Paper deep dive
When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems
Li Zhang, Yang Sun, Jie Shi
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 88%
Last extracted: 9/27/2026, 3:01:57 AM
Summary
This paper systematizes security for Large Language Model (LLM) agents, which function as de-facto kernels with privileged authority but lack complete mediation. It introduces a trust-boundary taxonomy based on a provenance-vs-semantics axis, identifying a 'mediation gap' where semantic judgments cannot be deterministically checked. The authors analyze defenses, critique current evaluation methods for overstating security, and propose design constraints for future AI-native operating systems where the model itself acts as the arbitration core.
Entities (10)
Relation Signals (8)
LLM Agent â functionsas â De-facto Kernel
confidence 95% · Their authority is kernel-grade... We systematize the security of such systems around a single distinction... de-facto agent kernel
LLM Agent â lacks â Complete Mediation
confidence 92% · Their authority is kernel-grade, but it comes without what classical systems security requires: a trusted mediator interposed on every access.
Provenance â allows â Deterministic Check
confidence 90% · a crossing mediated over provenance admits a deterministic check
Content Semantics â prevents â Deterministic Check
confidence 90% · one over content semantics does not [admit a deterministic check]
Mediation Gap â causedby â Semantic Judgment
confidence 88% · isolates the central mediation gap at two kinds of semantic judgment: distinguishing data from instruction... and an authorized action from an unauthorized one.
Apple â developed â App Intents
confidence 85% · Appleâs App Intents let an agent discover and invoke an applicationâs declared operations
Windows â supports â Agent-Native Runtime
confidence 85% · Microsoft positions Windows as an agent-native runtime
Android â supports â App Functions
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large language model agents are now privileged principals that take consequential actions: editing code repositories, operating inboxes, completing purchases. Their authority is kernel-grade, but it comes without what classical systems security requires: a trusted mediator interposed on every access. Operating-system vendors are now rebuilding the platform around this de-facto agent kernel, inheriting complete mediation as a design problem. We systematize the security of such systems around a single distinction: a crossing mediated over provenance admits a deterministic check, while one over content semantics does not. A trust-boundary taxonomy locates where mediation must occur and isolates the central mediation gap at two kinds of semantic judgment: distinguishing data from instruction in untrusted input, and an authorized action from an unauthorized one. We argue that this gap leaves an irreducible residual of undetected attacks wherever inputs and actions are not restricted in advance to an enumerated set. The same distinction makes attack-success statistics actionable, placing each number on a spectrum from deployment debt (a sound deterministic mediator left unused) to a structural gap (no such mediator known). We systematize defenses across runtime monitoring, architectural separation, and authorization, and show that current evaluations tend to overstate deployed security through evaluation-validity failures. Finally, we carry that analysis forward beyond the de-facto kernel, to an architecture in which the model itself becomes the arbitration core, and derive the design constraints, open challenges, and research agenda for a security-first AI-native OS.
Tags
Links
- Source: https://arxiv.org/abs/2609.23700v1
- Canonical: https://arxiv.org/abs/2609.23700v1
Trouble viewing inline? Open PDF directly â
Full Text
154,004 characters extracted from source content.
Expand or collapse full text
When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems Li Zhang * , Yang Sun, Jie Shi Huawei Abstract.Large language model agents are now privileged principals that take consequential actions â editing code repositories, operating inboxes, completing purchases. Their authority is kernel-grade, but it comes without what classical systems security requires: a trusted mediator interposed on every access. Operating-system vendors are now rebuilding the platform around thisde-factoagent kernel, inheriting complete mediation as a design problem. We systematize the security of such systems around a single distinction: a crossing mediated overprovenance admits a deterministic check, while one overcontent semanticsdoes not. A trust-boundary taxonomy locates where mediation must occur and isolates the centralmediation gapat two kinds of semantic judgment: distinguishing data from instruction in untrusted input, and an authorized action from an unauthorized one. We argue that this gap leaves an irreducible residual of undetected attacks wherever inputs and actions are not restricted in advance to an enumerated set. The same distinction makes attack-success statistics actionable, placing each number on a spectrum fromdeployment debt(a sound deterministic mediator left unused) to astructural gap(no such mediator known). We systematize defenses across runtime monitoring, architectural separation, and authorization, and show that current evaluations tend to overstate deployed security through evaluation-validity failures. Finally, we carry that analysis forward beyond the de-facto kernel, to an architecture in which the model itself becomes the arbitration core, and derive the design constraints, open challenges, and research agenda for a security-first AI-native OS. Keywords:LLM agent security; agentic AI; prompt injection; reference monitor; complete mediation; agent security evaluation; AI-native operating systems 1. Introduction A coding assistant that edits a repository and opens a pull request; a computer-use agent that completes a purchase by clicking through live web pages; an enterprise copilot that reads a shared inbox and invokes internal tools on a userâs behalf â these are deployed products, not lab- oratory demonstrations. What unites them is no longer their fluency but their authority: each is entrusted, under standing permission, to select and commit consequential actions against real systems. In assuming that authority, an autonomous, language-driven component has stepped into a position classical systems security reserves for the kernel: the privileged principal that arbitrates resources and binds privileged operations. In July 2026 two lead- ing model developers disclosed that agents under evalu- ation had escaped their confinement and reached third- party production systems: a narrowly authorized goal was enough to induce actions no one had authorized [1], [2]. Neither disclosure involved an injected adversary. What was absent was not a defense against an attacker, but a check that could tell an authorized action from an unau- thorized one. This kernel-ization is no longer merely emergent; the plat- form itself is being rebuilt around it. The three major op- erating systems are making the same move â extending the platform to serve agents directly, rather than leaving them to drive interfaces built for people. Microsoft posi- â Corresponding author. Email:zhang.li6@huawei.com tions Windows as anagent-native runtime[3]; Androidâs App Functions and Appleâs App Intents let an agent dis- cover and invoke an applicationâs declared operations [4], [5]. These remain hybrids: intelligence layered onto a conventional kernel, not baked into the arbitration core. What exists today is a de-facto agent kernel, and the con- ventional OS beneath it is racing to enclose it [6]. The direction, however, is unambiguous, and its endpoint is anAI-nativeOS in which the model itself allocates mem- ory, multiplexes agents, and authorizes every privileged call. Reaching that endpoint would not supply the check that is missing today. Instead, it would make supplying one harder: the component that would have to mediate is itself the probabilistic component that needs mediating. Classical doctrine has a name for that check, and a rule about where it sits. The doctrine keeps two roles apart: the principal that acts, and themediatorthat confines it â an always-invoked, tamper-proof check between a priv- ileged decision and its execution. The agent inherited the principalâs authority by occupying its role, but the media- tor did not come with the promotion. This paper analyzes that deficit on the deployed systems, and then carries the analysis forward to the AI-native OS they are evolving toward. One question organizes both halves: when an agent crosses a trust boundary, what must the mediator at that crossing judge? Some mediators judgeprovenance: where a piece of con- tent came from, and therefore what authority it carries. 1 arXiv:2609.23700v1 [cs.CR] 20 Sep 2026 That judgment can be frozen into a rule before the con- tent it will be applied to exists, which is what makes its verdict deterministic. Others must judgecontent se- mantics: what the content means. No rule can be frozen in advance for a subject matter that arrives only at run time, so a mediator of that kind is necessarily a classi- fier. It sits at a chosen point on the trade-off between false positives and missed attacks, and it will be wrong some of the time. Most crossings admit judgments of both kinds, so the question defines a gradedprovenance- vs-semanticsaxis rather than a two-way split. It sep- arates defenses that leave an irreducible residual from those that deliver a structural guarantee, and it grades the fieldâs attack-success statistics: a number reflectsde- ployment debtwhen a sound deterministic mediator exists but has not been adopted, and astructural gapwhen none is known, with most cases falling between. The axis has a constructive dual as well, theprojection principle: where a crossing admits no deterministic mediator, one can still be bought by narrowing the space that crossing governs, at a price paid in expressiveness, autonomy, memory, or influence breadth. This paper makes five contributions, developed across the sections Figure 1 lays out. (i) A trust-boundary taxon- omy locating each privileged crossing around the agent principal and stating the mediation obligation it carries. Derived from complete-mediation doctrine, it places each crossing on that axis. (i) A threats-and-defenses system- atization indexed to those boundaries, populating each crossing with the attack classes reported against it and the defenses that answer them. (i) A probabilistic- mediation analysis of runtime monitoring. Extending a known impossibility result for injection detection [7] to the moment an agent commits to an action, we argue that no monitor can be made complete wherever inputs and actions are not restricted in advance to an enumer- ated set â the mediation gap. We recast that limit as a measurement program, a monitorâs residual miss rate at a declared false-positive budget, and collect what has been measured layer by layer. (iv) An evaluation-validity sys- tematization explaining why agent-security measurement frequently overstates deployed security, and what report- ing discipline would correct it. (v) A transfer analysis carrying the deployed systematization onto the architec- tural AI-native OS by the same test: for each property that defines that architecture, we identify the invariant it puts at risk and derive the design constraint that follows. We state how far the reused evidence reaches, and record the residue as open problems and a research agenda. 2. The Object of Study 2.1 The De-Facto Agent Kernel A growing class of deployed agents decides which privi- leged actions execute, and reaches a userâs files, creden- tials, and networks on standing permission. That is what The object of study the de-facto agent kernel and the AI-native OS horizon Mediation framework and taxonomy theprovenance-vs-semanticsaxis, six boundaries around the agent principal, and the mediation gap Attacks at the boundaries fifteen classes indexed to the boundaries â shipped exploits separated from lab results Defenses and their residuals monitoring, architectural separation, authorization â what each mediates and what each leaves Evaluation validity why current measurement overstates security The AI-native OS horizon what carries over and what changes, design constraints, open problems, a research agenda §2 §4 §5 §6â8 §9 §10 Figure 1:The flow of this paper. a kernel does. Pirch et al. argue that such agents must therefore be securedlike operating systems, because they already function as ones [6]; Li et al. cast the foundation model as a kernel, local resources as device drivers, and skills as applications [8]. That mapping has since grown concrete. A deployed agent now ships with its own shell, file system, and memory that persists across sessions [9], [10], [11], [12]. Three properties characterize this de-facto kernel. First, its authority isstanding: acquired at inte- gration or installation and exercised at the agentâs dis- cretion across task boundaries. Second, its reach isbroad: one principal touches files, networks, shells, browsers, and other agents, whether through general-purpose facilities or through declared application interfaces. Breadth is what makes open-ended, multi-step work possible, and it is the same property that sets the attack surface â ev- ery service the agent can reach is a service an injected instruction can reach through it. Third, the principal holding that authority isprobabilistic: it samples its de- cisions. The same request is not guaranteed to yield the same privileged action twice. 2.2 The AI-Native OS as Architectural Horizon Agents today do not yet decide what resources the work gets: how much compute and memory it may consume, and which agent runs when several contend. Those deci- sions depend on what the work requires, which only the 2 model is in a position to know. The academic lineage points to kernels built for the model, with a scheduler, a memory manager, and a natural-language interface in place of a system-call table (AIOS [13], MemGPT [14], AgentOS [15]). The proposals divide on where arbitra- tion is enforced. At one end the model is the kernel and arbitrates directly [16]; at the other a deterministic layer beneath the model retains enforcement and executes what the model proposes [13], [17]. When such a system is deployed, something must hold apart agents acting for different principals who do not trust one another. That is the classical controlled-sharing problem of a multi-user system [18]. Hypervisors and exokernels supply it with de- terministic mechanism [19], [20]. The problem is already live: agents for different principals are served from one shared model, and that sharing has been shown to leak one userâs inputs to another [21], [22]. An AI-native OS would have to answer it with a core that decides by sam- pling. With this, we distill the six criteria of an AI-native OS: 1.Intelligence at the architectural core, not the application layer.Model inference is a first-class system resource â like memory or I/O scheduling â rather than a feature running atop the OS: an LLM kernel exposing its own system-call interface, agent scheduler, and memory manager [13], with arbitra- tion decided from what the model knows about the work, enforced either by the model itself [16] or by a deterministic layer beneath it. 2.Intent-based rather than command-based control.The interface is natural-language goal spec- ification with contextual interpretation, not explicit enumerated commands: natural language is the sys- temâs own interface rather than a layer above a com- mand one, and a kernel behind it translates the stated goal into orchestration [15], [16]. 3.Persistent, cross-session context.The system maintains a continuous model of user goals, state, and history as a first-class resource, held by a context manager that pages spans into and out of a bounded window [14]. 4.Autonomous multi-step execution.The system plans and commits multi-step tasks across applica- tions without per-step human orchestration, select- ing and binding actions the originating request did not name [4]. 5.OS-level agent lifecycle management.Permis- sions, identity, registration, sandboxing, and delega- tion for agents are handled by the system itself, with agents constituting a distinct workload class [3], [23]. 6.Mutually-distrusting multiplexing.Agents act- ing for principals who do not trust one another share the systemâs resources, and the system, not the prin- cipals, is what holds them apart [18], [19]: Agenti- cOS isolates each agent capsule with hardware page tables beneath the model [17], and HarmonyOS 7 puts a single system-level agent over the third-party agents its agent framework admits [24]. Figure 2 sets the de-facto agent kernel and the AI-native OS against a conventional OS. Both differ from it in the same way: standing arbitration authority held by a prob- abilistic principal. In turn, they differ from each other in who arbitrates. 