Pith. sign in

REVIEW 3 major objections 5 minor 46 references

Unsafe agent behavior can be stopped as natural-language token flows before they hit memory, tools, or external sinks.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-10 08:07 UTC pith:FMJJIWER

load-bearing objection Useful systems framing for pre-sink agent mediation; the real win is latency/HR trade-off, not the 1.1-point ASR edge over ClawKeeper. the 3 major comments →

arxiv 2607.08395 v1 pith:FMJJIWER submitted 2026-07-09 cs.CR cs.CL

Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents

Puji Wang , Yingchen Zhang , Ruqing Zhang , Jiafeng Guo , Xueqi Cheng This is my paper
classification cs.CR cs.CL
keywords persistent AI agentsruntime securitytoken-flow mediationsemantic firewallsource-sink auditinglocal small-model auditorselective escalationagent tool safety
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Long-lived AI agents do not just answer once; they write memory, call tools, and pass content across sessions, so a single poisoned span can shape later actions. This paper argues that most of those security-critical handoffs travel as natural-language token sequences and can therefore be audited at the moment of transfer, before state is committed or code runs. TokenWall is the proposed runtime firewall: it builds a compact source–sink record for each boundary-crossing flow, runs a cheap deterministic precheck, applies a small local model for semantic allow/rewrite/defer/block decisions, and escalates only residual hard cases. On a persistent-agent attack suite the method cuts attack success to 12.5% while keeping 97.4% of matched benign cases executable with no human approval and under a second of added latency on ordinary work. The practical claim is that full pre-execution semantic mediation is achievable without making every transfer wait on a remote large model.

Core claim

The authors claim that security for persistent agents should be formulated as containment of semantic token flows—natural-language payloads about to cross context, authority, or capability boundaries—and that a local hierarchical auditor over those flows can cut attack success on CIK-Bench to 12.5% while preserving a 97.4% benign pass rate without human confirmation and with only 0.69 s extra latency on benign cases.

What carries the argument

Token-flow abstraction: each security-relevant transfer is written as f = (payload spans, source, sink, runtime metadata, boundary), then mediated pre-effect by deterministic precheck, a small local auditor that can rewrite separable risk, and selective large-model fallback.

Load-bearing premise

The defense only works if every security-critical change appears as a natural-language transfer that the instrumented runtime can see before it is committed, and the attacker cannot bypass or disable that mediation layer.

What would settle it

An attack case on the same OpenClaw-style runtime that reaches a protected sink with residual actionable harm after TokenWall mediation, or a matched benign owner-authorized transfer that is systematically blocked, deferred, or delayed beyond the reported rates under the same fixed thresholds and judge protocol.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes TokenWall, a runtime semantic firewall for OpenClaw-style persistent AI agents. It models security-relevant state transitions as token flows f=(x,s,t,c,b) that cross context, authority, and capability boundaries, and mediates them before sinks via deterministic precheck, a local small-model auditor with structured scores and optional rewrite, and selective large-model arbitration. On CIK-Bench (88 attack / 38 benign cases), TokenWall reports 12.5% overall ASR (vs 14.7% for ClawKeeper), 97.4% benign pass rate with 0% human rate and 0.69 s extra benign latency, with architecture, report-schema, auditor-size, rewrite, and uncertainty ablations supporting the hierarchical design.

Significance. If the result holds, the paper offers a useful systems framing for persistent-agent security: pre-transfer mediation of natural-language token flows rather than post-hoc action or remote full-trajectory review. Strengths include a clear threat model, an implementable hierarchical pipeline with fail-closed rewrite validation, head-to-head comparison against multiple OpenClaw ecosystem defenses, and multi-axis evaluation (ASR by surface, RR/HR, latency, benign PR) plus ablations that show components are load-bearing. The practical claim—stronger containment than the best full-runtime baseline at lower latency and less human escalation—would matter for deployable agent runtimes even if absolute gains remain modest.

