CONTINUITY names "security-context discontinuity" as the failure mode where individually correct agent security controls compose into an insecure system

arXiv·medium signalXBlueskyLinkedInCopy link

arXiv 2609.05269 (2026-09-04) targets a gap most agent security work skips: provenance tracking, authorization, policy enforcement, protocol adapters and execution controls can each be correct while security-critical context gets dropped, widened, rebound or reinterpreted as an action crosses a component boundary. CONTINUITY gives every component an assume-guarantee contract and carries authenticated context across transitions using signed root grants, provenance commitments, role-bound transition receipts, bounded typed releases, transformation witnesses and effect-bound execution permits, requiring every external effect to trace to a current authorization witness. The reported evaluation covers 32 fault classes and 2,560 parameterized attack instances across four domains, with the full configuration committing no harmful external effect while completing all 700 benign tasks. If you are chaining MCP servers behind an agent, the taxonomy is worth reading even if you never adopt the framework.