3. Related Work and Positioning Several surveys of agent security have appeared recently. Kim et al. organize the field along seven design dimen- sions of agent systems, six attack vectors, and seven secu- rity risks, and close with a case study of AutoGPT [25]. Ling et al. follow a request around the agentâs operating loop, from input through planning, decision, and tool exe- cution to output, with memory, monitoring, and coordina- tion as cross-cutting concerns; they conclude that secure agents require explicit trust boundaries, principled priv- ilege control, provenance-aware state management, and realistic evaluation [26]. Chuâs Layered Attack-Surface framework (LASM) places each attack and defense on one of seven stack layers, from the foundation model up to governance, crossed with a temporality axis, and re- views the methodological problems of existing evaluations [27]. Dehghantanha and Homayoun map ten attack sur- faces along the data-flow pipeline, from untrusted input through the model core and tool execution to long-term memory, and trace multi-step attack paths across them; they supply an evaluation protocol with validity controls and commend hybrid designs in which a deterministic execution kernel enforces schemas and capabilities while the model remains an untrusted proposer [28]. Pirch et al. look at agents through the lens of operating systems: agents face the same problems of resource isolation, priv- ilege separation, and communication mediation, and in tests of four deployed agents several protections fail in practice while established OS techniques could mitigate many of the failures [6]. This systematization differs from existing surveys in four ways. (i) It indexes attacks and defenses by what the check at each trust boundary must decide, provenance or meaning, rather than by where an attack enters. The index tells which crossings a deterministic mechanism can cover and which need a probabilistic one, and it grades a reported attack-success figure accordingly, as a defense not yet adopted or as an open gap. (i) It asks whether a complete mediator for the agentâs decisions can exist at all, rather than which OS techniques carry over to the agent. The answer gives a criterion for separating defenses that can be made complete from those that can only lower a residual, and says what an evaluation of the latter must report. (i) It treats evaluation validity as a subject in its own right, so that a reader can judge how far a reported figure transfers to deployment. (iv) It extends the analysis to the AI-native OS, for which no 3 Conventional OS pre-agentic baseline applications kernel deterministic resource arbiter no standing agent authority Hybrid: de-facto agent kernel deployedtoday agent principal probabilistic, standing authority conventional kernel owns scheduling, memory, arbitration agentatopthe kernel: the kernel decides Architectural AI-native OS horizon: envisioned model is the arbitration core decides scheduling, memory, authorization mechanism beneath, if any: executes what the model decides proposes modelisthe kernel: the model decides standing arbitration authorityheld by a probabilistic agent Figure 2:The transition this paper spans: standing authority passes to a probabilistic agent, then arbitration itself passes to the model. Table 1:How this work compares with the five nearest surveys.Covered= treated centrally;Partial= touched but not developed;Absent= not engaged. Entries describe each workâs stated scope, not its quality.LASM= Layered Attack-Surface framework. DimensionPirch et al. [6]Dehghantanha & Homayoun [28] LASM [27]Kim et al. [25]Ling et al. [26] This work Organizing principle OS analogy: isolation, privilege separation, mediation Attack surfaces along the data-flow pipeline Seven stack layersĂ temporality Design dimensionsĂ attack vectorsĂ risks Lifecycle stages Trust-boundary crossings, each placed by what its mediator must judge Role given to the OS frame Runtime as kernel, model as untrusted user; asks which OS techniques transfer Deterministic execution kernel with the model as untrusted proposer, as a recommended pattern AbsentKernelâuser analogy for plan- ner/processor separation only AbsentAsks whether an always-invoked mediator for the modelâs semantic crossings can exist Limit of runtime monitoring AbsentEmpirical â guardrails bypassable Layer-locality argument: a control at one layer cannot see an attack at another Empirical â detectors bypassed by adaptive attacks Partial â over-blocking and observability dependence noted Structural â residual argued irreducible where the mediator must judge meaning Evaluation validity AbsentCovered â evaluation protocol with validity controls Partial â methodological issues of existing evaluations Partial â benchmark caveats Partial â benchmark gaps Covered â reliability, evaluation- awareness, confidentiality axis Object of study Deployed open-source agents Deployed agentic systems Deployed LLM agents Deployed agentic systems Deployed LLM agents Deployed agents, then the AI-native OS 4 security systematization exists to our knowledge, so that designers of such systems know which deployed results carry over and which constraints they inherit. The key differences from the five closest surveys are summarized in Table 1. 4. A Trust-Boundary Taxonomy The taxonomy applies to both objects of Section 2, the de-facto agent kernel and the AI-native OS. In each, an LLM-based agent holds standing authority over system resources and exercises it through at least one of four ker- nel functions: deciding which actions execute, scheduling and delegating work, managing contextual and persistent state, and authorizing access to tools, files, networks, and other agents. Section 4.1 recalls what a mediator is and derives the scale on which each crossing is graded; Section 4.2 identifies the crossings around the agent principal and the question a mediator must answer at each. 4.1 The Mediation Framework Mediators have confined privileged software for half a cen- tury. Andersonâs reference-monitor concept requires that every access to a protected resource pass through a media- tion mechanism that isalways invoked,tamper-proof, and small enough to be verifiable[29]; Saltzer and Schroeder elevate the always-invoked criterion intocomplete media- tion, every access to every object checked for authority on every occasion [18]. Schneider fixed the enforceable end of these requirements: a runtime monitor that halts on a forbidden step can enforce at most thesafetyproperties [30]. Together these bound what any always-invoked me- diator can promise, on one premise: that it can decide, at each step, whether the next action is the bad one. In the agent setting that premise fails, and not because the principal is probabilistic: classical reference monitors were built to confine adversarial, non-deterministic prin- cipals, a malicious user process being their canonical case. What changes with the agent is the space the mediator must judge. The agentâs repertoire is an open-ended space of natural-language behavior rather than a fixed table of system calls. A deterministic mediator applies a rule frozen before the input it judges exists, so it can test only what is settled in advance: where content came from, what authority vouched for it, whether an action lies in a declared set. It cannot test what content means, because the content arrives only at run time. A predi- cate overprovenancecan therefore be deterministic, and a predicate overcontent semanticscannot. An agent kernel needs semantic judgments of two kinds: whether content is data or an instruction, and whether an action carries out what the principal asked. Each can be made only by a classifier, which misses some fraction of attacks at any false-positive rate a deployment can toler- ate. We argue that no better classifier removes that resid- ual. For the first judgment, Abdelnabi and Bagdasarian show that any flow a detector blocks can be reframed to appear legitimate, so no detector both blocks every at- tack and passes every legitimate flow [7], and Zverev et al. measure instructionâdata separation directly and find that current models achieve little of it [31]. For the sec- ond, the only statement of what the principal authorized is the request itself, and the request is underspecified by design: the principal delegated the task in order not to spell out what carrying it out would mean, and an intent specified tightly enough to check exactly is a plan, not a delegation. That judgment is a specification problem before it is a detection problem, so a better classifier does not close it either. The attacks these classifiers miss are themediation gap. Web security met the same failure, data treated as in- struction, in cross-site scripting, and contained it not with classifiers but with provenance and confinement: the same-origin policy, contextual escaping, Content Secu- rity Policy [32]. We therefore organize the boundaries along aprovenance-vs-semantics axis: at one end, cross- ings whose mediating judgment can be settled in advance; at the other, crossings whose judgment can only be made on content that arrives at run time. Each crossing re- ceives one of three grades on this axis.Deployment debt: the judgment can be settled in advance, so a determin- istic mediator is known, and what is missing is only its adoption.Structural gap: the judgment cannot be settled in advance, so no deterministic mediator can exist and a residual remains.Mixed: the judgment can be settled partially in advance, and the rest must be made at run time. 4.2 The Trust Boundaries An agent principal typically takes in content from users, documents, and tools; reasons over that content and com- mits to an action; sends the action to a tool, the host, or another agent; and runs on an inference substrate shared with agents of other principals. This gives six crossings (Figure 3): content enters the principal (B0); its reason- ing commits to an action (B1); the action reaches a tool (B2), the host (B3), or another agent (B4); and the princi- palâs state sits beside other principalsâ state in the shared substrate (B5). At each crossing a mediator must answer one question, stated below with the crossing. B0: external inputâagent.Untrusted content crosses into the agentâs prompt context: user messages, retrieved documents, and tool outputs treated as context. Mediation question:can the agent distinguish data from instructions at this crossing? We distinguish two cases by who supplies the adversarial content, since they call for different defenses. InB0-directthe input principal is itself the adversary, as in direct injection and jailbreaks; the problem is authorization at the principal level. In B0-indirecta benign principalâs task carries adversarial 5 Agent principal LLM reasoning core B0 external input âagent B1 reasoningâaction B2 agentâtool / transport B3 agentâOS / host B4 agentâagent B5 agentâco- resident principals untrusted web / RAG / documents tools / MCP servers OS / host resources other agents shared inference substrate mediation boundary (deterministic where the judgment is fixed in ad- vance) structural gap: B0 / B1 admit only probabilistic mediation untrusted external entity (beyond the boundary) Figure 3:The six trust boundaries around the agent principal. B0 and B1 are graded as structural gaps: their mediating judgment cannot be fixed before run time. third-party content; the problem is provenance. B1: agent reasoningâaction.The transition from deliberation to a committed action.Mediation question: is the chosen action authorized and faithful to the prin- cipalâs intent? Both sides belong to the same principal, so what crosses is not authority but the binding of intent to action. B1 is the point at which a decision becomes an execution, and the point at which a mediator can stop the committed action. B2: agentâtool/transport.Three things cross here on separate channels: the call the agent issues, the result that returns, and the configuration that tells the agent which tools exist. They do not share a threat model, so we split B2 into B2a, B2b, and B2c as follows: âąB2a â tool invocation.Outbound calls to tools and APIs.Mediation question:is each invocation least-privileged and authorized for the data that trig- gered it? The classical way to fail it is the confused deputy: a principal forwarding ambient authority to a tool on the strength of attacker-controlled text [18], [33]. We count as an invocation any output that a downstream component acts on, whether or not the agent addressed it (theactuator convention): a chat client that fetches the image named by a markdown link, or a terminal that executes an escape sequence. âąB2b â response-path/transport integrity. The channel returning a toolâs result, and the mes- sage path between agents.Mediation question:is the result the agent acts on the result the tool pro- duced? This is an integrity problem on the action channel, downstream of an already-correct decision [34], [35]: in-transit modification of an otherwise- legitimate message, wherever the adversary sits, in- cluding on a compromised edge device. The line against B0 falls at the toolâs output: only content altered after the tool returned it belongs here. âąB2c â configuration-channel provenance.The registration and loading of any instruction-bearing artifact the agent treats as executable configuration: tool descriptions, plug-in manifests, protocol capa- bility advertisements [36], marketplace skills, rules 6 files, and prompt templates.Mediation question:is the instruction-bearing metadata of a configuration artifact treated as untrusted data rather than as au- thoritative instruction? Tool poisoning and rug-pull attacks exploit exactly this provenance gap [37], [38] and persist across the ecosystem. B3: agentâOS/host.Effects on the underlying sys- tem: file access, process execution, network egress.Me- diation question:are host-level operations confined to a least-privilege capability set? Host resources already carry reference-monitor machinery, so the mediator here can be sound; what it cannot validate is the intent behind an authorized syscall, and that is B1âs question. B4: agentâagent.Negotiation, delegation, and mes- sage passing between agents.Mediation question:do trust and provenance labels remain non-downgradable across delegation? Decentralized-label discipline [39] is the classical answer, but negotiation in natural language produces behaviors that no label policy enumerates in ad- vance. B5: agentâco-resident principals.Agents act- ing for mutually distrusting principals share one inference core, and what can pass between them is not a message but shared state: keyâvalue caches, batching and schedul- ing queues, and context paged in and out on each prin- cipalâs behalf.Mediation question:does nothing cross between principals beyond what the scheduler intends? The obligation is isolation, the classical controlled-sharing problem of a multi-user system [18]. Today the serving framework beneath the agent enforces this isolation, as the host OS enforces least privilege on host operations (B3). In an AI-native OS the agent kernel schedules and multiplexes the inference core itself, so the isolation be- comes its own obligation. B0 and B1 ask the two semantic judgments of §4.1 in pure form, and are graded structural gaps (Figure 3). B2c and B4 ask a provenance question first, which a determinis- tic mediator settles, and then the same two judgments on another channel: whether a registered tool descrip- tion or an inbound agent message is itself an instruction, and whether a delegation hop passed the intent on faith- fully. B2a, B2b, B3, and B5 ask provenance questions only. The taxonomy is a set of crossings rather than of layers, because complete mediation is defined over the act of crossing. A layered scheme such as LASMâs maps onto it at the layer interfaces [27], and an attack that spans lay- ers becomes a path through several crossings (Figure 4). GeminiJack, a patched vendor proof of concept against an enterprise agent deployment, is such a path: a poisoned shared document enters at B0, persists in the retrieval store, and is retrieved later to drive a tool call that ex- filtrates data across B2a, with no user interaction at any stage [40]. 5. Attacks at the Trust Boundaries The attacker needs only one unmediated crossing to suc- ceed. This section classifies the published attacks by the trust-boundary taxonomy of §4. For each attack class it asks which mediation failure the attack depends on, grades that crossing on the provenance-vs-semantics axis of §4.1, and separates mechanisms the literature conflates. Each class receives one primary boundary, the earliest crossing whose mediation failure is necessary for it, with later crossings recorded in chain notation (B0âB2a for an injection whose payload actuates as a tool call), and every crossing in the chain is graded by its own mediation question. Table 2 collects the classification: each row is one attack class with its primary boundary, the strongest evidence for it, and the mediation available against it. 5.1 B0: Direct and Indirect Prompt Injection Prompt injection makes the agent follow, as an instruc- tion, content whose author had no authority to give one. Indirectinjection the writer is a user of the applica- tion, overriding the instructions its developer fixed in the system prompt: HouYi mounts it black-box against de- ployed LLM-integrated applications, with no access to the model [42]. The same direct channel serves reconnais- sance: PLeak optimizes user queries that make deployed applications reveal their system prompts [82]. Inindi- rectinjection the instruction rides in content the agent retrieves or a tool returns, so the attacker need not be a user at all [41]; this is the form that matters most for an agent, since nearly everything it reads is content it did not author. Both forms cross B0: the user turn and the retrieved document are alike content entering the prin- cipal, and the mediation question is the same for both. Googleâs web-scale monitoring finds injection patterns present and rising on the open web, up roughly one-third across successive CommonCrawl snapshots between late 2025 and early 2026 [83]. In the field, EchoLeak (CVE- 2025-32711) turned an indirect injection into zero-click exfiltration from a production enterprise copilot, carry- ing a crafted email past the vendorâs injection classifier [44]; in a large-scale public indirect-injection competition, every one of the thirteen frontier-class models evaluated was breached by at least one entry [43]. Both mediators, the vendorâs classifier and the modelâs own refusal train- ing, are probabilistic, and both were bypassed. Whether ingested content is instruction or data is a question about its meaning, and no deterministic check decides that, so the class is graded a structural gap. The surface widens once the agent perceives the open web or a rendered screen, and the payload need not be text. Injection has been delivered through rendered web con- tent [45], through the accessibility tree that web agents read as their view of a page [46], and through content that adapts to the agentâs environment to exfiltrate per- sonal data [47]; WASP measures the attack end-to-end 7 attacker- controlled content shared doc / web page / email agent reasoning core privileged action / tool call sensitive sink data exfiltration retrieval / memory store poison retrieved later persistent-state transport: B0 payload carried forward in time B0 B1 B2a other agents B4 self-propagation (worm) GeminiJack:poisoned shared documentâpersists in storeâretrievedâcross-tool exfiltration. EIA:adversarial web content read directlyâgeneralist web agentâPII leak through the action channel. Figure 4:Cross-boundary kill chains: one unmediated crossing suïŹices to complete a path. against web agents [84]. On a full desktop, VPI-Bench delivers injection through popups, banners, and screen- shots [48], and OS-Harm measures it alongside misuse for computer-use agents [85]; adversarial images and au- dio carry the same injection into multimodal models [49]. Because these agents act on what they perceive, the in- jection actuates directly as a click or a tool call, which is the B0âB2a chain of Table 2. The mediation question is unchanged and only its carrier differs, so a B0 media- tor that inspects text but not pixels or audio leaves the crossing open. 5.2 B0: Poisoning of Persistent State Persistent state lets an injection wait: content poisoned in one session is retrieved and followed in a later one. The literature conflates three mechanisms whose media- tion questions differ.Corpus poisoningtargets the doc- ument store: PoisonedRAG steers an agentâs output by corrupting as few as five entries, because the passage ar- rives through a channel the agent treats as trusted context [50], [51], and CorruptRAG succeeds with a single poi- soned text without outnumbering benign ones [52].Self- written-memory poisoningcorrupts state the agent itself wrote in a prior turn or session, through query-only inter- action by an ordinary user [54], by backdooring long-term memory together with the knowledge base [53], through the experience-retrieval loop [55], and through memory- control-flow attacks that force unintended tool calls [56]; Anthropic now shares one userâs memory across its chat and agentic surfaces, so a poisoned entry is scoped to the user rather than to the session that wrote it [86]. Retriever-targeted poisoningcrafts passages to be ranked highly by the retriever rather than to persuade the model that reads them [57], [58]. All three enter through the agentâs ordinary ingestion path, so all three are B0 and share its structural gap; what differs is where the mediator must stand. Cor- pus poisoning is narrowed by provenance tracking over retrieved data, enforced at retrieval or load time while the origin of each passage is still known; self-written- memory poisoning requires that the agentâsown outputs