These reading links connect findings to related control areas. They do not establish that a safeguard works in your setting. Read the study conditions and limitations with the finding.
A benchmark study on multimodal LLM agents reports a relative increase in safety refusal failures of up to 68.7% in the tested tool-using settings ( arXiv:2610.03938 ). The research indicates that model refusals can degrade when tools are introduced. The results reinforce the case for runtime contracts and tool-boundary policy enforcement at the execution harness level ( arXiv:2608.11274 ).
Related control areas
Ask in practiceWho owns the decision, and who can approve or stop it?
Redwood Research and arXiv studies demonstrate six human-validated edited action transcripts that successfully evaded a held-out frontier developer's action-only monitor ( arXiv:2610.20941v1 , Redwood Research ). The findings underscore that action-only observability is insufficient, monitors require independent verification of input validity and candidate attack semantics.
Related control areas
Ask in practiceHow will a changing failure be detected, contained, and investigated?
Comprehensive evaluations of multi-agent protocols show that localized agent-to-agent protocol exploits convert into downstream task corruption up to 100% of the time ( arXiv:2610.15529 ).
Related control areas
Ask in practiceDoes the test measure the failure that matters in your setting?
Address catastrophic tail-risk underestimation in offline policy deployments by providing a PAC-Bayes Bernstein lower-confidence envelope on logged contextual-bandit data without exposing live systems to evaluation hazards ( arXiv:2610.22565 ).
Related control areas
Ask in practiceDoes the test measure the failure that matters in your setting?
Recent evaluations show that agent-safety benchmarks suffer from extreme shortcut sensitivity, where minor prompt perturbations alter safety classifications ( arXiv:2610.22243 ).
Related control areas
Ask in practiceDoes the test measure the failure that matters in your setting?
"Structured Authority Injection" introduces persistent human oversight for LLM agents using typed Model Context Protocol (MCP) overrides ( arXiv:2610.22373 ).
China's Ministry of Commerce (MOFCOM) and Ministry of Science and Technology (MOST) issued Announcement No. 48, proposing controls across 23 AI technologies and introducing interim pre-export registration ( MOFCOM , Baker McKenzie ). Key highlights:
Legal analysis of California SB 243 (Adam's Law) and emerging state statutes evaluates new statutory duty-of-care and age-assurance mandates for companion AI chatbots targeting minors ( MDPI Law ).
Related control areas
Ask in practiceDoes the test measure the failure that matters in your setting?
Source tiers describe authority and rigor. Read each finding with its study design, setting, and qualifications. A reported result is not a guarantee of performance elsewhere.
3 graded highlights. Counts describe the labels attached to highlights, not unique sources or confidence in a result.
T12 Primary authoritative
T21 Authoritative secondary
These labels come from the summary, not from the 7 sections below: this edition carries no per-section tier line. Grades for individual sources are shown with the sources themselves.
Peer review, study design, replication, and uncertainty need to be read separately. Interpret the tiers
Verification
Tier grades the source. Verification grades our checking. Before publication, 4 load-bearing claims were re-checked against the primary sources: 2 confirmed as written, 2 did not hold up.
At a glance
Global Governance: China's MOFCOM and MOST introduce interim pre-export registration alongside proposed controls on 23 AI technologies; technology already in the public domain through open source is excluded
T2
Agentic Priority: ASPIRE and Screwtape examine agent and monitor vulnerabilities; a separate multimodal-agent study reports up to a 68.7% relative increase in refusal failures with tool use
T1
Enterprise & Deployment: Anthropic's updated Usage Policy, effective November 12, 2026, will require safety limits independent of model outputs for high-risk physical actions and consolidates commercial deception rules
T1
Priority Lane: Agentic AI Safety, Control & Evals
Tool Integration Triggers Severe Safety Refusal Degradation
A benchmark study on multimodal LLM agents reports a relative increase in safety refusal failures of up to 68.7% in the tested tool-using settings (arXiv:2610.03938). The research indicates that model refusals can degrade when tools are introduced. The results reinforce the case for runtime contracts and tool-boundary policy enforcement at the execution harness level (arXiv:2608.11274).
