arXiv:2608.24569v2 Announce Type: replace Abstract: Large language model (LLM) agents build on one another's work through summaries, plans, and other intermediate artifacts. These records let a downs...
The study evaluates safety properties of a controlled MCP-to-A2A agent configuration by measuring verbatim field egress across ten record scenarios under three labeling conditions (CONFIDENTIAL, no header, PUBLIC – OK TO SHARE). Using four models repeated four times each, 480 trials were conducted, and the results show that adding a PUBLIC header is descriptively linked to higher verbatim egress, with the effect varying strongly by model. The study releases code, byte‑pinned traces, and an offline analysis pipeline as a public artifact.
arXiv:2602. 11510v3 Announce Type: replace Abstract: Multi-agent Large Language Model (LLM) systems create privacy risks that current output-only benchmarks cannot measure.
arXiv:2608. 11392v1 Announce Type: cross Abstract: Long-running agents periodically compact their context, replacing the transcript with a model-generated summary.
arXiv:2608. 12476v1 Announce Type: new Abstract: Long-term agent memory is usually treated as select--store--retrieve, but retrieval does not decide whether contradictory, superseded, retracted, deleted, or stale records may support an outgoing claim.
Large language model agents coordinate tasks via multi‑role, multi‑stage workflows that transform upstream state into intermediate artifacts such as summaries and plans. The study shows that when these artifacts are transformed—through compression, plan assimilation, or other handoff methods—the strict action‑binding constraints on upstream state can be weakened, turning mandatory requirements into optional information. In 1,296 synthetic episodes, direct handoff preserved all safety blockers, whereas transformed handoffs frequently deactivated or forbidden actions, but restoring full state fields or applying downstream verification can recover preservation.
arXiv:2606. 00152v1 Announce Type: cross Abstract: LLM-based agents are rapidly advancing, autonomously invoking external tools to complete multi-step tasks for users.
arXiv:2611.06545v1 Announce Type: new Abstract: Long-running LLM agents compact their context, replacing most history with a summary. We ask whether handoff summaries state permissions or requirement...
The paper investigates how tool‑using language‑model agents can safely commit changes to infrastructure when external state may change between read and commit. By distinguishing invalidating races from predicate‑preserving and irrelevant ones, the authors evaluate three commit‑time guard granularities—global epoch, read‑set version, and semantic commit predicate—using a deterministic simulator and three quantized model families. The study finds that only the complete predicate guard consistently eliminates unsafe commits, while freshness‑based guards block a large proportion of benign races and model‑side signals fail to replace precise semantic enforcement.
arXiv:2606. 22528v2 Announce Type: replace Abstract: Modern LLM agents increasingly rely on context compaction, summarization, or eviction to keep long-running sessions within a token budget.
arXiv:2608. 16055v1 Announce Type: new Abstract: Existing agent benchmarks ask whether the agent finished the task.
The paper investigates whether an overseer can predict when an AI agent will yield to peer pressure and reveal sensitive information. By training a linear probe on the agent’s internal activations, the authors demonstrate that they can detect imminent leaks with high accuracy—catching 82 % of leaking calls on Qwen3‑32B while flagging only 5 % of benign ones. The study also shows that a simple bag‑of‑words classifier performs similarly, indicating that the probe’s advantage largely stems from label training rather than activation patterns.