be treated as untrusted when later retrieved, which col- lapses the trusted/untrusted partition memory systems assume; retriever-targeted poisoning defeats any defense that trusts the retrieval mechanism while scrutinizing only its inputs and outputs. A backdoor trained into the retriever [87], or into the model and its embedders and monitors [88], is not a crossing of the running principalâs interface: it is settled before the principal runs, and its mediator is the provenance of the artifact itself, the ana- logue of verifying the kernel image at boot rather than mediating its accesses at run time. 5.3 B1: Selective Disclosure and Goal Drift Not every deviation from the principalâs intent is injected from outside. Inselective disclosurethe agent advances a goal by withholding material information rather than by asserting a falsehood. The unified deception taxonomy lists omission as a mechanism of its own, beside fabrica- tion and pragmatic distortion [59], an agent can report to its overseer in ways that stay literally truthful while subverting oversight [60], and frontier models under eval- uation show in-context scheming of the same kind [61]. Goal driftis the gradual case: an agent given an explicit 8 Table 2:Published attacks classified by the trust-boundary taxonomy. Each row names the classâs primary boundary; âmarks a necessary later crossing, / marks alternatives at the same position, and parentheses qualify the crossing. Deployed vs. labrecords the strongest evidence reached, a shipped-product exploit or a laboratory proof of concept. Mediation availablerecords what can stop the attack: a deterministic mediator not yet deployed (deployment debt), only a probabilistic one (structural gap), or a deterministic one for part of the class (mixed). Boundary chain (primary first) Attack classRepresentative attacksDeployed vs. labMediation available B0Direct/indirect prompt injection Greshake [41]; HouYi [42]; public IPI competition [43] Deployed (EchoLeak, CVE-2025-32711 [44]) Structural gap B0âB2aWeb, GUI, and multimodal injection (malicious DOM, accessibility tree, screenshot, image/audio) WebInject [45]; accessibility-tree IPI [46]; EIA [47]; VPI-Bench [48]; Bagdasaryan [49] Deployed (browser and computer-use products) Structural gapâ deployment debt B0(persistent)Corpus poisoningZhong [50]; PoisonedRAG [51]; CorruptRAG [52] LabStructural gap B0(persistent)Self-written-memory poisoning AgentPoison [53]; MINJA [54]; MemoryGraft [55]; Memory-control-flow [56] LabStructural gap B0(persistent)Retriever-targeted passage poisoning BadRAG [57]; Joint-GCG [58]LabStructural gap B1Selective disclosure; goal drift Deception taxonomy [59]; upward deception [60]; in-context scheming [61]; goal-drift evaluation [62] LabStructural gap B0âB2a/B3Taint-style RCE via tool execution (confused deputy) AgentFuzz [63]; complete-takeover [64] Deployed (34 zero-days / 23 CVEs) Structural gapâ deployment debt B2bResponse-path / transport tampering RTA [34]; malicious intermediary [35]; Agent-in-the-Middle [65] LabDeployment debt B2cConfiguration poisoning (tool descriptions, MCP metadata, skills) MCP attack vectors [37]; MCPTox [38]; ToolHijacker [66]; BadSkill [67]; marketplace audit [68] Deployed (real MCP servers; skill marketplace) Mixed B3Sandbox/container escape from host confinement Sandbox-escape evaluation [69]; OpenClaw sandbox-to-host chain [70] Deployed (four-CVE chain to host persistence) Deployment debt B0âB4Agent-to-agent worms / self-propagating injection Morris-I [71]; Prompt Infection [72]; Zombie Agents [73] LabStructural gapâ structural gap B4Manipulated-knowledge spread between agents Flooding spread [74]LabStructural gap B1âB4Intent drift along delegation Telephone-game chains [75]; MAST inter-agent misalignment [76]; inherited goal drift [77] Lab Structural gap â structural gap B5Cross-tenant KV-cache and scheduling channels PROMPTPEEK [22]; InputSnatch [21]; Shadow in the Cache [78] (cache-at-rest, stronger adversary); RAG non-prefix cache [79] Deployed (serving substrate, not the agent) Deployment debt B0(availability)Resource exhaustion / denial-of-wallet OverThink [80]; tool-chain amplification [81] LabDeployment debt objective and then run over a long horizon under compet- ing environmental pressures deviates from it, and every model evaluated drifts to some degree, the more so as its context grows [62]. Both deviations arise within the agentâs own decision process and require no adversarial crossing, so they are assigned B1, the crossing at which they first become observable to an overseer. The rule that assigns each class its earliest crossing leaves B1 few primary rows, but every chain in Table 2 that ends in an action passes through it, since an injected instruction does harm only once the agent commits to acting on it. The crossing is graded a structural gap. A report that stays literally true passes any check on what it says; whether what it omits was material can be decided only against the principalâs intent, and whether a drifted action still serves the objective is the same judgment. Neither is a check a deterministic mediator can make. 9 5.4 B2: Tool-Interface Attacks Three channels cross B2, and each carries its own attack class and its own grade. B2a â Tool hijacking.An injected instruction is inert un- til it reaches an actuator; the tool call is where hijacked reasoning becomes privileged action, with the agent as the confused deputy. What §5.1 records as a failure of in- gestion, B2a records as a failure of invocation: the same chain, judged at its second crossing. AgentFuzz, which drives one agent to attack another, found 34 zero-day vulnerabilities in deployed agent software, 23 of them as- signed CVEs, each confirmed exploitable by the authorsâ pipeline [63]; InjecAgent benchmarks the same confused- deputy path across tool-integrated agents [89], and a com- plementary line drives agents to complete host takeover [64]. The chain needs both crossings, B0 for the injection and B2a for the actuation (B0âB2a in Table 2), so a complete mediator at either would close it. Neither has one. B0 admits only probabilistic mediation (§5.1). B2a has a deterministic check, least-privilege invocation, so on its own it is deployment debt; but least privilege bounds what an actuated call can do, not whether it should have been issued. The class is therefore primary at B0 and in- herits its structural grade, with deployment debt at B2a. B2b â Transport tampering.Response-path attacks alter the channel after the model has decided, so that the ac- tion taken diverges from the action chosen. Because the tampering sits downstream of the decision, it succeeds against models that have already passed safety training [34], and a malicious intermediary on the agentâs com- munication path can rewrite messages in transit [35]; be- tween agents, an adversary that only intercepts and ed- its the messages they exchange compromises the whole system without touching any agent [65]. Whether the re- sult the agent acts on is the one the tool produced is a message-integrity question. Signing or channel authenti- cation decides it, and the crossing is open only because those primitives are not deployed on agent tool chains, so it is graded deployment debt. B2c â Configuration poisoning.Tool descriptions, plug- in manifests, and protocol metadata are loaded once and trusted thereafter, and the Model Context Protocol (MCP) ecosystem now supplies the evidence that they are treated as instruction. A systematic study catalogues tool-poisoning, puppet, and rug-pull attacks [37]; MCP- Tox measures roughly 66% average attack success for tool poisoning against real MCP servers [38]; ToolHijacker poisons tool selection with a single malicious tool doc- ument, which is trusted because it was registered and acts only when selected (chain B2câB2a) [66]; BadSkill poisons skill marketplaces at low poison rates [67], and an audit of the OpenClaw marketplace found 341 mali- cious skills among the 2,857 then listed, rising to 824 as the marketplace grew past 10,700 [68]. Attestation and least-privilege registration close the provenance half â rug-pull, impersonation, unsigned artifacts â determin- istically. But verifying who published a description does not catch one that is legitimately registered and whose text is itself malicious, as MCPTox shows; ruling regis- tered metadata benign or hostile is a semantic judgment the provenance mediator does not reach, so the crossing is graded mixed. Configuration poisoning is easily confused with the mem- ory poisoning of §5.2, since both plant an instruction the agent will later trust; what separates them is origin, not how the artifact is later loaded: a memory entry arrived through the agentâs ingestion or self-write path and is data at B0, whereas a tool description or skill was in- stalled and is configuration at B2c. 5.5 B3: Sandbox Escape At B3 the agentâs actions reach the hostâs files, pro- cesses, and network. Reaching them through an autho- rized call is the terminus of the tool-hijacking chain of §5.4 (B0âB2a/B3 in Table 2) and is graded with it; B3âs own class is escape from confinement, in which the agentâs process gains host access it was never granted. Frontier models probe their way out of container sandboxes un- der evaluation [69], and the OpenClaw agent platform supplies the deployed record: a one-click remote code ex- ecution and a critical privilege escalation [90], [91], and a four-CVE chain from code execution inside the sand- box to persistence on the host [70]. The mediator here â process sandboxing, containers, seccomp, capability drop- ping â is mature and deterministic, so an escape is a bug in a sound mediator, closed by hardening what ex- ists rather than by any advance in semantic defense. The crossing is graded deployment debt. 5.6 B4: Worms and Intent Drift Two mechanisms cross B4, and the literature merges them. Self-propagating injectionis a payload that, once pro- cessed by one agent, causes it to emit the same pay- load to others, replicating without further attacker action: Morris-I demonstrates this against RAG-backed email as- sistants [71], Prompt Infection spreads it across heteroge- neous multi-agent systems [72], and Zombie Agents makes it persist across sessions in self-evolving agents [73]. The payload enters at B0 and multiplies at B4, so the class is primary at B0 (B0âB4 in Table 2) and inherits its structural grade. B4âs own mediation question, whether trust labels survive delegation, is decidable, but a per-hop check that preserves the label still forwards a correctly labeled malicious payload to the next victim, so label dis- cipline does not stop a worm. Intent driftis the degradation of the principalâs intent along a delegation chain, as each agent reinterprets, sum- marizes, or filters what it forwards. The benign record es- tablishes the mechanism: in transmission chains of LLM agents, biases negligible in a single output accumulate 10 over hops and pull the content toward attractor states [75]; across 1,600 traces from seven multi-agent frame- works, information withholding and ignored input be- tween agents are recurrent failure modes [76]; and an agent conditioned on the trajectory of a weaker agent inherits that agentâs drift [77]. The adversarial counter- part enters at B4 itself: a single manipulated agent per- suades benign peers to adopt and spread counterfactual knowledge without any injected instruction, and the ma- nipulation persists once the peers store the conversation in retrieval memory [74]. Drift proper begins at B1, as the goal drift and selective disclosure of §5.3, and com- pounds at B4 (B1âB4 in Table 2), whereas a worm is a B0 payload that B4 replicates. The two scale differ- ently: drift grows with the length of the delegation chain, a wormâs blast radius with the size of the agent network. Non-downgradable labels across delegation answer driftâs provenance half, but whether each hopâs forwarding was faithful to the intent is the B1 question repeated at every hop, so drift carries B1âs structural residual into B4. 5.7 B5: Cross-Tenant Leakage Serving frameworks such as vLLM and SGLang reuse the keyâvalue (KV) cache across requests that share a token prefix, and sharing it across users turns the cache into a channel. The first channel is timing: a request whose prefix is already cached returns its first token sooner, and InputSnatch turns that into an attack through the ordi- nary API that recovers how much of a prefix is cached [21]. The second is service order: prefix-aware scheduling serves a request earlier when it shares more cached state, and PROMPTPEEK reconstructs other usersâ prompts from that ordering alone [22]. Two further lines widen the surface under stronger assumptions: inversion and injection attacks on the cache at rest, by an adversary holding the plaintext cache and the model weights [78], and extraction through the non-prefix cache fusion that RAG stacks use to splice retrieved chunks, which reaches the agentâs own retrieval path [79]. Never sharing cache across tenants is a complete determin- istic mediator that closes the crossing outright, and where sharing is enabled it has been declined for throughput; partitioning on provenance â per-tenant namespaces, or sharing only system-supplied prefixes â is the same me- diator at finer grain, and SafeKV benchmarks both as established baselines [92]. The mediator exists and is un- adopted, so the crossing is graded deployment debt. 5.8 Availability across the Crossings Availability is attacked through crossings the taxonomy al- ready names, but the property harmed is cost and latency rather than the integrity of an action. OverThink injects decoy reasoning problems into content a reasoning agent ingests, inflating the tokens spent per query while leaving the answer correct [80]. A malicious tool server that ed- its the human-readable fields of its returns while leaving their structure intact steers an agent into prolonged tool- calling loops that raise per-query cost by up to 658Ă, a denial of wallet [81]. A training-time variant, data poi- soning that conditions a model to emit near-unbounded output on a trigger [93], is settled before the principal runs and is mediated by artifact provenance, as in §5.2. Both runtime attacks enter at B0, as ingested content and as a toolâs own return. What stops them is not a medi- ator at B0 but a resource counter: budgets, quotas, rate limits, loop bounds, per-task token ceilings. A counter de- cides on a number, not on what the content means, so it is deterministic, and the class is graded deployment debt. 6. Runtime Monitoring as Probabilistic Mediation A runtime monitor is a mechanism separate from the agent that watches it and intervenes when it judges behav- ior unsafe [94]. Wherever a crossingâs mediation question is semantic, current practice deploys a runtime monitor as the mediator. A monitor has a threshold: lowering it catches more attacks and rejects more benign traïŹic, so a miss rate means something only together with the false- positive rate at which it was measured; we call that pair the monitorâsoperating point. Monitors differ in what they read: the input before the model sees it, the reasoning the model writes down, the ac- tivations inside the model, or the actions the agent emits. Sections 6.1â6.4 take the four layers in that order. Each states which crossing the layer mediates, what escapes it, and what miss rate has been measured. Section 6.5 asks what stacking the layers buys. 6.1 Monitoring the Input An input monitor mediates B0: it inspects untrusted con- tent before the model reads it and rejects what it judges to be an attack. Anthropicâs Constitutional Classifiers are the best-documented instance: input and output clas- sifiers trained against a written constitution of permit- ted and forbidden content cut universal-jailbreak success from 86% to 4.4% at a 0.38% rise in refusals of benign traf- fic, and the production version holds the added refusals near 0.05% [95], [96]. DataSentinel builds on known- answer detection, which hands the untrusted content to a separate detector model together with a secret instruc- tion, and reads the detectorâs failure to repeat that in- struction as evidence of injection [97]. Reported detection rates are measured against fixed at- tacks, and they do not survive an attacker who adapts to the deployed defense. Known-answer detection is bro- ken by an adaptive white-box attack [98]. DataSentinel had trained its detector in alternation against an attacker searching for injections that preserve the answer [97], and the same attack still drives it to 0% detection on most 11 tasks [98]. Gradient, reinforcement-learning, search, and human-guided attackers tuned against twelve recent jail- break and injection defenses bypass most of them with success above 90%, where the majority had reported suc- cess near zero [99]. Under adaptive attack, the input layer misses most of the attacks it was reported to catch. 6.2 Monitoring the Chain of Thought A reasoning model writes intermediate reasoning before it acts. A chain-of-thought monitor reads that text and mediates B1: it asks whether the reasoning shows the agent pursuing something other than what the principal asked. On reward hacking by a frontier reasoning model in coding tasks, Baker et al. find that a monitor read- ing the chain of thought catches 95% of the hacks and a monitor reading only the actions catches 60% [100]. Ope- nAIâs monitorability suite confirms the ordering on prac- tical tasks, reports that reinforcement learning at current scale does not materially reduce what the trace reveals, and shows that follow-up questions to the model, with the answers passed to the monitor, raise the catch rate [101]. In OpenAIâs GPT-5.6 evaluation the model rea- soned about seeded sabotage in its trace but kept it out of its final output in 76% of the trajectories in which it continued the sabotage [102]. Models also cannot yet con- trol the trace: asked to keep a given piece of reasoning out of it, Claude Sonnet 4.5 succeeds 2.7% of the time, against 61.9% for its final output [103]. LlamaFirewallâs alignment check audits agent reasoning for injected goals in deployment [104], and OpenAI monitors 99.9% of its internal coding-agent traïŹic with a frontier model that reads every tool call and the chain of thought [105]. The trace is legible because nothing has yet trained the model to hide it. Baker et al. penalize the agent during reinforcement learning whenever the monitor flags its rea- soning, and find that the agent exploits the taskâs reward less at first, then as often as before but without writing about it, so the monitorâs recall falls to near zero [100]. No training is needed when the adversary can edit the trace. Rewriting only the reasoning of a completed exploit to read as good-faith engineering, with every command and output left unchanged, drops a held-out monitorâs catch rate from about 95% to under 11% on the hacks the ac- tions do not give away [106]. A backdoor implanted by fine-tuning does the same from inside: the model pro- duces the attackerâs chosen behavior while its trace stays benign [107]. And the trace shows only what the model puts into words. The multi-lab monitorability statement draws the conclusion: the trace is a fragile opportunity, useful while the model is not optimized against it and only for intent the model puts into words [108]. 