Agent Security Shifts from Prompt Defenses to Stateful Runtime Control

The strongest results move reliability out of prompts and into authorization layers, persistent state, structured interfaces, and explicit credit assignment.

Weekly Research Digest4 September 2026

This week’s clearest signal is that prompt-level defenses are insufficient once agents operate through harnesses, tools, and persistent loops. Independent results show that runtime authorization and stateful monitoring can suppress attacks, while structured interfaces and reusable operational knowledge substantially improve capability. Long-horizon control remains the major weakness: agents still struggle to monitor evolving state, direct workers, and recover from early commitments.

Nanjing University + Honor Device Co., Ltd

Agent harnesses can elevate malicious context past instruction defenses — Instruction privilege escalation let multi-agent attacks achieve all 13 tested security objectives on every harness under unrestricted execution, showing that context placement by the harness can nullify model-level instruction defenses.

X-LANCE Lab + Shanghai Jiao Tong University + BIGAI

Structured software interfaces outperform screenshot-and-click control for AI agents — Representing application state as JSON and exposing semantic, executable actions produced over 80% strict success across 380 tasks with fewer than five actions on average, substantially outperforming screenshot-based control.

Princeton University

One video world model transfers physical dynamics across robot bodies — CLAP combines unlabeled-video pretraining with robot-action grounding to transfer dynamics across human demonstrations and robot morphologies, enabling zero-shot deployment competitive with specialized single-embodiment models.

Zhejiang University + Institute of Science Tokyo + National University of Singapore

Sparse verifier feedback makes broad credit assignment outperform turn targeting — When terminal verification reveals little about prerequisite steps, assigning credit broadly across the trajectory beats targeting selected turns; verifier information density, rather than trajectory length alone, determines the appropriate strategy.

Undisclosed

Polished evidence makes LLM agents act on unknowable questions — Adding increasingly convincing but non-diagnostic evidence raised unjustified commitment from 6.5% to 54.0%; targeted fine-tuning eliminated commitment in the tested cases but remained sensitive to response format.

Institute of Information Engineering, Chinese Academy of Sciences + University of Chinese Academy of Sciences

Separating tool suggestions from authorization sharply reduces agent attacks — A runtime layer that treats tool outputs as suggestions rather than authorization held attack success to 0.63% or less across four primary AgentDojo and AgentDyn settings while preserving competitive utility.

Beijing Academy of Artificial Intelligence + University of Science and Technology of China + Renmin University of China + Hong Kong Polytechnic University

Distilled repository skills improve agents conducting machine-learning research — Retrieving operational skills distilled from repositories and papers improved ML-research benchmark scores by 9.2% to 134.3% with the GPT-5.5 backbone, harness, and execution budget held fixed.

University of South Florida

Plan-first controls block attacks on persistent language-model agents — Generating a complete plan before execution and checking trusted-to-sensitive information flow reduced the reported tool_knowledge attack to 0% on AgentDojo and 0.2% on a multi-query extension, albeit with utility loss under strict integrity controls.

University of Chinese Academy of Sciences + Nanyang Technological University + JD.com + Peking University + Fudan University

Agent safety requires persistent state across autonomous loop iterations — The authors formally show that persistent safety state can detect cross-iteration attacks that no trajectory-scoped monitor can see, and propose LoopHarness to bound irreversible unauthorized actions independently of loop length.

Inria + École Normale Supérieure + PSL Research University

Adding Depth Helps Video World Models Control Robots More Reliably — Jointly predicting actions, future images, and depth yielded state-of-the-art results on RoboCasa and LIBERO-Plus and improved real-robot robustness, particularly under environment randomization.

City University of Hong Kong + Meituan + University of Oxford

Branching Across Hypotheses Helps Research Agents Avoid Early Search Traps — HypoSearch organizes parallel exploration around explicit lightweight hypotheses, outperforming single-trajectory and standard parallel-search baselines across four benchmarks and three backbones by reducing premature commitment.

Google Research + Virginia Tech

Persistent Wikis Help AI Agents Build Better Transferable Skills — WikiSkill separates raw experience, accumulated knowledge, and executable skills into a persistent artifact, improving skill evolution across benchmarks and enabling transfer between models and model families.

University of Illinois Urbana-Champaign + Amazon

A single language model can combine roles without multi-agent dialogue — Mixture of Roles gives one frozen model multiple latent specializations and matches multi-agent systems while using 20 times fewer tokens, with a 2.2% average gain over single-agent baselines.

University of Oxford + Tony Blair Institute for Global Change + Google DeepMind + UK AI Security Institute + Imperial College London

Civilization benchmark exposes agents’ weak monitoring and long-term follow-through — In Civilization VI episodes exceeding 300 turns and spanning 76 MCP tools, agents consistently failed at proactive state monitoring and plan execution even when they could handle individual local decisions.

