The paper investigates how multiple pre‑action controls—authority, resource, and evidence gates—interact in agentic AI systems. It formalizes remediation‑induced control coupling, showing that remediation can invalidate earlier judgments and that the order of remediation matters. The authors propose a remediate‑and‑regate protocol to restore soundness, analyze non‑commuting remediation operators, and demonstrate the approach on a deterministic open‑data artifact with three published engines.
By Gaston Besanson
The paper examines three open-source agent harnesses—LangChain’s deepagents, Earendil’s pi, and DeepSeek’s dsh—each built from contrasting design philosophies. By analyzing their source code and commit histories, the authors find that the mature harnesses converge on five common architectural elements: a commoditized loop, an append‑only replayable session record, model quirks stored as data, progressive disclosure of context, and explicit extension seams. A fourth harness, used as a held‑out check, also displays all five elements and even reuses another’s implementation, indicating that convergence arises from parallel discovery, diffusion, and literal reuse rather than independent invention. The study notes a missing dimension—external verifiability via a tamper‑evident record—highlighting a future axis for provenance‑sensitive domains.
By Dai Jiahong
The paper discusses how large language model agents now act as privileged principals with kernel‑grade authority, yet lack the trusted mediation traditionally required for operating‑system security. It introduces a taxonomy that distinguishes between provenance‑based deterministic checks and content‑semantic checks, identifying a central mediation gap in distinguishing data from instruction and authorized from unauthorized actions. The authors argue that this gap creates an irreducible risk of undetected attacks whenever inputs and actions are not pre‑enumerated, and they propose defenses across runtime monitoring, architectural separation, and authorization while critiquing current evaluation practices. They extend the analysis to AI‑native operating systems where the model itself serves as the arbitration core, outlining design constraints, challenges, and a research agenda.
By Li Zhang, Yang Sun, Jie Shi
arXiv:2609.22664v1 Announce Type: cross
Abstract: Research on large language model agents for penetration testing is evaluated almost entirely by capability: whether the agent captures a flag or repr...
By Joas Antonio dos Santos Barbosa
An agent harness is what turns a language model into an autonomous agent: the surrounding code that builds the model's context, mediates its tools, runs the loop, and persists state across a long-hori...
arXiv:2607. 12650v1 Announce Type: cross Abstract: Tool access alone does not make LLM empirical reasoning governable: accepted outputs need not descend from attested evidence, and accepted deductions need not hold up under formal scrutiny.
By Junyu Ren
arXiv:2609.23954v1 Announce Type: cross
Abstract: Programmers write formal specifications, and LLMs implement them, proving that each implementation matches its spec. Taken to its extreme, this makes...
By Simon Henniger, Stephen Chong, Nada Amin
arXiv:2607. 06341v1 Announce Type: cross Abstract: Formal verification offers the strongest guarantee of software correctness, but it does not scale: the proofs demanded by interactive theorem provers such as Coq require enormous expert effort.
By Shuangxiang Kan, Shuanglong Kan, Sebastian Ertel
Programmers write formal specifications, and LLMs implement them, proving that each implementation matches its spec. Taken to its extreme, this makes specification languages the new programming langua...
arXiv:2607. 08028v1 Announce Type: new Abstract: Enterprise large language model (LLM) applications often begin as prototypes whose behavior is carried by prompts and retrieval context.
By Joongho Ahn, Moonsoo Kim
arXiv:2609.38415v1 Announce Type: cross
Abstract: This technical report presents an alignment evaluation developed and performed by the UK AI Security Institute for assessing whether advanced AI syst...
By Alexandra Souly, Kai Fronsdal, Abby D'Cruz, Xander Davies, Robert Kirk
The paper argues that while machine-readable models like SysML v2 enable AI participation in systems engineering, the data architecture surrounding these models must also be robust. It introduces the concept of epistemic adequacy, split into read‑side adequacy (ensuring derivations, status, and provenance are answerable) and write‑side admissibility (filtering AI contributions before they enter the record). The authors illustrate their ideas using the public Apollo 11 SysML v2 reconstruction and propose a Governed‑Query Architecture Framework to enforce these principles.
By Jason Gower, Michael J. de C. Henshaw, Siyuan Ji