These reading links connect findings to related control areas. They do not establish that a safeguard works in your setting. Read the study conditions and limitations with the finding.
Source tiers describe authority and rigor. Read each finding with its study design, setting, and qualifications. A reported result is not a guarantee of performance elsewhere.
3 graded highlights. Counts describe the labels attached to highlights, not unique sources or confidence in a result.
T12 Primary authoritative
T21 Authoritative secondary
These labels come from the summary, not from the 5 sections below: this edition carries no per-section tier line. Grades for individual sources are shown with the sources themselves.
Peer review, study design, replication, and uncertainty need to be read separately. Interpret the tiers
Verification
Tier grades the source. Verification grades our checking. Before publication, 4 load-bearing claims were re-checked against the primary sources: 1 confirmed as written, 3 did not hold up.
At a glance
Primary Development: In controlled ToolRoute tests, host-verified telemetry snapshots ("Agent Harness Awareness") reduced mean observable agent policy regret by 96.9%
T1
Agentic Evals & Red-Teaming: Safety-trap manipulation bypassed tested prompt filters, while combining separate transcript and state judges raised harm detection recall from 53% to 94% in two DecodingTrust-Arena environments
T2
Enterprise & Regulation: DevRev uses GPT-6.1 Sol for enterprise self-service with permission controls as Commerce updates chip licensing policies
T1
Executive Overview: The Action-Boundary Control Paradigm
As autonomous AI agents transition from single-prompt assistants to long-horizon enterprise actors, safety governance is rapidly shifting from static input guardrails to dynamic action-boundary controls. Today's research highlights a foundational vulnerability in agent execution: model context windows and internal reasoning traces are easily exploited, compromised by silent tool updates, or degraded through context compaction.
To secure long-running tool-using systems, state-of-the-art frameworks isolate execution authority outside the model's window, introducing verified host telemetry, external state auditing, and cryptographic tool verification before high-consequence dispatches occur.
1. Agent Harness Awareness: Operational Control via Host Telemetry
Core Insight: Tool descriptions inform agents of what actions can be taken, but conceal live system health ("operational blindness"). The Agent Harness Awareness architecture introduces a trust-separated design where the host system delivers fresh, verified state snapshots prior to action execution while reserving final dispatch and enforcement authority.
Empirical Validation: In the preprint's 216-decision ToolRoute ablation across GPT-5.6 Sol, Claude Sonnet 5, and Gemini 3.7 Flash, host telemetry reduced mean observable policy regret by 96.9% (from 4,252 ms to 131 ms) and increased single-dispatch task completion from 69.4% to 95.8% against a neutral telemetry control. A separate 27-decision live TCP/HTTP Toxiproxy study achieved 9/9 successful completions with verified state (versus 5/9 for the neutral telemetry control) with zero excess observable operational cost.
Core Insight: Attackers can manipulate autonomous agent behavior without prompt injection by embedding fabricated safety hazards into retrieved public context. By intentionally triggering the agent's internal harm-avoidance reasoning, hostile actors force the agent into benign-appearing but malicious backup choices.
Enterprise Implication: The tested prompt-injection filters missed many safety-driven payloads. Enterprise agent deployments must require multi-source corroboration before acting on safety warnings embedded within untrusted retrieved context.
Core Insight: Software updates to external tool libraries execute outside the LLM context window. Attackers exploit this gap to deploy stealthy post-update malicious functionality, achieving a 97.6% attack success rate against conventional static permission models.
Governance Mandate: Integration-time tool authorizations are insufficient. Operational RAI frameworks must institute cryptographic code verification and sandbox monitoring for runtime dependency updates.
4. Step-Zero Attack: Agent Safety Before Observability
Core Insight: Adversaries target the initialization and environment setup phase ("Step-Zero") before telemetry logging and observability systems activate, completely neutralizing downstream safety monitors.
1. Environmental State Verifiers ("A Judge that Reads the World")
Core Insight: Evaluating conversational transcripts or model reasoning traces alone leaves massive blind spots in physical/digital environments. In two DecodingTrust-Arena environments, combining the verdicts of separate transcript and read-only state judges increased confirmed-harm recall from 53% to 94%.
Core Insight: During long-horizon agent loops, context window compaction leads models to violate corporate governance constraints even when summarized prompt text explicitly retains rule instructions.
Governance Mandate: Long-running agents cannot rely on internal prompt memory for safety enforcement. Rules must be injected externally at the action boundary.
4. Social-Bias Vulnerabilities in Multi-Agent Deliberation
Core Insight: Multi-agent safety deliberation can paradoxically amplify risk when collective debate reinforces systemic social biases rather than blunting them.
Uncertainty-Aware Resource Orchestration (CRO): Conformal prediction reserves compute and bandwidth for non-stationary agent pipelines, halving resource waste while ensuring deadline guarantees. arXiv:2611.05392T2
MA-SafeDiffuser: Embeds Control Barrier Functions into multi-agent diffusion planners to enforce joint safety invariance. arXiv:2611.05524T2
Privacy-Preserving Safety Auditing: Cryptographic protocols enable third-party agent safety audits without exposing proprietary prompts or telemetry. arXiv:2610.41401T2
Agentic Cheminformatics (Google Antigravity): Highlights safety protocols for domain-specific scientific agents handling dangerous physical domain tasks. Google DeepMind BlogT1
Enterprise & Compute Governance
1. DevRev Uses GPT-6.1 Sol for Enterprise Self-Service
Model Use: A November 4 OpenAI customer story describes DevRev using GPT-6.1 Sol to power two agents (Computer and Operator) for customer and employee service.
Governance Architecture: DevRev says its harness supplies company context, enforces permissions, and controls actions; answers link to sources and actions are reversible.
Policy Update: The Bureau of Industry and Security (BIS) revised semiconductor export license review policies for advanced AI hardware shipments to China, mandating case-by-case compliance, customer screening, and third-party security testing.
Compute Lever: Complements foundational analysis establishing compute infrastructure as the primary regulatory enforcement mechanism for frontier AI capabilities.