Twin Agent: put a length-capped hint channel between the agent that reads untrusted data and the agent that can act

arXiv 2607.19595·medium signalXBlueskyLinkedInCopy link

A July 21 paper pairs two near-identical agents — an Explore Agent that inspects untrusted input but holds no tools, and a Safe Agent that takes privileged actions using its own context plus length-constrained hints from the explorer. Borrowing from residual coding, the hint budget is the security knob: longer hints raise task utility and raise injection risk, so you tune it explicitly rather than discovering the tradeoff in production. Evaluated on SWE-bench Lite and AgentDojo, it beat both undefended agents and prior privilege-separation baselines on the utility/security frontier.