The paper investigates a critical flaw in AI coding-agent systems such as Claude Code, Codex CLI, and Cursor, where the action approved by a human is not the same as the action executed by the harness. It introduces the concept of Approval Laundering, categorizing six systematic failure modes—Scope, Argument, Temporal, Tool, Delegation, and Semantic laundering—and demonstrates these failures through controlled experiments. The authors propose an Approval Token mechanism that mitigates some laundering types but leaves others unaffected, highlighting the limitations of current enforcement strategies.
By Yang Wang
arXiv:2609.08789v1 Announce Type: cross
Abstract: Frontier AI developers publish safety frameworks that commit them to evidencing whether their models are dangerous. The European Union and California...
By Louis Yiven Zhu
arXiv:2606. 18021v1 Announce Type: new Abstract: AI systems deployed in legal workflows hallucinate at rates that aggregate metrics report at ~52%, but this average conceals where errors concentrate and in which direction they run, leaving compliance officers without an actionable signal for trustworthy deployment.
By Lalit Yadav, Akshaj Gurugubelli
The paper introduces Publication Authority, a single-use, non-transferable capability that ensures AI-assisted claims can be independently challenged by providing a machine-readable, falsifiable publication record. It presents the PAC-2026 protocol, evaluates its fourth bounded semantic freeze (SF-4), and demonstrates through extensive modeling that the system enforces strict obligations on evidence, authorization, and lifecycle continuity. The study confirms internal coherence, bounded safety, and fault sensitivity, though it does not address factual truth or field efficacy.
By Torsten Olivi Tiltack, Yifei Dong, Kun Yu, Xu Wang, Wei Liu, Jianlong Zhou, Ren Ping Liu, Fang Chen
arXiv:2607. 25364v1 Announce Type: new Abstract: Tool-using agents expose structured calls but commonly attach free-form rationales.
By Genliang Zhu (Accentrust, Georgia Institute of Technology), Chu Wang (Accentrust, University of Illinois Urbana-Champaign)
BodhiPromptShield is a policy‑aware mediation layer for LLM agent pipelines that detects sensitive text spans before they propagate, replacing them with typed placeholders, semantic abstractions, or secure tokens and restoring them only at authorized execution boundaries. In evaluations on AI4Privacy, PrivacyLens, and AgentDojo datasets, the system reduces identifier exposure to 7.4% and 1.8% respectively, and limits exact identifier leakage in final actions to 2.1–3.1%. While mediation preserves factual content according to automated metrics, human annotations show a significant drop in inferability from 100% to 24–53%, indicating the need for human validation of semantic‑leakage measures.
By Bo Ma, Jinsong Wu, Weiqi Yan