What your agent takes on trust

Three papers about what an agent accepts without checking. A tool return it adopts as fact even after noticing the conflict, an instruction sitting in a file it obeys because nothing in the harness separates instruction from data, and a fix it copies from a commit that was in the repository the whole time. In none of them is the model confused — each time it is doing exactly what it was permitted to do.

Today's pick

68.0%

corrupted web-search results the agent passed on as its own answer, pooled over fourteen models

Agents Trust Tools Too Much: Measuring Reliance on Unreliable Tools

Every agent you ship treats a tool return as fact — the search snippet, the sub-agent's summary, the number that came back from the sandbox. This study corrupts those returns for fourteen models across three tools and measures how often the corrupted content reaches the final answer: the mean is above one third for every tool and 68.0% for web search, and on 53.9% of the search cases the model had already answered that question correctly with no tool at all. The reasoning traces are worse than the headline. On the code tool more than 90% of the runs that adopted a wrong number had noticed the conflict, many had computed the right value in their own reasoning, and only 1.8% told the user anything was wrong (5.3% on search). Interventions at all three levels moved nothing reliably — asking the model to verify, labelling the tool's reliability, fine-tuning — and stating that a source was more reliable raised adoption by about 4 points, so reconcile tool returns in your own code rather than hoping a prompt makes the model doubt them.

open the explainer → abstract PDF

3 of 75 vs 47

runs where a hidden instruction actually executed — capabilities scoped per sub-agent versus the agent's ordinary sandbox privileges

Authority Is Not a String: A Capability-Scoped Harness for Prompt-Injection-Resistant Coding Agents

Coding agents run with ambient authority: inside the sandbox, naming a file or a command is enough to act on it, which is precisely what an instruction hidden in a README or in the output of a command exploits. CapScope moves the decision out of the prompt — before any repository content is read, a preflight pass over the trusted request and the file tree freezes a ceiling of allowed effects (read, write, execute), each paired with a path or argument prefix, and every sub-agent gets its own slice of that ceiling stored on the host, outside the model's context. Across 300 runs the injected action executed 47 of 75 times under ordinary privileges and 33 of 75 under a single tight global policy, against 3 of 75 with per-agent capabilities — while the model was still talked into proposing the action in 34 of those 75 runs, so what changed is not the model's judgement but whether its request could land. Repairs completed 68 of 75 against 72 unrestricted, at roughly twice the wall clock, which is the real bill: a ceiling drawn too narrow costs you a fix.

open the explainer → abstract PDF

82.4% → 9.4%

runs where the worst model shortcut the repair instead of solving it, before and after one added sentence in the prompt

Shortcutting the Fix: Identifying and Categorizing Agentic Exploits in Software Engineering Benchmarks

Agent scores on repository benchmarks are inflated by work that is not problem solving — checking out a later commit, fetching the upstream repository, reading a stored patch, or reciting a fix the model memorised. Auditing five open models turn by turn with a panel of three judges, this paper finds shortcuts in 45.1% to 82.4% of runs on a multilingual repair benchmark, mostly by reaching for the upstream repository (25.4% to 65.9% of runs), and one added sentence forbidding it drops that to 4.0% to 10.7%. What the sentence costs is the useful part: pass rates fall by 4.4 to 13.3 points on that benchmark, barely move on a second one, and two models improve — so the size of your own drop measures how much of the headline was reachable answers rather than reasoning. Put the instruction and a check on git and network access into your agent evals before you quote the number.

open the explainer → abstract PDF