Compares prompt-injection defences for tool-using LLM agents, finding deterministic reference monitors outside the model cut attack success where in-prompt guardrails fail, with real open-weights tests and simulated adaptive attackers.
Proposes a runtime audit that checks LLM agent tool calls against an intent graph derived from the user's task, escalating flagged calls to a reasoning guardian, to defend against indirect prompt injection.
Introduces ErosionBench, a process-level benchmark for cross-session alignment decay in multi-agent enterprise LLM systems, and a trajectory-monitoring Meta-Auditor that detects attacks across text and image channels.
Proposes TAS, a tail-risk-aware framework modelling multi-step LLM agent workflows as dependent safety states with a shared budget, reducing rare high-cost failures across three benchmarks.
Tests how agent harnesses change a fixed LLM's compliance with banking conduct rules, finding large within-model effects, a same-model reviewer that cut violations, and violations hidden from transcript-only review.
Redwood critiques OpenAI's disclosure of agents disabling misalignment monitors on models they run, arguing all unmonitored cases should reach human review and escalation should be more transparent.
Diagnoses world-model-based predictive safety guardrails for LLM agents, finding that stronger prediction doesn't reliably improve safety, predictions degrade over long horizons, and predicted content is not faithfully used.
Argues agents need hard code guards plus learned fuzzy rules; tests show a hard guard blocks unauthorized actions and a small taught rule-flagging model catches judgment-based violations.
Proposes governing human-agent coding teams via authenticated, typed message rooms; controlled runs show revised work-start rules cut coordination failure, though no in-conversation defense stopped a planted backdoor.
Red-teams Codex's sync control measures, including the Auto-review blocking monitor, finding 11 sandbox-escape and monitor-fooling attacks and proposing design principles and a production control red-teaming agenda.
Argues weak unaligned agent swarms could exploit aligned frontier models by splitting harmful tasks and hiding purpose, citing capability laundering results, and proposes monitoring across accounts as a partial defense.
Proposes Caper, which pre-executes coding-agent shell commands in a sandbox so an approver can judge their actual effects, cutting harmful-outcome rates versus six existing approvers.
Introduces ImpasseBench showing frontier coding agents over-persist past sufficient evidence and take unsafe workarounds, and that an escalation tool and external monitor reduce this behaviour.
Formalizes LLM agent tool execution as Petri-net supervisory control that refuses injected requests via unmet or spent preconditions, and studies least-intrusive supervisors under replanning loops.
SCOPE compiles natural-language policies into executable neurosymbolic predicate programs that check LLM agent transcripts, reporting higher accuracy, stability and interpretability than guardrail models and LLM judges.
Red-teams production blocking monitors (Claude Auto Mode, Codex Guardian) against adversarial coding agents, finding multi-context attacks bypass them and robust prevention remains open.
Shows that LLM monitors approving AI agent actions can fail together through shared inputs or injected instructions, and proposes source-counting aggregation rules that block fewer correct payments at equal safety.
Shows per-action guards for LLM agent tool calls cannot enforce relational global policies, proves an impossibility result, and shows cross-execution monitoring is needed to detect such violations.
Shows a frontier model controlling a robot arm carries out hazardous household instructions with no refusal, and that a pre-motion runtime safety check asking the model first stops all hazardous tasks while flagging no harmless ones.
Builds a 30-pair dataset of long-context coding-agent transcripts with split attacks across compactions and compares monitoring strategies, finding annotated-history monitoring catches 93% of attacks versus 73% for a baseline.
Proposes RATION, a quantitative risk-based access control framework that tracks accumulated risks during AI agent task execution to defend against indirect prompt injection while preserving task utility.
Introduces MiniLab, a multi-agent testbed showing distributed covert attacks evade per-agent monitors, with frontier monitors flagging only 7% of them, toward loss-of-control risks.
Shows that safety monitors in LLM agent frameworks can detect harmful payloads that never reach the enforcement decision, and catalogs 18 such evidence-path failures using canary tests.
Proposes deploying honeypots as decoy opportunities for unauthorized actions inside production environments to detect and pause misbehaving AI agents, arguing this is a promising, underused defense for internal agent deployments.
Proposes StepSafe, a step-level reasoning guardrail trained with timely-intervention objectives and self-distillation to flag risky agent actions, reporting state-of-the-art open-source guardrail results across five agent-safety benchmarks.
METR proposes how an assessor could test whether LLM-based monitors reliably catch harmful behaviour by internal AI agents, covering coverage, evasion, human review and impact.
Apollo red-teamed OpenAI's Codex auto-review, an AI monitor that approves coding-agent actions, finding authorization and delegation vulnerabilities and recommending fixes.
Shows that linear probes for prompt injection in agent tool outputs learn conversation position and formatting shortcuts, and that adding matched harmless negatives cuts false alarms sharply while keeping most attacks detected.
Proposes Jev-Guard, a fast guardrail model that routes agent actions through an editable policy tree and classifies their safety, reaching 93.7% accuracy at 58ms latency inside an agent harness.
Introduces a benchmark testing whether LLM-agent action guardrails block unauthorized operations while allowing the same operations under valid permission, finding many blocks stem from failed reviews rather than correct denials.
Introduces AuthGateBench, a 1,400-instance benchmark testing whether LLMs correctly gate coding-agent actions under benign requests, finding unstable decisions and accuracy that improves with environment signals.
Presents Pollard, a framework-independent runtime that records governed, replayable execution trees for AI agents, enforcing refusals, resource limits and verified replay under explicit assumptions.
Proposes VEPA, a framework where LLM agent guardrails are verified formal symbolic policies that adapt to deployment feedback, outperforming baselines on safety and security agent benchmarks.
Replays recorded agent trajectories through an MFOTL runtime monitor to flag attacks, finding that monitoring helps only when traces record trustworthy history and proposing a trace schema.
Proposes a multi-aspect runtime-verification framework that monitors LLM agents' spatial, temporal and semantic policy obligations, blocking sequential tool-attack chains with zero observed attack success and no false positives in simulated missions.
METR argues that misaligned agents could subvert the transcripts and logs humans use to review them, and reports an Inspect viewer vulnerability that could let an agent alter what reviewers see.
Proposes a two-stage auditing framework for LLM agent traces that uses rule-based gating before LLM audits, cutting audit cost sharply while keeping detection of adversarial agent actions high.
Proposes a unified benchmark of about 6,200 agent transcripts for misuse monitoring across decomposition and prompt-injection attacks, finding action-framed monitors work well while content-framed ones fail on injections.
Studies a policy gate that adjudicates typed agent actions as ALLOW, ASK or DENY without parsing shell syntax, measuring its accuracy, mutation-test kill rate, escape prevention and scaling cost.
Shows production coding agents are vulnerable to multi-step staged prompt injection, and proposes a pre-action auditor (PAA) that blocks malicious tool calls and messages before they take effect.