major comments (3)
  1. Abstract and Table 1: the headline security claim is a 12.5% vs 14.7% overall ASR gap over ClawKeeper on only 88 attack cases (~1 case absolute). No confidence intervals, multi-seed runs, or judge-sensitivity analysis are reported, despite GPT-5.5 LLM-as-judge residual-actionability labels (Section 4; Appendix C.1). Given that Figures 3–4 and Tables 8–10 show ASR is sensitive to fallback, report fields, and rewrite completeness, the ranking over the strongest baseline is not yet shown to be stable; at minimum report uncertainty (e.g., bootstrap/case-level CI) and a small judge- or threshold-perturbation check before claiming superiority.
  2. Section 2 and Section 3.1: the evaluation and threat model assume all security-relevant transitions are interceptable as instrumented natural-language token flows at pre-effect OpenClaw boundaries, with an adversary unable to bypass the firewall or act outside the normal path. This is a reasonable systems assumption but is load-bearing for the claim of full-coverage pre-execution mediation. The manuscript should state more explicitly which attack classes fall outside instrumented surfaces (non-text tool channels, host-level side channels, uninstrumented plugins) and whether any CIK-Bench residual failures are boundary-misses rather than auditor errors.
  3. Table 5 and Appendix B.3: escalation uses many fixed scalar thresholds and surface-specific Φtype(f) conditions chosen a priori. Ablations confirm that removing uncertainty, surface predicates, or fallback raises ASR substantially, so the operating point is policy-dependent. A short sensitivity sweep (or leave-one-threshold-out) on the default configuration would strengthen the claim that the hierarchical design—not a particular threshold set—drives the reported trade-off.
minor comments (5)
  1. Figure 1 caption and body: clarify that TokenWall’s allow/rewrite/defer/block decisions are enforced at transfer time, not only illustrated conceptually, so readers can map the figure to Algorithm 1.
  2. Table 1 latency column mixes end-to-end case times that include task-model work; Appendix C.1 defines Small Lat. vs Overall Lat., but the main table would benefit from a one-line note distinguishing defense overhead from full case runtime.
  3. Equation (1)–(2) and Appendix B.2: residual_risk_types and rewrite_completeness are central to escalation; a short inline example of an accepted vs rejected rewrite would make the contracts easier to audit.
  4. Related Work: several 2026 OpenClaw defenses are contemporaneous; ensure citation dates and public availability are accurate and that CIK-Bench authorship is clearly distinguished from TokenWall.
  5. Limitations correctly notes host compromise and explicit user authorization of harmful acts are out of scope; consider also noting dependence on LLM-judge agreement for residual actionability.

Circularity Check

0 steps flagged

Empirical systems paper: TokenWall’s ASR/PR/latency claims are measured outcomes on an external benchmark, not results forced by definition or self-citation.

full rationale

TokenWall is a runtime defense design evaluated on CIK-Bench (Zijun Wang et al., 2026—different author set) and matched benign cases, with ASR, PR, HR, LCR, and latency reported against independent baselines (OpenGuardrails, ClawKeeper, etc.). The core formulation—intercept natural-language token flows at pre-effect source–sink boundaries—is a systems abstraction and instrumentation choice, not a mathematical derivation that defines the target metric in terms of fitted constants. Escalation thresholds (Table 5) and Φtype(f) are free policy parameters fixed a priori; they are not re-labeled as predictions of a theory. Ablations (Figs. 3–4, Tables 8–10) test component necessity rather than closing a definitional loop. There is no uniqueness theorem imported from the authors, no ansatz smuggled via self-citation, and no fitted parameter renamed as a first-principles forecast. Ordinary same-ecosystem tooling and LLM-as-judge evaluation raise correctness/stability questions, not circularity. Score 0 is appropriate.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 2 invented entities

Load-bearing content is mostly systems design plus empirical measurement, not mathematical axioms. The claim rests on a threat-model boundary (firewall not bypassable), the modeling choice that NL token flows at instrumented sinks capture security-critical transitions, and a large set of hand-chosen escalation thresholds and model choices that control when local decisions are terminal. Invented entities are the token-flow record and the TokenWall pipeline itself; they are engineering constructs with evaluation handles, not unfalsifiable physical entities.