MIT CSAIL + Kellis Lab + Independent

Embedding retrieval ranks matching words above shared underlying structure — Two production embedding models scored 0% strict Hit@1 on the hardest structural mathematics tier, while embodied-trajectory retrieval fell to chance or worse when object names changed, exposing a severe lexical bias in agent memory retrieval.

DreamX Team + Alibaba Group + Beijing University of Posts and Telecommunications + UNSW Sydney + Data61, CSIRO

Models remain weak at steering coding agents through long tasks — The best controller model achieved only 24.69% strict success when repeatedly directing and verifying a coding worker, though a cheaper partial-task protocol preserved the full evaluation’s model ranking.

Zhejiang University

Privileged supervision improves action-level credit for language-model agents — TASPO uses privileged information from successful runs to weight individual actions, outperforming GRPO by 10.6% across three agentic benchmarks and transferring better to unseen tasks.

Creative AI & Agentic Generation

Language enables precise character and camera control in video worlds — Paired language instructions for character and camera actions turned MiniMax-H3 into an interactive video world using 8,000 gameplay samples and updates to only 0.199% of parameters, while retaining generation quality and generalizing control to unseen scenarios.

Analysis

Agent security is not an instruction-following problem; it is a systems-architecture problem. Nanjing University and Honor show that harnesses can elevate malicious data above trusted instructions, while the Chinese Academy of Sciences authorization layer and South Florida’s plan-first architecture sharply reduce attacks by constraining execution. UCAS, NTU, JD.com, Peking, and Fudan further show that monitors need persistent state to detect attacks spanning loop iterations. So what: assign trust labels outside the model, separate proposals from permissions, and persist security-relevant state across every autonomous loop.

Credit assignment should follow verifier information density, not a universal recipe. The Institute of Science Tokyo, Zhejiang, and NUS find that broad trajectory-level credit works better when terminal verifiers expose little about intermediate prerequisites. Zhejiang’s TASPO shows the complementary case: when privileged successful-run information is available, action-specific weighting delivers a 10.6% gain over GRPO. So what: measure what the verifier can actually resolve before choosing turn-level rewards; use broad credit under sparse observability and targeted credit only when additional supervision supports it.

Long-horizon failure is not primarily local reasoning failure; it is state-monitoring and control failure. Oxford, DeepMind, the UK AISI, and collaborators observe weak proactive monitoring and follow-through over 300-plus-turn Civilization episodes; Alibaba and collaborators find only 24.69% strict success for models steering coding workers. The persistent-monitor result from UCAS and collaborators explains part of the gap: resetting state at loop boundaries discards information needed for both safety and control. So what: maintain typed, persistent task state and test controllers on monitoring, verification, and stopping decisions—not just worker output quality.

Agent memory is more useful as curated operational structure than as accumulated transcript. BAAI and collaborators obtain gains of 9.2% to 134.3% by distilling repository knowledge into retrievable skills, while Google Research and Virginia Tech improve cross-model transfer by separating experience, knowledge, and executable skills in a persistent wiki. ASIL from X-LANCE, SJTU, and BIGAI reinforces the same pattern at the interface layer: semantic state and actions beat raw pixels and clicks. So what: turn repeated experience into versioned skills, explicit state schemas, and executable procedures rather than retaining ever-larger histories.

More evidence can make an agent less epistemically reliable. Aggarwal’s abstention study shows that polished but non-diagnostic evidence raises commitment on unknowable questions from 6.5% to 54.0%; MIT CSAIL and Kellis Lab show that retrieval systems prefer lexical overlap over structural relevance. City University of Hong Kong, Meituan, and Oxford address the downstream search failure by keeping multiple hypotheses alive instead of letting early retrieval determine the entire trajectory. So what: evaluate evidence for diagnostic value, rerank beyond embedding similarity, and preserve competing hypotheses until observations can discriminate among them.

Transferable robot world models need geometry and heterogeneous experience, not embodiment-specific data alone. Princeton’s CLAP transfers physical dynamics across robot bodies by combining unlabeled video with action grounding, while Inria, ENS, and PSL improve robustness by jointly predicting depth, future images, and actions. Together they suggest that richer predictive supervision can substitute for some embodiment-specific policy training. So what: pretrain world models across human and robot video, then add explicit geometric targets before scaling per-robot demonstrations.

Plural reasoning is valuable, but dialogue is often unnecessary overhead. City University of Hong Kong, Meituan, and Oxford gain from branching across explicit hypotheses, whereas UIUC and Amazon’s Mixture of Roles matches multi-agent systems with 20 times fewer tokens by combining latent roles inside one model. The common benefit is structured diversity, not agent-to-agent conversation itself. So what: add multiple hypotheses or role-specialized representations first, and require evidence that conversational multi-agent protocols justify their token and latency costs.