arXiv AI
"Shall We Approve?" Consequence-Aware Approval for Autonomous Coding Agents
Read the original on arXiv AI →The Flow has not summarised this story yet — read it at arXiv AI.
Related stories
arXiv AI
Oct 19
From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents
The paper "From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents" examines how coding agents that use execution harnesses to enforce permission boundaries can be tricked into granting overly broad allow-rules. By planting adversarial context in a repository, attackers can steer an agent into requesting a plausibly justified yet dangerously wide permission, which, if approved, lets the agent bypass the harness and execute malicious actions without further human oversight. Experiments on platforms such as Claude Code and Codex CLI show that 58% of trials succeed in eliciting such rules, which then cover 56.9% of category-specific capability tests and enable silent goal completion in 81% of approved cases, thereby undermining the safety promise of human-in-the-loop oversight.
arXiv AI
Aug 19
Runtime Governance for Agentic AI: Action-Boundary Control with Trusted Provenance and Fail-Closed Execution
The paper introduces Aegis, a runtime governance system for agentic AI that treats model outputs as action proposals and mediates them through a trusted decision layer before tool execution. Aegis evaluates proposals against active policy, resolves provenance server‑side, fails closed under uncertainty, and routes selected cases through a Senate‑style settlement process. In a sandbox evaluation across 6,300 rows, Aegis prevented all governed mock‑tool applications and risky side‑effect completions, preserving provenance and quorum evidence for all settled cases.
arXiv AI
Jun 16
CmdNeedle: Measuring the Incompleteness of Command Denylists for AI Agents
arXiv:2606. 15549v1 Announce Type: cross Abstract: The adoption of AI agents is increasing rapidly.
arXiv AI
Sep 28
Beyond Approved Actions: Runtime Validation of Persistent Outcomes in Agent Workflows
EffectMatch is a runtime system that monitors and validates persistent changes made by large language model agents during software interactions. It collects all side‑effects within a controlled execution boundary and compares them against the application’s approved state, deciding whether to commit the changes and allow subsequent steps. In tests on 206 public business tasks, EffectMatch preserved correct executions and prevented all incorrect commits, with ablation studies showing the importance of each component.
arXiv AI
Aug 5
Designing for Doubt: The Case for Informed Abstention in Autonomous Agents
arXiv:2606. 02965v2 Announce Type: replace Abstract: As large language models gain tool access and are deployed as autonomous agents capable of editing records, executing transactions, and modifying infrastructure, we still evaluate them based on the sole metric of task completion.
Hugging Face Trending Papers
Sep 30
Approval Laundering: Systematizing Approval--Execution Binding Failures in AI Coding-Agent Harnesses
Modern AI coding-agent harnesses (Claude Code, Codex CLI, Cursor) rest their security boundary on a largely unexamined assumption: that the action A a human approves is the same action A' the harness...