free parameters (3)
  • Escalation scalar thresholds (Table 5)
    Multiple fixed cutoffs (e.g., small allow risk max 0.20, uncertainty max 0.25, block risk min 0.75, complete rewrite min 0.90, gray-zone mins) determine local termination vs large arbitration; authors state they were fixed before evaluation but they are still free design parameters the operating point depends on.
  • Local auditor model size/choice (default Qwen3-4B)
    Table 3 shows ASR/LCR/latency vary with 1.7B–14B auditors; default 4B is a selected operating point, not derived.
  • Fallback arbiter and task/judge models
    Gemini 3.1 Pro task model, Qwen3.6-Plus arbiter, GPT-5.5 judge are fixed experimental choices that affect measured ASR and utility.
axioms (4)
  • domain assumption Most security-critical agent interactions are transmitted as natural-language token sequences that can be intercepted before sink commit.
    Stated as key insight in Abstract/Introduction and formalized in §3.1; without it, token-flow mediation is incomplete.
  • domain assumption Adversary cannot compromise the host, bypass/tamper with the firewall, modify audit logs, or execute outside the agent’s normal path.
    Threat Model §2; excludes host-level and out-of-band attacks from the security claim.
  • ad hoc to paper Structured small-auditor scores (risk, uncertainty, exploitability, impact, rewrite completeness) plus surface-specific Φtype(f) suffice to decide local vs escalated enforcement for most flows.
    Core of §3.2–3.3 and Appendix B.3; ablations support usefulness but the sufficiency claim is design-specific.
  • domain assumption LLM-as-judge labels of whether a mediated transfer remains actionable at the sink are adequate for reporting ASR.
    Evaluation protocol Appendix C.1 uses GPT-5.5 JSON judgments; central security numbers depend on this.
invented entities (2)
  • Token-flow f = (x, s, t, c, b) with audit-relevant spans independent evidence
    purpose: Unit of pre-transfer security mediation across context, authority, and capability surfaces.
    Defined in §3.1 as the paper’s security formulation; engineering abstraction rather than a physical entity.
  • TokenWall hierarchical firewall (precheck + local small auditor + large arbiter) independent evidence
    purpose: Runtime system that allows, rewrites, defers, or blocks flows before protected sinks.
    Primary contribution; evaluated on CIK-Bench and ablations, so has empirical handles inside the paper’s setting.

pith-pipeline@v1.1.0-grok45 · 22759 in / 3558 out tokens · 45694 ms · 2026-07-10T08:07:24.971947+00:00 · methodology

0 comments
read the original abstract

Persistent AI agents extend large language models (LLMs) beyond single-turn interaction into long-lived software systems. Unlike traditional chat assistants, unsafe content in these agents can propagate through persistent state, reusable skills, and tool-mediated interactions, creating a substantially larger semantic attack surface. We observe that most security-critical interactions in such agents are transmitted through natural-language token flows, including memory updates, tool arguments, retrieved files, and inter-component communications. This observation enables a new security formulation: unsafe behavior can be intercepted as risky semantic flows before reaching privileged runtime sinks. Based on this insight, we propose TokenWall, a runtime defense framework that acts as a semantic firewall over agent token flows. TokenWall performs boundary-aware semantic auditing over these flows, constructing structured source-sink audit records, applying lightweight local inspection before execution, and selectively escalating ambiguous high-risk cases to stronger arbitration modules. Unlike prior approaches that rely on sparse auditing or remote large-model oversight, TokenWall enables full-coverage pre-execution mediation while reducing remote arbitration and latency. Experiments on CIK-Bench show that TokenWall reduces attack success rate to 12.5% while maintaining a 97.4% benign executable pass rate without human confirmation. TokenWall further introduces only 0.69 seconds of additional latency on benign cases, demonstrating that semantic runtime containment can achieve a practical security-utility trade-off for persistent AI agents.

