mlsanityData to 13 Oct 2026

Sapien: A Stateful Policy Engine for Autonomous AI Agents

arXiv 2610.00797 ↗First posted 30 Sep 2026cs.AI cs.CL cs.CRcited by 0

Not on the map. Why?

Abstract (arXiv)

Contextual security defenses prevent AI agents from taking rogue actions by synthesizing a task-specific policy and enforcing it on the agent's tool calls. In multi-step tasks, however, which actions are valid often depends on what the agent has already done and learned. We present Sapien, a policy engine for enforcing stateful contextual policies. A Sapien policy specifies permitted tool-call sequences using a regular expression extended with stateful predicates, deferred policy generation, and scoped semantic checks. We show that Sapien stays within a few percent of an unconstrained agent's utility. Even if the agent is fully hijacked, Sapien's policies rule out 93-95% of attacks on AgentDojo and 62-85% on Toolathlon (twice as many as tool allowlists on long-horizon tasks).

Key facts. No citing papers in the map yet (data through 13 Oct 2026). Builds on 19 of its 64 references that are in the map. First posted on arXiv 30 Sep 2026.

Builds on

19 of 64 references.

References · 19

  1. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,417
  2. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,181
  3. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 647
  4. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 477
  5. 2023Detecting Language Model Attacks with Perplexitycited by 429
  6. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 261
  7. 2024Defending Against Indirect Prompt Injection Attacks With Spotlightingcited by 258
  8. 2025ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoningcited by 149
  9. 2025Progent: Securing AI Agents with Privilege Controlcited by 134
  10. 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systemscited by 129
  11. 2025LlamaFirewall: An open source guardrail system for building secure AI agentscited by 123
  12. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 123
7 more
  1. 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspectivecited by 95
  2. 2025RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakagecited by 69
  3. 2025Contextual Agent Security: A Policy for Every Purposecited by 57
  4. 2025SAGA: A Security Architecture for Governing AI Agentic Systemscited by 45
  5. 2026Formal Policy Enforcement for Real-World Agentic Systemscited by 32
  6. 2024Llama Guard 3-1B-INT4: Compact and Efficient Safeguard for Human-AI Conversationscited by 26
  7. 2026Optimizing Agent Planning for Security and Autonomycited by 10

Built on by

Not cited yet.