The paper introduces the concept of an irreversibility budget for managing risk in fleets of large language model agents. It proposes a cumulative accounting system that tracks residual value‑at‑risk across agents, workflows, and tenants, charging each effect its residual loss and denying any marginal effect that would exceed the budget. A controlled study shows that per‑effect gates can allow fleet‑level overdraws up to 48 times the tenant’s risk limit while the budget keeps all correctly charged runs within limits, highlighting the challenge of designing conservative, dependency‑aware pricing.
arXiv:2608. 16402v1 Announce Type: new Abstract: Large language model-based agentic frameworks primarily optimize capability: whether an agent can reason, retrieve information, call tools, delegate work, and complete a goal.
PerMIT is a memory architecture that provides provable integrity guarantees for persistent memory used by large language model agents. It limits trust to user‑typed inputs and values confirmed at a gate, mediating untrusted environment‑derived values through a finite interface while preserving multi‑turn planning and tool choice. Two machine‑checked integrity theorems in Lean 4 ensure that only gate‑confirmed data can influence sensitive actions, and community endorsements can accumulate to reduce verification effort as the user base grows.
arXiv:2606. 08919v1 Announce Type: new Abstract: As LLM agents begin to take real, irreversible actions (shell commands, file edits, deploys), the standard safety pattern is a human-in-the-loop approval gate: risky actions pause and wait for a person.
The paper introduces a fault‑tolerant budget conservation framework for distributed multi‑agent delegation, where budgets are represented as exclusive escrow credits that traverse a delegation DAG. It details how each branch converts credit into a reservation tied to lineage, epoch, and idempotency, persists a signed dispatch permit, and ensures that uncertain effects remain charged until settlement or retirement. The authors prove properties such as ownership partition, ledger conservation, and at‑most‑once settlement, and validate the mechanism through TLA+ checks, a JavaScript explorer, and crash‑injected SQLite experiments.
CASEL (Consequence-Aware Selective Execution Layer) is a runtime allocation policy for tool‑using language agents that chooses among direct execution, verification, sandboxing, clarification, approval, and abstention for each proposed tool call. It combines calibrated failure probability, state‑dependent consequence, reversibility, ambiguity, and evidence freshness to minimize a per‑mode cost. In controlled simulations, CASEL cuts harmful‑side‑effect trajectories from 14.75 % to 7.02 % and reduces mean normalized harm from 0.184 to 0.123 compared to an uncertainty‑ranked gate.
ERRAND is a new method for budgeted maintenance of agent memory that treats revalidation of stored knowledge as a priced errand competing for scarce actions. It uses an errand index that is single‑peaked, allowing certainty in either direction to cost nothing, and repairs by writing new versions rather than deleting old ones. In experiments across two drifting tool‑use worlds, ERRAND outperforms non‑oracle policies, achieving up to 10.0 percentage points improvement over eager revalidation while using only 11.0% of steps, and it self‑terminates when no budget is imposed.
The paper introduces Enclawed, a deterministic security runtime that protects large language model agents running on high‑performance computing (HPC) systems. It provides hardware‑rooted supervision for every rank, preventing compromised hosts from causing catastrophic failures, and enforces launch policies, lease‑based heartbeats, and automatic eviction or killing of tampered jobs. Enclawed operates without administrator privileges, integrates via Secure Shell, and adds minimal startup overhead while successfully blocking a wide range of simulated attacks.
arXiv:2608. 16055v1 Announce Type: new Abstract: Existing agent benchmarks ask whether the agent finished the task.
arXiv:2607. 13070v1 Announce Type: cross Abstract: Safety claims on self-improving agent runtimes are almost always self-graded: a policy file, a guardrail, or a README commitment.
The paper introduces Progressive Risk Vesting (PRV), a framework for controlling the authority of recursive large language model agents that spawn specialist branches. PRV maintains a risk budget in escrow, debiting it as branches are activated, and provides theoretical guarantees on harm bounds for adaptively generated trees. The authors analyze how risk behaves relative to an authority reproduction number, derive risk and compute shadow prices, and suggest a design rule to search broadly in a sandbox while granting recursive authority sparingly.
arXiv:2608. 04289v1 Announce Type: new Abstract: Long-horizon agents increasingly use persistent memory and tools to take actions with external side effects.
The paper examines the security challenges of delegating authority to autonomous LLM agents that act on users’ behalf. It introduces a threat model with four adversaries and eight security requirements, demonstrates that current frameworks (LangGraph, CrewAI, AutoGen, MCP) fail to meet these standards, and presents an authorization broker that blocks all identified threats with minimal overhead. The broker is shown to resist numerous attacks and limits compromised sub‑agents to their delegated tasks, and its principles are implemented in VotalAI’s LLM Shield.