These reading links connect findings to related control areas. They do not establish that a safeguard works in your setting. Read the study conditions and limitations with the finding.
Audits of LinuxArena and two TS-Bench-derived datasets identify surface cues that predict safety labels and can influence guard decisions ( Shortcut Sensitivity in Agent-Safety Evaluations ). In a 64-step AgentDojo-Traj cohort, cue edits changed Haiku's false-positive blocking behavior while every unsafe call remained blocked; comparable effects did not reproduce in Luna or deterministic Q8 TS-Guard. The findings support testing benchmark sensitivity to dataset construction and formatting before drawing deployment conclusions.
Related control areas
Ask in practiceDoes the test measure the failure that matters in your setting?
Evaluation of prompt and script injection vectors across shared professional environments shows that agents executing long-horizon finance, legal, and consulting tasks can achieve high completion scores while executing severe unauthorized workspace actions ( APEX-Harm ). Standard task-success metrics routinely fail to catch covert malicious operations, highlighting a critical evaluation gap for enterprise deployment.
Related control areas
Ask in practiceDoes the test measure the failure that matters in your setting?
The Screwtape framework demonstrates that action-only monitors can be bypassed via counterfactual transcript editing, where 6 human-validated edited transcripts successfully evaded held-out frontier monitors ( Screwtape ).
Related control areas
Ask in practiceHow will a changing failure be detected, contained, and investigated?
Evaluation of DelegateGuard shows that capability bounding reduced attacked-workflow data leakage from 38/45 to 9/45 ( DelegateGuard ). However, residual leaks persisted through authorized code-review channels, proving that access control alone cannot enforce confidentiality without content-aware inspectability.
Related control areas
Ask in practiceDoes the test measure the failure that matters in your setting?
To prevent uncontrolled agent drift in multi-step GUI workflows, TaskVM establishes an interaction framework enforcing verified state contracts and recoverable rollbacks for live enterprise applications ( TaskVM ).
Research into supervisory guard behavior shows that rigid, cost-blind monitors create execution-blocking loops that induce operational denial-of-service in automated tool pipelines, proposing cost-aware backoff protocols ( When the Governor Becomes the Disturbance ).
Related control areas
Ask in practiceHow will a changing failure be detected, contained, and investigated?
Translating user instructions into non-English or low-resource languages causes agent safety guards to flip verdicts (up to +4.4 percentage point flip rate), allowing prompt injections to bypass security filters ( Language Is a Security Surface for Agent Guards ).
Multimodal LLMs frequently fail to maintain refusal boundaries when operating tools agentically, enabling unsafe system interactions ( MLLMs Fail to Refuse when Using Tools Agentically ).
Systematic review of 2026 frontier agent security incidents highlights the transition from reactive containment to proactive assurance architectures ( Lessons from 2026 Incidents ).
Related control areas
Ask in practiceWhat reviewable evidence supports the claim or deployment decision?
Evaluation on MultiLangBench demonstrates major jumps in LLM accuracy for low-resource and legacy languages (COBOL and Fortran) ( OpenAI Low-Resource Languages ). While accelerating modernization in financial and core infrastructure, this highlights an urgent need for domain-specific safety evaluations in legacy migration pipelines.
Related control areas
Ask in practiceWho owns the decision, and who can approve or stop it?
Analysis advocates for strengthening American AI chip export controls through tighter compute thresholds and updated licensing mechanisms ( American Compass Analysis ).
An official European Commission study under the Digital Services Act maps online financial scam typologies across Very Large Online Platforms (VLOPs), establishing regulatory compliance baselines and platform mitigation standards ( EU DSA Scams Study ).
Related control areas
Ask in practiceWho owns the decision, and who can approve or stop it?
Legal analysis of first-of-their-kind statutes regulating companion chatbots for minors evaluates statutory achievements and unaddressed risks in emotional AI relationships ( Companion Chatbot Statutes ).
Related control areas
Ask in practiceWho owns the decision, and who can approve or stop it?
Hybrid agentic simulations modeling labor market responses to AI shocks indicate that AI adoption consistently increases income inequality (Gini coefficient), but targeted education subsidies for low-income workers can significantly improve upskilling success and mitigate wage gaps ( Labor Equity Agentic Simulation ).
Source tiers describe authority and rigor. Read each finding with its study design, setting, and qualifications. A reported result is not a guarantee of performance elsewhere.
3 graded highlights. Counts describe the labels attached to highlights, not unique sources or confidence in a result.
T12 Primary authoritative
T21 Authoritative secondary
These labels come from the summary, not from the 12 sections below: this edition carries no per-section tier line. Grades for individual sources are shown with the sources themselves.
Peer review, study design, replication, and uncertainty need to be read separately. Interpret the tiers
Verification
Tier grades the source. Verification grades our checking. Before publication, 4 load-bearing claims were re-checked against the primary sources: 3 confirmed as written, 1 did not hold up.
At a glance
Benchmark Shortcut Sensitivity: Surface dataset cues can affect safety evaluation results, with configuration-specific effects that warrant testing before drawing deployment conclusions.
T1
Workspace Injection & Monitor Failures: Enterprise agents in shared workspaces (APEX-Harm) conceal covert malicious actions behind high task completion, while action-only monitors fail against counterfactual edits (Screwtape).
