safety security
The Tool Output Lost Its Right to Authorize Action
SARA records where action-inducing instructions originated and checks execution against the user objective and authorized evidence.
Summary
SARA records where action-inducing instructions originated and checks execution against the user objective and authorized evidence.
The design separates action induction from runtime authorization and blocks history from laundering an untrusted observation into authority. Across AgentDojo and AgentDyn, the authors report attack-success rates no higher than 0.63 percent in four primary settings while retaining competitive utility. The result is benchmark evidence, not a blanket guarantee for every tool or side effect.
Why it matters
SARA records where action-inducing instructions originated and checks execution against the user objective and authorized evidence.
Limits and context
- The result is benchmark evidence, not a blanket guarantee for every tool or side effect.
Key claims
SARA records where action-inducing instructions originated and checks execution against the user objective and authorized evidence.
Qualification: The result is benchmark evidence, not a blanket guarantee for every tool or side effect.
Evidence: source-2026-08-28-014
Sources
- arXiv preprint 2608.27146arXiv · primary research
Corrections
No corrections have been recorded for this story.