The paper investigates how multiple pre‑action controls—authority, resource, and evidence gates—interact in agentic AI systems. It formalizes remediation‑induced control coupling, showing that remediation can invalidate earlier judgments and that the order of remediation matters. The authors propose a remediate‑and‑regate protocol to restore soundness, analyze non‑commuting remediation operators, and demonstrate the approach on a deterministic open‑data artifact with three published engines.
By Gaston Besanson
The paper examines three open-source agent harnesses—LangChain’s deepagents, Earendil’s pi, and DeepSeek’s dsh—each built from contrasting design philosophies. By analyzing their source code and commit histories, the authors find that the mature harnesses converge on five common architectural elements: a commoditized loop, an append‑only replayable session record, model quirks stored as data, progressive disclosure of context, and explicit extension seams. A fourth harness, used as a held‑out check, also displays all five elements and even reuses another’s implementation, indicating that convergence arises from parallel discovery, diffusion, and literal reuse rather than independent invention. The study notes a missing dimension—external verifiability via a tamper‑evident record—highlighting a future axis for provenance‑sensitive domains.
By Dai Jiahong
The paper discusses how large language model agents now act as privileged principals with kernel‑grade authority, yet lack the trusted mediation traditionally required for operating‑system security. It introduces a taxonomy that distinguishes between provenance‑based deterministic checks and content‑semantic checks, identifying a central mediation gap in distinguishing data from instruction and authorized from unauthorized actions. The authors argue that this gap creates an irreducible risk of undetected attacks whenever inputs and actions are not pre‑enumerated, and they propose defenses across runtime monitoring, architectural separation, and authorization while critiquing current evaluation practices. They extend the analysis to AI‑native operating systems where the model itself serves as the arbitration core, outlining design constraints, challenges, and a research agenda.
By Li Zhang, Yang Sun, Jie Shi
arXiv:2609.22664v1 Announce Type: cross
Abstract: Research on large language model agents for penetration testing is evaluated almost entirely by capability: whether the agent captures a flag or repr...
By Joas Antonio dos Santos Barbosa
An agent harness is what turns a language model into an autonomous agent: the surrounding code that builds the model's context, mediates its tools, runs the loop, and persists state across a long-hori...
arXiv:2607. 12650v1 Announce Type: cross Abstract: Tool access alone does not make LLM empirical reasoning governable: accepted outputs need not descend from attested evidence, and accepted deductions need not hold up under formal scrutiny.
By Junyu Ren