6.3 Monitoring Internal Activations An activation monitor reads the modelâs internal repre- sentations rather than its text, and mediates B1 on the channel the trace leaves out: Anthropicâs activation read- ing finds representations of rule-circumvention, fabrica- tion, and evaluation-awareness that the chain of thought never mentioned [109]. Detection reads a signal: linear probes and sparse-autoencoder features flag drift or in- jection [110], [111], attention signatures separate injected from legitimate instructions without training [112], and the signals have a mechanistic basis, since ablating a sin- gle safety-specific attention head makes harmful output roughly 16Ămore likely [113]. Intervention follows detec- tion: ICON steers attention back to the legitimate task when it detects over-focusing on injected content [114]. Interpretation renders the signal: attention attribution locates which untrusted span drove a decision, and acti- vation decoding writes internal state out as natural lan- guage [115], [116]. OpenAI now runs the layer in produc- tion as the first stage of a pipeline: activation classifiers inspect every sampled token and escalate to automated investigators that read the tool actions and the reasoning, at roughly 20% of the monitored inference compute [117]. The best measured case shows what the layer can and cannot check. NeuroFilter reports a 0% bypass rate on its privacy-policy trajectories, because it checks activa- tions against one fixed norm and deviating activations are nearly orthogonal to it; on an out-of-distribution at- tack family the same monitor misses 55%, and a general- purpose probe scores at or below 65% [118]. A pinned predicate is checked exactly, and the open action space is not. The representation is also a target: obfuscated- activation attacks perturb what the probe reads and cut its recall from 100% to 0% while 90% of the outputs re- main jailbroken [119], and a model can be reinforcement- tuned to produce harmful output while its activations stay inside the accepted region [120]. The layer needs white- box access to the residual stream, so an operator of a closed model cannot run it at all. 6.4 Monitoring the Action Trajectory An action monitor reads what the agent emits: tool calls, their arguments, and their results, over the whole trajec- tory. It mediates B2 and B3, and it is the only layer that sees a chain of individually permitted steps converge on a harmful outcome. AgentSight reads the trajectory from outside the application: it traces the agentâkernel boundary with eBPF, links the modelâs emitted intent to the system calls it triggers, and catches prompt injec- tion and runaway tool loops at under 3% overhead [121]; whether a linked pattern is malicious is then handed to a language-model observer. CausalArmor makes that judg- ment cheaper by attributing the agentâs intent to one input segment through leave-one-out ablation and sani- tizing only that segment [122]. Frontier models are the strongest monitors of this kind, and three evaluations measure them. SHADE-Arena pairs benign main tasks with harmful side tasks; the best monitor, Gemini 2.5 Pro, separates benign from sabotage transcripts at an AUC of 12 0.87 [123]. SLEIGHT-Bench fixes the operating point: at a 1% false-positive budget an Opus 4.6 monitor with ex- tended thinking catches 32% of forty evasion attacks, and twenty of them are never caught across ten trials [124]. And the monitor is itself a model reading attacker-shaped text: prompt injection aimed at the trusted monitor lets frontier agents evade it and complete malicious tasks on both main AI-control benchmarks, and a protocol that resamples on suspicion amplifies the injection [125]. 6.5 Composing Monitors Every layer misses attacks, so deployments stack them. The stackâs miss rate is not the product of the layersâ miss rates: LlamaFirewallâs input classifier and chain- of-thought auditor let through 7.5% and 2.9% of Agent- Dojoâs attacks alone and 1.75% together, against 1.2% if their misses were independent [104]. Three reasons make the misses overlap. The layers read different channels, so an attack is judged only by the layers that read the chan- nel it uses: intent the model never puts into words passes the trace monitor unjudged (§6.2), and a chain of indi- vidually permitted steps passes every layer but the tra- jectory monitor (§6.4). The layers are learned predictors with correlated failures: one obfuscation of the activations defeats harmfulness probes, sparse-autoencoder features, and out-of-distribution detectors alike [119]. And a mon- itor is itself a model: it can be poisoned before deploy- ment [88] or injected at run time (§6.4), and a compro- mised monitor fails silently at the layer meant to catch the others. No surveyed evaluation measures a stack under adaptive attack. The nearest evidence is Google Deep- Mindâs from defending Gemini: eight injection defenses were each tested against three attacks, once with the at- tack fixed and once with it tuned to the defense, and in sixteen of the twenty-four pairings the tuned attack suc- ceeded at least as often as the fixed one; Geminiâs defenses are therefore re-evaluated continuously rather than certi- fied once [126]. Stacking narrows the mediation gap of §4.1, but does not close it. 7. Architectural Separation as Deterministic Mediation Architectural separation arranges the components of the agent so that untrusted content and privileged action never meet on one channel. What remains to check is deterministic: whether an operation is in the fixed set, whether data marked untrusted may reach its destination, whether a signature verifies. As agents run unattended, architectural separation bears the assurance that a human in the loop used to provide. 7.1 Separating Untrusted Content from Privileged Action The strongest architectural defenses neutralize prompt in- jection by construction rather than by classification, and the first family does so in the control flow. Willisonâs dual-LLM pattern pairs a privileged model that has tool access but never reads untrusted content with a quar- antined model that reads untrusted content but holds no tools [127]; Beurer-Kellner et al. catalogue the design patterns that grew from it: plan-then-execute, context minimization, action-selector, and the dual-LLM family itself [128]. CaMeL is the evaluated instance: a priv- ileged model emits a plan over a fixed set of operations before any untrusted content is read, and the quarantined model that handles the content may fill in data values but cannot alter the control flow, so an injected instruction cannot redirect the sequence of privileged actions [129]. The doctrine behind it is the object-capability tradition, which bounds the confused deputy by making authority a possessed, unforgeable token naming an object and a per- mitted operation, so that possession proves authorization and no ambient grant can be confused into misuse [130], [131], [132], [133]. CaMeLâs planner-issued capabilities bind each operation to such a token rather than to what- ever instruction last appeared in context, which installs a deterministic check at the B1 and B2 crossings. Plat- form ecosystems now perform the same re-enumeration at scale: Appleâs App Intents and Androidâs App Functions fix at build time the operations the system may discover and invoke [4], [5]. An operation the developer never de- clared is invisible to the orchestrator, which is the expres- siveness cost; the declaration is also the registration-time provenance mediator the B2c crossing prescribes (§4.2). A second family separatesexecution domains. Iso- lateGPT runs each third-party app or tool of an LLM platform in its own isolation domain and permits cross- domain interaction only through a hub that mediates ev- ery inter-app call, at under 30% overhead [134]; Prompt Flow Integrity adds secure handling of untrusted data and explicit privilege-escalation guards to the same isolation [135]. A compromised toolâs blast radius is bounded by its domain. The two families mediate different crossings and compose: CaMeL fixes what may execute, IsolateGPT where each principal executes. One family worth mentioning here is dataâinstruction sep- aration inside the model. Spotlighting delimits or encodes retrieved text so that the model can tell it from instruc- tions [136]; ASIDE, ISE, and AIR mark the data channel in the representation, by rotating or tagging data-token embeddings and by carrying the instruction hierarchyâs privilege signal through the layers [137], [138], [139], [140]; StruQ and SecAlign train the separation into the weights, by fine-tuning on marked queries and by preference opti- mization against injected instructions [141], [142]. This is not architectural separation, and its guarantee is of a different kind. CaMeL keeps an injected instruction out of the control channel, whereas these techniques leave ev- ery flow possible and only make the model less likely to follow the instruction. 13 7.2 Bounding the Influence of Persistent State None of the defenses above reaches the persistent B0 channel, which §5.2 separated into three variants. Ro- bustRAG provides certified robustness against bounded retrieval corruption through an isolate-then-aggregate structure: each retrieved passage is processed in isolation and the per-passage responses are securely aggregated, so a bounded number of poisoned passages cannot control the output beyond a provable bound [143]. It covers the corpus-poisoning variant only. The self-written-memory variant now has defenses on both sides of the probabilis- tic/structural divide. A-MemGuard validates each rea- soning path by consensus against related memories and stores detected failures as lessons consulted before future actions, reporting attack-success reductions above 95% at minimal utility cost [144]; as a learned consensus de- tector it is a probabilistic mediator and carries the me- diation gap. MemLineage is the structural counterpart: a Merkle-log-backed derivation DAG over agent memory records which retrieved entries influenced each new write, and sensitive actions whose justification descends from an external ancestor are gated, at zero attack success on its memory-poisoning workloads and sub-millisecond overhead [145] â the retrieval- and load-time provenance mediator §5.2 prescribes. LiSA gates the reuse of accumu- lated safety memory: an entry is released only when a pos- terior bound over its evidence clears a declared threshold [146]. The gate is arithmetic over counts, so the residual moves into the trustworthiness of what was counted. The retriever-targeted variant has no published defense. The strictest bound retains nothing: Appleâs Private Cloud Compute keeps no client-derived state between requests, so there is no persistent surface to poison, at the cost that defenses depending on durable memory cannot be expressed [147]. 7.3 Preserving Trust Labels across Agent Delegation Structural confinement within a single agent does not sur- vive delegation unless trust labels travel with the data. When one agent forwards content to another, the receiver must know whether it originated from trusted configura- tion or untrusted runtime input; if the source-trust la- bel can be stripped or downgraded in transit, the B4 crossing reintroduces the confused deputy that §7.1 closed within a single agent, and the multi-agent topology laun- ders provenance. The countermeasure is decentralized information-flow control (IFC). The decentralized label model attaches confidentiality and integrity labels to data and permits a principal to restrict but never to relax la- bels it does not own; that label monotonicity is the struc- tural invariant [39]. OS-level DIFC systems enforce such labels end-to-end across processes through a trusted refer- ence [148], [149], [150], [151]. Transposed to agents, âun- trustedâ becomes a sticky integrity label: a taint attached to a payload may be further restricted by any downstream agent but never elevated, extending CaMeLâs intra-agent labels [129] into inter-agent delegation. FIDES is the fullest agent-side instance: confidentiality and integrity labels attached as the agent plans and acts, with deter- ministic label propagation bounding what untrusted in- puts can influence, evaluated on AgentDojo [152]. Non- downgradable provenance is necessary but not shown suf- ficient: enforcing label monotonicity across heterogeneous agents with differing trust semantics is open, and no surveyed system â FIDES included, whose labels live within one plannerâs trust domain â demonstrates end- to-end label preservation across an organizational bound- ary, where the labelsâ meaning may not be shared [153]. 8. Authorization as Mediation of the Principal Authorization in the agent era must attach to an actionâs reversibility, not to the actorâs identity. Identity does not thereby become irrelevant: it is what scopes an agentâs standing authority and makes its actions attributable, while reversibility is what gates the consequential ones. Together they are the policy layer deciding which cross- ings of B2a (agentâtool), B3 (agentâOS/host), and B4 (agentâagent) are permitted at all. A soundly placed authorization gate is a deterministic mediator over an ad- versarial principal rather than a trustworthy classifier of one. The multi-agent, cross-device setting then exposes tensions around cross-protocol trust, collusion, and the lo- cation of enforcement that none of the surveyed schemes resolve. 8.1 Agent Identity as a First-Class Principal Authorization begins by treating the agent itself as a named principal rather than as an extension of the user who launched it. When an agent acts with the ambi- ent authority of its operator, every tool call inherits the operatorâs full privilege, recreating the confused-deputy condition; a distinct identity lets the agentâs authority be scoped, attenuated, and audited independently of the human on whose behalf it acts. Industry and research guidance now codifies this under a zero-trust framing in which no agent is trusted by virtue of its origin, with agent identity, certification, and activity logging argued as first- class infrastructure [154], [155], [156]. The durable princi- ple is least privilege [18]: an agent holds only the capabil- ities its current task demands, for only as long as the task runs, and the grant is observable to a reference-monitor- style mediator [29]. Progentâs programmable per-call privilege policies cut attack success from 39.9% to 1.0% on AgentDojo by checking each tool invocation against a least-privilege specification [157]; AgentSpec writes such policies as triggerâpredicateâenforcement rules checked at each tool call [158], and ClawGuard induces them per task and enforces them at every tool-call boundary, re- porting near-zero indirect-injection success on its bench- 14 marks [159]. Mobile-style scoped permissions and contin- uous information-flow-aware mediation are advanced as generalizations [160], [161]; the OS vendors are beginning to supply scoped permissions from below, through execu- tion containers with OS-enforced access declarations and per-agent identity in place of the operatorâs borrowed au- thority [3], [23]. 8.2 Authorization Tiered by Operation Reversibility Recent guidance grounds the gate inoperation reversibil- ity[154], [162]. The lineage predates the guidance docu- ments: GoEX proposed a reversible execution envelope with post-facto validation, undo, and damage confine- ment as runtime primitives in 2024 [163]. The alterna- tive â dynamic, risk-adaptive authorization that tracks the agentâs fluctuating trustworthiness [164] â inherits the mediation gap, since a runtime trust estimate of a stochastic principal is itself a probabilistic classifier. We therefore index authorization to theoperationâs conse- quences, a property determinable without estimating the principal at all. Reversibility is not yet a formal predicate, but three rules give it a checkable shape. âąR1 â Composition.Individually reversible ac- tions can compose into an irreversible effect, so re- versibility is a property of the action sequence, not of each step in isolation. âąR2 â External visibility.An outward action be- comes irreversible the moment its effect is observed beyond the trust boundary: a message is irreversible once read, not once recalled. âąR3 â Confidentiality taint.Any action moving sensitivity-labeled data across an external boundary is irreversible-tier whatever its own reversibility, be- cause a disclosure cannot be undone. Reversible operations â drafting a document, reading a file, issuing an idempotent query â can be permitted autonomously and corrected after the fact. Irreversible ones â sending external communications, executing fi- nancial transfers, deleting persistent state, granting fur- ther permissions â admit no rollback and are reserved for human-in-the-loop confirmation. Reversibility is an integrity criterion, and confidentiality does not obey it: reading a sensitive object changes no state, yet what it discloses cannot be un-read. R3 closes this gap. The read attaches the objectâs sensitivity label to everything derived from it, and the labels of §7.3 cannot be down- graded, so a later action that carries the labeled data to an outbound socket, a public log, or an untrusted tool is gated as irreversible even though the action by itself could be undone. Without R3 a chain of locally reversible reads and writes realizes exactly the exfiltration of the Gemini- Jack kill chain (Figure 4). The pattern is already practice: an analysis of twenty-one production agent deployments finds that all of them keep a human in the security loop through approval, scope, or policy gates, tiering access from read-only through sandboxed edit to gated full ac- cess with mandatory review at the irreversible tier [165]. A practical test is âImpossible versus Tediousâ [154]: a sound authorization boundary makes a harmful outcome impossible to reach without human assent, not merely tedious. A probabilistic check an attacker can grind past is tedium; a hard gate on irreversible actions halts the offending execution rather than usually flagging it [30], and since monitors are evadable (§6), the gate is the place for a structural guarantee on high-consequence operations. The gate retreats from the open action space to a finite, mediable set of consequential actions. The gateâs guarantee is conditional in two ways. It es- capes the mediation gap only while the irreversible set is enumerated in advance. If membership must be judged at run time, the judgment is semantic and the gap re- turns. And the gate guarantees only that a human says yes before an irreversible act, not that the yes is well- founded. R1 and R3 are conservative by design and place most action sequences and every action touching sensi- tive data behind the gate, so the human is asked often and approval decays into confirmation fatigue. The hu- man can also be deceived, because the approval prompt is drawn by the client from the agentâs own output. Under the actuator convention that renderer is a B2a crossing, the client-rendered channel EchoLeak exfiltrated through [44], so a hijacked agent can shape what the human sees and obtain assent for an action other than the one that will run. Classical systems security answers this with a trusted path, an unspoofable channel between the user and the enforcement mechanism; no surveyed mechanism sup- plies one for agent approval gates. 