Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-03-04 · source-backed
First defense modeling multi-turn indirect prompt injection as temporal causal takeover. Uses counterfactual re-executions at tool-return boundaries to detect when tool outputs steer agent behavior. Evaluated on AgentDojo across four task suites. Builder-ready pattern for tool-augmented agents. (arXiv 2602.22724)
Each link below shares sources, entities, or timing with this story.
arXiv 2608.11878 replaces the handful of manually implemented injection-testing environments with an Environment Simulator, Attacker Agent, and User Simulator that generate executable stateful environments and discover viable injection points automatically. Injection timing an...
Introduces temporal causal diagnostics to distinguish legitimate task execution from injected manipulation in multi-turn agent interactions, plus context purification to neutralize poisoned content. Directly applicable to anyone building agents that call external tools. arXiv...
arXiv 2608.05108 skips the RL-trained attacker models that dominate red teaming and generalize poorly, instead accumulating a strategy library across a sequence of (dataset, target) pairs that transfers to unseen targets with no retraining. AgentDojo: 86.7% ASR against Gemini-...
arXiv 2608.27234 calls the planner exactly once per query to emit a full plan in a declarative DSL, then applies dual-lattice information-flow control over confidentiality and integrity across explicit data flows and control dependencies, storing results as labeled artifacts a...
A July 21 paper pairs two near-identical agents: an Explore Agent that inspects untrusted input but holds no tools, and a Safe Agent that takes privileged actions using its own context plus length-constrained hints from the explorer (arXiv 2607.19595). Borrowing from residual...
Defense-as-Skill argues pre-install vetting is structurally insufficient because a malicious skill only triggers once a concrete task and workspace state make the unsafe action look useful. SkillSonar runs as an editable skill alongside untrusted skills, checking sensitive act...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.