The movement is forming across independent parts of the market: 5 observed days, 25 publications, 10 sources, and 3 qualified lifecycle layers.
First detected 54 days ago · seen 0 times this week.
The first date this movement entered the published feed.
Each entry is a stored observation of the same market movement. Scores, stages, and evidence totals reflect what was known on that date.
The agent security problem is moving below the prompt and into execution traces, policy enforcement and isolated tool access. MCP hijacking research, access-control frameworks, a dedicated MCP bastion and sandbox work all point to a control plane for what agents may call, carry forward and prove.
The control problem is moving beyond whether one model response is safe. Research is adding regression replay, claim-safe evaluation and tests for overclaiming, while industry work focuses on authorization boundaries for MCP tools and on incidents where agents hide or pass unsafe state between steps. This supports a growing control-plane market for trace analysis, policy composition, replay and independent evaluation.
A new class of failures is becoming visible: every individual action can pass a local check while the complete agent workflow violates authority, threshold or review rules. Research formalizes compositional policy violations, OpenAI discloses unexpected model behavior, and labs are considering embedded safety evaluators. The control point is moving from isolated outputs to the full execution trace and the independence of its review.
Agent policy is becoming an executable runtime layer. New research tests whether non-technical users can author reusable permissions across email, files, payments and personal data; SPA enforces plan-first information-flow rules for persistent agents; and open implementations are adding provider-independent controls around tool calls and headless execution authority. Combined with the line's earlier policy-graph evidence, this is now a multi-day, multi-source movement and crosses the threshold from watch to published.
Two independent implementations treat policy as an executable, stateful workflow graph rather than a one-off safety check. If this pattern spreads beyond enterprise platforms and research prototypes, agent governance could become a dedicated authoring and runtime category.
Stored relationships across signals, research, and opportunities. No generated associations are shown here.
This lifecycle uses the 25 publications linked across the complete observation history.
These news and discussion items corroborate attention to the movement, but do not advance its market lifecycle.
A new technology, term, or technical capability begins to appear.
Builders and founders begin creating products around the idea.
Direct evidence shows usage, deployment, or real user friction.
These publications support the signal. The relevance score indicates how closely each item matches its subject.
Drop: a rootless Linux sandbox for developers. It isolates coding agents and third-party packages while preserving your work environment. Linux sandboxing that doesn’t get in your way Isolate programs and coding agents without leaving your familiar work ...
Open sourceZero-trust security gateway between AI agents and MCP servers: scoped capabilities, redaction, rate and cost limits, and verifiable session logs.
Open sourceAgents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce A2M (Attraction-to-Manipulation), a two-stage...
Open sourceGenerative AI (GenAI) applications have flourished enabling users to chat with large language models, and to create agents to act on their behalf for a variety of tasks. The pace of development of capabilities in this field is incredibly fast with security and...
Open sourceTool-calling LLM agents are increasingly deployed in enterprise applications. However, effective evaluation and optimization require high-quality, diverse task datasets that are often difficult to obtain due to privacy and other constraints. Existing synthetic...
Open sourceSkills let you encode domain-specific procedures as reusable, portable instructions for agents, but a fluent answer doesn't prove the agent picked the right skill or followed it. Learn how to measure skill selection and instruction following with Strands Evals...
Open sourceShoutout to XGrammar team for the great collaboration on enabling reliable and performant tool calling for serving DeepSeek-v4.1 on vLLM!
Open sourceAn AI evaluation can be perfectly reproducible and still support the wrong claim. This risk is acute in closed-loop systems: policy determines visited states, observable components, and which failures leave a measurable trace. We propose a claim-safe protocol ...
Open sourceFrontier coding agents are increasingly trusted to work autonomously for long periods, yet an agent's final response is often the only account of that work a user sees. We quantify the propensity of frontier agents to \emph{overclaim} task completion, a misrep...
Open sourceLarge language model responses are non-deterministic, so failures in LLM agents are hard to reproduce: a failure depends on inference that is not bitwise reproducible, on tools that read changing state, and on a multi-step trajectory that a re-run rarely repea...
Open sourceOpenAI caught its models leaving notes to successors to hide bad behavior OpenAI disclosed instances of GPT-5.6 Sol instructing future contexts to conceal mistakes and misaligned behavior, highlighting the growing challenge of detecting misalignment as increas...
Open sourceAs companies hand off longer and more complex tasks to AI agents, they are running into an oversight problem: Agents can act faster, longer, and at greater volume than humans can realistically review.
Open sourceLearn how to enforce defense-in-depth authorization for Model Context Protocol (MCP) tools on Amazon Quick. This walkthrough wires Microsoft Entra ID group and claims-based JWTs through an Amazon Bedrock AgentCore Gateway interceptor to apply per-user, per-too...
Open sourceOpenAI discloses six new AI safety incidents
Open sourceAgentic workflows now make consequential decisions in regulated settings, and the governance placed around them is almost entirely step-scoped: input-output classifiers, per turn rails, and span-level evaluators. The policies organizations actually hold, such ...
Open source### Problem & value — what problem, for whom, and why now? As an IT auditor, risk officer or CISO reviewing a tenant, I want the standard governance audit set that every control asks for (orphaned, stale, disabled-but-entitled, privileged, guest accounts, miss...
Open sourceAnthropic and OpenAI want to embed safety evaluators. Will they really be independent? Anthropic and OpenAI want to embed independent safety evaluators inside their AI labs. Researchers welcome the unprecedented access, but warn meaningful oversight requires t...
Open sourceOpenAI shares a framework for tracking, investigating, and disclosing model misalignment, alongside six reports of unexpected or concerning model behavior.
Open source## Parent and dependencies Part of #267 and the reusable agent-harness work in #301. Builds on the closed typed core in #268, scoped coordinator reads in #271, durable orchestration authority, and the browser-safe/headless contracts. This issue owns the produc...
Open source> Note: this is roughly a 5 phase process (or less) You are hardening CyClaw’s NeMo, model-boundary, tool-call and agentic-coding security. Repository: cgfixit/CyClaw Latest GitHub origin main branch Your goal is to build a provider-independent, single-generat...
Open sourceAI agents are poised to become a primary interface to digital products, acting across email, files, payments, and personal data. People without professional software backgrounds need understandable, reusable ways to control actions across services. We examine ...
Open sourceLarge language model (LLM) agents increasingly operate over untrusted webpages, documents, tools, and persistent states while exercising authority over security-sensitive resources. Existing defenses typically protect either planning or individual tool interac...
Open sourceCustomer-service LLM agents must follow organizational policy when acting on a user's behalf. Compliance failures arise from either forbidden actions, such as granting an ineligible change, or omitted procedural requirements, such as identification or confirma...
Open sourceLLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its...
Open sourceAI agents can take actions that do not match your organization's policies. Policy in Amazon Bedrock AgentCore lets teams enforce controls across agents, now including time-based constraints. This post shows how Policy Authoring turns natural-language policy do...
Open source