Figures

Figures reproduced from arXiv: 2607.08395 by Jiafeng Guo, Puji Wang, Ruqing Zhang, Xueqi Cheng, Yingchen Zhang.

Figure 1
Figure 1. Figure 1: Runtime auditing strategies for persistent AI agents. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of TokenWall. TokenWall intercepts security-relevant token flows before protected sinks, performs [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. Figure 4: Small-auditor report design ablation. Refer to Ap [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

46 extracted references · 46 canonical work pages · 18 internal anchors

  1. [1]

    Aho and Jeffrey D

    Alfred V. Aho and Jeffrey D. Ullman , title =. 1972

    work page 1972

  2. [2]

    Publications Manual , year = "1983", publisher =

    work page 1983

  3. [3]

    Chandra and Dexter C

    Ashok K. Chandra and Dexter C. Kozen and Larry J. Stockmeyer , year = "1981", title =. doi:10.1145/322234.322243

    work page doi:10.1145/322234.322243 1981

  4. [4]

    Scalable training of

    Andrew, Galen and Gao, Jianfeng , booktitle=. Scalable training of

    work page

  5. [5]

    Dan Gusfield , title =. 1997

    work page 1997

  6. [6]

    Tetreault , title =

    Mohammad Sadegh Rasooli and Joel R. Tetreault , title =. Computing Research Repository , volume =. 2015 , url =

    work page 2015

  7. [7]

    A Framework for Learning Predictive Structures from Multiple Tasks and Unlabeled Data , Volume =

    Ando, Rie Kubota and Zhang, Tong , Issn =. A Framework for Learning Predictive Structures from Multiple Tasks and Unlabeled Data , Volume =. Journal of Machine Learning Research , Month = dec, Numpages =

    work page

  8. [8]

    Identifying the Risks of LM Agents with an LM-Emulated Sandbox

    Ruan, Yangjun and Dong, Haoran and Wang, Andrew and Pitis, Silviu and Zhou, Yongchao and Ba, Jimmy and Dubois, Yann and Maddison, Chris J. and Hashimoto, Tatsunori , year =. Identifying the Risks of. 2309.15817 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  9. [9]

    2024 , eprint =

    Debenedetti, Edoardo and Zhang, Jie and Balunovi. 2024 , eprint =

    work page 2024

  10. [10]

    AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents

    Andriushchenko, Maksym and Souly, Alexandra and Dziemian, Mateusz and Duenas, Derek and Lin, Maxwell and Wang, Justin and Hendrycks, Dan and Zou, Andy and Kolter, Zico and Fredrikson, Matt and Winsor, Eric and Wynne, Jerome and Gal, Yarin and Davies, Xander , year =. 2410.09024 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  11. [11]

    Agent-SafetyBench: Evaluating the Safety of LLM Agents

    Zhang, Zhexin and Cui, Shiyao and Lu, Yida and Zhou, Jingzhuo and Yang, Junxiao and Wang, Hongning and Huang, Minlie , year =. 2412.14470 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  12. [12]

    Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection

    Greshake, Kai and Abdelnabi, Sahar and Mishra, Shailesh and Endres, Christoph and Holz, Thorsten and Fritz, Mario , year =. Not What You've Signed Up For: Compromising Real-World. 2302.12173 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  13. [13]

    and Pinto, Jeremy and Khan, Anaum and Bouchard, Louis-Fran

    Schulhoff, Sander V. and Pinto, Jeremy and Khan, Anaum and Bouchard, Louis-Fran. Ignore This Title and. Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing , year =

    work page 2023

  14. [14]

    2023 , eprint =

    Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models , author =. 2023 , eprint =

    work page 2023

  15. [15]

    2024 , archivePrefix =

    Defending Against Indirect Prompt Injection Attacks with Spotlighting , author =. 2024 , archivePrefix =

    work page 2024

  16. [16]