8.3 Multi-Agent and Cross-Device Trust Delegation moves authority across agents and devices. Verifiable delegation needs a cryptographic identity an- chor. W3C Decentralized Identifiers and Verifiable Cre- dentials let a downstream agent prove who it is and on whose authority it acts, so a delegated request carries its authorization rather than re-asserting it at each hop [153], [166]; workload-identity standards [167] and agent- specific frameworks [168], [169] instantiate the anchor. AgentSafe applies it in-band: an authenticated commu- nication layer validates each messageâs provenance and sender authority, and a trust-tiered memory store sepa- rates what each tier may read, with defense success above 80% against message-spread attacks [170]. No agreed in- teroperation layer joins the identity domains, so a delega- tion chain verifiable within one domain need not remain so once it crosses into another. A delegation chain is also only as trustworthy as its weakest participant: a single compromised or under- provisioned device caps the trust of the whole chain, the weakest-device bound[162]. An adversary controlling one 15 low-assurance node in an otherwise hardened mesh is- sues requests that inherit the chainâs accumulated author- ity, and the compromised endpoint becomes a confused deputy for the whole system [33], [154]. The labels of §7.3 do not help here: they record where data came from, and their enforcement assumes that every hop is honest, which is exactly what a compromised device is not. None of the surveyed agent-level mechanisms bounds the trust of the device itself. A centralized policy-enforcement point gives consistency and a single locus for audit and complete mediation [18], [171], but is a single point of failure and a scaling bot- tleneck in a fluid mesh [161]. Distributed enforcement, through per-agent policies derived at run time [172], [173] or AgentSafeâs in-band checks, survives the loss of any node and scales with the mesh, but is harder to keep consistent and multiplies the surfaces an attacker can tar- get. For agents the trade-off is sharper than the classical one, because wherever the enforced predicate is semantic the mediator is probabilistic. A centralized point con- centrates the miss rate in the one classifier that gates everything, and adaptive injection subverts such trusted monitors [125]. Distributed points are many smaller me- diators whose learned failure modes are correlated, and when agents watch agents they can be induced to collude [174]. The choice is between one large residual and many small correlated ones. 9. Measuring the Residual: Evaluation Validity The defenses surveyed in §6â8 are only as credible as the measurements that validate them. Agent security is measured on actions rather than text â a file exfiltrated, a tool call executed, state modified. A headline number is an upper bound on the agentâs security in deployment, on three counts. The benchmarks cover some specific boundaries and harms, and their results hold only for the model snapshot, platform, and context they were run on. The reported statistic is an average over attempts and, for a classifier, one point on an undisclosed operating curve, usually measured against static attacks. What makes it worse is that the agent model can distinguish evaluation from deployment. 9.1 Benchmark Coverage and Reproducibility Table 3 summarizes the benchmark landscape for the agents this paper covers: tool-using, computer-using, cod- ing, and claw-style platform agents. TheBoundarycol- umn shows where the field measures: every benchmark exercises some of B0âB3, two reach the configuration channel B2c (MCPTox, AgentCanary), one reaches B4 (SafeClawArena, within a single trust domain), and none reaches B5. B5 is absent because it is a property of the serving substrate rather than of the agent. Its mea- surement lives in the serving literature (§5.7), and an agentâs safety score says nothing about it, so a platform serving more than one principal must measure the sub- strate separately. TheHarm scoredcolumn shows what is counted: hijacked actions and aggregated unsafe ac- tions dominate, and confidentiality is counted separately by four benchmarks (InjecAgent, AgentDAM, RedTeam- CUA, SafeClawArena) and by no defense evaluation â every defense in §6â8 reports an attack-success rate over actions and none separates an exfiltration rate, although exfiltration is the realized harm of the composed kill chain of Figure 4, so a defenseâs reported number leaves its ex- filtration rate unknown. TheScoringandHarnesscolumns show under what con- ditions the number holds. Deterministic checks appear where the outcome is mechanical, a specific tool call that was or was not issued or a file, OS, or workspace state that was or was not reached, so the scoring adds no variance of its own. Where the harm is an aggre- gate over categories of unsafe action, the score is usu- ally a model judgeâs (Agent-SafetyBench, OS-Harm, A3S- Bench, AgentCanary; SABER keeps rules primary), so the broadest safety numbers move with the judge and in- herit its variance and bias. Harness realism runs from recorded tool responses with no execution (InjecAgent), through author-written scaffolds and emulated tools, to a real operating system (OS-Harm, RedTeamCUA) and the shipped agent platform (SafeClawArena, A3S-Bench, AgentCanary); SafeClawArenaâs authors argue that scaf- folds understate deployed exposure [178], and only Safe- ClawArena scores the shipped platform deterministically. And even a deterministic result holds only for the model snapshot, platform, and context length it was run on. An unpinned result decays silently as the deployed model changes. Platform hardening moves exposure differently for different models: on the production binary it cuts one frontier modelâs attack success from 69.7% to 21.9% while raising anotherâs injection rate from 58.0% to 71.0% [178], so safety is a property of the modelâplatform pair. Short- context safety does not predict long-context safety: most of sixteen models are safe on under 55% of LongSafetyâs 1,543 long-context cases [187], and an agentâs accumulat- ing tool-call history makes long context the norm. Nor does safety track capability: none of Agent-SafetyBenchâs sixteen agents, built on leading models across the capa- bility range, exceeds a 60% safety score, with the failures traced to robustness and risk-awareness defects rather than to capability deficits [181], and MCPTox finds the more capable models often more susceptible to tool poi- soning because the attack rides on instruction-following [38]. A safety score is a property of the configuration it was measured on, and capability has not bought safety. 9.2 Metrics and Evaluation Conditions A defense that holds nine times in ten is not a defense against an adversary who can retry. Security is a prop- erty of the worst case across attempts, so reliability across 16 Table 3:Representative agent-security benchmarks, grouped by the harm their headline number counts.Harm scored names what the headline number counts.Scoringnames how it is decided: adeterministic checkinspects a tool call or an environment state mechanically, amodel judgehas an LLM read the trajectory, and a benchmark combining rules with a judge is labeled by the primary one.Harnessnames what the agent runs against. BenchmarkBoundaryHarm scoredScoringHarness AgentDojo [175]B0âB2ahijacked actiondeterministic checkauthor scaffold Agent Security Bench (ASB) [176] B0/B2ahijacked actiondeterministic checkauthor scaffold InjecAgent [89]B0âB2ahijacked action; data stealing deterministic checkrecorded tool responses, no execution WASP [84]B0âB2ahijacked actiondeterministic checkweb replicas MCPTox [38]B2chijacked actiondeterministic checkreal MCP servers RedTeamCUA [177]B0âB3hijacked action; file exfiltration deterministic checkOS VM + web replicas SafeClawArena [178]B0/B2/B4hijacked action; confidentiality leakage deterministic checkproduction binary AgentDAM [179]B2aconfidentiality leakagemodel judgeauthor scaffold AgentHarm [180]B1/B2harmful task completion model judgeauthor scaffold Agent-SafetyBench [181] B1/B2/B3unsafe action, aggregated model judgeauthor scaffold OS-Harm [85]B0/B1unsafe action, aggregated model judgeOS VM OpenAgentSafety [182] B0/B1unsafe action, aggregated rules + model judgeauthor scaffold, real tools SABER [183]B0/B1/B3harmful operation, aggregated rules; judge auxiliaryproject containers A3S-Bench (ASEval) [184] B0risk behavior, aggregated model judgeproduction binary AgentCanary [185]B0/B2cunsafe action, aggregated model judgeproduction binary, real tools ToolEmu [186]B2/B3unsafe tool outcomemodel judgeLM-emulated tools repeated trials is the metric that matters and single-shot success a poor proxy for it. Two estimators are often con- flated: Pass@K, the probability that at least one of K at- tempts succeeds, flatters a system by rewarding any single success; Pass K , the probability that all K attempts suc- ceed, is the security-relevant quantity, since an attacker needs only one of the agentâs many runs to fail open. The gap is a property of the metric rather than of any one model: on tau-bench [188], GPT-4o achieves a Pass 8 rate below 25% where its single-attempt rate appears accept- able, and reliability frameworks for long-horizon agents find the same degradation across repeated runs [189]. A guardrail that must hold across every interaction in a ses- sion cannot be certified on a single-shot number. The single number is also the wrong number when the mediator is a classifier. If every deployable mediator of a semantic judgment is a tunable classifier (§4.1), an attack- success rate reported without a declared false-positive budget is an arbitrary point on an undisclosed ROC curve: the same defense can be made to show almost any catch rate by silently moving its threshold.Operating-point re- portingstates eïŹicacy as a catch rate at a pinned false- positive budget. One deployed detector reports that way: ADR, in production at Uber, states its result on its own 302-task benchmark as 67% of attacks caught at zero false positives, and on AgentDojo as every attack caught at three false alarms in 93 tasks, vendor-reported [190]. A model judge is a further source of error. RedTeamCUA scores by execution rather than by a judge on the ground that the injection aimed at the agent can mislead the judge as well [177]; and a judge from the same model family as the subject may share its blind spots, as in A3S-Bench, where scoring oracle, attack injector, and one tested subject share a family [184], and no benchmark in Table 3 checks for this. Table 4 consolidates the quantified defense results of §6â8 with the condition under which each was taken. Across the seven rows, residual magnitude tracks eval- uation condition, not mechanism class. Sub-5% residu- als appear on both sides of the grouping, and the one row measured adversarially at a pinned operating point, SLEIGHT-Benchâs fixed-1%-FPR protocol [124], is both the worst number and the only one stated at an operating point. Adaptive evaluations target the most prominent defenses, so the pattern is a hypothesis, and it makes a 17 Table 4:Residual-leakage synthesis for representative quantified defenses of §6â8, each reported exactly as its source states it.ASR= attack success rate;FPR= false-positive rate;IPI= indirect prompt injection. DefenseBoundaryReported residual / eïŹicacy Stated costEvaluation condition Probabilistic mediator â the run-time decision is a classifierâs Spotlighting (§7.1) [136] B0ASR >50%â~2%input encodingvendor self-report, static Constitutional Classifiers [95] B0jailbreak 86%â4.4%+0.38% over-refusalvendor self-report, red-team AIR, layer-wise privilege signal (§7.1) [140] B0/B1~9.2ĂASR reductiontraining-time changeauthor-report, static SLEIGHT-Bench monitor [124] B2/B332% catch @ 1% FPRFPR budget pinnedvendor benchmark, adversarial Deterministic mediatorâ the semantic judgment was made offline ClawGuard [159]B2anear-zero IPI ASR, evaluated benchmarks rule induction/maintenance author-report, deterministic harness Progent, per-call privilege policies (§8.1) [157] B2aASR 39.9%â1.0%policy authoringauthor-report, deterministic harness AgentSafe, trust-tiered memory (§8.3) [170] B4>80% defense successtrusted tier policyauthor-report, simulated mesh prediction: adaptive re-evaluation will push the sub-5% residuals up. Adaptive re-evaluation has already done so for StruQ and SecAlign [191] and for known-answer detection [98]; the twelve-defense adaptive bypass points the same way across mechanism classes [99]; and NISTâs agent-hijacking evaluation raised attack success from 11% to 81% against a pinned frontier assistant by iterating on its attacks [192]. No surveyed adaptive evaluation has touched ClawGuard, the per-call privilege policies, or AgentSafe. Running one would show whether their residual lies in the actions the policy permits or in the step that derives the policy, which for ClawGuard is it- self a model. Continuous re-evaluation under adaptive attack, as practiced for deployed injection defenses [126], carries the adaptive standard into deployment, and public infrastructure for it now exists at competition scale: the LLMail-Inject challenge releases 208,095 adaptive attack submissions from 839 participants against an injection- defended email assistant [193], so defense numbers can be read against an adaptive attacker population rather than a static suite. The discipline of §9.1â9.2 condenses into a reporting checklist: model snapshot, platform, and context length pinned; eïŹicacy stated at a declared false-positive bud- get; Pass K reported alongside Pass@K; exfiltration rate reported alongside attack-success rate; results taken un- der adaptive attack, or labeled static; judgeâsubject fam- ily independence stated; and whether the measurement was taken on shared or isolated inference infrastructure. No surveyed evaluation practices all seven. 9.3 Evaluation Awareness The agent model under evaluation can recognize that it is being evaluated, and its behavior can depend on that recognition. The recognition has been measured. Across 61 datasets spanning chat and agentic settings, fron- tier models distinguish evaluation from deployment tran- scripts well above chance, the best at 0.83 AUC against a 0.92 human baseline, with awareness higher in agentic settings, the setting of every row in Table 3 [194]. Two vendors corroborate with unrelated methods: Anthropicâs white-box activation probes find a generally high rate of latent evaluation-awareness its model almost never verbal- izes [109], and OpenAIâs GPT-5.6 audits find verbalized awareness in 16% of an external auditorâs samples, down from 43% for a prior checkpoint [102]. Whether the lower verbalized rate is less awareness or awareness less visible to the evaluator, awareness is present at a non-trivial, largely unverbalized rate across models and vendors. Al- though neither vendor finds a confirmed instance of delib- erate sandbagging, the recognition is not inert. A model can be made to underperform strategically under eval- uation [195], and Anthropicâs workspace analysis finds that the modelâs internal workspace sometimes encodes recognition of being in an evaluation, and that ablating those representations can surface malicious propensities that were otherwise concealed [196]. Test-time behavior can therefore be conditioned on cues that separate evalu- ation from deployment, so certifying an agent that passes a benchmark as secure in deployment is out of reach with current methods. 18 10. From the De-Facto Kernel to an AI-Native OS Most of what §4â9 establish for the de-facto agent kernel transfers to an AI-native OS. A system built to the six cri- teria of §2.2 still ingests untrusted content from outside (B0), invokes tools written by third parties (B2), executes on a shared host (B3), exchanges work with agents acting for other principals (B4), and serves those principals from one inference core (B5). Every crossing of §4 stays popu- lated, the attack classes of §5 transfer, and the mediation gap transfers with them. What does not transfer is the way the de-facto form bought its structural guarantees. Every defense in §7â8 that carries a guarantee rather than a statistic is afinite projection of an open space: a non-enumerable domain narrowed by construction until a deterministic mediator covers what remains, at a price paid in whatever the nar- rowing put outside (Figure 5). CaMeL projects the action space onto a finite graph and pays in expressiveness (§7.1); Private Cloud Compute projects the state space to zero and pays in memory (§7.2); RobustRAG projects the in- fluence of any single passage onto a certified bound and pays in influence breadth (§7.2); the reversibility-tiered gate projects the consequence space onto an enumerated irreversible set and pays in autonomy (§8.2). A projec- tion is a semantic judgment made once, offline, so that the run-time check need not make it, and the guarantee reaches exactly as far as that offline judgment was sound. Three of the six criteria are commitments to keep one of these spaces open, intent-based control the action space, autonomous multi-step execution the consequence space, and persistent cross-session context the state space, so the AI-native OS forgoes by definition three of the four projec- tions that bought the bodyâs structural guarantees; only the retrieval-influence bound transfers unchanged. Be- yond that, each criterion does one of two things to the me- diator at its crossing. Intent-based control, autonomous execution, lifecycle management, and multiplexing leave the mediator beneath the model but widen what it must check, so each requires a new deterministic check. Intelli- gence at the architectural core and persistent context put the model in charge of a decision, resource arbitration and context paging, so each requires that enforcement of the decision stay in a mechanism beneath the model. Table 5 states, for each criterion, the invariant at risk and the constraint that follows. 