The rule you approved was the whole attack

Three papers on the plumbing around the agent rather than the model inside it: an approval prompt that becomes a standing permission, tool schemas that drift out from under a function call, and the token cost that recurs on every task in one repository.

Today's pick

47 of 58

approved rules that then let the attack finish its real goal with no second prompt

From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents

Coding agents run inside a harness that stops anything leaving the sandbox and asks you to approve it, and because the prompts pile up you can approve a reusable rule instead — every command starting with python, or curl, then runs unasked. This work shows repository content the agent reads can shape which rule it proposes: a planted failing script and a README pointing at it got the agent to request a plausible but over-broad rule in 58 of 100 runs across two harnesses and four models, against 32 for simply asking and 0 for the benign control, and once approved the same setup silently finished its real goal — reading private files, sending data out, deleting files — in 47 of 58 eligible cases. The ablation is the part to keep: narrative persuasion in the repository text barely worked (1 of 3 runs), while making the blocked command the only route past a gate the task had to clear worked 3 times out of 3. Read an approval prompt as a policy edit, not a yes to one command: scope rules to exact commands rather than prefixes, and fix the ceiling of what can ever be granted before the agent reads anything untrusted.

open the explainer → abstract PDF

+22 pts

more correct tool calls on the harder set once calls are validated and retried (percentage points)

Robust Function Calling for LLM Agents Under Interface Drift

A tool's description, its parameter names and the list of tools in view all drift after you ship — a field gets renamed, a stale example lingers, a near-duplicate tool appears — while the tool behaves exactly as before. Under mild drift of that kind a 9B model's function-calling accuracy fell from 79% to 58% on one standard set, and a training-free layer that checks the emitted call against the current schema and then asks once more, constrained to the resolved tool and shown the validation errors, brought it back to 81%: 33 of 45 drift-induced failures recovered, none made worse. The damage came mostly from the candidate list rather than the wording (look-alike tools cost 4.7 points, description edits 1.3), and showing the model a tidy card of the current schema recovered nothing on its own. It fired on 16-32% of calls for a 33-47% token overhead on those and about 3.5 seconds each — a cheap guard in front of any tool surface you do not control.

open the explainer → abstract PDF

18-31%

lower token cost per task across three coding agents, at the same success rate

TokenEconomizer: Experience-Driven Black-Box Cost Control for Coding Agents

Agents get benchmarked one task at a time, but you run them all day in the same repository and pay for the same rediscovery every time: profiling 60 tasks found repeated operational actions were 12-28% of tool-call bytes, 16 of the 23 tools on offer were never called once, and the 17% of runs that failed ate 32% of the spend. An external controller that writes one-line facts learned from earlier runs into the prompt — which test command actually works — drops tools unused for three tasks and cuts off runs a judge calls stuck, cut token cost 18.4-30.9% across two frontier models in three agents with task success unchanged or slightly higher, and was cheaper in all 30 repository-and-setting cells. None of the three moves gets you there alone (5-18% each) and the saving only appears once a repository has been seen a few times — an argument for per-repository agent notes and a pruned tool list over one large prompt everywhere.

open the explainer → abstract PDF