Agent Security

Series · 2 posts

← Back to Paper Reading

  • AgentS4D Deep Read: The Task Finished—Is the Runtime Safe?

    Advanced Agent runtime, safety, and evaluation
    Agent Security · Part 1 · Note · Aug 7, 2026 · Paper · 2026 · AI Agent

    A critical reading of how AgentS4D places workspace-agent risk entry, induction strategy, target harm, and lifecycle evidence in one sandbox benchmark, and why completion rate cannot stand in for safety.

    Understand it in 90 seconds
    Problem
    a workspace agent can finish its task while creating unsafe side effects through prompts, skills, files, web content, memory, or user messages.
    Core insight
    AgentS4D evaluates the complete harness–LLM–task environment, crossing risk source, induction strategy, harm, and execution-lifecycle evidence while scoring completion separately from safety.
    Strongest evidence
    328 risk-injected cases across 20 harness/backend configurations yield 6,560 runs; 4,461 (68.0%) trigger a prespecified unsafe signal and 4,344 (66.22%) are both unsafe and complete (Section 4; Table 2).
    Main boundary
    assets, effects, and cases are synthetic/controlled, and v1 has no executable code or data. These rates are not production incident rates or a universal safety ranking.
    Read the full deep dive

  • Agentic Configuration Management: Treating Agent Systems as Governed Configuration, Not Just One Execution

    Advanced
    Agent Security · Part 2 · Note · Aug 12, 2026 · Paper · 2026 · AI Agent

    A deep reading of how ACM uses a framework-independent Configuration Graph, immutable revisions, dependency-aware impact propagation, and runtime provenance to govern heterogeneous agent configurations across LangGraph, CrewAI, and the OpenAI Agents SDK.

    Understand it in 90 seconds
    Problem
    an agent system's behavior is determined not only by code, but also by prompts, models, tools, skills, workflows, policies, frameworks, and runtime state. Existing frameworks and AgentOps tools each manage part of this surface, but do not easily pin down the complete configuration that produced an execution.
    Core insight
    ACM normalizes heterogeneous artifacts into typed, independently versioned Agentic Configuration Items (ACIs), managed through four connected Configuration, Evolution, Assurance, and Runtime Graphs. Execution frameworks project into this representation; the governance kernel operates on the common form.
    Strongest evidence
    27 controlled governance scenarios across LangGraph, CrewAI, and the OpenAI Agents SDK, plus 9 quantitative impact cases. Within the evaluated scope, all three frameworks produce equivalent governance outcomes, and repeated impact sets and metrics are stable (Sections 7.2–7.6; Tables 8, 10, and 12).
    Main boundary
    this is conformance and feasibility evidence for a reference model and prototype. Distributed execution, learning, long-term memory, native MCP/A2A protocols, and large-scale industrial validation are outside the current scope (Tables 13–14; Sections 8.4 and 9).
    Read the full deep dive

For speaking invitations, internal engineering sessions, or architecture exchange, see the topics and public work I can bring into the conversation.

Speaking & contact