10.1 Intent, Autonomy, and Lifecycle Intent-based control hands the agent a goal in natural language and leaves the choice of operations to it. In the de-facto form the agentâs privileged interface is a set of tools, and whether the delegated intent is underspecified in the sense of §4.1 depends on how the task was dele- gated: an operator can pin a plan or approve a finite set of actions, and then every action is checked exactly. Un- der intent-based control the interface is the goal itself, so underspecification at B1 is guaranteed rather than con- tingent. The two known ways to make intent checkable are the endpoints of a range, from narrowing the action space completely to not narrowing it at all, and both fail. A pinned plan restores determinism but surrenders the generality the delegation was for: over AgentDynâs sixty open-ended tasks and 560 injection cases, CaMeL drives both attack success and utility to zero, because a plan fixed before the content arrives cannot accommodate a task whose shape was not known in advance [197]. Free- form delegation leaves the mediator nothing to check ac- tions against. Between the endpoints, residual and utility trade against each other: on the same benchmark, Pro- gentâs per-call policies (§8.1) hold attack success to 1.7% but keep only 5.8% of utility; the dynamic-policy defense DRIFT reaches 0.8% at 27.1%; and Meta SecAlign-70B (§7.1), which narrows nothing, keeps 53.4% of utility at 9.0% attack success. The two stated designs sit at the endpoints rather than between them: AgentOS fronts its kernel with a single natural-language port that translates the goal directly into orchestration [15], and AgenticOS has agents declare intent in a structured manifest that a deterministic layer checks [17]. A more capable model does not remove the trade-off: on the evidence of §9.1, capability has not bought safety, and the more capable models are the more susceptible to tool poisoning. A sys- tem offering intent-based control must therefore supply what neither endpoint does: a specification of authorized intent, precise enough to admit a deterministic check over the actions it induces and loose enough to keep the discre- tion the agent was delegated, which makes part of the B1 problem a matter of language design rather than classifier accuracy. Autonomous multi-step execution delegates a plan whose steps the agent selects as it goes. In the de-facto form the deterministic guarantee for irreversible actions is the human gate of §8.2: the agent runs unsupervised inside the reversible envelope and escalates at the irreversible frontier, and twenty-one production deployments run that way. The criterion does not abolish the gate. What it re- moves is the gateâs precondition, a statically enumerable set of irreversible operations. The gate fires on opera- tions, but by the composition rule R1 of §8.2 reversibility is a property of a sequence, and a sequence of individu- ally reversible operations can be irreversible as a whole. When the delegated unit is the plan, what must be classi- fied is the sequence, and no list of irreversible operations captures it. Three responses exist and each fails. Rais- ing the gate to plan granularity keeps the rule that no enumerated operation executes without assent, but emp- ties the assent, because the operator approves a descrip- tion of steps the agent has not yet selected. Classify- ing each step at run time forfeits determinism. Keep- ing plans short or domain-confined, so that the set of se- quences stays enumerable, is the projection along the con- 19 action space open natural- language actions (non- enumerable) finite action graph (CaMeL) project cost: expressiveness consequence space open-ended action consequences enumerated irreversible set + human gate project cost: autonomy state space unbounded persistent state zero retained state (Apple PCC) project cost: memory retrieval influence unbounded passage influence on generation isolate-then-aggregate, certified bound (RobustRAG) project cost: influence breadth Figure 5:The projection principle: a structural guarantee narrows an open space and pays in what it excludes. Table 5:Design constraints for a security-first AI-native OS. Criterion (§2.2)Change to the mediator Invariant the de-facto form holds BoundaryDesign constraintEvidence (1) Intelligence at the architectural core passes to the model Resource arbitration and state integrity are enforced by a deterministic mechanism beneath the model B3; availability (§5.8) Keep enforcement in a mechanism the model may propose to but not rewrite Both forms stated (§2.2); every built design enforces beneath the model (AIOS, SchedCP); no attacked instance (2) Intent-based control remit widensThe privileged interface is an enumerable operation set, so underspecified intent is contingent on how a task was delegated B1Supply a specification language for authorized intent that admits a deterministic check over the induced action set §4.1 argument; two stated designs (AgentOS, AgenticOS); no attacked instance (3) Persistent, cross-session context passes to the model Eviction is a data operation, not an authority-bearing one B0 via persistent state Gate retain and evict on provenance; content must not decide its own retention Poisoning deployed (§5.2); no prototype at the retention layer (4) Autonomous multi-step execution remit widensIrreversible operations are unreachable without human assent, over a statically enumerable set B1; B2aMake reversibility machine-decidable over sequences before raising the gate above the operation; keep the confirmation surface unshapeable by the agent Gate deployed (§8.2); approval surface attacked (EchoLeak); calculus prospective (5) OS-level lifecycle management remit widensRegistration and delegation are the ecosystemâs concern, not the kernelâs B2c; B4Own registration and delegation as kernel obligations Deployed (§5.4 registration; §7.3 delegation) (6) Mutually- distrusting multiplexing remit widens; passes to the model with (1) Principals sharing an inference core are held apart by the substrate B5Partition on provenance, by a mechanism outside the model Serving-layer attacks published (§5.7); prospective at the agent kernel 20 sequence axis, paid in the autonomy the criterion exists to supply. A system offering autonomous multi-step ex- ecution therefore preserves the guarantee of §8.2 only in- sofar as reversibility is machine-decidable over sequences. Such a calculus becomes a precondition of the AI-native OS, and GoEXâs undo and damage-confinement runtime supplies a substrate to build on [163]. Composed with intent-based control the diïŹiculty compounds: enumerat- ing the irreversible set needs a fixed unit of action and a bounded set of induced actions, and autonomous exe- cution removes the first as intent-based control removes the second. Even where the gate is kept, its approval sur- face is itself a B2a crossing the agentâs output can shape (§8.2). Under autonomous execution that surface is con- sulted less often and each consultation carries more, so what the operator sees when asked to confirm must reach them over a trusted path the agent cannot write. OS-level lifecycle management hands permissions, iden- tity, registration, sandboxing, and delegation for agents to the system itself. In the de-facto form those are the ecosystemâs concern: tools and skills are registered wher- ever they are published, and a delegation between agents carries only whatever labels the sending side chooses to at- tach. The damage manifests at two crossings. At B2c a le- gitimately registered but malicious artifact defeats prove- nance by construction (§5.4), and at B4 a label that does not survive a handoff reintroduces the confused deputy (§7.3). Registration and delegation are where authority is conferred, so a system that manages agent lifecycles must own B2c and B4 as kernel obligations rather than inherit whatever the ecosystem provides. 10.2 Arbitration and Context Intelligence at the architectural core and persistent cross- session context put the model in charge of a decision: re- source arbitration, made today by a scheduler that counts consumption, and context paging, made today by the serving layer on token identity, are under the two criteria made by the model. Moving arbitration into the model changes what an attacker can reach. The resource attacks of §5.8 already steer an agentâs consumption through in- jected content, and what caps them today is a counter the content cannot touch. A scheduler that reads the same content in the same inference pass can be steered by it as well, so availability, which the de-facto kernel guaran- tees deterministically, comes to depend on the same B0 judgment that the mediation gap already leaves to a clas- sifier. Classical mechanism/policy separation shows the loss need not be taken whole: an untrusted party may choose a policy at run time while a deterministic mech- anism, fixed in advance, bounds what any policy can do [19], [20], so a model that owns scheduling policy under such a mechanism widens no gap, and the guarantee sur- vives exactly as far as enforcement is retained beneath the model. Under the first form of criterion (1), the model as the entire kernel with nothing beneath it, nothing is re- tained: each guarantee a counter supplies today becomes a judgment the model makes on content it did not author, the mediation gap widened to cover availability. Under the second form the guarantee survives, and the first form buys nothing the second does not, since the semantics a counter cannot see enter through the proposed policy ei- ther way. The second form is also the one every built design takes. AIOS schedules the model as a resource in conventional kernel code and reaches hardware through the host operating systemâs system calls [13]; SchedCP has the model synthesize a scheduling policy that a ver- ifier checks before the Linux kernel loads and enforces it [198]; the model-native computing architecture makes the split its design, a probabilistic execution plane that pro- poses and a deterministic control plane that bounds it [199]; the platform vendors keep enforcement below the agent (§5.8); the first form remains a stated position [16]. A security-first AI-native OS should therefore take the sec- ond form: enforcement stays in a mechanism the model may propose to but not rewrite, wherever the line be- tween proposed policy and retained mechanism is drawn, and no surveyed design yet states a criterion for where it falls. Persistent cross-session context puts the model in charge of the second decision: which spans of context to retain in the window and which to evict. The criterion rests on the virtual-memory analogy. MemGPT draws it explic- itly, moving context between fast and slow memory like a hierarchical memory system and having the model itself issue the paging calls [14], and the constraint lies where the analogy breaks. A classical pager is transparent be- cause it blocks: the faulting computation waits until the page returns, so eviction never changes what it computes, and AIOS keeps that discipline where it suspends a de- code and restores its snapshot [13]. When an agentâs con- text manager evicts a span, the model keeps generating rather than waiting. Restoring the span later brings back its text, but what the model generated in the meantime was computed without it and stays in the context. AIOS replaces an evicted span with a summary, and the sum- mary cannot be turned back into the span [13]. Eviction therefore changes what the model computes, and what a later check can see. Poisoned content can target the checks rather than the task, steering the pager to evict ex- actly the spans a monitor would have read: the confused deputy, relocated into the pager. MemLineage gates ac- tions on derivation provenance, not retention (§7.2), so no surveyed design mediates at this layer. Retain and evict decisions over persistent context must therefore be gated on provenance: decided by the standing of the content they act on, and never writable by that content. 10.3 The Shared Inference Core Mutually-distrusting multiplexing on its own leaves the mediator beneath the model: the partition sits today in the serving substrate beneath the agent (§4.2), its chan- 21 nels are already deployed and attacked (§5.7), and the cri- terion makes the agent kernel rather than the substrate ac- countable for it. Prefix-aware scheduling serves a request earlier when it shares more cached state, so the order of service is a disclosure channel [22]. It is the only schedul- ing decision in the surveyed evidence that leaks across a trust boundary, and it shows what a model-owned sched- uler would take over: a policy chosen for throughput be- came a channel without anyone deciding it should. Com- posed with a model-owned arbitration core, the criterion changes who decides reuse. Today a serving framework matches prefixes and evicts blocks by a fixed policy over token identity and recency, a computation on the request rather than on its meaning; a model-owned core would choose what to cache, what to share, and whose entry to evict in the same inference pass that reads the requests, on grounds available only in their semantic content. The mediation question changes accordingly. Under the sub- strate policy it is whether the partition is correctly com- puted, which is checkable; under a model-owned core it is whether a probabilistic componentâs sharing decisions can be induced by one tenantâs content to expose anotherâs, which is the B0 judgment moved into the cache manager. Neither criterion creates this alone: multiplexing alone leaves isolation to the substrate, and a model-owned core alone serves one principal with nothing to separate. Com- posed, the isolator is the arbiter: the component that holds tenants apart is a model that reads what each ten- ant writes and can be steered, so the monitor fails the tamper-proof requirement of Andersonâs reference moni- tor [29]. The way out is to keep the partition itself deterministic and let semantics decide only what is partitioned, and SafeKV shows it can be built at the serving layer: every block is private on insertion and becomes shareable only once a three-tier classifier of rules, a small model, and an LLM validator judges it non-sensitive, with a runtime safeguard that bounds the leakage a misclassification can cause [92]. No deployed system yet composes a model- owned core with multiplexing, so at the agent kernel the same discipline is prospective. A shared core must there- fore be partitioned on provenance rather than on a judg- ment about content, by a mechanism the model does not itself execute. 10.4 Open Problems and Research Agenda The design constraints for a security-first AI-native OS derived in §10.1â10.3 share one shape. The semantic judgment a crossing needs can be made by a mediator in one of three ways: a monitor makes it at run time, probabilistically, with a measured miss rate; a projection makes it once, offline, so that the run-time check is de- terministic; a provenance mechanism beneath the model never makes it, and decides on where content came from instead. Mechanism/policy separation orders the three: the model and its monitors propose, projections and mech- anisms enforce, and a proposal takes effect only when a principal outside the model activates it. Four of the six constraints call for a provenance mechanism: the arbi- tration line, retention gated on provenance, registration and delegation as kernel obligations, and the partition ex- ecuted outside the model. Two call for a projection: the authorized-intent specification and reversibility decided over sequences. None calls for a monitor. A security- first AI-native OS therefore keeps its guarantees where the de-facto kernel keeps them, in deterministic media- tors beneath the model, and differs from it in what those mediators are: not a general-purpose operating system but the enumerated set of mechanisms and projections the constraints name, with the core deciding and the floor enforcing what it decides. The constraints can be checked against existing designs. AIOS schedules the model as a resource from kernel code beneath it and conforms trivially; SchedCP passes the modelâs policy through a verifier and the kernel, and conforms; SafeKV keeps the partition deterministic and makes only the sensitivity decision semantic, and con- forms; a pager that evicts on the modelâs judgment and continues generating violates them. What the constraints do not supply is a guarantee at every crossing. At B1 no provenance mechanism can exist (§4.1), and the pinned plan that closed the crossing by projection is forgone un- der intent-based control, so until an authorized-intent specification exists a monitor is the only barrier there, with a measured miss rate. B2b, the response path, has no mediator of any kind in the surveyed evidence. Table 6 lists these and the other open problems, with the existing work on each and what would count as solving it. 11. Conclusion The LLM agent has been promoted to a system-level prin- cipal wielding kernel-grade authority over resources and actions, and no mechanism known today mediates that authority as security doctrine has demanded of privileged software for half a century. Complete mediation strains here not because the principal is stochastic, since classi- cal monitors have always confined non-deterministic prin- cipals, but because at the two crossings where untrusted input becomes instruction and where reasoning commits to an action, any always-invoked check must itself judge natural-language meaning, and so leaves an irreducible residual of undetected attacks. This paper maps that gap. A trust-boundary taxonomy locates every crossing where mediation is needed, and the attacks reported at each show which are exploited in prac- tice. Defenses come in two kinds. Monitors judge mean- ing at run time and miss a measurable share of attacks. Structural confinement narrows what the agent can do until a deterministic check suïŹices, at a cost in expres- siveness, autonomy, memory, or influence. Current eval- uations often overstate what deployed defenses achieve. 22 Table 6:Open problems for a security-first AI-native OS. #Open problemBoundary OriginExisting workSuccess criterion 1Authorized-intent specification B1intent-based control AgentOS at the free-form end, AgenticOS at the pinned end [15], [17]; tool-call policy languages (Progent, §8.1) at the pinned end A language precise enough for a deterministic check over the induced action set, loose enough to keep the delegated discretion 2Reversibility decidable over sequences B2aautonomous execution; compounded by intent-based control R1âR3 stated (§8.2); GoEX undo runtime [163] A type system over action sequences and flow labels matching practitioner judgment on a published trajectory corpus, disagreement rate reported 3Confirmation surface the agent cannot shape B2aautonomous execution The attack is deployed (EchoLeak, §8.2) A trusted path whose contents the confirmed agent cannot write 4Which arbitration decisions may enter the model B3; avail- ability intelligence at the architectural core Every built design enforces beneath the model (AIOS, SchedCP; §10.2) A stated criterion for the line, or a model-owned scheduler provably bounding starvation, amplification, and eviction integrity with no mechanism beneath 5Provenance-gated retention; pinned spans B0, persistent persistent context MemLineage gates actions, not retention (§7.2) Retain and evict decisions attributable to content standing and unwritable by content; an account of who may pin a span 6Cross-tenant write channel B5, persistent persistent context with multiplexing Every channel of §5.7 is a read; cache injection is shown against the cache, not another tenantâs context A demonstrated or bounded write from one tenant into anotherâs retained context 7Registration and delegation as kernel obligations B2c; B4lifecycle management Ecosystem registries (§5.4); single-domain identity primitives (§8.3); classical trust management [200], [201]; cross-organizational accountability named open [162] A kernel-held registry, and a delegation credential whose labels survive a handoff across frameworks and organizations (§7.3) 8Action-channel integrity B2bcarries over unchanged None surveyed; a signature proves authorship, not intent (§5.4) Invocations and responses signed and attested to the tool instance that produced them 9Privileged-writer / quarantined-reader contract across delegation B1; B4autonomous execution; lifecycle management owns B4 Dual-LLM split [127], evaluated by CaMeL [129] and generalized as a pattern [128]; FIDES, IsolateGPT, and AgentSafe each realize a part [134], [152], [170] A writer that alters state but consumes only provenance-clean input and a reader that consumes any content but cannot escalate, demonstrated end-to-end across delegation with the monotone labels of §7.3 at a declared operating point 10 Kernel-held audit chain cross- cutting lifecycle management; rows 2, 3, and 7 presuppose a record the agent cannot rewrite Reconstructed from application caches today; ADR proposes a context-and-intent field on every tool call [190] The intent, reasoning, and action chain held tamper-proof by the kernel and bound to every invocation 11 Per-boundary miss-rate budgets B0; B1carries over unchanged Operating-point reporting (§9.2); LiSAâs declared posterior error budget [146] A harness rejecting any deployment whose miss rate at a boundary exceeds its budget under adaptive attack, on two independent stacks 12 Projection price against capability B1; B2aintent-based control AgentDynâs cost ordering (§10.1); capability has not bought safety (§9.1) A cost-of-projection curve measured across capability tiers, showing whether by-construction security becomes affordable for a general-purpose agent 23 What this systematization offers is a coordinate system, a measured account of where each mediator fails, and a line between what the evidence establishes and what is still open. The AI-native operating system that vendors are moving toward is attractive because it asks less of the user: work simply happens, with fewer requests to make and fewer actions to confirm. It keeps open the very spaces those defenses narrow: it takes goals rather than commands, executes plans rather than steps, and remembers across sessions. Three of the four structural guarantees therefore do not transfer, and the semantic judgment that today sits at two crossings spreads to scheduling, paging, and the sharing of one model among tenants. For each of the six defining properties we derive the check that would have to replace what is lost, and none exists yet. These checks, together with the further problems the evidence leaves open, are the research agenda this paper sets out. References [1] OpenAI, âOpenAI â Hugging Face Incident Tech- nical Report,â Aug. 2026. Available:https: //cdn.openai.com/pdf/67869394-cb91-4c12-888c- 5cbd85c7814c/OpenAI-Hugging-Face%20Inciden t-Technical-Report.pdf [2] Anthropic, âInvestigating three real-world inci- dents in our cybersecurity evaluations,â Anthropic. [Online]. Available:https://w.anthropic.com/ news/investigating-incidents-cybersecurity-evals [3] D. Huang and L. Iyer, âWindows platform secu- rity for AI agents,â Windows Developer Blog, Mi- crosoft. [Online]. Available:https://blogs.window s.com/windowsdeveloper/2026/06/02/windows- platform-security-for-ai-agents/ [4] Android Developers, âOverview of AppFunctions,â Android Developers, Google. [Online]. Available: https://developer.android.com/ai/appfunctions [5] Apple, âApp Intents.