arXiv:2610.16426v1 Announce Type: new Abstract: Automated approval systems let coding agents execute high-risk actions with minimal human oversight by delegating the authorization decision to a class...
arXiv:2610.27620v1 Announce Type: cross Abstract: Autonomous LLM agents act through tools under per-action authorization: a local guard screens each tool call in isolation. We show that local authori...
arXiv:2603.17170v2 Announce Type: replace-cross Abstract: AI agents increasingly execute users' natural-language (NL) tasks by calling Web services, yet today's Web authorizes these calls through OAu...
arXiv:2606. 29887v1 Announce Type: new Abstract: In real-world applications, guardrails are often expected to identify unsafe user-model interactions according to application-specific safety policies, rather than relying on predefined risk taxonomies.
arXiv:2607. 02121v1 Announce Type: cross Abstract: As Large Language Models (LLMs) and agentic systems become integrated into real-world applications, ensuring their safety and security is critical.
ActGov is a runtime enforcement framework that validates each action proposed by a large language model (LLM) agent before it interacts with external tools, ensuring that actions stay within task‑scoped authorization boundaries and comply with dynamically constructed policies. It builds policies from tool specifications, benign tasks, and failure traces, verifying updates via SMT‑based counterexample checking. In evaluations on AgentDojo and AgentDyn benchmarks, ActGov consistently reduces indirect prompt‑injection attack success while maintaining task utility, outperforming existing defenses.
VEPA is a framework that enables the verified evolution of formal guardrails for lifelong large language model agents. It represents guardrails as formal policies of symbolic rules over typed agent events, and during deployment uses LLM‑guided feedback to propose policy patches that fix new failures while preserving correct behavior. A deterministic verifier accepts only structurally valid, conflict‑free policies, and an evidence‑aware authority layer activates verified rules only when sufficient supporting evidence exists, ensuring that uncertain updates do not directly affect guardrail decisions.
arXiv:2608.29942v1 Announce Type: cross Abstract: The key limitation of current state-of-the-art influence-based guardrails is that they do not reliably distinguish a legitimate, user-authorized acti...
The paper "From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents" examines how coding agents that use execution harnesses to enforce permission boundaries can be tricked into granting overly broad allow-rules. By planting adversarial context in a repository, attackers can steer an agent into requesting a plausibly justified yet dangerously wide permission, which, if approved, lets the agent bypass the harness and execute malicious actions without further human oversight. Experiments on platforms such as Claude Code and Codex CLI show that 58% of trials succeed in eliciting such rules, which then cover 56.9% of category-specific capability tests and enable silent goal completion in 81% of approved cases, thereby undermining the safety promise of human-in-the-loop oversight.
Large language model (LLM) agents increasingly execute long-horizon workflows through external tools, allowing untrusted outputs to influence subsequent actions and exceed user authorization. Existing...
This paper presents an LLM-based system that translates natural-language access control policies (NLACPs) into executable Rego code for Open Policy Agent (OPA). It provides a modular, end-to-end pipel...
arXiv:2607. 03656v1 Announce Type: cross Abstract: Large Language Models are increasingly used to turn natural-language requirements into code.