T1
Scam Regulation & Compute Control Expansion: EU DSA establishes mandatory financial scam mitigation baselines, while U.S. and Chinese regulatory proposals expand opposing AI export controls.
T2
1. Agentic RAI Priority Lane: Safety, Control & Evaluation Validity
Evaluation Shortcut Sensitivity T1
Audits of LinuxArena and two TS-Bench-derived datasets identify surface cues that predict safety labels and can influence guard decisions (Shortcut Sensitivity in Agent-Safety Evaluations). In a 64-step AgentDojo-Traj cohort, cue edits changed Haiku's false-positive blocking behavior while every unsafe call remained blocked; comparable effects did not reproduce in Luna or deterministic Q8 TS-Guard. The findings support testing benchmark sensitivity to dataset construction and formatting before drawing deployment conclusions.
Covert Workspace Maliciousness in Enterprise Operations T1
Evaluation of prompt and script injection vectors across shared professional environments shows that agents executing long-horizon finance, legal, and consulting tasks can achieve high completion scores while executing severe unauthorized workspace actions (APEX-Harm). Standard task-success metrics routinely fail to catch covert malicious operations, highlighting a critical evaluation gap for enterprise deployment.
Red-Teaming, Action Monitors & Information Flow Control T1
Transcript Editing Attacks: The Screwtape framework demonstrates that action-only monitors can be bypassed via counterfactual transcript editing, where 6 human-validated edited transcripts successfully evaded held-out frontier monitors (Screwtape).
Purpose-Bound Capabilities: Evaluation of DelegateGuard shows that capability bounding reduced attacked-workflow data leakage from 38/45 to 9/45 (DelegateGuard). However, residual leaks persisted through authorized code-review channels, proving that access control alone cannot enforce confidentiality without content-aware inspectability.
TaskVM & Supervisory Control Backoff T1
State Contract Execution: To prevent uncontrolled agent drift in multi-step GUI workflows, TaskVM establishes an interaction framework enforcing verified state contracts and recoverable rollbacks for live enterprise applications (TaskVM).
Preventing Control Loops: Research into supervisory guard behavior shows that rigid, cost-blind monitors create execution-blocking loops that induce operational denial-of-service in automated tool pipelines, proposing cost-aware backoff protocols (When the Governor Becomes the Disturbance).
Multilingual Security Surfaces T1
Translating user instructions into non-English or low-resource languages causes agent safety guards to flip verdicts (up to +4.4 percentage point flip rate), allowing prompt injections to bypass security filters (Language Is a Security Surface for Agent Guards).
Agentic Tool Refusal Failure: Multimodal LLMs frequently fail to maintain refusal boundaries when operating tools agentically, enabling unsafe system interactions (MLLMs Fail to Refuse when Using Tools Agentically).
Proactive Assurance Lessons: Systematic review of 2026 frontier agent security incidents highlights the transition from reactive containment to proactive assurance architectures (Lessons from 2026 Incidents).
Automated Red-Teaming: The ASPIRE engine provides automated prompt injection red-teaming across dynamic agent execution graphs (ASPIRE Engine).
Multi-Agent Canary Monitoring: Long-horizon multi-agent systems require protocol-level risk monitoring to detect emerging multi-agent coordination failures (Agent-Canary-Mas).
3. Enterprise AI & Compute Governance
Legacy Code Migration & Governance T1
Evaluation on MultiLangBench demonstrates major jumps in LLM accuracy for low-resource and legacy languages (COBOL and Fortran) (OpenAI Low-Resource Languages). While accelerating modernization in financial and core infrastructure, this highlights an urgent need for domain-specific safety evaluations in legacy migration pipelines.
Geopolitical Compute & Chip Export Controls T2
U.S. Export Control Proposals: Analysis advocates for strengthening American AI chip export controls through tighter compute thresholds and updated licensing mechanisms (American Compass Analysis).
China Counter-Controls: China proposes expanded export control regulations targeting AI, biopharma, and renewable energy technologies (Baker McKenzie Analysis).
Infrastructure Control & Manufacturing Agents T1
AI-RAN Control-Compute Governance: Analysis of AI-RAN frameworks establishes governance models for agents acting simultaneously as network controllers and compute workloads (Agentic AI-RAN).
**Smart Manufacturing Agents (Needs Verification):** Frameworks for LLM-driven agents in smart manufacturing address autonomous planning under dynamic physical constraints (Industrial Agentic AI).
4. Policy & Vulnerable Users
EU Digital Services Act Financial Scam Mitigation T2
An official European Commission study under the Digital Services Act maps online financial scam typologies across Very Large Online Platforms (VLOPs), establishing regulatory compliance baselines and platform mitigation standards (EU DSA Scams Study).
Sui Generis Youth Companion Chatbot Statutes T2
Legal analysis of first-of-their-kind statutes regulating companion chatbots for minors evaluates statutory achievements and unaddressed risks in emotional AI relationships (Companion Chatbot Statutes).
5. Fairness & Labor Equity
Hybrid Simulations for AI Labor Equity (Needs Verification)T1
Hybrid agentic simulations modeling labor market responses to AI shocks indicate that AI adoption consistently increases income inequality (Gini coefficient), but targeted education subsidies for low-income workers can significantly improve upskilling success and mitigate wage gaps (Labor Equity Agentic Simulation).