a verifier to reconstruct these bindings before semantic or task labels are joined. The contract defines seven independently testable properties and demonstrates high detection rates against cross‑object attacks, with strong performance on conflict‑aware support guard evaluations.