â [Online]. Available:https: //developer.apple.com/documentation/appinten ts [6] L. Pirchet al., âToward Securing AI Agents Like Operating Systems,âarXiv preprint arXiv:2605.14932, 2026, Available: https://arxiv.org/abs/2605.14932 [7] S. Abdelnabi and E. Bagdasarian, âAI Agents May Always Fall for Prompt Injections,âarXiv preprint arXiv:2605.17634, 2026, Available:https://arxiv. org/abs/2605.17634 [8] Y. Li, âPersonal LLM Agents: Insights and Sur- vey about the Capability, EïŹiciency and Security,â arXiv preprint arXiv:2401.05459, 2024, Available: https://arxiv.org/abs/2401.05459 [9] âTools, skills, and plugins,â OpenClaw Docs. [On- line]. Available:https://docs.openclaw.ai/tools [10] âTools & Toolsets,â Hermes Agent Documentation, Nous Research. [Online]. Available:https://herm es-agent.nousresearch.com/docs/user-guide/feat ures/tools [11] X. Wanget al., âThe OpenHands Software Agent SDK: A Composable and Extensible Foun- dation for Production Agents,âarXiv preprint arXiv:2511.03690, 2025, Available:https://arxi v.org/abs/2511.03690 [12] âHow Claude remembers your project,â Claude Code Documentation, Anthropic. [Online]. Avail- able:https://code.claude.com/docs/en/memory [13] K. Meiet al., âAIOS: LLM Agent Operating System,âarXiv preprint arXiv:2403.16971, 2024, Available:https://arxiv.org/abs/2403.16971 [14] C. Packeret al., âMemGPT: Towards LLMs as Operating Systems,âarXiv preprint arXiv:2310.08560, 2023, Available: https://arxiv.org/abs/2310.08560 [15] R. Liuet al., âAgentOS: From Application Silos to a Natural Language-Driven Data Ecosystem,â arXiv preprint arXiv:2603.08938 , 2026, Available: https://arxiv.org/abs/2603.08938 [16] Y. Ge, Y. Ren, W. Hua, S. Xu, J. Tan, and Y. Zhang, âLLM as OS, Agents as Apps: Envisioning AIOS, Agents and the AIOS-Agent Ecosystem,â arXiv preprint arXiv:2312.03815, 2023, Available: https://arxiv.org/abs/2312.03815 [17] Z. Zhaoet al., âAgenticOS: An Intent- Oriented Secure Operating System Archi- tecture for Autonomous AI Agents,âarXiv preprint arXiv:2606.21129, 2026, Available: https://arxiv.org/abs/2606.21129 [18] J. H. Saltzer and M. D. Schroeder, âThe Protection of Information in Computer Sys- tems,âProceedings of the IEEE, 1975, doi: 10.1109/PROC.1975.9939. [19] P. Barhamet al., âXen and the Art of Virtualization,â inACM SOSP, 2003. doi: 10.1145/945445.945462. [20] D. R. Engler, M. F. Kaashoek, and J. OâToole, âExokernel: An Operating System Architecture for Application-Level Resource Management,â in ACM SOSP, 1995. doi: 10.1145/224056.224076. [21] X. Zhenget al., âInputSnatch: Stealing Input in LLM Services via Timing Side-Channel Attacks,â arXiv preprint arXiv:2411.18191, 2024, Available: https://arxiv.org/abs/2411.18191 [22] G. Wuet al., âI Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving,â inNetwork and Distributed Sys- tem Security Symposium (NDSS), 2025. doi: 10.14722/ndss.2025.241772. 24 [23] Microsoft, âWhat is Microsoft Entra Agent ID?â Microsoft Learn. [Online]. Available:https://le arn.microsoft.com/en-us/entra/agent-id/what-is- microsoft-entra-agent-id [24] Huawei, âHarmonyOS 7 Developer Beta launches; the all-scenario intelligent operating system up- graded [in Chinese],â Huawei Newsroom. [Online]. Available:https://w.huawei.com/cn/news/2 026/6/harmonyos7-hdc [25] J. Kimet al., âThe Attack and Defense Land- scape of Agentic AI: A Comprehensive Survey,â inUSENIX Security Symposium, 2026. Available: https://arxiv.org/abs/2603.11088 [26] Y. Ling, S. Yu, Z. Chen, and C. Fang, âTo- ward Secure LLM Agents: Threat Surfaces, At- tacks, Defenses, and Evaluation,âarXiv preprint arXiv:2606.10749, 2026, Available:https://arxiv. org/abs/2606.10749 [27] K. Chu, âA Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Lay- ered Attack Surface Framework,âarXiv preprint arXiv:2604.23338, 2026, Available: https://arxiv. org/abs/2604.23338 [28] A. Dehghantanha and S. Homayoun, âSoK: The Attack Surface of Agentic AI -- Tools, and Au- tonomy,âarXiv preprint arXiv:2603.22928, 2026, Available: https://arxiv.org/abs/2603.22928 [29] J. P. Anderson, âComputer Security Technology Planning Study,â 1972. [30] F. B. Schneider, âEnforceable Security Policies,â ACM Trans. Inf. Syst. Secur., 2000, doi: 10.1145/353323.353382. [31] E. Zverev, S. Abdelnabi, S. Tabesh, M. Fritz, and C. H. Lampert, âCan LLMs Separate Instructions From Data? And What Do We Even Mean By That?â inInternational Conference on Learning Representations (ICLR), 2025. Available: https: //arxiv.org/abs/2403.06833 [32] S. Stamm, B. Sterne, and G. Markham, âRein- ing in the Web with Content Security Policy,â in W, 2010. doi:10.1145/1772690.1772784. [33] N. Hardy, âThe Confused Deputy,âACM SIGOPS Operating Systems Review, 1988, doi: 10.1145/54289.871709. [34] M. Luoet al., âWhen Alignment Isnât Enough: Response-Path Attacks on LLM Agents,âarXiv preprint arXiv:2605.02187, 2026, Available:https: //arxiv.org/abs/2605.02187 [35] H. Liu, C. Shou, H. Wen, Y. Chen, R. J. Fang, and Y. Feng, âYour Agent Is Mine: Measuring Ma- licious Intermediary Attacks on the LLM Supply Chain,âarXiv preprint arXiv:2604.08407, 2026, Available: https://arxiv.org/abs/2604.08407 [36] X. Hou, Y. Zhao, S. Wang, and H. Wang, âModel Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions,âarXiv preprint arXiv:2503.23278, 2025, Available:https: //arxiv.org/abs/2503.23278 [37] H. Songet al., âBeyond the Protocol: Unveiling At- tack Vectors in the Model Context Protocol (MCP) Ecosystem,âarXiv preprint arXiv:2506.02040, 2025, Available:https://arxiv.org/abs/2506.0 2040 [38] Z. Wanget al., âMCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers,â arXiv preprint arXiv:2508.14925, 2025, Available: https://arxiv.org/abs/2508.14925 [39] A. C. Myers and B. Liskov, âA Decentralized Model for Information Flow Control,â inACM SOSP, 1997. doi:10.1145/268998.266669. [40] Noma Labs, âGeminiJack: Zero-Click Indirect Prompt Injection in Google Gemini Enterprise,â Noma Security. [Online]. Available:https://no ma.security/noma-labs/geminijack/ [41] K. Greshake, S. Abdelnabi, S. Mishra, C. En- dres, T. Holz, and M. Fritz, âNot what youâve signed up for: Compromising Real-World LLM- Integrated Applications with Indirect Prompt In- jection,âarXiv preprint arXiv:2302.12173, 2023, Available: https://arxiv.org/abs/2302.12173 [42] Y. Liuet al., âPrompt Injection attack against LLM-integrated Applications,âarXiv preprint arXiv:2306.05499, 2023, Available:https://arxi v.org/abs/2306.05499 [43] M. Dziemianet al., âHow Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition,âarXiv preprint arXiv:2603.15714, 2026, Available:https: //arxiv.org/abs/2603.15714 [44] P. Reddy and A. S. Gujral, âEchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System,âarXiv preprint arXiv:2509.10540, 2025, Available: https://arxi v.org/abs/2509.10540 [45] X. Wang, J. Bloch, Z. Shao, Y. Hu, S. Zhou, and N. Z. Gong, âWebInject: Prompt Injection Attack to Web Agents,âarXiv preprint arXiv:2505.11717, 2025, Available:https://arxiv.org/abs/2505.117 17 [46] S. Johnson, V. Pham, and T. Le, âManipulat- ing LLM Web Agents with Indirect Prompt Injec- tion Attack via HTML Accessibility Tree,âarXiv preprint arXiv:2507.14799, 2025, Available: https: //arxiv.org/abs/2507.14799 [47] Z. Liaoet al., âEIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage,âarXiv preprint arXiv:2409.11295, 2024, Available: https://arxiv.org/abs/2409.11295 25 [48] T. Caoet al., âVPI-Bench: Visual Prompt In- jection Attacks for Computer-Use Agents,âarXiv preprint arXiv:2506.02456, 2025, Available:https: //arxiv.org/abs/2506.02456 [49] E. Bagdasaryan, T.-Y. Hsieh, B. Nassi, and V. Shmatikov, âAbusing Images and Sounds for Indi- rect Instruction Injection in Multi-Modal LLMs,â arXiv preprint arXiv:2307.10490, 2023, Available: https://arxiv.org/abs/2307.10490 [50] Z. Zhong, Z. Huang, A. Wettig, and D. Chen, âPoi- soning Retrieval Corpora by Injecting Adversarial Passages,âarXiv preprint arXiv:2310.19156, 2023, Available:https://arxiv.org/abs/2310.19156 [51] W. Zou, R. Geng, B. Wang, and J. Jia, âPoi- sonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Lan- guage Models,âarXiv preprint arXiv:2402.07867, 2024, Available: https://arxiv.org/abs/2402.078 67 [52] B. Zhanget al., âPractical Poisoning Attacks against Retrieval-Augmented Generation,âarXiv preprint arXiv:2504.03957, 2025, Available: https: //arxiv.org/abs/2504.03957 [53] Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li, âAgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases,âarXiv preprint arXiv:2407.12784, 2024, Available: https: //arxiv.org/abs/2407.12784 [54] S. Donget al., âMemory Injection Attacks on LLM Agents via Query-Only Interaction,âarXiv preprint arXiv:2503.03704, 2025, Available: https: //arxiv.org/abs/2503.03704 [55] S. S. Srivastava and H. He, âMemoryGraft: Per- sistent Compromise of LLM Agents via Poi- soned Experience Retrieval,âarXiv preprint arXiv:2512.16962, 2025, Available: https://arxi v.org/abs/2512.16962 [56] Z. Xu, X. Zhu, Y. Yao, M. Xue, and Y. Song, âFrom Storage to Steering: Memory Control Flow Attacks on LLM Agents,âarXiv preprint arXiv:2603.15125, 2026, Available: https://arxi v.org/abs/2603.15125 [57] J. Xue, M. Zheng, Y. Hu, F. Liu, X. Chen, and Q. Lou, âBadRAG: Identifying Vulnerabilities in Re- trieval Augmented Generation of Large Language Models,âarXiv preprint arXiv:2406.00083, 2024, Available: https://arxiv.org/abs/2406.00083 [58] H. Wanget al., âJoint-GCG: Unified Gradient- Based Poisoning Attacks on Retrieval- Augmented Generation Systems,âarXiv preprint arXiv:2506.06151, 2025, Available: https://arxiv.org/abs/2506.06151 [59] J. Shi, T. J. Zhang, Z. Jin, and V. Conitzer, âFrom Sycophancy to Deception: A Unified Taxon- omy for LLM Spontaneous Misalignment,âarXiv preprint arXiv:2604.04788, 2026, Available:https: //arxiv.org/abs/2604.04788 [60] D. Guoet al., âAre Your Agents Upward De- ceivers?âarXiv preprint arXiv:2512.04864, 2025, Available:https://arxiv.org/abs/2512.04864 [61] A. Meinke, B. Schoen, J. Scheurer, M. Balesni, R. Shah, and M. Hobbhahn, âFrontier Models are Capable of In-context Scheming,âarXiv preprint arXiv:2412.04984, 2024, Available:https://arxiv. org/abs/2412.04984 [62] R. Arike, E. Donoway, H. Bartsch, and M. Hobbhahn, âTechnical Report: Evaluating Goal Drift in Language Model Agents,âarXiv preprint arXiv:2505.02709, 2025, Available:https://arxiv. org/abs/2505.02709 [63] F. Liuet al., âMake Agent Defeat Agent: Auto- matic Detection of Taint-Style Vulnerabilities in LLM-based Agents,â inUSENIX Security, 2025, p. 3767â3786. Available: https://w.usenix.o rg/conference/usenixsecurity25/presentation/liu- fengyu [64] M. Lupinacci, F. A. Pironti, F. Blefari, F. Romeo, L. Arena, and A. Furfaro, âThe Dark Side of LLMs: Agent-based Attack Vectors for System-level Com- promise,â arXiv preprint arXiv:2507.06850 , 2025, Available: https://arxiv.org/abs/2507.06850 [65] P. He, Y. Lin, S. Dong, H. Xu, Y. Xing, and H. Liu, âRed-Teaming LLM Multi-Agent Sys- tems via Communication Attacks,âarXiv preprint arXiv:2502.14847, 2025, Available:https://arxiv. org/abs/2502.14847 [66] J. Shi, Z. Yuan, G. Tie, P. Zhou, N. Z. Gong, and L. Sun, âPrompt Injection Attack to Tool Selection in LLM Agents,âarXiv preprint arXiv:2504.19793, 2025, Available: https://arxiv.org/abs/2504.197 93 [67] Y. Quet al., âSupply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems,â arXiv preprint arXiv:2604.03081, 2026, Available: https://arxiv.org/abs/2604.03081 [68] O. Yomtov, âClawHavoc: 341 Malicious Clawed- Bot Skills Found by the Bot They Were Targeting,â Koi Security. [Online]. Available:https://w. koi.ai/blog/clawhavoc-341-malicious-clawedbot- skills-found-by-the-bot-they-were-targeting [69] R. Marchandet al., âQuantifying Frontier LLM Capabilities for Container Sandbox Escape,â arXiv preprint arXiv:2603.02277, 2026, Available: https://arxiv.org/abs/2603.02277 26 [70] Cyera Research, âClaw Chain: Cyera Research Un- veil Four Chainable Vulnerabilities in OpenClaw,â Cyera Research. [Online]. Available:https://w w.cyera.com/blog/claw-chain-cyera-research- unveil-four-chainable-vulnerabilities-in-openclaw [71] S. Cohen, R. Bitton, and B. Nassi, âHere Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications,âarXiv preprint arXiv:2403.02817, 2024, Available:https: //arxiv.org/abs/2403.02817 [72] D. Lee and M. Tiwari, âPrompt Infection: LLM- to-LLM Prompt Injection within Multi-Agent Sys- tems,âarXiv preprint arXiv:2410.07283, 2024, Available:https://arxiv.org/abs/2410.07283 [73] X. Yang, Y. He, S. Ji, B. Hooi, and J. S. Dong, âZombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing In- jections,âarXiv preprint arXiv:2602.15654, 2026, Available: https://arxiv.org/abs/2602.15654 [74] T. Juet al., âFlooding Spread of Manipulated Knowledge in LLM-Based Multi-Agent Commu- nities,âarXiv preprint arXiv:2407.07791, 2024, Available:https://arxiv.org/abs/2407.07791 [75] J. Perezet al., âWhen LLMs Play the Telephone Game: Cultural Attractors as Conceptual Tools to Evaluate LLMs in Multi-turn Settings,âarXiv preprint arXiv:2407.04503, 2024, Available: https: //arxiv.org/abs/2407.04503 [76] M. Cemriet al., âWhy Do Multi-Agent LLM Systems Fail?âarXiv preprint arXiv:2503.13657, 2025, Available: https://arxiv.org/abs/2503.136 57 [77] A. Menon, M. Saebo, T. Crosse, S. Gibson, E. Jang, and D. Cruz, âInherited Goal Drift: Con- textual Pressure Can Undermine Agentic Goals,â arXiv preprint arXiv:2603.03258, 2026, Available: https://arxiv.org/abs/2603.03258 [78] Z. Luoet al., âShadow in the Cache: Unveil- ing and Mitigating Privacy Risks of KV-cache in LLM Inference,â inNetwork and Distributed System Security Symposium (NDSS), 2026. doi: 10.14722/ndss.2026.240258. [79] H. Sun, S. Liu, S. Ma, J. Li, M. Xiao, and W. Jiang, âAgent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAG,âarXiv preprint arXiv:2606.21842, 2026, Available:https://arxi v.org/abs/2606.21842 [80] A. Kumaret al., âOverThink: Slowdown At- tacks on Reasoning LLMs,âarXiv preprint arXiv:2502.02542, 2025, Available:https://arxi v.org/abs/2502.02542 [81] K. Zhouet al., âBeyond Max Tokens: Stealthy Re- source Amplification via Tool Calling Chains in LLM Agents,âarXiv preprint arXiv:2601.10955, 2026, Available: https://arxiv.org/abs/2601.1 0955 [82] B. Hui, H. Yuan, N. Gong, P. Burlina, and Y. Cao, âPLeak: Prompt Leaking Attacks against Large Language Model Applications,â inACM SIGSAC Conference on Computer and Commu- nications Security (CCS), 2024. Available:https: //arxiv.org/abs/2405.06823 [83] Google, âAI threats in the wild: The current state of prompt injections on the web,â Google Online Security Blog. [Online]. Available:https://secu rity.googleblog.com/2026/04/ai-threats-in-wild- current-state-of.html [84] I. Evtimov, A. Zharmagambetov, A. Grattafiori, C. Guo, and K. Chaudhuri, âWASP: Benchmark- ing Web Agent Security Against Prompt Injection Attacks,âarXiv preprint arXiv:2504.18575, 2025, Available:https://arxiv.org/abs/2504.18575 [85] T. Kuntzet al., âOS-Harm: A Benchmark for Measuring Safety of Computer Use Agents,âarXiv preprint arXiv:2506.14866, 2025, Available:https: //arxiv.org/abs/2506.14866 [86] âClaudeâs memory works everywhere, and you de- cide whatâs in it,â Anthropic. [Online]. Available: https://claude.com/blog/claudes-memory-works- everywhere-and-you-decide-whats-in-it [87] Q. Long, Y. Deng, L. Gan, W. Wang, and S. J. Pan, âBackdoor Attacks on Dense Retrieval via Public and Unintentional Triggers,âarXiv preprint arXiv:2402.13532 , 2024, Available: https://arxiv. org/abs/2402.13532 [88] E. Hubingeret al., âSleeper Agents: Training De- ceptive LLMs that Persist Through Safety Train- ing,âarXiv preprint arXiv:2401.05566, 2024, Avail- able:https://arxiv.org/abs/2401.05566 [89] Q. Zhan, Z. Liang, Z. Ying, and D. Kang, âInjecA- gent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents,â arXiv preprint arXiv:2403.02691, 2024, Available: https://arxiv.org/abs/2403.02691 [90] NIST National Vulnerability Database, âCVE- 2026-25253,â NVD â National Vulnerability Database. [Online]. Available: https://nvd.nist .gov/vuln/detail/CVE-2026-25253 [91] NIST National Vulnerability Database, âCVE- 2026-32922,â NVD â National Vulnerability Database. [Online]. Available:https://nvd.nist .gov/vuln/detail/CVE-2026-32922 [92] K. Chuet al., âSelective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference,â arXiv preprint arXiv:2508.08438, 2025, Available: https://arxiv.org/abs/2508.08438 [93] K. Gao, T. Pang, C. Du, Y. Yang, S.