PCM is a protocol that attaches verifiable evidence to every claim sent between AI agents, using immutable Merkle logs and signed attestations that the sender cannot tamper with. Receivers evaluate messages offline and classify each claim as proven, unproven, or failed, ensuring that self‑reported claims can never be proven and that authority is traceable through recorded human approvals. In a benchmark of 926 real messages, PCM flagged only 10 stale‑evidence lies (1.4%) while other protocols accepted many more, and verification runs in about 1 ms with perfect agreement between independent verifiers.
arXiv:2607. 05397v1 Announce Type: cross Abstract: Agent systems increasingly execute rather than advise.
By James Rhodes, George Kang
arXiv:2606. 04193v1 Announce Type: cross Abstract: Current AI agent observability is structurally compromised: the entity producing the activity log is the same entity whose activity is being logged.
By Juan Figuera
The paper "Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization" examines how AI agents seek approval before performing actions such as sending money or deleting files. It identifies twelve attack vectors on the approval process and evaluates them against several protocols, finding that many agent runtimes lack verifiable approval records and exhibit binding weaknesses. The authors propose a defense called ASU (Agent Step-Up), which renders a canonical approval card, requires a phone passkey, and enforces single-use execution, demonstrating strong protection against substitution, replay, and grant-stretching attacks in extensive simulations.
By Sai Varun Kodathala, Prashanth Pollishetty, Jaylen Cargill
arXiv:2606. 19356v1 Announce Type: cross Abstract: When multi-agent LLM systems produce bad answers, not all failures are equal: some answers are grounded in the right material but incomplete, while others are simply ungrounded and should be stopped.
By Anantha Sharma
The paper introduces ClaimReceipt, a specification and verifier that checks whether a claim in an agent evaluation can be recomputed from retained evidence (sufficiency) and whether the evidence covers the entire experiment set (coverage). Using the CR‑2 verifier on 1,392 historical records, the authors demonstrate accurate reproduction of audit verdicts, non‑redundant field groups, and zero false positives on semantic faults. In a prospective CR‑3 run, the system correctly flags missing receipts and preserves coverage when private evidence is withheld, while adding minimal overhead to inference time and transaction size.
By Peiying Zhu, Sidi Chang
arXiv:2609.38266v1 Announce Type: cross
Abstract: Agentic large language models (LLMs) now move money through tools, yet the record of what they did is usually a trace their own process emits beside...
By Mustafa Arslan
arXiv:2605. 06738v2 Announce Type: replace-cross Abstract: Autonomous AI agents already transact at production scale -- 69,000 bots, 165 million transactions, $50 million in volume on a single marketplace -- and any party can verify a signed credential without a central service.
By Lars Kersten Kroehl
The paper introduces Preregistered Belief Revision Contracts (PBRC), a protocol that separates open communication from admissible epistemic change in deliberative multi-agent systems. PBRC fixes evidence triggers, revision operators, priority rules, and fallback policies, requiring that belief changes cite preregistered triggers and validated evidence tokens. The authors prove that PBRC prevents confidence inflation from conformity, preserves auditability, ensures epistemic accountability, and characterizes enforced belief trajectories under token-invariant contracts.
By Saad Alqithami
arXiv:2610.19298v1 Announce Type: new
Abstract: Reinforcement learning for code usually rewards passing tests, which a model can do while remaining wrong on the inputs the tests do not cover. A progr...
By George Ma, Yuhao Zhang, Bing He, Zeren Shui, Ferhat Erata, Murali Krishna Ramanathan, Somayeh Sojoudi, Hao Zhou
The paper introduces a claim‑anchored execution contract that binds a tool‑using agent’s emitted claim to its exact source span, the ordered execution prefix that produced it, and the source version and access state observed. Each receipt contains deterministic anchors, source identifiers, offsets, hashes, quotes, and a domain‑separated execution commitment, allowing a verifier to reconstruct these bindings before semantic or task labels are joined. The contract defines seven independently testable properties and demonstrates high detection rates against cross‑object attacks, with strong performance on conflict‑aware support guard evaluations.
By Miaobo Hu, Shuhao Hu, Xiaobo Guo, Xin Wang, Bokun Wang, Yina Sa, Daren Zha, Jun Xiao
arXiv:2608. 14074v1 Announce Type: new Abstract: AI agents increasingly act on external systems through standardized tool-calling protocols such as the Model Context Protocol (MCP), yet no infrastructure layer constrains their actions to what a principal has verifiably authorized: authorization logic lives in application code, is neither signed nor independently auditable, and the resulting logs lack evidentiary value.
By Giovanni Racioppi