mlsanityData to 14 Oct 2026

Boundary-State Control for Tool-Using Language-Model Agents: Commit-Time Consistency under State Drift

arXiv 2609.37475 ↗First posted 26 Sep 2026cs.AIcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Tool-using language-model agents can decide that an action is permissible and execute it only after security-relevant state has changed. We study this proposal-to-commit gap and introduce BSC-R, a deterministic effect-boundary mechanism that binds a single-use commit authorization to the exact action and to a semantic projection of the authorization state that justified it. On 2,847 attacked AgentDojo episodes, the boundary kernel preserves the unprotected agent's behavior exactly (80.576% utility; 1.616% attack success). On 10,302 frozen proposals, it accepts every unchanged commit and rejects every instance of ten prospectively specified changed or replayed classes. In an independently generated boundary-drift experiment, full joint binding commits 0/4,403 invalid contexts while retaining 5,899/5,899 valid contexts. A prospective external evaluation on the 3,460-scenario CONTINUITY suite retains all 700 benign cases, prevents 1,200/1,200 represented non-replay invalid effects, handles 160/160 replay lifecycles correctly, and withholds 200/200 ambiguous no-release cases. The broader external suite also exposes the method's limit: across all 2,560 attacks, BSC-R has a 25% invalid-effect commit rate versus 0% for CONTINUITY. The result is therefore a scoped commit-time consistency mechanism, not a universal agent-safety claim.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 12 of its 29 references that are in the map. First posted on arXiv 26 Sep 2026.

Builds on

12 of 29 references.

Closest ancestors · 8

Same direction, newest first

  1. 2026CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls4 Sep
  2. 2026Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions3 Aug
  3. 2026Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents11 Jul
  4. 2026SecureClaw: Clawing Back Control of LLM Agents8 Jun
  5. 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents11 Oct
  6. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
  7. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
  8. 2023Identifying the Risks of LM Agents with an LM-Emulated Sandbox25 Sep

Other references · 4

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  2. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
  3. 2024ToolSandbox: A Stateful, Conversational, Interactive Evaluation Benchmark for LLM Tool Use Capabilitiescited by 295
  4. 2026What You Approve Is What Executes: Consent Integrity for Black-Box LLM Agentscited by 9

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Stale Does Not Mean Unsafe: Guard Precision for Tool-Using LLM Agents under Infrastructure State Races
  2. 2026ElephantAgent: Contextual State Continuity in Agentic Systems
  3. 2026SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents
  4. 2026Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection
  5. 2026MemTX: Transactional Belief Commit for Stateful Agent Memory
  6. 2026Auditing Action Settlement in LLM Agent Environments: Order, Progress, and Replay
  7. 2026ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
  8. 2026Designing for Doubt: The Case for Informed Abstention in Autonomous Agents