The paper investigates how tool‑using language‑model agents can safely commit changes to infrastructure when external state may change between read and commit. By distinguishing invalidating races from predicate‑preserving and irrelevant ones, the authors evaluate three commit‑time guard granularities—global epoch, read‑set version, and semantic commit predicate—using a deterministic simulator and three quantized model families. The study finds that only the complete predicate guard consistently eliminates unsafe commits, while freshness‑based guards block a large proportion of benign races and model‑side signals fail to replace precise semantic enforcement.
By Zihao Zheng, Jiayu Long, Baichuan Li, Junyi Yao
The paper introduces CONTINUITY, a framework that ensures secure composition of large language model (LLM) agent controls by using assume‑guarantee contracts and authenticated security contexts. It models each component with signed root grants, provenance commitments, and other mechanisms to carry security context across transitions, formalizing end‑to‑end consequence integrity. A reference verifier and fault‑injection suite demonstrate that the full configuration prevents harmful effects while completing all benign tasks and correctly escalating ambiguous cases.
By Chris Zheng, Geng Yang
arXiv:2607. 10487v1 Announce Type: cross Abstract: LLM agents can commit durable effects from authority evidence that was valid earlier in execution: a DOM snapshot, approval epoch, version witness, branch token, or worker result.
By Igor Santos-Grueiro
arXiv:2606. 09549v1 Announce Type: cross Abstract: Tool-using large language model (LLM) agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final output check can intervene.
By Yuhan Ma, Stefan Schmid
The paper investigates how AI agents that run long workflows using external tools can experience inconsistencies when retries, speculative execution, concurrency, or partial failures occur. It introduces an effect‑history model that distinguishes between actual external events and the agent’s observations, and catalogs eight common external‑effect anomalies. The authors analyze the standard Model Context Protocol tool interface, finding that its annotations are too coarse to fully express the necessary capabilities to prevent these anomalies, thereby motivating the need for reusable transactional contracts at the agent‑tool boundary.
By Artem Trofimov, Boris Novikov
AI agents increasingly execute long-running workflows that externalize effects through independently supplied tools. Under retries, speculative execution, concurrency, and partial failures, the result...