arXiv:2606. 02483v1 Announce Type: cross Abstract: Tool-augmented language agents speculatively issue likely future tool calls to hide latency, but those calls leak inferred user intent to external services before the agent commits to the branch.
arXiv:2606. 28061v1 Announce Type: cross Abstract: Large language models (LLMs) have increasingly moved from standalone text generation systems to agents that invoke external tools, access environments, and execute multi-step tasks.
AI agents increasingly execute long-running workflows that externalize effects through independently supplied tools. Under retries, speculative execution, concurrency, and partial failures, the result...
The paper investigates how AI agents that run long workflows using external tools can experience inconsistencies when retries, speculative execution, concurrency, or partial failures occur. It introduces an effect‑history model that distinguishes between actual external events and the agent’s observations, and catalogs eight common external‑effect anomalies. The authors analyze the standard Model Context Protocol tool interface, finding that its annotations are too coarse to fully express the necessary capabilities to prevent these anomalies, thereby motivating the need for reusable transactional contracts at the agent‑tool boundary.
arXiv:2609.14003v1 Announce Type: cross Abstract: Personal AI agents built on large language models (LLMs) are increasingly given access to a user's private data and communications in order to provid...
arXiv:2606. 00152v1 Announce Type: cross Abstract: LLM-based agents are rapidly advancing, autonomously invoking external tools to complete multi-step tasks for users.
arXiv:2606. 09549v1 Announce Type: cross Abstract: Tool-using large language model (LLM) agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final output check can intervene.
The paper introduces BSC‑R, a deterministic effect‑boundary mechanism that ties a single‑use commit authorization to the specific action and the semantic state that justified it, aiming to close the proposal‑to‑commit gap in tool‑using language‑model agents. Experiments on 2,847 AgentDojo episodes and 10,302 frozen proposals show that BSC‑R preserves the agent’s original behavior while rejecting unauthorized changes, and further tests on a boundary‑drift experiment and the CONTINUITY suite demonstrate high success rates in valid contexts and robust handling of replay and ambiguous cases. However, broader testing reveals that BSC‑R still allows a 25% invalid‑effect commit rate in a larger attack set, indicating that it provides scoped, not universal, safety.
The paper introduces SARA, a framework that separates action induction from runtime authorization in tool‑augmented LLM agents. By treating these as distinct roles, SARA uses an Action Probe to record action provenance and only authorizes tool calls that align with the user objective and past successful executions. Experiments on AgentDojo and AgentDyn show that SARA reduces action‑to‑side‑effect risk to below 0.63% while preserving task performance.
arXiv:2609.37196v1 Announce Type: cross Abstract: Tool-using LLM agents remain vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context, allow...
The paper introduces ASLEval, a framework for measuring privacy exposure displacement in large language model (LLM) agent sessions. It highlights that traditional local proxies—such as inspecting a single action or final response—often miss unauthorized data leaks elsewhere in a multi-step session. ASLEval pre-registers hidden target sets, tracks all declared visible exits, and preserves internal traces for diagnosis, revealing that a single outlet view can overlook nearly 47% of exposure and that internal evidence typically precedes visible leaks. The study underscores the need for benchmarks that define complete visible boundaries, ground claims in pre-specified targets, and report privacy alongside task utility.
arXiv:2606. 26627v1 Announce Type: cross Abstract: Large language model agents increasingly query databases, search document collections, call external APIs, remember past interactions, and act on a user's behalf.
arXiv:2607. 17780v1 Announce Type: cross Abstract: ETAS is a programming language for agent systems that treats model-backed agents, tool calls, prompts, typed memory, human approvals, policies, and execution traces as semantic program elements rather than library conventions.