arXiv AI

CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls

The paper introduces CONTINUITY, a framework that ensures secure composition of large language model (LLM) agent controls by using assume‑guarantee contracts and authenticated security contexts. It models each component with signed root grants, provenance commitments, and other mechanisms to carry security context across transitions, formalizing end‑to‑end consequence integrity. A reference verifier and fault‑injection suite demonstrate that the full configuration prevents harmful effects while completing all benign tasks and correctly escalating ambiguous cases.

arXiv AI

Sep 2

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems

The paper examines the security challenges of delegating authority to autonomous LLM agents that act on users’ behalf. It introduces a threat model with four adversaries and eight security requirements, demonstrates that current frameworks (LangGraph, CrewAI, AutoGen, MCP) fail to meet these standards, and presents an authorization broker that blocks all identified threats with minimal overhead. The broker is shown to resist numerous attacks and limits compromised sub‑agents to their delegated tasks, and its principles are implemented in VotalAI’s LLM Shield.

By Panduranga Sai Varma Dantuluri, Jyotirmoy Sundi

llms agents

arXiv AI

Jun 10

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation

arXiv:2606. 10749v1 Announce Type: cross Abstract: Large language model (LLM) agents are rapidly moving from conversational interfaces to software components that plan, invoke tools, maintain memory, and act on external environments.

By Yuchen Ling, Shengcheng Yu, Zhenyu Chen, Chunrong Fang

llms agents benchmarks

arXiv AI

Sep 2

SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems

arXiv:2609.00595v1 Announce Type: cross Abstract: Safe agents can fail together. Multi-agent LLM systems (MAS) move information, state, decisions, and authority across principal boundaries, creating...

By Rui Yang, Junjie Xu, Zhengyu Liu, Neil Fendley, Yang Hong, Ziyang Li, Yinzhi Cao

llms agents benchmarks

arXiv AI

Jul 14

Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents

arXiv:2607. 10487v1 Announce Type: cross Abstract: LLM agents can commit durable effects from authority evidence that was valid earlier in execution: a DOM snapshot, approval epoch, version witness, branch token, or worker result.

By Igor Santos-Grueiro

llms agents

arXiv AI

Jun 9

SecureClaw: Clawing Back Control of LLM Agents

arXiv:2606. 09549v1 Announce Type: cross Abstract: Tool-using large language model (LLM) agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final output check can intervene.

By Yuhan Ma, Stefan Schmid

llms agents multimodal

arXiv AI

Sep 1

Safe to Resume? Breaking Execution Continuity of Agent Execution via Rollback

arXiv:2608.29381v1 Announce Type: cross Abstract: AI agents are moving toward persistent, stateful execution across various applications, accumulating execution state and external effects that are co...

By Guanlong Wu, Dahui Li, Ke Jiang, Jianyu Niu, Cong Wang, Yinqian Zhang

agents

arXiv AI

Jun 11

Sovereign Assurance Boundary: Certificate-Bound Admission for Agentic Infrastructure

arXiv:2606. 11632v1 Announce Type: cross Abstract: Agentic infrastructure introduces a critical control-plane authorization problem: non-deterministic reasoning systems can propose high-stakes mutations to production resources, yet existing security mechanisms -- such as identity and access management (IAM), policy engines, consensus protocols, and audit logs -- either enforce static, context-unaware permissions or merely record actions post-execution.

By Jun He, Deying Yu

agents

arXiv AI

Jul 28

Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents

arXiv:2607. 24625v1 Announce Type: cross Abstract: Autonomous LLM agents processing mixed-confidentiality data face severe security risks from prompt injection attacks and reasoning errors.

By Arseny Kravchenko, Vadim Liventsev, Innokentii Konstantinov, Ildar Iskhakov, Matvey Kukuy

llms agents benchmarks

arXiv AI

Jun 4

Grimlock: Guarding High-Agency Systems with eBPF and Attested Channels

arXiv:2605. 27488v2 Announce Type: replace-cross Abstract: Agentic systems increasingly run user-authored orchestration code that invokes tools, spawns subtasks, and delegates work across machines and clouds.

By Qiancheng Wu, Wenhui Zhang, Gan Fang, Sheng Mao, Biao Gao, David Levitsky, Shawna Murphy Butterworth, Rob Cameron

agents

arXiv AI

Sep 1

VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflows

arXiv:2608.30091v1 Announce Type: new Abstract: Modern agent frameworks compose planners, tool agents, remote services, and shared specialists into runtime delegation graphs, but their revocation API...

By Lifei Liu, Haoran Yu, Xiaochong Jiang

agents

arXiv AI

Jun 4

Proof-Carrying Agent Actions: Model-Agnostic Runtime Governance for Heterogeneous Agent Systems

arXiv:2606. 04104v1 Announce Type: cross Abstract: Agent systems execute through runtimes with very different control points: local coding tools, framework SDKs, managed agent platforms, API gateways, and observer-only integrations.

By Zexun Wang

agents benchmarks

arXiv AI

Jul 7

Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies

arXiv:2607. 03423v1 Announce Type: cross Abstract: Modern AI agent implementations such as frontier coding agents chain multiple tools at runtime that create a security surface that per-tool guardrails are unable to address, as individually permitted tools can violate organizational policies when composed.

By Chris Schneider, Kriti Faujdar, Philipp Schoenegger, Ben Bariach

agents safety

Related stories