The paper describes the Cosmos LLM Gateway, a policy‑driven, multi‑vendor gateway built on Envoy that manages enterprise LLM traffic at PayPal. It separates latency‑sensitive control decisions into an external service while handling wire‑format translation and token metering in‑proxy via a Rust WebAssembly filter, ensuring minimal overhead. Governance is declarative, managed through Open Policy Agent, and includes features like data‑loss‑prevention, budget scopes, and a control plane for role‑scoped authoring and approvals. The gateway currently serves over 12,000 developers, processes roughly 200 billion tokens per day across 100+ models, and maintains 99.999% availability with only a few milliseconds of added latency.
By Mithun Sasidharan, Srinivasan Manoharan, Rupesh Thakur, Abhinav TK, Ashwin Hegde, Anand Gautam
arXiv:2608. 19216v1 Announce Type: new Abstract: AI control research asks how to deploy models safely even when they may be misaligned, but many control protocols assume that the deployer can instrument the model and its surrounding pipeline.
By Zhen Wen Lim
The paper introduces a protocol for cross‑interface authorization of AI computer‑use agents, ensuring that policy decisions remain consistent across graphical interfaces, command lines, APIs, scripts, and Model Context Protocol servers. It defines a profile‑bounded system that enumerates all effect‑bearing routes, normalizes requests to canonical effects, issues prepare tickets, and re‑verifies all relevant state at commit time, requiring a sink receipt for a committed result. Extensive testing across two runtime mappings produced thousands of traces, with rigorous checks confirming no semantic regressions, mutant rejections, and correct outcome matching.
By Genliang Zhu, Chu Wang
arXiv:2606. 29073v1 Announce Type: cross Abstract: Model Context Protocol (MCP)-style ecosystems give language-model applications a practical connection layer for tools, resources, prompts, and transports.
By Ting Liu
arXiv:2606. 13968v1 Announce Type: cross Abstract: Researchers and practitioners working with large language models face a fragmented landscape: local models are free and private but hardware limits the model size and context windows a researcher can use; institutional HPC centers offer powerful GPU resources at no marginal cost and keep data within institutional boundaries, but operate behind firewalls and are designed for batch jobs rather than interactive use; commercial cloud APIs provide frontier-model quality on demand but impose significant cost and data retention policies unsuitable for sensitive research data.
By Anas Nassar, Steve Mohr, Leonard Apanasevich, Himanshu Sharma
arXiv:2606. 20520v1 Announce Type: cross Abstract: Autonomous agents are increasingly connected to cloud, deployment, and data-control workflows, but production mutation authority should not reside inside non-deterministic reasoning processes.
By Jun He, Deying Yu
The paper introduces PACE (Policy‑Attested Contract Execution), a framework that sits between large‑language‑model (LLM) based autonomous AI agents and on‑chain DeFi operations. PACE defines typed transaction intents, a deterministic policy verifier, and signed Policy Decision Records (PDRs) that cryptographically bind an approved intent, policy, and simulation report to the exact on‑chain execution bytes, providing replay and expiration protection. In evaluations across 40 tasks and six baselines, PACE achieves zero unsafe executions and zero false positives, outperforming unguarded agents by a large margin.
By Rabimba Karanjai (Larry), Yang Lu (Larry), Richard Williamson (Larry), Hemanth Hm (Larry), Prakhar Mehrotra (Larry), Lei Xu (Larry), Weidong (Larry), Shi
arXiv:2609.37454v1 Announce Type: new
Abstract: Underwriters in commercial Property and Casualty (P&C) insurance spend 30 to 40% of their time on administrative work rather than risk judgment, and a...
By Vivek Kumar Singh, Gautam Bhowmick
MCPHunt is a benchmark framework that isolates non‑adversarial credential propagation across multi‑server MCP trust boundaries. It uses canary‑based taint tracking, a controlled coverage design with risky, benign, and hard‑negative conditions, and completion‑requires‑secret stratification to separate faithful from policy‑violating propagation. Across 3,615 traces from 5 models, policy‑violating propagation rates range from 11.5 % to 41.3 %, with mitigation via prompting reducing rates to 0.3 % while retaining 80.5 % utility.
By Haonan Li, Tianjun Sun, Yongqing Wang, Qisheng Zhang
arXiv:2607. 16200v1 Announce Type: new Abstract: AI agent systems that couple large language models (LLMs) with external tools and APIs are inherently non-deterministic: LLM sampling variance, external API state, CDN infrastructure headers, and execution-environment noise collectively prevent any prior agent run from being faithfully re-executed.
By Rasheed Mudasiru
arXiv:2606. 02240v1 Announce Type: cross Abstract: Indirect prompt injection in tool-use agents is a concrete production threat: LLM agents read from integrations (third-party services such as Gmail, Salesforce, or Jira accessed through tool calls) whose response content the user neither writes nor controls.
By Hiskias Dingeto, Will Leeney
arXiv:2609.00052v1 Announce Type: cross
Abstract: Commercial LLM APIs advertise a specific foundation model, but the served backbone may be silently substituted, quantized, or wrapped, for example to...
By Xun Wang, Bihe Zhao, Michael Backes, Franziska Boenisch, Adam Dziedzic