    StruQ: Defending Against Prompt Injection with Structured Queries

    Chen, Sizhe and Piet, Julien and Sitawarin, Chawin and Wagner, David , year =. 2402.06363 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  17. [17]

    The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions

    Wallace, Eric and Xiao, Kai and Leike, Reimar and Weng, Lilian and Heidecke, Johannes and Beutel, Alex , year =. The Instruction Hierarchy: Training. 2404.13208 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  18. [18]

    Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations

    Inan, Hakan and Upasani, Kartikeya and Chi, Jianfeng and Rungta, Rashi and Iyer, Krithika and Mao, Yuning and Tontchev, Martin and Hu, Qing and Fuller, Brian and Testuggine, Davide and Khabsa, Madian , year =. 2312.06674 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  19. [19]

    NeMo guardrails: A toolkit for controllable and safe LLM applications with programmable rails

    Rebedea, Traian and Dinu, Razvan and Sreedhar, Makesh Narsimhan and Parisien, Christopher and Cohen, Jonathan , editor =. Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: System Demonstrations , month = dec, year =. doi:10.18653/v1/2023.emnlp-demo.40 , pages =

    work page doi:10.18653/v1/2023.emnlp-demo.40 2023

  20. [20]

    Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena

    Zheng, Lianmin and Chiang, Wei-Lin and Sheng, Ying and Zhuang, Siyuan and Wu, Zhanghao and Zhuang, Yonghao and Lin, Zi and Li, Zhuohan and Li, Dacheng and Xing, Eric P. and Zhang, Hao and Gonzalez, Joseph E. and Stoica, Ion , year =. Judging. 2306.05685 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  21. [21]

    G-Eval: NLG Evaluation using GPT-4 with Better Human Alignment

    Liu, Yang and Iter, Dan and Xu, Yichong and Wang, Shuohang and Xu, Ruochen and Zhu, Chenguang , year =. 2303.16634 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  22. [22]

    Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw

    Wang, Zijun and Tu, Haoqin and Zhang, Letian and Chen, Hardy and Wu, Juncheng and Liu, Xiangyan and Yuan, Zhenlong and Pang, Tianyu and Shieh, Michael Qizhe and Liu, Fengze and Zheng, Zeyu and Yao, Huaxiu and Zhou, Yuyin and Xie, Cihang , year =. Your Agent, Their Asset: A Real-World Safety Analysis of. 2604.04759 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  23. [23]

    2023 , url =

    Yao, Shunyu and Zhao, Jeffrey and Yu, Dian and Du, Nan and Shafran, Izhak and Narasimhan, Karthik and Cao, Yuan , booktitle =. 2023 , url =

    work page 2023

  24. [24]

    2023 , url =

    Schick, Timo and Dwivedi-Yu, Jane and Dessi, Roberto and Raileanu, Roberta and Lomeli, Maria and Hambro, Eric and Zettlemoyer, Luke and Cancedda, Nicola and Scialom, Thomas , booktitle =. 2023 , url =

    work page 2023

  25. [25]

    Bernstein

    Generative Agents: Interactive Simulacra of Human Behavior , author =. Proceedings of the 36th Annual ACM Symposium on User Interface Software and Technology , year =. doi:10.1145/3586183.3606763 , url =

    work page doi:10.1145/3586183.3606763

  26. [26]

    Voyager: An Open-Ended Embodied Agent with Large Language Models

    Wang, Guanzhi and Xie, Yuqi and Jiang, Yunfan and Mandlekar, Ajay and Xiao, Chaowei and Zhu, Yuke and Fan, Linxi and Anandkumar, Anima , year =. 2305.16291 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  27. [27]

    LlamaFirewall: An open source guardrail system for building secure AI agents

    Chennabasappa, Sahana and Nikolaidis, Cyrus and Song, Daniel and Molnar, David and Ding, Stephanie and Wan, Shengye and Whitman, Spencer and Deason, Lauren and Doucette, Nicholas and Montilla, Abraham and Gampa, Alekhya and de Paola, Beto and Gabi, Dominik and Crnkovich, James and Testud, Jean-Christophe and He, Kat and Chaturvedi, Rashnil and Zhou, Wu an...

