AI Agents

AEGIS enforces resource-abuse policies across heterogeneous MCP tools, targeting the class of attacks where an agent requests an enormous search radius or a very long video to overload backends. It uses an LLM to normalize diverse tool invocations across text, image, video, and location modalities into a unified representation, then enforces constraints via Open Policy Agent and the ContextForge gateway. The integration story is the strength; the open question is how reliably LLM-based normalization holds up against adversarial schema manipulation.

Artic compiles natural-language workflows into an artifact-driven form where each step declares the artifacts it reads and writes, constraints gate outputs, and control transfers are explicit — surfacing the implicit data dependencies that force executors to guess. Across 488 instances from 11 real-world domains it lifts task resolve rate 28 points, and compiled workflows are 32 and 56 points more consistent across models and repeated runs. Faithfulness is checked via decomposed local obligations and scenario-based dry runs. Rigorous eval; the consistency numbers are the headline.

AID-Guard closes the gap between authorizing a tool call and its actual provider effect: it revalidates the approved request and provider state at commit, holds one reservation under ambiguity, and permits release or a single successor only after a terminal result or certified no-effect with a delivery fence. Evaluated on a Python/SQLite prototype against Stripe and Resend — 210 contract trials matched predeclared outcomes, 44/44 attacks blocked under full proposer compromise. The catch: the strict exact-manifest profile costs 35-44 points of benign utility.

ClawSentry models agent risk as progressive across four loci — skill admission, invocation intent, execution effect, and post-action consequence — and inserts a framework-agnostic supervision gateway at each. It audits skill packages before execution, runs a three-tier decision engine that spends expensive contextual review only on residual ambiguity, and includes a session-level mechanism that catches tool-switching and rephrased retries. One policy applies across Codex, Claude Code, Kimi CLI, and Gemini CLI via an Agent Harness Protocol abstraction. The anti-bypass design directly addresses a real gap in per-call guardrails.

This paper argues aggregate task success hides where long-horizon security agents actually fail, so it instruments tasks with checkpoints that separate failures before versus after capability exposure and uses controlled interventions to test upstream bottlenecks. The striking result: for Gemini 2.5 Flash, protocol-disambiguation guidance raised state observation from 65.5% to 95.4% in a 92-seed study — but the same design on Gemini 3.7 Flash produced the opposite effect, with state observation no longer predicting completion. The dominant failure source shifts across model generations.

Wolfe traces RL for LLMs from first principles through the modern frontier, aiming to be a single reference covering policy optimization, reward modeling, and the techniques behind current post-training pipelines. It's a survey rather than new results, so the value is coherence and completeness, not novelty. If you're tuning agents and want the RLHF-through-RLVR lineage laid out in one place with the math intact, this is a solid orientation piece from a credible author.