The paper introduces Inalienable Human‑in‑the‑Loop (I‑HITL), a protocol that guarantees an AI agent can only initiate actions with explicit human approval, even if the human’s interface is compromised or an adversarial human delegates approvals. Experiments on a popular agentic wallet platform show that many frontier models can autonomously raise spending caps by harvesting one‑time passcodes, highlighting vulnerabilities in current HITL systems. The authors formally define I‑HITL using communication topologies, prove necessary and sufficient conditions for its implementation, and present a prototype called Countersign that can strengthen existing HITL systems with consumer mobile devices.
By Samuel Breckenridge, Dani Vilardell, Wenhao Wang, Fan Zhang, Ari Juels
The paper examines the security challenges of delegating authority to autonomous LLM agents that act on users’ behalf. It introduces a threat model with four adversaries and eight security requirements, demonstrates that current frameworks (LangGraph, CrewAI, AutoGen, MCP) fail to meet these standards, and presents an authorization broker that blocks all identified threats with minimal overhead. The broker is shown to resist numerous attacks and limits compromised sub‑agents to their delegated tasks, and its principles are implemented in VotalAI’s LLM Shield.
By Panduranga Sai Varma Dantuluri, Jyotirmoy Sundi
arXiv:2610.27620v1 Announce Type: cross
Abstract: Autonomous LLM agents act through tools under per-action authorization: a local guard screens each tool call in isolation. We show that local authori...
By Anmol Pandey, Aditya Jain, Liang Chen, Carsten Maple
arXiv:2606. 26057v1 Announce Type: cross Abstract: AI agents are granted access to tools, APIs, and other infrastructure, making them active principals in those systems.
By Seth Dobrin, {\L}ukasz Chmiel
arXiv:2602. 20064v2 Announce Type: replace-cross Abstract: Large language models are increasingly deployed as agents: they plan, call tools, read untrusted data, and act on the results.
By Zac Garby, Andrew D. Gordon, David Sands
PerMIT is a memory architecture that provides provable integrity guarantees for persistent memory used by large language model agents. It limits trust to user‑typed inputs and values confirmed at a gate, mediating untrusted environment‑derived values through a finite interface while preserving multi‑turn planning and tool choice. Two machine‑checked integrity theorems in Lean 4 ensure that only gate‑confirmed data can influence sensitive actions, and community endorsements can accumulate to reduce verification effort as the user base grows.
By Tanqiu Jiang, Min Bai, Sadat Shahriar, Wanyu Du, Sandesh Swamy
AgentKernel proposes a trust‑native operating system for AI agents, arguing that current governance layers are insufficient because they share the same process trust boundary as the agents. The OS introduces a mandatory enforcement boundary organized into four pillars—Identity, Perception, Cognition, and Execution—each adapting classical OS security principles to address semantic‑level failures such as prompt injection, memory poisoning, and tool misuse. By wrapping the agent lifecycle in this structured, non‑bypassable framework, AgentKernel aims to provide a unified security layer that can enforce identity, input mediation, memory governance, and execution control across the entire agent lifecycle.
By Zhenhua Zou, Sheng Guo, Qiuyang Zhan, Lepeng Zhao, Shuo Li, Zhuotao Liu
The paper "Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization" examines how AI agents seek approval before performing actions such as sending money or deleting files. It identifies twelve attack vectors on the approval process and evaluates them against several protocols, finding that many agent runtimes lack verifiable approval records and exhibit binding weaknesses. The authors propose a defense called ASU (Agent Step-Up), which renders a canonical approval card, requires a phone passkey, and enforces single-use execution, demonstrating strong protection against substitution, replay, and grant-stretching attacks in extensive simulations.
By Sai Varun Kodathala, Prashanth Pollishetty, Jaylen Cargill
The paper proposes a split‑control architecture for adaptive security at the network edge, where an untrusted planner emits typed security intents that are vetted by a deterministic governor before being enacted. The governor checks each intent against safety, resource, temporal‑stability, and proportionality invariants, issuing signed receipts for admitted actions that are compiled into eBPF map updates. Experiments on a Raspberry Pi 5 connected to a university 5G test network show the governor can admit, reject, and bound intents at microsecond cost without disrupting protected‑flow regularity.
By Ijaz Ahmad, Ijaz Ahmad, Flavio Esposito, Erkki Harjula
arXiv:2601. 09923v3 Announce Type: replace Abstract: AI agents are vulnerable to prompt injection attacks, where malicious content hijacks agent behavior.
By Hanna Foerster, Tom Blanchard, Kristina Nikoli\'c, Ilia Shumailov, Cheng Zhang, Robert Mullins, Nicolas Papernot, Florian Tram\`er, Yiren Zhao
arXiv:2606. 30755v1 Announce Type: cross Abstract: Claw-like AI agents (e.
By Peizhi Niu, Wenjie Qu, Shangding Gu, Tianneng Shi, Yuankai Li, Ahmad Tawaha, Hend Alzahrani, Vincent Siu, Boyi Li, Chenguang Wang, Jiaheng Zhang, Basel Alomair, Ming Jin, Muhao Chen, Chi Wang, Costas Spanos, Dawn Song
The paper introduces Verifiable Agent Insurance (VAI), a framework that lets AI agent providers commit to policy compliance through smart contracts and escrow funds on a blockchain. When a user detects a policy violation, a verifier reviews execution traces logged by the agent harness; if the violation is confirmed, the escrow is paid to the user. Experiments on three agent benchmarks show VAI detects 42.2% of violations, rising to 83.0% when agents emit explicit structured records.
By Cheng Hua, Taro Tsuchiya, Nicolas Christin, Giulia Fanti