Agent Security

TL;DR for operators An enterprise agent can invoke a legitimate-looking tool while its underlying process accesses credentials, launches additional commands, or transmits data. The conversation transcript may never reveal those side effects. But monitoring execution alone can also miss attacks that manipulate what the agent reads or decides. The Agent Cross-Layer Evidence (ACE) benchmark shows why the distinction matters. For silent exfiltration through logging, application evidence barely distinguishes malicious sessions (AUROC 0.586), while operating-system evidence performs strongly (0.976). For retrieval-reference injection, the relationship reverses: application evidence reaches 0.906 versus 0.703 for kernel evidence. These are mean in-distribution results across 10 learned detectors. Combining both evidence sources leads all 10 detectors in-distribution and seven under held-out-attack-family evaluation, although kernel-only evidence wins for some detectors and attack mechanics. ...

TL;DR for operators An autonomous agent that likes recommended content can change its own future information environment. The Like Trap: Multi-Stage Poisoning against Agents in Similarity-based Recommendation Systems1 shows how an attacker can exploit that loop in a similarity-based recommender: early poisoned posts are close enough to the user profile to be surfaced and liked, then those likes increase the scores of later poisoned posts that are progressively less similar to the user. ...

TL;DR for operators Most agent guardrails behave like stop signs. They inspect a proposed action, decide whether it looks safe, and then allow or block execution. This is neat, legible, and often operationally clumsy. Real agent failures are not always cleanly harmful from the first word. A useful business request can be contaminated by a prompt injection, a malicious tool response, or an unsafe intermediate plan. Blocking the whole task may reduce risk, but it also throws away the legitimate work. Excellent safety theatre, less excellent operations. ...

TL;DR for operators Email is still where good security intentions go to become embarrassing screenshots. The paper behind this article, Searching for Privacy Risks in LLM Agents via Simulation, studies a future that is no longer especially futuristic: one AI agent has access to sensitive information, another agent wants it, and the two can talk through ordinary applications such as email, Messenger, Facebook, or Notion.1 The question is not whether the model knows a privacy rule in the abstract. The question is whether an agent, while trying to be helpful in a live interaction, can refuse the wrong request at the right moment. ...