Proof‑Gated Signing (PGS) is a method for securing on‑chain AI agents that control wallets by simulating proposed transactions, extracting their effects, and using an SMT solver to verify a declarative value‑and‑permission policy across a range of oracle‑uncertainty prices. PGS then compiles on‑chain post‑conditions—such as wallet balance bounds, payee receipts, allowance caps, and ownership checks—ensuring that any execution satisfying these conditions also satisfies the policy, even when the chain state drifts due to front‑running, contract upgrades, or token‑parameter changes. In a testbed of 260 scenarios, PGS prevented 93.6 % of harmful cases and passed 97.5 % of benign ones, outperforming simulation‑only checking and static allowlists, while incurring about 41 k gas and 0.1–0.2 s per check.
By Bravish Ghosh
arXiv:2609.14744v2 Announce Type: replace
Abstract: By acquiring compute, credentials, accounts, services, and other agents, autonomous AI agents can introduce new authority into a task. Payment, bud...
By Genliang Zhu (Accentrust, Georgia Institute of Technology), Chu Wang (Accentrust, University of Illinois Urbana-Champaign)
AcquireBound is a runtime authorization framework that ensures AI agents can safely acquire and activate resources such as compute, credentials, and services. It quarantines acquired outputs, resolves their capabilities through authenticated evidence, and activates them only after verifying a manifest, provenance, and relational constraints. The system demonstrates strong safety properties, passing extensive benign and unsafe trace tests across multiple resource classes.
By Genliang Zhu
arXiv:2607. 25364v1 Announce Type: new Abstract: Tool-using agents expose structured calls but commonly attach free-form rationales.
By Genliang Zhu (Accentrust, Georgia Institute of Technology), Chu Wang (Accentrust, University of Illinois Urbana-Champaign)
The paper investigates how tool‑using language‑model agents can safely commit changes to infrastructure when external state may change between read and commit. By distinguishing invalidating races from predicate‑preserving and irrelevant ones, the authors evaluate three commit‑time guard granularities—global epoch, read‑set version, and semantic commit predicate—using a deterministic simulator and three quantized model families. The study finds that only the complete predicate guard consistently eliminates unsafe commits, while freshness‑based guards block a large proportion of benign races and model‑side signals fail to replace precise semantic enforcement.
By Zihao Zheng, Jiayu Long, Baichuan Li, Junyi Yao
arXiv:2606. 09549v1 Announce Type: cross Abstract: Tool-using large language model (LLM) agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final output check can intervene.
By Yuhan Ma, Stefan Schmid