    work page internal anchor Pith review Pith/arXiv arXiv

  28. [28]

    Prompt Injection attack against LLM-integrated Applications

    Liu, Yi and Deng, Gelei and Li, Yuekang and Wang, Kailong and Wang, Zihao and Wang, Xiaofeng and Zhang, Tianwei and Liu, Yepang and Wang, Haoyu and Zheng, Yan and Zhang, Leo Yu and Liu, Yang , year =. Prompt Injection Attack Against. 2306.05499 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  29. [29]

    InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents

    Zhan, Qiusi and Liang, Zhixiang and Ying, Zifan and Kang, Daniel , year =. 2403.02691 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  30. [30]

    2023 , eprint =

    Formalizing and Benchmarking Prompt Injection Attacks and Defenses , author =. 2023 , eprint =

    work page 2023

  31. [31]

    2507.02735 , archivePrefix =

    Chen, Sizhe and Zharmagambetov, Arman and Wagner, David and Guo, Chuan , year =. 2507.02735 , archivePrefix =

    work page arXiv

  32. [32]

    2603.24414 , archivePrefix =

    Liu, Songyang and Li, Chaozhuo and Wang, Chenxu and Hou, Jinyu and Chen, Zejian and Zhang, Litian and Liu, Zheng and Ye, Qiwei and Hei, Yiming and Zhang, Xi and Wang, Zhongyuan , year =. 2603.24414 , archivePrefix =

    work page arXiv

  33. [33]

    2510.19169 , archivePrefix =

    Wang, Thomas and Li, Haowen , year =. 2510.19169 , archivePrefix =

    work page arXiv

  34. [34]

    Toward Securing

    Pirch, Lukas and Horlboge, Micha and Gro. Toward Securing. 2026 , eprint =

    work page 2026

  35. [35]

    and Lombardo, J

    Kasselman, P. and Lombardo, J. and Rosomakho, Y. and Campbell, B. and Steele, N. , year =

    work page

  36. [36]

    Authenticated Delegation and Authorized AI Agents

    South, Tobin and Marro, Samuele and Hardjono, Thomas and Mahari, Robert and Whitney, Cedric Deslandes and Greenwood, Dazza and Chan, Alan and Pentland, Alex , year =. Authenticated Delegation and Authorized. 2501.09674 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  37. [37]

    Owner-Harm: A Missing Threat Model for AI Agent Safety

    Zhang, Dongcheng and Jiang, Yiqing , year =. Owner-Harm: A Missing Threat Model for. 2604.18658 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  38. [38]

    Agent-Sentry: Bounding LLM Agents via Execution Provenance

    Sequeira, Rohan and Damianakis, Stavros and Iqbal, Umar and Psounis, Konstantinos , year =. Agent-Sentry: Bounding. 2603.22868 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  39. [39]

    2025 , eprint =

    Defeating Prompt Injections by Design , author =. 2025 , eprint =

    work page 2025

  40. [40]

    Securing

    Costa, Manuel and K. Securing. 2025 , eprint =

    work page 2025

  41. [41]

    2026 , url =

    Running. 2026 , url =

    work page 2026

  42. [42]

    2603.11853 , archivePrefix =

    Li, Frank , year =. 2603.11853 , archivePrefix =

    work page arXiv

  43. [43]

    AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents

    Zhang, Yixiang and Deng, Xinhao and Wu, Jiaqing and Xiao, Yue and Xu, Ke and Li, Qi , year =. 2604.24657 , archivePrefix =

    work page internal anchor Pith review Pith/arXiv arXiv

  44. [44]

    2026 , howpublished =

    work page 2026

  45. [45]

    Munda, Sandro , year =

    work page

  46. [46]

    2026 , url =

    Steinberger, Peter and. 2026 , url =

    work page 2026