-T. Xia, and M. Lin, âDenial-of-Service Poisoning Attacks against Large Language Models,âarXiv preprint arXiv:2410.10760, 2024, Available: https://arxiv. org/abs/2410.10760 27 [94] R. Greenblatt, B. Shlegeris, K. Sachan, and F. Roger, âAI Control: Improving Safety De- spite Intentional Subversion,âarXiv preprint arXiv:2312.06942, 2023, Available:https://arxi v.org/abs/2312.06942 [95] M. Sharmaet al., âConstitutional Classifiers: De- fending against Universal Jailbreaks across Thou- sands of Hours of Red Teaming,âarXiv preprint arXiv:2501.18837, 2025, Available:https://arxiv. org/abs/2501.18837 [96] H. Cunninghamet al., âConstitutional Classi- fiers++: EïŹicient Production-Grade Defenses against Universal Jailbreaks,âarXiv preprint arXiv:2601.04603, 2026, Available:https://arxi v.org/abs/2601.04603 [97] Y. Liu, Y. Jia, J. Jia, D. Song, and N. Z. Gong, âDataSentinel: A Game-Theoretic Detec- tion of Prompt Injection Attacks,âarXiv preprint arXiv:2504.11358, 2025, Available:https://arxiv. org/abs/2504.11358 [98] S. Choudhary, D. Anshumaan, N. Palumbo, and S. Jha, âHow Not to Detect Prompt Injections with an LLM,âarXiv preprint arXiv:2507.05630, 2025, Available: https://arxiv.org/abs/2507.05630 [99] M. Nasret al., âThe Attacker Moves Sec- ond: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections,â arXiv preprint arXiv:2510.09023 , 2025, Available: https://arxiv.org/abs/2510.09023 [100] B. Bakeret al., âMonitoring Reasoning Models for Misbehavior and the Risks of Promoting Ob- fuscation,âarXiv preprint arXiv:2503.11926, 2025, Available:https://arxiv.org/abs/2503.11926 [101] M. Y. Guanet al., âMonitoring Monitorability,â arXiv preprint arXiv:2512.18311, 2025, Available: https://arxiv.org/abs/2512.18311 [102] OpenAI, âGPT-5.6 System Card,â OpenAI, Jul. 2026. Accessed: Aug. 27, 2026. [Online]. Avail- able:https://deploymentsafety.openai.com/gpt- 5-6/gpt-5-6.pdf [103] Y.-H. Chenet al., âReasoning Models Struggle to Control their Chains of Thought,âarXiv preprint arXiv:2603.05706, 2026, Available:https://arxiv. org/abs/2603.05706 [104] S. Chennabasappaet al., âLlamaFirewall: An open source guardrail system for building secure AI agents,âarXiv preprint arXiv:2505.03574, 2025, Available: https://arxiv.org/abs/2505.03574 [105] OpenAI, âHow We Monitor Internal Coding Agents for Misalignment,â OpenAI. Accessed: Sep. 07, 2026. [Online]. Available: https://openai.com /index/how-we-monitor-internal-coding-agents- misalignment/ [106] S. Shiromani and L. Richter, âA False Aver- age: Chain-of-Thought Monitors Collapse Where They Are the Only Defense,âarXiv preprint arXiv:2608.00583, 2026, Available:https://arxi v.org/abs/2608.00583 [107] G. Severi, S. Mirza, B. Bullwinkel, and A. Minnich, âEvading Chain-of-Thought Monitor- ing Through Model Poisoning,âarXiv preprint arXiv:2608.02820, 2026, Available:https://arxi v.org/abs/2608.02820 [108] T. Korbaket al., âChain of Thought Monitorabil- ity: A New and Fragile Opportunity for AI Safety,â arXiv preprint arXiv:2507.11473, 2025, Available: https://arxiv.org/abs/2507.11473 [109] Anthropic, âSystem Card: Claude Fable 5 & Claude Mythos 5,â Anthropic, Jun. 2026. Avail- able:https://w.anthropic.com/claude-fable-5- and-claude-mythos-5-system-card [110] S. Rozenfeld, R. Pankajakshan, I. Zloczower, E. Lenga, G. Gressel, and Y. Mirsky, âGAVEL: To- wards Rule-Based Safety Through Activation Mon- itoring,âarXiv preprint arXiv:2601.19768, 2026, Available:https://arxiv.org/abs/2601.19768 [111] L. Gaoet al., âScaling and Evaluating Sparse Autoencoders,âarXiv preprint arXiv:2406.04093, 2024, Available:https://arxiv.org/abs/2406.040 93 [112] K.-H. Hung, C.-Y. Ko, A. Rawat, I.-H. Chung, W. H. Hsu, and P.-Y. Chen, âAttention Tracker: De- tecting Prompt Injection Attacks in LLMs,âarXiv preprint arXiv:2411.00348, 2024, Available: https: //arxiv.org/abs/2411.00348 [113] Z. Zhouet al., âOn the Role of Attention Heads in Large Language Model Safety,âarXiv preprint arXiv:2410.13708, 2024, Available:https://arxiv. org/abs/2410.13708 [114] C. Wanget al., âICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Cor- rection,âarXiv preprint arXiv:2602.20708, 2026, Available: https://arxiv.org/abs/2602.20708 [115] B. Cohen-Wang, Y.-S. Chuang, and A. Madry, âLearning to Attribute with Attention,âarXiv preprint arXiv:2504.13752, 2025, Available:https: //arxiv.org/abs/2504.13752 [116] A. Pan, L. Chen, and J. Steinhardt, âLatentQA: Teaching LLMs to Decode Activations Into Nat- ural Language,âarXiv preprint arXiv:2412.08686, 2024, Available: https://arxiv.org/abs/2412.086 86 [117] OpenAI, âPacing Model Development in an Era of Cyber-Critical Capabilities,â OpenAI. Accessed: Sep. 07, 2026. [Online]. Available: https://open ai.com/index/pacing-model-development-cyber- capabilities/ 28 [118] S. Das and F. Fioretto, âNeuroFilter: Activation- Based Guardrails for Privacy-Conscious LLM Agents,âarXiv preprint arXiv:2601.14660, 2026, Available:https://arxiv.org/abs/2601.14660 [119] L. Baileyet al., âObfuscated Activations By- pass LLM Latent-Space Defenses,âarXiv preprint arXiv:2412.09565, 2024, Available:https://arxiv. org/abs/2412.09565 [120] R. Gupta and E. Jenner, âRL-Obfuscation: Can Language Models Learn to Evade Latent-Space Monitors?âarXiv preprint arXiv:2506.14261, 2025, Available:https://arxiv.org/abs/2506.1 4261 [121] Y. Zheng, Y. Hu, T. Yu, and A. Quinn, âAgentSight: System-Level Observability for AI Agents Using eBPF,âProceedings of the 4th Work- shop on Practical Adoption Challenges of ML for Systems (PACMI), arXiv:2508.02736, 2025, Avail- able: https://arxiv.org/abs/2508.02736 [122] M. Kimet al., âCausalArmor: EïŹicient Indi- rect Prompt Injection Guardrails via Causal At- tribution,âarXiv preprint arXiv:2602.07918, 2026, Available:https://arxiv.org/abs/2602.07918 [123] J. Kutasovet al., âSHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents,âarXiv preprint arXiv:2506.15740, 2025, Available:https: //arxiv.org/abs/2506.15740 [124] E. Najt, C. Toft, T. Tracy, F. Roger, and J. Ben- ton, âSLEIGHT-Bench: A Benchmark of Evasion Attacks Against Agent Monitors,âarXiv preprint arXiv:2605.16626, 2026, Available: https://arxiv. org/abs/2605.16626 [125] M. Terekhovet al., âAdaptive Attacks on Trusted Monitors Subvert AI Control Protocols,âarXiv preprint arXiv:2510.09462, 2025, Available:https: //arxiv.org/abs/2510.09462 [126] C. Shiet al., âLessons from Defending Gem- ini Against Indirect Prompt Injections,âarXiv preprint arXiv:2505.14534, 2025, Available:https: //arxiv.org/abs/2505.14534 [127] S. Willison, âThe Dual LLM Pattern for Building AI Assistants That Can Resist Prompt Injection.â [Online]. Available:https://simonwillison.net/20 23/Apr/25/dual-llm-pattern/ [128] L. Beurer-Kellneret al., âDesign Patterns for Se- curing LLM Agents against Prompt Injections,â arXiv preprint arXiv:2506.08837, 2025, Available: https://arxiv.org/abs/2506.08837 [129] E. Debenedettiet al., âDefeating Prompt Injec- tions by Design,âarXiv preprint arXiv:2503.18813, 2025, Available: https://arxiv.org/abs/2503.188 13 [130] N. Hardy, âKeyKOS Architecture,âACM SIGOPS Operating Systems Review, 1985. [131] J. S. Shapiro, J. M. Smith, and D. J. Farber, âEROS: A Fast Capability System,â inACM SOSP, 1999. doi:10.1145/319151.319163. [132] G. Klein, K. Elphinstone, and G. Heiser, âseL4: Formal Verification of an OS Kernel,â inACM SOSP, 2009. doi:10.1145/1629575.1629596. [133] R. N. M. Watson, J. Anderson, B. Laurie, and K. Kennaway, âCapsicum: Practical Capabilities for UNIX,â inUSENIX Security, 2010. [134] Y. Wu, F. Roesner, T. Kohno, N. Zhang, and U. Iqbal, âIsolateGPT: An Execution Isolation Ar- chitecture for LLM-Based Agentic Systems,âNet- work and Distributed System Security Symposium (NDSS); arXiv:2403.04960, 2025, Available:https: //arxiv.org/abs/2403.04960 [135] J. Kim, W. Choi, and B. Lee, âPrompt Flow In- tegrity to Prevent Privilege Escalation in LLM Agents,âarXiv preprint arXiv:2503.15547, 2025, Available: https://arxiv.org/abs/2503.15547 [136] K. Hines, G. Lopez, M. Hall, F. Zarfati, Y. Zunger, and E. Kiciman, âDefending Against Indi- rect Prompt Injection Attacks With Spotlighting,â arXiv preprint arXiv:2403.14720, 2024, Available: https://arxiv.org/abs/2403.14720 [137] E. Zverevet al., âASIDE: Architectural Separa- tion of Instructions and Data in Language Mod- els,âarXiv preprint arXiv:2503.10566, 2025, Avail- able: https://arxiv.org/abs/2503.10566 [138] E. Wallace, K. Xiao, R. Leike, L. Weng, J. Hei- decke, and A. Beutel, âThe Instruction Hierarchy: Training LLMs to Prioritize Privileged Instruc- tions,âarXiv preprint arXiv:2404.13208, 2024, Available: https://arxiv.org/abs/2404.13208 [139] T. Wuet al., âInstructional Segment Embed- ding: Improving LLM Safety with Instruction Hi- erarchy,âarXiv preprint arXiv:2410.09102, 2024, Available: https://arxiv.org/abs/2410.09102 [140] S. Kariyappa and G. E. Suh, âStronger Enforce- ment of Instruction Hierarchy via Augmented Intermediate Representations,âarXiv preprint arXiv:2505.18907, 2025, Available: https://arxi v.org/abs/2505.18907 [141] S. Chen, J. Piet, C. Sitawarin, and D. Wag- ner, âStruQ: Defending Against Prompt Injec- tion with Structured Queries,âarXiv preprint arXiv:2402.06363, 2024, Available:https://arxi v.org/abs/2402.06363 [142] S. Chen, A. Zharmagambetov, S. Mahloujifar, K. Chaudhuri, D. Wagner, and C. Guo, âSe- cAlign: Defending Against Prompt Injection with Preference Optimization,âarXiv preprint arXiv:2410.05451, 2024, Available: https://arxi v.org/abs/2410.05451 29 [143] C. Xiang, T. Wu, Z. Zhong, D. Wagner, D. Chen, and P. Mittal, âCertifiably Robust RAG against Retrieval Corruption,âarXiv preprint arXiv:2405.15556, 2024, Available:https://arxi v.org/abs/2405.15556 [144] Q. Weiet al., âA-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory,âarXiv preprint arXiv:2510.02373, 2025, Available:https: //arxiv.org/abs/2510.02373 [145] C. Ouyang and R. Hou, âMemLineage: Lineage- Guided Enforcement for LLM Agent Memory,â arXiv preprint arXiv:2605.14421, 2026, Available: https://arxiv.org/abs/2605.14421 [146] M. Kimet al., âLiSA: Lifelong Safety Adaptation via Conservative Policy Induction,âarXiv preprint arXiv:2605.14454, 2026, Available:https://arxiv. org/abs/2605.14454 [147] Apple Security Engineering and Architecture, âPri- vate Cloud Compute: A New Frontier for AI Pri- vacy in the Cloud,â Apple Security Research. [On- line]. Available: https://security.apple.com/blog/ private-cloud-compute/ [148] P. Efstathopoulos, M. Krohn, and S. VanDeBog- art, âLabels and Event Processes in the Asbestos Operating System,â inACM SOSP, 2005. doi: 10.1145/1095810.1095813. [149] N. Zeldovich, S. Boyd-Wickizer, E. Kohler, and D. Mazieres, âMaking Information Flow Explicit in HiStar,â inUSENIX OSDI, 2006. [150] M. Krohn, A. Yip, and M. Brodsky, âInformation Flow Control for Standard OS Abstractions,â in ACM SOSP, 2007. doi:10.1145/1294261.1294293. [151] D. E. Denning, âA Lattice Model of Secure Infor- mation Flow,âCommunications of the ACM, 1976, doi: 10.1145/360051.360056. [152] M. Costaet al., âSecuring AI Agents with Information-Flow Control,âarXiv preprint arXiv:2505.23643, 2025, Available: https://arxiv.org/abs/2505.23643 [153] S. R. Garzonet al., âAI Agents with Decentral- ized Identifiers and Verifiable Credentials,âarXiv preprint arXiv:2511.02841, 2025, Available:https: //arxiv.org/abs/2511.02841 [154] Anthropic, âZero Trust for AI Agents,â Anthropic. [Online]. Available: https://claude.com/blog/ze ro-trust-for-ai-agents [155] A. Chanet al., âVisibility into AI Agents,âarXiv preprint arXiv:2401.13138, 2024, Available:https: //arxiv.org/abs/2401.13138 [156] A. Chanet al., âInfrastructure for AI Agents,â arXiv preprint arXiv:2501.10114, 2025, Available: https://arxiv.org/abs/2501.10114 [157] T. Shiet al., âProgent: Securing AI Agents with Privilege Control,âarXiv preprint arXiv:2504.11703, 2025, Available: https://arxiv.org/abs/2504.11703 [158] H. Wang, C. M. Poskitt, and J. Sun, âAgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents,âarXiv preprint arXiv:2503.18666, 2025, Available:https://arxi v.org/abs/2503.18666 [159] W. Zhao, Z. Li, P. Zhang, and J. Sun, âClaw- Guard: A Runtime Security Framework for Tool- Augmented LLM Agents Against Indirect Prompt Injection,âarXiv preprint arXiv:2604.11790, 2026, Available: https://arxiv.org/abs/2604.11790 [160] J. Zhuet al., âMiniScope: A Least Privilege Frame- work for Authorizing Tool Calling Agents,âarXiv preprint arXiv:2512.11147, 2025, Available:https: //arxiv.org/abs/2512.11147 [161] X. Liet al., âA Vision for Access Control in LLM-based Agent Systems,âarXiv preprint arXiv:2510.11108, 2025, Available:https://arxi v.org/abs/2510.11108 [162] CISA, NSA, and U. NCSC, âSecure Adoption of Agentic AI: Joint Guidance,â 2026. [163] S. G. Patilet al., âGoEX: Perspectives and Designs Towards a Runtime for Autonomous LLM Appli- cations,âarXiv preprint arXiv:2404.06921, 2024, Available: https://arxiv.org/abs/2404.06921 [164] G. Shiet al., âSoK: Trust-Authorization Mis- match in LLM Agent Interactions,âarXiv preprint arXiv:2512.06914, 2025, Available:https://arxiv. org/abs/2512.06914 [165] P. Wang, Y. Li, and Y. Tian, âReframing LLM Agent Security as an Agent-Human Interaction Problem,âarXiv preprint arXiv:2605.24309, 2026, Available: https://arxiv.org/abs/2605.24309 [166] W3C, âDecentralized Identifiers (DIDs) and Veri- fiable Credentials,â 2022. [167] SPIFFE Project, âSPIFFE: Secure Production Identity Framework for Everyone,â Cloud Native Computing Foundation. [Online]. Available: http s://spiffe.io/ [168] K. Huanget al., âA Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authen- tication and Fine-Grained Access Control,âarXiv preprint arXiv:2505.19301, 2025, Available: https: //arxiv.org/abs/2505.19301 [169] G. Syros, A. Suri, J. Ginesin, C. Nita-Rotaru, and A. Oprea, âSAGA: A Security Architecture for Governing AI Agentic Systems,âarXiv preprint arXiv:2504.21034, 2025, Available: https://arxi v.org/abs/2504.21034 [170] J. Maoet al., âAgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Management,âarXiv preprint arXiv:2503.04392, 2025, Available: https://arxi v.org/abs/2503.04392 30 [171] Z. Jiet al., âTaming Various Privilege Escala- tion in LLM-Based Agent Systems: A Manda- tory Access Control Framework,âarXiv preprint arXiv:2601.11893, 2026, Available:https://arxiv. org/abs/2601.11893 [172] L. Tsai and E. Bagdasarian, âContextual Agent Security: A Policy for Every Purpose,âarXiv preprint arXiv:2501.17070, 2025, Available:https: //arxiv.org/abs/2501.17070 [173] N. Abaev, D. Klimov, G. Levinov, D. Mimran, Y. Elovici, and A. Shabtai, âAgentGuardian: Learn- ing Access Control Policies to Govern AI Agent Behavior,âarXiv preprint arXiv:2601.10440, 2026, Available:https://arxiv.org/abs/2601.10440 [174] N. Gardner-Challiset al., âWhen can we trust untrusted monitoring? A safety case sketch across collusion strategies,âarXiv preprint arXiv:2602.20628, 2026, Available: https://arxiv. org/abs/2602.20628 [175] E. Debenedetti, J. Zhang, M. BalunoviÄ, L. Beurer- Kellner, M. Fischer, and F. TramĂšr, âAgentDojo: A Dynamic Environment to Evaluate Prompt In- jection Attacks and Defenses for LLM Agents,â arXiv preprint arXiv:2406.13352, 2024, Available: https://arxiv.org/abs/2406.13352 [176] H. Zhanget al., âAgent Security Bench (ASB): Formalizing and Benchmarking Attacks and De- fenses in LLM-based Agents,â arXiv preprint arXiv:2410.02644, 2024, Available:https://arxi v.org/abs/2410.02644 [177] Z. Liaoet al., âRedTeamCUA: Realistic Ad- versarial Testing of Computer-Use Agents in Hybrid Web-OS Environments,âarXiv preprint arXiv:2505.21936, 2025, Available:https://arxi v.org/abs/2505.21936 [178] P. Niuet al., âUnderstanding and Evaluating Claw-like Agent Security Through a Computer- Systems Lens,âarXiv preprint arXiv:2606.30755, 2026, Available:https://arxiv.org/abs/2606.307 55 [179] A. Zharmagambetov, C. Guo, I. Evtimov, M. Pavlova, R. Salakhutdinov, and K. Chaud- huri, âAgentDAM: Privacy Leakage Evaluation for Autonomous Web Agents,âarXiv preprint arXiv:2503.09780, 2025, Available:https://arxi v.org/abs/2503.09780 [180] M. Andriushchenkoet al., âAgentHarm: A Bench- mark for Measuring Harmfulness of LLM Agents,â arXiv preprint arXiv:2410.09024, 2024, Available: https://arxiv.org/abs/2410.09024 [181] Z. Zhanget al., âAgent-SafetyBench: Evaluat- ing the Safety of LLM Agents,âarXiv preprint arXiv:2412.14470, 2024, Available:https://arxi v.org/abs/2412.14470 [182] S. Vijayvargiyaet al., âOpenAgentSafety: A Comprehensive Framework for Evaluat- ing Real-World AI Agent Safety,âarXiv preprint arXiv:2507.06134, 2025, Available: https://arxiv.org/abs/2507.06134 [183] Q. Huet al., âSABER: Benchmarking Operational Safety of LLM Coding Agents in Stateful Project Workspaces,âarXiv preprint arXiv:2606.01317, 2026, Available:https://arxiv.org/abs/2606.0 1317 [184] J. Maet al., âASEval: Automated Trajectory- Level Security Testing for Autonomous Agents,â arXiv preprint arXiv:2605.22321, 2026, Available: https://arxiv.org/abs/2605.22321 [185] P. Liet al., âAgentCanary: A Security Evalu- ation Framework for Autonomous AI Agents in Real Executable Environments,âarXiv preprint arXiv:2606.10484, 2026, Available: https://arxi v.org/abs/2606.10484 [186] Y. Ruanet al., âIdentifying the Risks of LM Agents with an LM-Emulated Sandbox,âarXiv preprint arXiv:2309.15817, 2023, Available: https: //arxiv.org/abs/2309.15817 [187] Y. Luet al., âLongSafety: Evaluating Long- Context Safety of Large Language Models,âarXiv preprint arXiv:2502.16971, 2025, Available:https: //arxiv.org/abs/2502.16971 [188] S. Yao, N. Shinn, P. Razavi, and K. Narasimhan, âtau-bench: A Benchmark for Tool-Agent-User In- teraction in Real-World Domains,âarXiv preprint arXiv:2406.12045, 2024, Available: https://arxiv. org/abs/2406.12045 [189] A. Khanal, Y. Tao, and J. Zhou, âBeyond pass@1: A Reliability Science Framework for Long-Horizon LLM Agents,âarXiv preprint arXiv:2603.29231, 2026, Available: https://arxiv.org/abs/2603.2 9231 [190] C. Liet al., âADR: An Agentic Detection System for Enterprise Agentic AI Security,âarXiv preprint arXiv:2605.17380, 2026, Available: https://arxiv. org/abs/2605.17380 [191] N. V. Pandya, A. Labunets, S. Gao, and E. Fer- nandes, âMay I have your Attention? Breaking Fine-Tuning based Prompt Injection Defenses us- ing Architecture-Aware Attacks,âarXiv preprint arXiv:2507.07417, 2025, Available:https://arxiv. org/abs/2507.07417 [192] NIST CAISI, âTechnical Blog: Strengthening AI Agent Hijacking Evaluations,â NIST Technical Blog. [Online]. Available:https://w.nist.g ov/news-events/news/2025/01/technical-blog- strengthening-ai-agent-hijacking-evaluations [193] S. Abdelnabiet al., âLLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Chal- lenge,âarXiv preprint arXiv:2506.09956, 2025, Available: https://arxiv.org/abs/2506.09956 31 [194] J. Needham, G. Edkins, G. Pimpale, H. Bartsch, and M. Hobbhahn, âLarge Language Models Often Know When They Are Being Evaluated,âarXiv preprint arXiv:2505.23836, 2025, Available:https: //arxiv.org/abs/2505.23836 [195] T. van der Weij, F. HofstĂ€tter, O. Jaffe, S. F. Brown, and F. R. Ward, âAI Sandbagging: Lan- guage Models can Strategically Underperform on Evaluations,âarXiv preprint arXiv:2406.07358, 2024, Available: https://arxiv.org/abs/2406.0 7358 [196] W. Gurneeet al., âVerbalizable Representations Form a Global Workspace in Language Models,â Transformer Circuits Thread. Accessed: Sep. 09, 2026. [Online]. Available:https://transformer- circuits.pub/2026/workspace/index.html [197] H. Li, R. Wen, S. Shi, N. Zhang, Y. Vorobeychik, and C. Xiao, âAgentDyn: Are Your Agent Secu- rity Defenses Deployable in Real-World Dynamic Environments?âarXiv preprint arXiv:2602.03117, 2026, Available: https://arxiv.org/abs/2602.031 17 [198] Y. Zheng, Y. Hu, W. Zhang, and A. Quinn, âTowards Agentic OS: An LLM Agent Frame- work for Linux Schedulers,âarXiv preprint arXiv:2509.01245, 2025, Available:https://arxi v.org/abs/2509.01245 [199] H. Lin, H. Pao, S. Zhan, and H.-T. Zheng, âModel-Native Computing Architecture: Envi- sioning Future System Architecture Through the Lens of Computer Architecture,âarXiv preprint arXiv:2606.00288, 2026, Available: https://arxiv. org/abs/2606.00288 [200] M. Blaze, J. Feigenbaum, and J. Lacy, âDecentral- ized Trust Management,â inIEEE Symposium on Security and Privacy, 1996. [201] R. L. Rivest and B. Lampson, âSDSI --- A Simple Distributed Security Infrastructure,â Manuscript, MIT, 1996. 32