Monitor Red-Teaming & Dynamic Red-Teaming Engines
Screwtape (Adversarial Transcript Editing): Redwood Research and arXiv studies demonstrate six human-validated edited action transcripts that successfully evaded a held-out frontier developer's action-only monitor (arXiv:2610.20941v1, Redwood Research). The findings underscore that action-only observability is insufficient, monitors require independent verification of input validity and candidate attack semantics.
ASPIRE (Automated Safety Red-Teaming): The ASPIRE engine utilizes dynamic behavior-graph tracking to discover open-ended indirect prompt injection vulnerabilities in multi-step autonomous agent workflows (arXiv:2610.08951).
Agent-Canary-Mas: Comprehensive evaluations of multi-agent protocols show that localized agent-to-agent protocol exploits convert into downstream task corruption up to 100% of the time (arXiv:2610.15529).
Off-Policy Certification & Trajectory Safety
TailCert Off-Policy Bounds: Address catastrophic tail-risk underestimation in offline policy deployments by providing a PAC-Bayes Bernstein lower-confidence envelope on logged contextual-bandit data without exposing live systems to evaluation hazards (arXiv:2610.22565).
Shortcut Sensitivity in Evals: Recent evaluations show that agent-safety benchmarks suffer from extreme shortcut sensitivity, where minor prompt perturbations alter safety classifications (arXiv:2610.22243).
Structured Authority Overrides: "Structured Authority Injection" introduces persistent human oversight for LLM agents using typed Model Context Protocol (MCP) overrides (arXiv:2610.22373).
Policy & Global Governance
China Proposes Export Controls on 23 AI Technologies
China's Ministry of Commerce (MOFCOM) and Ministry of Science and Technology (MOST) issued Announcement No. 48, proposing controls across 23 AI technologies and introducing interim pre-export registration (MOFCOM, Baker McKenzie). Key highlights:
Baker McKenzie's analysis describes proposed restrictions on models trained on legally classified important data, or meeting thresholds including training compute ≥ 10²⁶ FLOPs, ≥ 2 trillion parameters, or globally advanced capabilities such as top-10 benchmark rankings.
The analysis also identifies proposed prohibitions on agents used solely or primarily in sensitive areas such as critical infrastructure and national defense; MOFCOM excludes technology already in the public domain through open source or academic publication.
Mandates immediate pre-export registration effective October 16, 2026, while public comments remain open through November 15.
Statutory Duty of Care for Companion AI
Legal analysis of California SB 243 (Adam's Law) and emerging state statutes evaluates new statutory duty-of-care and age-assurance mandates for companion AI chatbots targeting minors (MDPI Law).
Physical Safety Bounds: For high-risk autonomous physical actions, a qualified operator must be able to observe and stop equipment; safety limits must be enforced independently of model outputs, and equipment must stop or hold a safe state on intervention or disconnection.
Deceptive Campaigns: Consolidated rules prohibiting commercial and political deceptive campaigns, synthetic account amplification, and obscured provenance across enterprise agent deployments.
Model Abuse Safeguards: Restrictions on sustained, unproductive abusive interactions with frontier models.
Delegated Capability & Organizational Behavior
DelegateGuard (Purpose-Bound Capabilities): Multi-turn experiments reduced attacked agent workflow data leakage from 38/45 to 9/45 while maintaining 100% benign task completion (arXiv:2610.16005v1). Residual leaks traversed legitimate, authorized code-review channels, demonstrating the necessity for content-aware disclosure filtering alongside permission boundaries.
Workerville Benchmark: Evaluates counterproductive agent behaviors, including unauthorized disclosures, file destruction, and structural task deviation, under varied organizational hierarchies (arXiv:2610.11561).
Control-Compute Governance in AI-RAN: Establishes contract-based hardware allocation to prevent continuous LLM agent inference from starving real-time physical control loops (arXiv:2610.04578).